Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android Developer Verification

android-developers.googleblog.com

Post reply on HN
Print view View original

151–160 of 345 posts

Re: Android Developer Verification

#151

Post by fakwandi_priv »

lm411 wrote: post #127
mrtksn wrote: post #35

The Android verification is such a broken experience. Recently I decided to purchase a dev account for my company, so far: 1) Provided my company DUNS number etc. once to create the payment profile. I did this some times ago, don’t remember the details but it was an involved verification process and it is marked as verified business payment profile. 2) Later on the payment step verified myself with a passport and ban…

The whole Google Play experience is awful. Recent things I've had to do: 1) Re-submit an app after it was rejected and labelled a gambling app (it wasn't even close - a 15 second look by a real human would have seen that. This one was even appealed and the support was utterly useless. I ended up changing one word and re-submitting the app, approved no problem. 2) An existing app, in the Play store for years but a nic…

So what was the word you changed?

Re: Android Developer Verification

#154

Post by thayne »

lm411 wrote: post #127
mrtksn wrote: post #35

The Android verification is such a broken experience. Recently I decided to purchase a dev account for my company, so far: 1) Provided my company DUNS number etc. once to create the payment profile. I did this some times ago, don’t remember the details but it was an involved verification process and it is marked as verified business payment profile. 2) Later on the payment step verified myself with a passport and ban…

The whole Google Play experience is awful. Recent things I've had to do: 1) Re-submit an app after it was rejected and labelled a gambling app (it wasn't even close - a 15 second look by a real human would have seen that. This one was even appealed and the support was utterly useless. I ended up changing one word and re-submitting the app, approved no problem. 2) An existing app, in the Play store for years but a nic…

Maybe it's better now, though I doubt it, but my experience publishing on the Apple app store years ago wasn't any better.

Re: Android Developer Verification

#155

Post by thayne »

tedk-42 wrote: post #141
ethagnawl wrote: post #12

What % of Android users actually want this? Do they know or care? I've been using Android since 2010 because it was open in ways that the Apple ecosystem wasn't. I do not want this and imagine hardly any other power users (for lack of a better term) do. I'm already using a mostly deGoogled device but this really seals the deal. I have been longing for a true Linux phone for years and now seems like a good time to get…

Google/Android don't want AI bots spamming marketplaces with dodgy apps. Tie in the app to a verified identity/individual and it makes the audit process easier as well as engagement with authorities from the user's country if required (e.g. app facilitating child abuse).

But they don't have a problem with using unreliable AI bots to audit apps and deal with support.

Re: Android Developer Verification

#156

Post by hansvm »

mrtksn wrote: post #35

The Android verification is such a broken experience. Recently I decided to purchase a dev account for my company, so far: 1) Provided my company DUNS number etc. once to create the payment profile. I did this some times ago, don’t remember the details but it was an involved verification process and it is marked as verified business payment profile. 2) Later on the payment step verified myself with a passport and ban…

That sounds a lot like my experience as an Apple Developer too, with the added bonus (unclear from your description if you experienced this too) that they took my money before the verification process was finished and wouldn't refund it once their AI couldn't connect my face to my ID and wouldn't let me connect with a real person (the first dozen times were on them, but after that it was maybe my fault for including a middle finger in the photographs).

Is there a way around this shitocracy?

Re: Android Developer Verification

#158

Post by john01dav »

AussieWog93 wrote: post #149
Dwedit wrote: post #134

Earlier quoted context omitted.

Forcing people to keep up with SDK updates is a bad thing in itself. Let people target the earliest possible feature set and make the app run on as many phones as possible rather than showing scary messages to people due to targeting an older API.

I think the problem is that older SDK versions allowed you to do things like scan local WiFi names to get location data, without requiring the location permission. So bad actors would just target lower SDK versions and ignore the privacy improvements

The newer Android version could simply give empty data (for example, location is 0,0 latitude longitude, there are no visible WiFi networks), when the permission is missing and an app on the old SDK version requests it.

Of course, they don't like this because then apps can't easily refuse to work if not allowed to spy.

Re: Android Developer Verification

#159

Post by yjftsjthsd-h »

selectively wrote: post #76
pxc wrote: post #60

Earlier quoted context omitted.

F-Droid is in fact what an app store concerned about user safety looks like. Nobody gets hoodwinked into installing apps that track them or sell their data or otherwise abuse them on F-Droid.

This is non-technical. F-Droid is horrible. https://privsec.dev/posts/android/f-droid-security-issues/#5... F-Droid has not meaningfully improved since that piece was written, either. No one should use F-Droid.

Can you describe the threat model / specific attack under which... any of the supposed flaws on that page matter? (Most of the particular section you've linked appears to be about extra defenses that could be added, but which are unlikely to make a difference in the face of Android's TOFU signature verification on installed APKs.)

Re: Android Developer Verification

#160

Post by yjftsjthsd-h »

bsimpson wrote: post #140
donatj wrote: post #139

I would genuinely like to know more about these supposed users who are side loading things and getting hoodwinked. It seems high enough friction that you have to have something of an idea of what you're doing to begin with. Everyone I've known who is side loaded anything has been reasonably technical. My dad on the other hand, who worked for Control Data in the 1980s regularly installs some of the scummiest apps imag…

Have you seen those YouTube videos of people punking scammers? Scammers will convince people to drive to Target, buy gift cards, and read the credentials out over the phone. Those same people can surely talk you through tapping out a dialog flow. That's presumably why there's a lockout period - it keeps a scammer from reasonably holding the line until they can pressure you to finish it.

> Have you seen those YouTube videos of people punking scammers? Scammers will convince people to drive to Target, buy gift cards, and read the credentials out over the phone. Those same people can surely talk you through tapping out a dialog flow.

...if the scammer can get the victim to physically drive to Target a buy a bunch of gift cards, what makes you think they need to install anything on your phone? Having RCE on a human is more useful than RCE on a device.

Post reply on HN