Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Google on Mandatory Developer Registration for App Distribution

keepandroidopen.org

Post reply on HN
Print view View original

211–220 of 392 posts

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#211

Post by thegrim33 »

andyferris wrote: post #169
WarmWash wrote: post #158

The judge told Google that Apple is not anti-competitive because Apple has no competitors on it's platform (this all stemming from the Epic lawsuits). Google listened. Blame the judge for one of the worst legal calls in recent history. Google is a monopoly and Apple is not. Simple fix for Google... Same comment I made a few days ago, I feel it bears repeating as much as possible until it's really driven home how detr…

Like many things in the US, this should be settled by congress not judges. Things that everyone relies on for life are generally regulated by law. Telecom platforms for instance. I’d say the mandatory software platform I need for my bank, drivers license, daily communication, etc should be in this bucket. The EU declaring both Apple and Google gateway platforms is a much better approach. Congress is abdicating its re…

"Like many things in the US, this should be settled by congress"

The US government is by design supposed to be as minimal as possible, and the laws affecting you kept as local as possible. We're not supposed to have a "the government" that's the same as EU governments. "The federal government should make laws" should be an absolute last resort. When you say "congress is abdicating its responsibility", I'd like you to point to where in the constitution it says that congress has such responsibilities.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#212

Post by array_key_first »

mirekrusin wrote: post #126
marcprux wrote: post #91

Earlier quoted context omitted.

I am the author of the letter and the coordinator of the signatories. We aren't saying "nuh uh, everything's fine as it is." Rather, we are pointing out that Android has progressively been enhanced over the years to make it more secure and to address emerging new threat models. For example, the "Restricted Settings"¹ feature (introduced in Android 13 and expanded in Android 14) addresses the specific scam technique o…

Would you say that iOS ecosystem suffers the same rate of malware as Android?

The app store does contain malware, although arguably less than the play store. Apple devices would be much more secure without the app store. Apple should remove the app store.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#213

Post by RHSeeger »

dfabulich wrote: post #3

The most controversial claim in this letter is in the section that "Existing Measures Are Sufficient." In Google's announcement in Nov 2025, they articulated a pretty clear attack vector. https://android-developers.googleblog.com/2025/11/android-de... > For example, a common attack we track in Southeast Asia illustrates this threat clearly. A scammer calls a victim claiming their bank account is compromised and uses…

There will _always_ be a need to balance between safety and the cost of adding more safety. There is no point at which safety is complete; there is always more that can be done, but the cost gets higher and higher.

So yes, "its fine the way it is" _is_ valid; but the meaning it "we're at a good point in the balance, any more cost is too much given the gains it generates"

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#214

Post by giancarlostoro »

pas wrote: post #173
hbn wrote: post #154

Earlier quoted context omitted.

You can add 5 layers of "are you sure you want to do this unsafe thing" and it just adds 5 easy steps to the scam where they say "agree to the annoying popup"

then make the unlock cost money relatively easy for devs, but hard to scale for scammers

It's either that or as suggested, hard require developer validation for specific API permissions.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#215

Post by iamnothere »

singpolyma3 wrote: post #148
Tharre wrote: post #48

Earlier quoted context omitted.

There simply isn't a known solution to this problem. If you give users the ability to install unverified apps, then bad actors can trick them into installing bad ones that steal their auth codes and whatnot. If you want to disallow certain apps then you have to make decisions about what apps (stores) are "blessed" and what criteria are used to make those distinctions, necessarily restricting what users can do with th…

> There simply isn't a known solution to this problem. If you give users the ability to install unverified apps, then bad actors can trick them into installing bad ones that steal their auth codes and whatnot. This is also true if they can only install verified apps, because no company on earth has the resources to have an actually functional verification process and stuff gets through every day.

> This is also true if they can only install verified apps, because no company on earth has the resources to have an actually functional verification process and stuff gets through every day.

This is true, but if this goes through, I imagine that the next step for safety fascists will be to require developer licensing and insurance like general contractors have. And after that, expensive audits, etc, until independent developers are shut out completely.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#216

Post by array_key_first »

harikb wrote: post #19
JoshTriplett wrote: post #9

Earlier quoted context omitted.

If you can "coach someone to ignore standard security warnings", you can coach them to give you the two-factor authentication codes, or any number of other approaches to phishing.

Installing an app that silently intercepts SMS/MMS data is a persistent technical compromise. Once the app is there, the attacker has ongoing access. In contrast, convincing someone to read an OTP over the phone is a one-time manual bypass. To use your logic.. A insalled app - Like a hidden camera in a room. Social engineering over phone - Like convincing someone to leave the door unlocked once.

This is still not a root cause solution, it's just a mitigation. Because you do not require side loading to install malware. The play store and apple app store both contain malware, as well as apps which can be used for nefarious purposes, such as remote desktop.

A root cause solution is proper sandboxing. Google and apple will not do this, because they rely on applications have far too much access to make their money.

One of the fundamentals of security is that applications should use the minimum data and access they need to operate. Apple and Google break this with every piece of software they make. The disease is spreading from the inside out. Putting a shitty lotion on top won't fix this.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#217

Post by jrm4 »

mwwaters wrote: post #103
bigstrat2003 wrote: post #67

Earlier quoted context omitted.

> I agree that mandatory developer registration feels too heavy handed, but I think the community needs a better response to this problem than "nuh uh, everything's fine as it is." Why would the community give a different response? Everything is fine as it is. Life is not safe, nor can it be made safe without taking away freedom. That is a fundamental truth of the world. At some point you need to treat people as adul…

There is some world where somebody scammed through sideloading loses their life savings, and every country is politically fine with the customer, not the bank, taking the losses. But for regular people, that is not really the world they want. If the bank app wrongly shows they’re paying a legitimate payee, such as the bank, themselves or the tax authority, people politically want the bank to reimburse. Then the quest…

Keeeep going.

Are banks POWERFUL? Do they have lots of money and/or connections to those who do? Do they have a vested interest in getting transactions right?

Absolutely!

Now, with all that money and power -- they -- whoever THEY are, need to come up with smart ways to verify transactions that don't involve me giving them all the keys to all my devices.

We have protections like this elsewhere - even when they have some "ownership." The bank kinda owns my house, but they still can't come in whenever they want.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#218

Post by TheJoeMan »

asim wrote: post #178

I think we're about to see an explosion in "mini apps". It's taken 10+ years for us to catch up to WeChat and China but this regulation and other issues are going to block a lot of innovation and we're better off surfacing tiny PWA or SPA like apps that get loaded in native apps or we just do away with that entirely. The time has come.

Elon's vision for the X "everything" app. It's great for them, now every single thing you do has the full gamut of privacy permissions. Playing a "mini-game"? Full accurate GPS coordinates available to it because you also have the ride-hailing "mini-app".

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#219

Post by shaky-carrousel »

dfabulich wrote: post #3

The most controversial claim in this letter is in the section that "Existing Measures Are Sufficient." In Google's announcement in Nov 2025, they articulated a pretty clear attack vector. https://android-developers.googleblog.com/2025/11/android-de... > For example, a common attack we track in Southeast Asia illustrates this threat clearly. A scammer calls a victim claiming their bank account is compromised and uses…

That attack vector is just a symptom. It’s unfathomably foolish to use two-factor authentication via something as easy to intercept as SMS. Two-factor authentication should be done using a separate hardware token that generates time-based one-time codes. Anything else is basically security theater.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#220

Post by jrm4 »

RandomGerm4n wrote: post #128
Tharre wrote: post #48

Earlier quoted context omitted.

There simply isn't a known solution to this problem. If you give users the ability to install unverified apps, then bad actors can trick them into installing bad ones that steal their auth codes and whatnot. If you want to disallow certain apps then you have to make decisions about what apps (stores) are "blessed" and what criteria are used to make those distinctions, necessarily restricting what users can do with th…

The solution would be a "noob mode" that disables sideloading and other security-critical features, which can be chosen when the device is first turned on and requires a factory reset to deactivate. People who still choose expert mode even though they are beginners would then only have themselves to blame.

This should be voted higher, it quite literally is this simple.
Post reply on HN