Live data from Hacker News

Google details new 24-hour process to sideload unverified Android apps

arstechnica.com

181–190 of 1001 posts

Re: Google details new 24-hour process to sideload unverified Android apps

#181

This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? - One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably no…

That is working as intended. Google wants to kill side loading.

Re: Google details new 24-hour process to sideload unverified Android apps

#182

24 hour mandatory wait time to side load!? All apps I want to use on my phone are not in the Play Store. So I buy a new phone (or wipe a used phone) and then I can’t even use it for 24 hours?

1) The one-time, one-day waiting period only applies if you go through the advanced flow to allow installing unregistered apps. You can still install registered apps (ie. apps made by developers who have verified their identity) even if they're distributed outside the Play Store. 2) You can use ADB to immediately install unregistered apps. ADB installs are not subject to the waiting period.

3) And how can we keep on using F-Droid and other app stores?

4) How can we install apps made by devs who won't do the verification dance with Google?

Re: Google details new 24-hour process to sideload unverified Android apps

#184
post #57

Earlier quoted context omitted.

>- Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? Hi, I'm the community engagement manager @ Android. It's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you tur…

So... we're just going to move the scam into convincing the end user to run an application on their PC to ADB sideload the Scam App. Got it, simple enough. It's not hard to coach a user into clicking the "no, I'm not being coached" button, too, to guide them towards the ADB enable flow.

I think this is a "don't let the perfect be the enemy of the good thing". It's technically possible to get around, but adding more speed bumps in the way of scammers tends to drastically reduce the number of people who get scammed.

Re: Google details new 24-hour process to sideload unverified Android apps

#185
post #112

I'm generally OK with this, but the 24 hour hang time does seem a bit onerous. Most of the apps on my phone are installed from F-Droid. I guess the next time I get a new phone I'll have to wait at least 24 hours for it to become useful. I'm seriously considering Graphene for a next personal device and whatever the cheapest iOS device is for work.

This is hopefully an exciting time to consider a Motorola device, since they are partnering with GrapheneOS, but I worry that Google will block Google Play Services on any device that doesn't comply, so this might actually be a demoralizing time to be a GrapheneOS fan, when we watch them worm their stupid walled garden nonsense into the Motorola version of it.

Blocking Play might not be that bad if some frameworks/efforts crop up to allow easily targeting devices without it.

Re: Google details new 24-hour process to sideload unverified Android apps

#186

Earlier quoted context omitted.

The bank/institution is where the money is leaving from therefore they should implement policies that protect vulnerable customers like seniors, for example. I don't know how that looks but it seems reasonable that they could put limits on an account flagged "vulnerable person" I'm not sure what you're getting at with the rant about police power and a state? Google isn't the government either. What would legislation…

Sure, there are things banks can do, and those are features they can market. But ultimately, if the state isn't pursuing criminals who prey on the vulnerable, then society as we know it has failed and we would need a new society, or a new state, or both...The bank can't arrest anyone! I never said anything about it being Googles responsability, I agree it is not. And the only legislation that might be necessary over…

Fraud is already illegal, the issue is that these scammers reside in other countries. I don't doubt there could be pressure applied from really high up at the diplomatic level but I highly doubt the FBI for example is going to be able to do anything even with legislation.

Re: Google details new 24-hour process to sideload unverified Android apps

#187
post #165

Earlier quoted context omitted.

I'm assuming good faith and giving them the benefit of the doubt. Of course it might be that they want more control. In addition to controlling the world's most popular web browser and the world's most popular search engine and the world's most popular online advertising network and the world's most popular online video service.

It's really hard to when there's already technical solutions. They could require a process like bootloader unlocking that puts it in "dev" mode for instance While signing is useful, leaving no escape hatch imo is blatantly predatory

These restrictions already don't apply to something you install over adb, so there's already that. But that still considerably raises the bar for things like apps made by sanctioned entities, for example, most Russian banks.

Re: Google details new 24-hour process to sideload unverified Android apps

#190
post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

This has nothing to do with keeping people safe. If it did then power users could continue to install their own software by being given that ability as a developer setting. The fact that some people are gullible enough to go into a hidden setting on their phone and enable that in order to install an app from a random Chinese website is not a good reason to take away everyone's freedom. Consolidation of power is all this is about.
Post reply on HN