Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google details new 24-hour process to sideload unverified Android apps

arstechnica.com

Post reply on HN
Print view View original

351–360 of 1001 posts

Re: Google details new 24-hour process to sideload unverified Android apps

#351

Post by dwaite »

josephg wrote: post #299
browningstreet wrote: post #192

Earlier quoted context omitted.

I worked at a bank on the backend for architecture and security.. and I've posted this attestation here before, but the sheer volume of fraud and fraud attempts in the whole network is astonishing. Our device fingerprinting and no-jailbreak-rules weren't even close to an attempt at control. It was defense, based on network volume and hard losses. Should we ever suffer a significant loss of customer identity data and/…

I wish we had technical solutions that offered both. For example, a kernel like SeL4, which could directly run sandboxed applications, like banking apps. Apps run in this way could prove they are running in a sandbox. Then also allow the kernel to run linux as a process, and run whatever you like there, however you want. Its technically possible at the device level. The hard part seems to be UX. Do you show trusted a…

Yes, sandboxing is a technological protection, but once you have important data flowing we often don't have technological protections to prevent exfiltration and abuse. The global nature of the internet means that someone who publishes an app which abuses user expectations (e.g. uses accessibility to provide command and control to attackers) is often out of legal reach.

You also have so much grey area where things aren't actual illegal, such as gathering a massive amount of information on adults in the US via third party cookies and ubiquitous third party javascript.

Thats why platforms created in the internet age are much more opinionated on what API they provide to apps, much more stringent on sandboxing, and try to push software installation onto app stores which can restrict apps based on business policy, to go beyond technological and legal limitations.

Re: Google details new 24-hour process to sideload unverified Android apps

#352

Post by SchemaLoad »

ravenstine wrote: post #190
grishka wrote: post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

This has nothing to do with keeping people safe. If it did then power users could continue to install their own software by being given that ability as a developer setting. The fact that some people are gullible enough to go into a hidden setting on their phone and enable that in order to install an app from a random Chinese website is not a good reason to take away everyone's freedom. Consolidation of power is all t…

There is immense pressure to stop online scams which are draining old people of their life savings. The whole flow from the article seems entirely based around letting power users install what they want while being able to break the flow of a scammer guiding a clueless person in to installing malware.

It is promising that Google has avoided just turning off sideloading but still put measures in place to protect people.

Re: Google details new 24-hour process to sideload unverified Android apps

#354

Post by NoahZuniga »

headsman771 wrote: post #237
MishaalRahman wrote: post #40

Earlier quoted context omitted.

>- Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? Hi, I'm the community engagement manager @ Android. It's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you tur…

Why do you keep harping on about ADB installs. That's not helpful. It doesn't help me install open source apps from FDroid. It's ridiculous that you think booting up a computer and using ADB is a reasonable workaround. It isn't.

You would be able to install f droid and it's apps without going through this flow.

Re: Google details new 24-hour process to sideload unverified Android apps

#355

Post by inquirerGeneral »

grishka wrote: post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

[dead]

Re: Google details new 24-hour process to sideload unverified Android apps

#356

Post by wat10000 »

grishka wrote: post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

Smartphones and the internet are really useful and convenient. Even if we could make it work, it seems quite rude to say that people should be excluded from it because we can't be bothered to make it safe.

Consider an older technology that became fundamental to much of daily life a century or two ago: writing. After a few millennia where literacy was a specialized skill, we pretty quickly transitioned to a society where it was essential for common activities. Rather than make sure everything had pictures and such to accommodate the illiterate, we tried to make it so that the entire population is literate, and came pretty close to succeeding. There are people who just outright can't read for whatever reason, but they're a very small minority and we aim to accommodate them by giving them assistance so they can get by in a literate world, rather than changing the world so you don't need to be able to read to live a normal life.

Rather than saying that half the population (a low estimate, I believe, for how many people will fall prey to malware in an anything-goes world) should abandon this technology, we should work to make it so they don't have to, with some combination of education and technological measures.

Re: Google details new 24-hour process to sideload unverified Android apps

#357

Post by kllrnohj »

josephg wrote: post #299
browningstreet wrote: post #192

Earlier quoted context omitted.

I worked at a bank on the backend for architecture and security.. and I've posted this attestation here before, but the sheer volume of fraud and fraud attempts in the whole network is astonishing. Our device fingerprinting and no-jailbreak-rules weren't even close to an attempt at control. It was defense, based on network volume and hard losses. Should we ever suffer a significant loss of customer identity data and/…

I wish we had technical solutions that offered both. For example, a kernel like SeL4, which could directly run sandboxed applications, like banking apps. Apps run in this way could prove they are running in a sandbox. Then also allow the kernel to run linux as a process, and run whatever you like there, however you want. Its technically possible at the device level. The hard part seems to be UX. Do you show trusted a…

The problem is it's quite easy to poke holes in a sandbox when you're outside the sandbox looking in, especially when the user is granting you special permissions they don't understand. These apps aren't doing things like manipulating the heap of the banking app, they are instead just taking advantage of useful but powerful features like screen mirroring to read what the app is rendering.

Re: Google details new 24-hour process to sideload unverified Android apps

#359

Post by NoahZuniga »

bityard wrote: post #268

Welp, I guess my current Android phone will be my last one. At least half of the apps I use on a daily basis come from f-droid. This enforced 24-hour wait is simply not acceptable. Android has always been a far inferior overall user experience compared to iPhone. Android's _only_ saving grace was that I could put my own third-party open-source apps on it. There is nothing left keeping me on Android now. I'll probably…

Probably f droid will become an official app store recognized by Google, and then you won't have to go through this flow to install f droid or its apps.

Re: Google details new 24-hour process to sideload unverified Android apps

#360

Post by goodusername »

Although I'm slightly relieved there is a way out of Googles verification system, it's still pretty wild if you compare this to installing software on a Windows pc. I'm sure Microsoft is heading in the same direction with Windows, but today its still "only" a few confirmations to install anything.

This will sadly still put a major damper on adoption of open source apps, while giving a false sense of security that apps from the Play store are safe.

Years down the road, the low usage of apps installed from outside the Play store will be used as an argument for removing the functionality completely.

Post reply on HN