Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android Developer Verification: Threat masquerading as protection

f-droid.org

Post reply on HN
Print view View original

271–280 of 793 posts

Re: Android Developer Verification: Threat masquerading as protection

#271

Post by einpoklum »

The temerity of Alphabet to claim to protect users from malware/spyware, when they are known to share all of your personal information and communications with the US government (Snowden revelations), is the epitome of hubris. And, also, in the world we live in, just another Thursday.

But even ignoring this - it is not for Alphabet/Google to decide whether, and how, I want protections. I want to be able to pick a sequence of bytes and install that as an application on my phone, without Alphabet having any say in whether that happens or not, and in fact without them knowing about it. It's my phone, not theirs, and the software should help me do what I need/want, not help them provide me their often-questionable services.

Re: Android Developer Verification: Threat masquerading as protection

#272

Post by powerapple »

transcriptase wrote: post #25

I think the most fun part with Google is that if some wayward algorithm decides it doesn’t like you, along with nuking your app and developer account it will probably nuke your 20 year old gmail, your kids Google Drive accounts, your wife’s YouTube premium, the Adsense account of some company you worked for in 2008, and disable your Nest cameras. And you’ll never reach a human to sort it out.

That happened to me, lost 16 years old gmail account, which is my main account for my digital life. It happened after I disabled some tracking, and Google was no longer able to recognize me, even though I had my phone number registered, it was not enough.

Re: Android Developer Verification: Threat masquerading as protection

#273

Post by einpoklum »

sambuccid wrote: post #130

It doesn't solve the current issue, but in case we don't manage to push back on this, some people might not know that there are various actual linux OSes for mobile: - SailfishOS: still linux based and seems fairly community inclusive, but the UI part of the stack is closed source. Is the only one officially allowed to run android apps, via emulation. Has existed for a very long time, it's lightweight and I think the…

Which phones are supported by which of these operating systems? And can you provide some relevant links?

Re: Android Developer Verification: Threat masquerading as protection

#276

Post by jonathanstrange »

IshKebab wrote: post #241
KJs6ZxELzQM37O wrote: post #231

Earlier quoted context omitted.

There is a good solution. A big disclaimer and the user accepting the risk of running the software they want. The same solution they've been doing for years that did not need change. The new developer program is only here because it is more convenient to Google and governments.

We've known for literally decades that that doesn't actually work, for several reasons: 1. People are conditioned to ignore warnings. There are way too many benign warnings in the world; you can't read them all. 2. Even when people wouldn't ignore them, in cases where they are being tricked by scammers it's easy for the scammer to talk people into accepting them. 3. Those sorts of warnings aren't actionable. You're i…

The problem is easy to solve by making 99% of all apps normal apps that don't get any special privileges and don't require any developer certification, and having a certified developer program with heavily locked down run mode for the 1% of high security apps like banking and payment apps. It's not hard to attest unambiguously to the user in some way whether they are running one of these rare secure apps or a normal one, a restricted API suffices but you could also just add an LED for it.

You can't possibly convince me that Google couldn't develop something like that if they wanted to.

Re: Android Developer Verification: Threat masquerading as protection

#277

Post by llm_nerd »

devsda wrote: post #185
transcriptase wrote: post #25

I think the most fun part with Google is that if some wayward algorithm decides it doesn’t like you, along with nuking your app and developer account it will probably nuke your 20 year old gmail, your kids Google Drive accounts, your wife’s YouTube premium, the Adsense account of some company you worked for in 2008, and disable your Nest cameras. And you’ll never reach a human to sort it out.

What happens if you "accidentally" become persona non grata with both Google and Apple? If you want to participate in the society, you will forever have to resort to shady tactics. Shady can be defined something as arbitrary as using GrapheneOS. A temporary workaround like using alternatives like GrapheneOS for those affected will only delay the inevitable but it doesn't stop it at all.

> What happens if you "accidentally" become persona non grata with both Google and Apple?

https://www.theguardian.com/law/2026/feb/18/international-cr...

The US made a Canadian judge a persona non grata for any firm domiciled in the US. All because she works for the ICC, and the ICC declared Netanyahu a war criminal (which is indisputible). Why is the US destroying worldwide trust in US businesses on behalf of a reviled nuclear armed hermit nation on the other side of the planet? Good question, but it is what it is.

This example that the US will spuriously use sanctions like this is why many nations are investigating ways to purge American financial systems and tech.

Re: Android Developer Verification: Threat masquerading as protection

#278

Post by 0x000xca0xfe »

pimeys wrote: post #233

Btw. This whole debacle made me to stop installing any Android updates. I've done my best to avoid installing even the security updates, so my diabetes apps continue working in the future. I really need to take the time and go with Graphene OS in this device. My bank N26 kind of still allows it, but they made it harder and harder to use with certain custom checks. Looks like in the future I need a separate banking ph…

I have an old $70 test device with stock Android/Google that hasn't seen security updates in half a decade yet all banking apps, electric car charging, Google services, you name it, work absolutely fine.

Meanwhile the daily driver phones of my privacy-aware family members running up-to-date Lineage or Graphene OS with recent kernels and frequent updates constantly run into apps refusing to work for "security" reasons. It's a complete joke.

Re: Android Developer Verification: Threat masquerading as protection

#279

Post by einpoklum »

dolmen wrote: post #236
hulitu wrote: post #181

Earlier quoted context omitted.

> Android users need to switch to Graphene. Which supports only Pixel devices.

The resason is that only Google bothers to put enough hardware security features to build software on top that allows to make a really secure device that blocks tampering.

That's not a reason. When the hardware doesn't have those "security features", then don't "really secure", just run without being "really secure".

I never treat my (Android) phone as secure anyway.

Re: Android Developer Verification: Threat masquerading as protection

#280

Post by Zak »

yunohn wrote: post #237

While I sympathize with the general negative outrage towards this change, I truly believe that people here fail to empathize with the mainstream users of Android phones. I personally have seen every single older relative and non-tech friend, end up installing bloateare, spyware, and malware inadvertently - because they have no idea how anything in the tech domain works. And given the widespread popularity of Android…

The only time I've actually seen Android malware in the wild, it was because my mother installed a homescreen flashlight toggle widget from the Play Store that also displayed ads on the lockscreen. That was forbidden under Play Store rules, but there it was. I replaced it with something from F-Droid.

The Play Store still has a problem with shady apps years later. If Google wants to be more like Apple, they should start with better curation in their own store.

Post reply on HN