Android Developer Verification: Threat masquerading as protection • Hacker News Board

Re: Android Developer Verification: Threat masquerading as protection

#521

Post by eks391 » Thu, Jul 02, 2026, 3:37 PM UTC

MSFT_Edging wrote: post #317

transcriptase wrote: post #25

I think the most fun part with Google is that if some wayward algorithm decides it doesn’t like you, along with nuking your app and developer account it will probably nuke your 20 year old gmail, your kids Google Drive accounts, your wife’s YouTube premium, the Adsense account of some company you worked for in 2008, and disable your Nest cameras. And you’ll never reach a human to sort it out.

I've seen multiple stories of people buying phones from Fi, the phones never arriving, google refusing a refund, and on a chargeback, their entire google account gets shut down.

Holy crap that is scummy.

I still use 2 Google services, of which neither would crumble me if lost (YouTube, and my old email which now acts as my spam inbox). I have lost accesses before, when I was still partially dependent, and had to give up my privacy to get access again, long enough to get off. It sucks but I do consider myself lucky that I was able to prevent the life crushing consequences that some people have had. Such a terrible company.

Re: Android Developer Verification: Threat masquerading as protection

#522

Post by thewebguyd » Thu, Jul 02, 2026, 3:38 PM UTC

gruez wrote: post #437

throwburn202605 wrote: post #148

Earlier quoted context omitted.

GrapheneOS is currently the blessed child. Like CyanogenMod previously. They are "permitted" to access to Google Play Services because their work hardening Android currently benefits Google. Once Google feels like there is sufficient stability and compatibility with hardened memory allocator and tagged memory (and when they can get Qualcomm to support it across their range), they will make harder, until impossible, f…

>> Google’s Android—and [Open Handset Alliance] members are contractually prohibited from building non-Google approved devices >So to compete you'd have to create a compatible Google Play Services as well as find a supporting manufacturer. Samsung managed their own competing apps and store [2] for a while along with Tizen, likely for leverage or theoretical pivot. But has since dropped that effort. What's wrong with…

It's a nice effort, but without preinstalls you aren't going to capture the market except for the tiny percentage of enthusiasts which are maybe a fraction of a percent of the market.

Google needs to experience real competitive pressure, and you need preinstalls for that.

Same story for year of the Linux desktop. It's doomed to 5% or less of market share without preinstalls (which Valve & the various other PCs now releasing with SteamOS are changing)

But also, prohibiting OEMs from making or partnering with "non Google approved" OSes is ridiculous and I'm surprised that hasn't been challenged in court yet as an abuse of monopoly power.

Re: Android Developer Verification: Threat masquerading as protection

#523

Post by armadyl » Thu, Jul 02, 2026, 3:39 PM UTC

vlian2088 wrote: post #216

Arnt wrote: post #41

Earlier quoted context omitted.

I know Graphene has innovative security measures, do you happen to know whether that includes anything wrt. phishing or social engineering? (For those who haven't been following along: this whole affair started with phishing. People were social-engineered into installing an app and a little later their bank accounts were empty. A big issue in various poor countries.)

my brother in Christ, people who root their phones don't fall for "Hello sir, I'm sir John from Microsoft, you have virus sir, please do the needful install antivirus and send gift card sir."

You’re right, they just fall for installing updates or CLI tools which install compromised dependencies and run wild on a rooted system before getting caught 24 hours later.

Re: Android Developer Verification: Threat masquerading as protection

#524

Post by matejzvikl » Thu, Jul 02, 2026, 3:40 PM UTC

ghhj

Re: Android Developer Verification: Threat masquerading as protection

#525

Post by matejzvikl » Thu, Jul 02, 2026, 3:40 PM UTC

ghuu

Re: Android Developer Verification: Threat masquerading as protection

#526

Post by RussianCow » Thu, Jul 02, 2026, 3:44 PM UTC

codedokode wrote: post #505

hollow-moe wrote: post #188

Earlier quoted context omitted.

And all are useless because you can't use your mandatory bank or gov id app.

In my country, partially due to sanctions, you can access the bank via browser and receive 2FA codes on $15 dumb phone. Also why do you need bank app on your phone? Do you like to give money to random strangers on the street? Only scammers need money urgently. Also it is not secure to use the phone as a single factor to access the bank. I do not have any bank apps on my phone (it is not even connected to the Internet…

> Also why do you need bank app on your phone?

Many banks gate features like mobile check deposit behind the native app. The nearest ATM is 20 minutes away from my house, so unfortunately I consider this feature essential.

Re: Android Developer Verification: Threat masquerading as protection

#527

Post by imkac » Thu, Jul 02, 2026, 3:45 PM UTC

nativeit wrote: post #508

armadyl wrote: post #354

Earlier quoted context omitted.

All of which have beyond horrific security. GrapheneOS is the only acceptable alternative from mainstream Android.

Don’t they have standard Linux security? Does my phone need to be more secure than my production web server?

[dead]

Re: Android Developer Verification: Threat masquerading as protection

#528

Post by thewebguyd » Thu, Jul 02, 2026, 3:45 PM UTC

tredre3 wrote: post #510

grapheneos wrote: post #424

Earlier quoted context omitted.

An end-of-life Xiaomi device with no privacy or security patches for the firmware, Linux kernel, drivers and HALs for years doesn't provide the bare minimum for protecting user privacy and security. It would theoretically be possible to port it to a newer kernel but that's not within the scope of LineageOS. It doesn't do that so there aren't Linux kernel updates since the kernel branch has been end-of-life for years…

> An end-of-life Xiaomi device with no privacy or security patches for the firmware, Linux kernel, drivers and HALs for years doesn't provide the bare minimum for protecting user privacy and security. Your very rigid view of the world is so distorted to the point of being absurd. You know damn well that the vast, vast majority of spying on Android is done in userspace. A good OS that allows you to remove permissions…

I don't think its rigid at all. Its important to continue to be able to receive security updates. If a device can't, mostly because qualcomm/firmware no longer wants to bother 6 months after release, it's DoA.

We don't go around telling people that it's OK to still run Windows XP for the same reason. Why is/should mobile be any different?

Stop being OK with manufacturers having garbage support. It's completely unacceptable.

Re: Android Developer Verification: Threat masquerading as protection

#529

Post by troyvit » Thu, Jul 02, 2026, 3:46 PM UTC

lern_too_spel wrote: post #480

troyvit wrote: post #462

Earlier quoted context omitted.

That's only the consumer side of it though. As the post states: > Should a developer[...] elect to register themself with Google as a “verified” developer, they should expect to sign up for an account and pay a fee, surrender detailed personal information and upload government-issued identification, and then proceed to register the identifiers and signing keys for all the apps they intend to distribute (now or ever).…

This is no different from before. If you want consumers to be able to install your app without a warning on Google builds, you have to jump through verification hoops. The only thing that ADV changes for developers is that now they can distribute their apps outside the system app stores without a warning as well, which is a new benefit, not a new restriction. The correct thing to complain about is requiring developer…

Oh man thank you for the clarification <3

Re: Android Developer Verification: Threat masquerading as protection

#530

Post by janvlug » Thu, Jul 02, 2026, 3:49 PM UTC

sambuccid wrote: post #130

It doesn't solve the current issue, but in case we don't manage to push back on this, some people might not know that there are various actual linux OSes for mobile: - SailfishOS: still linux based and seems fairly community inclusive, but the UI part of the stack is closed source. Is the only one officially allowed to run android apps, via emulation. Has existed for a very long time, it's lightweight and I think the…

I'm using a Librem 5 as my daily phone. PureOS is actively developed and based on Debian. Monthly development updates are published here: https://puri.sm/posts/tag/advanced-readers/

Personally, I do not use Android apps on the Librem 5, but Waydroid is available in the PureOS repository. Waydroid is a container-based approach to boot a full Android system on regular GNU/Linux systems running Wayland based desktop environments (like PureOS).

PureOS also provides convergence via Phosh. Convergence means here that the same app can be used on a phone and on a big screen, the GUI adjusts to the available screen size.

Phosh aims to provide a daily-usable, robust and easy to use graphical user environment for mobile devices running mainline Linux. Phosh was originally initiated by developers from Purism for the Librem 5 phone but is nowadays used on many different devices covering smartphones, tablets and convertibles. It has even been seen on laptops.