Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google details new 24-hour process to sideload unverified Android apps

arstechnica.com

Post reply on HN
Print view View original

101–110 of 1001 posts

Re: Google details new 24-hour process to sideload unverified Android apps

#101

Post by andyjohnson0 »

astra1701 wrote: post #14

This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? - One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably no…

> some apps (e.g., banking apps) will refuse to operate and such when developer mode is on

Enable dev mode, sideload the apk, then disable dev mode. I'd argue that it is poor security practice to keep developer mode enabled long-term on a phone that is used for everyday activities, such as banking.

Re: Google details new 24-hour process to sideload unverified Android apps

#102

Post by catgirlinspace »

wolvoleo wrote: post #73
MishaalRahman wrote: post #40

Earlier quoted context omitted.

>- Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? Hi, I'm the community engagement manager @ Android. It's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you tur…

Do I need to be signed in to Google play to get the sideloading exception turned on? I don't sign in to it because I don't want to have my phone associated with a Google account. But I can't uninstall play completely on the devices I have. It says something about 'restart your phone and reauthenticate' that's why I'm asking. What do you autenticate? > ADB installs are not impacted by the waiting period, so that is an…

I think the authentication is doing your face/fingerprint/passcode unlock?

Re: Google details new 24-hour process to sideload unverified Android apps

#103

Post by varispeed »

politelemon wrote: post #94

I'm not in agreement with most of you, hn. They've found a decent compromise that works for power users and the general population. Your status as a power user does not invalidate the need to help the more vulnerable. Having to wait a day for a one off isn't a big deal, if they kept it looser then you'd be shouting about the amount of scams that propagate on the platform.

But this is very rich from them given they serve scam ads with impunity.

I'd say this has nothing to do with preventing scams, but to make independent software more difficult to distribute.

Re: Google details new 24-hour process to sideload unverified Android apps

#104

Post by Mogzol »

wolvoleo wrote: post #76
devsda wrote: post #68

Death, taxes and escalating safety are the only certainities in this tech dominated world. So, be ready for more safety in the next round few months/years down the line. Eventually Android will become as secure as ios. We need a third alternative before that day comes. It's not a win by any means. I hope that we don't stop making noise.

It's not secure when one of the main adversaries (Google) controls all the keys.

I believe that is why "escalating safety" and "secure" were written in italics in the comment. Those are the terms Google would use, not necessarily the truth.

Re: Google details new 24-hour process to sideload unverified Android apps

#105

Post by guelo »

grishka wrote: post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

> just should not use smartphones and the internet

That's ridiculous. Phones are being made more and more of a requirement to participate in society, including by governments.

Re: Google details new 24-hour process to sideload unverified Android apps

#106

Post by NullPrefix »

grishka wrote: post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

>They should probably not have a bank account at all and just stick to cash

Pretty much illegal in some parts of EU

Re: Google details new 24-hour process to sideload unverified Android apps

#107

Post by grishka »

guelo wrote: post #105
grishka wrote: post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

> just should not use smartphones and the internet That's ridiculous. Phones are being made more and more of a requirement to participate in society, including by governments.

Which is exactly my point! This is exactly the thing that desperately needs to be undone.

Re: Google details new 24-hour process to sideload unverified Android apps

#108

Post by beepbooptheory »

I get that its pretty clear with the straight sideloading case, but can anyone say for sure what this will look like for an f-droid user? Its hard to keep track but I thought something new here because of EU is that alternative app stores != sideloading? Something where app stores could choose themselves to get "verified," whatever that means, to become a trusted vendor? Or is this completely wrong?

Re: Google details new 24-hour process to sideload unverified Android apps

#109

Post by varispeed »

devsda wrote: post #68

Death, taxes and escalating safety are the only certainities in this tech dominated world. So, be ready for more safety in the next round few months/years down the line. Eventually Android will become as secure as ios. We need a third alternative before that day comes. It's not a win by any means. I hope that we don't stop making noise.

Google serves ads with known scams and nothing seems done about it.

Yet, they are concerned about this.

It has nothing to do with safety, but everything to do with control.

I remember when Google disabled call recording in Android, so you no longer could record scammers. Thanks to recording I was able to get money back from insurance company that claimed they absolutely didn't sell me this and that over the phone (paid for premium insurance and got basic).

Re: Google details new 24-hour process to sideload unverified Android apps

#110

Post by RIMR »

I am not happy about this, but as long as advanced Android users can still turn this off and keep it off, we're still in a better place than iOS.

Even though I understand the design decisions here, I think we're going about this the wrong way. Sure, users can be pressured into allowing unverified apps and installing malware, and adding a 24-hour delay will probably reduce the number of victims, but ultimately, the real solution here is user education, not technological guardrails.

If I want to completely nuke my phone with malware, Google shouldn't stand in my way. Why not just force me to read some sort of "If someone is rushing you to do this, it is probably an attack" message before letting me adjust this setting?

Anyone who ignores that warning is probably going to still fall for the scam. If anything, scammers will just communicate the new process, and it risks sounding even more legitimate if they have to go through more Google-centric steps.

Post reply on HN