Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android Developer Verification

android-developers.googleblog.com

Post reply on HN
Print view View original

181–190 of 345 posts

Re: Android Developer Verification

#181

Post by spaqin »

tredre3 wrote: post #170
tejtm wrote: post #108

Earlier quoted context omitted.

Please call it what it is and always has been: I.N.S.T.A.L.L.I.N.G S.O.F.T.W.A.R.E "side load" is like "jay walking' seeks to stigmatize humans being human.

When you jay walk you take the risk of being hit by a car, causing injuries to you, to the driver, and to other nearby people. So I don't understand your analogy? Are you suggesting that pedestrians own the streets and should do what they please, as users own their phone and should have the right to do as they please? Or something else?

Yeah, I'm willing to use my brain and look at incoming cars and just walk when it's empty and safe to do so? Where's the problem in that? I have eyes and can judge distance and speed?

Re: Android Developer Verification

#182

Post by ncr100 »

hnburnsy wrote: post #118
hnburnsy wrote: post #44

What Android versions is this applicable to?

Found the answer... >What Android versions will the developer verification requirements be enforced on? It will apply to all certified Android devices running Android 7 or higher. These updates are delivered through Google Play services to help maintain consistent security across the ecosystem. Last updated: March 23, 2026

So, Google TVs too?

Re: Android Developer Verification

#183

Post by fc417fc802 »

selectively wrote: post #76
pxc wrote: post #60

Earlier quoted context omitted.

F-Droid is in fact what an app store concerned about user safety looks like. Nobody gets hoodwinked into installing apps that track them or sell their data or otherwise abuse them on F-Droid.

This is non-technical. F-Droid is horrible. https://privsec.dev/posts/android/f-droid-security-issues/#5... F-Droid has not meaningfully improved since that piece was written, either. No one should use F-Droid.

Reads like a cheap hit piece to me.

The section you linked in particular is a load of editorialized bullshit IMO. As far as I can tell the only legitimate complaint is that there is (or was?) some sort of issue with the signing methodology for both APKs and repository metadata. Specifically they were apparently very slow to replace deprecated methods that had known issues. However it's worth noting that they appear to have been following what were at one point standard practices.

The certificate pinning nonsense is particularly egregious. APT famously doesn't need TLS unless you're concerned about confidentiality. It's the same for any package manager that securely signs everything, and if there's ever a signing vulnerability then relying on TLS certainly might save you but seems extremely risky. On top of that the Android TOFU model means none of this matters in the slightest for already installed apps which is expected to be the case the vast majority of the time.

As far as I'm concerned F-Droid is the best currently available option. That said of course there are places it could improve.

Re: Android Developer Verification

#184

Post by xigoi »

TGower wrote: post #41
brnt wrote: post #36

Earlier quoted context omitted.

Those scam apps largely are installed from the Play store. Let them fix that first.

Really, there are apps that will intercept and exfiltrate your bank one time code sms that are just sitting on the play store? First I'm hearing of this, what's the name of one?

Many of the most popular apps on the Play Store will monitor all activity on your device and send it to a for-profit company.

Re: Android Developer Verification

#185

Post by cyberax »

supern0va wrote: post #73
glenstein wrote: post #65

Don't love it but (1) it's addressing a serious problem and I'm not sure what the alternative is and (2) if you all remember the starting place, it was staggeringly, dramatically worse, practically a death sentence for F-Droid and seemingly testing the waters for if they could simply power through and do it despite objection. This is a major course correction that doesn't kill F-Droid. A one time 24 hour hoop to jump…

Is it a serious problem that you can run whatever software you want on your computer? Should we make it so that no one can do that without permission to protect them? I recommend Cory Doctorow's talk on why this is a serious problem for society: https://en.wikisource.org/wiki/The_Coming_War_on_General_Com... https://www.youtube.com/watch?v=HUEvRyemKSg

> Is it a serious problem that you can run whatever software you want on your computer?

Unfortunately. I talked about this a bit on LWN: https://lwn.net/Articles/1063741/

The problem is very, very real. I don't doubt that Google also has ulterior motives, but in this case they _are_ justified at least partially.

Re: Android Developer Verification

#186

Post by eviks »

jpollock wrote: post #172
john01dav wrote: post #158

Earlier quoted context omitted.

The newer Android version could simply give empty data (for example, location is 0,0 latitude longitude, there are no visible WiFi networks), when the permission is missing and an app on the old SDK version requests it. Of course, they don't like this because then apps can't easily refuse to work if not allowed to spy.

That can have some very extreme legal ramifications. Consider - it's a voip dialing client which has a requirement to provide location for E911 support. If the OS vendor starts providing invalid data, it's the OS vendor which ends up being liable for the person's death. e.g. https://www.cnet.com/home/internet/texas-sues-vonage-over-91... which is from 2005, but gives you an idea of the liability involved.

It can't have "extreme ramifications", Google's own phone couldn't call 911 for a while.

And you can manually force only the voip dialing apps instead of everyone

Re: Android Developer Verification

#187

Post by _66o »

hansvm wrote: post #156
mrtksn wrote: post #35

The Android verification is such a broken experience. Recently I decided to purchase a dev account for my company, so far: 1) Provided my company DUNS number etc. once to create the payment profile. I did this some times ago, don’t remember the details but it was an involved verification process and it is marked as verified business payment profile. 2) Later on the payment step verified myself with a passport and ban…

That sounds a lot like my experience as an Apple Developer too, with the added bonus (unclear from your description if you experienced this too) that they took my money before the verification process was finished and wouldn't refund it once their AI couldn't connect my face to my ID and wouldn't let me connect with a real person (the first dozen times were on them, but after that it was maybe my fault for including…

Going through hell with Apple Developer too. I didn't have to do much in terms of verification (probably because I created an account as an individual) but app submission is another story: - first time I got rejected for mentioning a name of a third party in my app description. The app description said: DISCLAIMER: not affiliated with xxx

- after fixing the app description I got rejected for using my app name(?!), multiple back and forths with the reviewer got me nowhere, they just copy pasted the same response not addressing my messages at all

- filled the app store review board appeal, it's been 5 days and I've got no response.

At this point I'm seriously considering rewriting the app for MacOS and distributing myself. I can't imagine going through all of this with every app update, it's beyond ridiculous.

Re: Android Developer Verification

#188

Post by pocksuppet »

jpollock wrote: post #172
john01dav wrote: post #158

Earlier quoted context omitted.

The newer Android version could simply give empty data (for example, location is 0,0 latitude longitude, there are no visible WiFi networks), when the permission is missing and an app on the old SDK version requests it. Of course, they don't like this because then apps can't easily refuse to work if not allowed to spy.

That can have some very extreme legal ramifications. Consider - it's a voip dialing client which has a requirement to provide location for E911 support. If the OS vendor starts providing invalid data, it's the OS vendor which ends up being liable for the person's death. e.g. https://www.cnet.com/home/internet/texas-sues-vonage-over-91... which is from 2005, but gives you an idea of the liability involved.

Phone companies are required to make sure 911 works on their phones. Random people on the internet aren't required to make sure 911 works on random apps, even if they look like phones.

Re: Android Developer Verification

#189

Post by pocksuppet »

ethagnawl wrote: post #12

What % of Android users actually want this? Do they know or care? I've been using Android since 2010 because it was open in ways that the Apple ecosystem wasn't. I do not want this and imagine hardly any other power users (for lack of a better term) do. I'm already using a mostly deGoogled device but this really seals the deal. I have been longing for a true Linux phone for years and now seems like a good time to get…

Time to switch to Graphene.

Re: Android Developer Verification

#190

Post by pocksuppet »

tredre3 wrote: post #171
tedk-42 wrote: post #141

Earlier quoted context omitted.

Google/Android don't want AI bots spamming marketplaces with dodgy apps. Tie in the app to a verified identity/individual and it makes the audit process easier as well as engagement with authorities from the user's country if required (e.g. app facilitating child abuse).

> e.g. app facilitating child abuse I'm going to go on a limb and say that the amount of apps dedicated to facilitating child abuse is close to 0, and the popular apps from verified developers being used for child abuse is close to 100%.

Session Messenger comes to mind. It's available in the Play Store and also in F-Droid.
Post reply on HN