Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google details new 24-hour process to sideload unverified Android apps

arstechnica.com

Post reply on HN
Print view View original

161–170 of 1001 posts

Re: Google details new 24-hour process to sideload unverified Android apps

#161

Post by gumby271 »

> In addition to the advanced flow we’re building free, limited distribution accounts for students and hobbyists. This allows you to share apps with a small group (up to 20 devices) without needing to provide a government-issued ID or pay a registration fee.

I don't quite understand how those installs would be tracked. If I create a "hobbyist" account and share the apk, are the devices that install that app all reporting it to Google? To my knowledge, Google only does this through the optional Play Protect system, is that now no longer optional? I'd like to know if my computer is reporting every app I install up to Google.

Re: Google details new 24-hour process to sideload unverified Android apps

#162

Post by Evidlo »

janice1999 wrote: post #26
2OEH8eoCRo0 wrote: post #21

Earlier quoted context omitted.

I don't see that on the page

They already announced it. Here they only mention the special case where it does not apply: > In addition to the advanced flow we’re building free, limited distribution accounts for students and hobbyists. This allows you to share apps with a small group (up to 20 devices) without needing to provide a government-issued ID or pay a registration fee. i.e. Government-issued ID and fees are needed for more than 20 device…

Isn't this a huge loophole? Couldn't a scammer just make many variants of their malware?

Re: Google details new 24-hour process to sideload unverified Android apps

#163

Post by Retr0id »

hbn wrote: post #58
MishaalRahman wrote: post #40

Earlier quoted context omitted.

>- Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? Hi, I'm the community engagement manager @ Android. It's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you tur…

> ADB installs are not impacted by the waiting period, so that is an option if you need to install certain unregistered applications immediately. Someone is just going to make a nice GUI application for sideloading apks with a single drag-and-drop, so if your idea is that ADB is a way to ensure only "users who know what they're doing" are gonna sideload, you've done nothing. This is all security theatre.

The scammers don't even need to make a GUI, they just need to get you to enable adb-over-tcp and bridge that to their network somehow - an ssh client app would do the trick.

Re: Google details new 24-hour process to sideload unverified Android apps

#165

Post by nijave »

grishka wrote: post #155
estimator7292 wrote: post #115

Earlier quoted context omitted.

Your mistake is taking Google's argument at face value. Protecting users is an outright lie, this is purely about control. Google doesn't give one single shit if users download malware from the Play Store, but hypothetical malware from third party sources is so much worse that we need to ruin the whole OS? That doesn't pass the sniff test. Google wants to make sure you can only download malware from developers who gi…

I'm assuming good faith and giving them the benefit of the doubt. Of course it might be that they want more control. In addition to controlling the world's most popular web browser and the world's most popular search engine and the world's most popular online advertising network and the world's most popular online video service.

It's really hard to when there's already technical solutions. They could require a process like bootloader unlocking that puts it in "dev" mode for instance

While signing is useful, leaving no escape hatch imo is blatantly predatory

Re: Google details new 24-hour process to sideload unverified Android apps

#166

Post by xg15 »

grishka wrote: post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

> People who are unwilling to figure out the risks just should not use smartphones and the internet.

That train has left the station decades ago. The internet has become an essential part of modern societies. People can't not use the internet (or smartphones), at least if they don't live in the woods.

Re: Google details new 24-hour process to sideload unverified Android apps

#167

Post by Teckla »

estimator7292 wrote: post #115
grishka wrote: post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

Your mistake is taking Google's argument at face value. Protecting users is an outright lie, this is purely about control. Google doesn't give one single shit if users download malware from the Play Store, but hypothetical malware from third party sources is so much worse that we need to ruin the whole OS? That doesn't pass the sniff test. Google wants to make sure you can only download malware from developers who gi…

It's all part of the war on general computing. This dystopian nightmare is coming to desktop operating systems too. See the age verification stuff that's all of a sudden being pushed hard by countries all over the world.

As someone that was going to switch from iPhone to Android/Pixel later this year, at least now I know not to bother anymore, as the locking down of Android won't stop here.

Re: Google details new 24-hour process to sideload unverified Android apps

#168

Post by benlivengood »

giancarlostoro wrote: post #137
grishka wrote: post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

Idiocracy needs a spiritual "sequel" with modern times.

It is called baseline reality, unfortunately.

We haven't started watering crops with salt-water but it's only a matter of time.

Re: Google details new 24-hour process to sideload unverified Android apps

#169

Post by nijave »

ninininino wrote: post #74
xnx wrote: post #28

Earlier quoted context omitted.

> some apps (e.g., banking apps) will refuse to operate and such when developer mode is on JFC. Why would an app be allowed to know this? Just another datapoint for fingerprinting.

Because estimates suggest Americans lose about $119 billion annually to financial scams, which is a not insignificant fraction of our entire military budget, or more than 5% of annual social security expenditures.

So put a disclaimer in... Same way tons of other stuff works...

Re: Google details new 24-hour process to sideload unverified Android apps

#170

Post by limagnolia »

hypeatei wrote: post #66
limagnolia wrote: post #61

Earlier quoted context omitted.

Why should the bank/institution be responsible for protecting individuals from themselves? They don't have police power- protecting people from bad actors is like, the reason to have a state. If the state wishes to farm it out to third parties, then we don't need the state anymore!

The bank/institution is where the money is leaving from therefore they should implement policies that protect vulnerable customers like seniors, for example. I don't know how that looks but it seems reasonable that they could put limits on an account flagged "vulnerable person" I'm not sure what you're getting at with the rant about police power and a state? Google isn't the government either. What would legislation…

Sure, there are things banks can do, and those are features they can market. But ultimately, if the state isn't pursuing criminals who prey on the vulnerable, then society as we know it has failed and we would need a new society, or a new state, or both...The bank can't arrest anyone!

I never said anything about it being Googles responsability, I agree it is not. And the only legislation that might be necessary over what we have is a budget directly to go after criminal fraudsters.

Post reply on HN