Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Google on Mandatory Developer Registration for App Distribution

keepandroidopen.org

Post reply on HN
Print view View original

271–280 of 392 posts

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#271

Post by miloignis »

dfabulich wrote: post #3

The most controversial claim in this letter is in the section that "Existing Measures Are Sufficient." In Google's announcement in Nov 2025, they articulated a pretty clear attack vector. https://android-developers.googleblog.com/2025/11/android-de... > For example, a common attack we track in Southeast Asia illustrates this threat clearly. A scammer calls a victim claiming their bank account is compromised and uses…

I have a radical solution - it should not be possible to contact someone unsolicited.

All phone calls, SMS, emails, and instant messages should be blocked unless the other party is in my contacts or I have reached out to them first (plus opt-in contact from contacts of contacts, etc). Ideally, cryptographically verified.

I would argue this is the real solution to spam and scamming - why on earth are random people allowed to contact me without my consent? Phone numbers or email addresses being all you need to contact me should be an artifact of an earlier time, just like treating social security numbers as secret.

I realize this isn't super practical to transition existing systems to (though spam warnings on email and calls helps, I suppose, and maybe it could be made opt-in). I dearly hope the next major form of communication works this way, and we eventually leave behind the old methods.

Also, SMS shouldn't be used for 2FA anyway.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#272

Post by atlgator »

"Don't be evil" → "Don't be evil without registering first and uploading your government ID."

The most telling detail is the sequencing. Google spent years in court arguing Android is open to fend off antitrust regulators, won key battles on that basis, and is now quietly closing the door they swore under oath was permanently propped open. The antitrust defense was the product roadmap's cover story. And framing this as security is particularly rich from the company whose own Play Store routinely hosts malware that passes their review. The problem they're solving isn't "unverified developers distribute harmful apps" — it's "unverified developers distribute apps we can't monetize or control."

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#273

Post by TeMPOraL »

danpalmer wrote: post #261
bigstrat2003 wrote: post #67

Earlier quoted context omitted.

> I agree that mandatory developer registration feels too heavy handed, but I think the community needs a better response to this problem than "nuh uh, everything's fine as it is." Why would the community give a different response? Everything is fine as it is. Life is not safe, nor can it be made safe without taking away freedom. That is a fundamental truth of the world. At some point you need to treat people as adul…

Cars worked fine without seatbelts too. Just because the world goes on doesn't mean we can't do better. Taking a step back though, I suspect there are cultural differences in approach here. Growing up in Europe, the idea of a regulation to make everyone safer is perfectly acceptable to me, whereas I get the impression that many folks who grew up in the US would feel differently. That's fine! But we also have to recog…

OTOH the controlling way modern software behaves is an US artifact, so the differences are not necessarily clear-cut like this.

I grew up and live in Europe. I support the general idea of "regulation to make everyone safer" being an acceptable choice. At the same time, I vehemently oppose third-party interests reaching into my computing device and dictating what I can vs. cannot do with it.

But as you say, "global platforms with global impact and reach" - and so I can't set up my phone to conditionally read out text and voice messages aloud, because somewhere on the other side of the world, someone might get scammed into installing malware, therefore let's lock everything down and add remote attestation on top.

Unfortunately, the problem is political, not technological, and this here is but one facet of it. Ultimately, what SaaS does is give away all leverage: as users, it doesn't matter if we fully own the endpoints, or have a user-friendly vendor: any SaaS can ultimately decide not to serve a client that doesn't give the service a user-proof beachhead.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#274

Post by jhasse »

UncleMeat wrote: post #149
Retr0id wrote: post #78

Earlier quoted context omitted.

> the malware captures their two-factor authentication codes Aren't we supposed to have sandboxing to prevent this kind of thing? If the malware relies on exploiting n-days on unpatched OSes, they could bypass the sideloading restrictions too.

Codes arrive via SMS, which is available to all apps with the READ_SMS permission. This isn't an OS vuln. It is a property of the fact that SMS messages are delivered to a phone number and not an app. On the Play store there is a bunch of annoying checking for apps that request READ_SMS to prevent this very thing. Off Play such defense is impossible.

Only require Developer Registration for apps with READ_SMS then.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#275

Post by scoofy »

nickorlow wrote: post #71
criddell wrote: post #54

Earlier quoted context omitted.

> The problem with mandatory developer registration, is that it gives Google and Governments the ability to veto apps. Don't they already have that power?

You can download any APK you like on the internet and run it without google/gov getting in the way

Yes, but the already have the power to ban apps if they wanted to. They just don't. That's the point.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#276

Post by TeMPOraL »

progbits wrote: post #265
scoofy wrote: post #256

Earlier quoted context omitted.

The point is "a warning" is not enough to communicate to people the gravity of what they are doing. It is not enough to write "be careful" on a bag you get from a pharmacy... certain medications require you to both have a prescription, and also to have a conversation with a pharmacist because of how dangerous the decisions the consumer makes can be. Normal human beings can be very dumb. It's entirely reasonable to ex…

OK so make the warning more annoying. Have a security quiz. Cooldown period of one day to enable. Require unlock via adb connected to laptop. There are alternative solutions if the true goal is maintaining user freedom while protecting dumb users. But that is not the true goal of the upcoming changes.

> Require unlock via adb connected to laptop.

Fine, just:

- Don't reset it every 5 days / 5 hours / 5dBm blip in Wi-Fi strength, because this pretty much defeats end-user automation, whether persistent or event-driven. This is the current situation with "Wireless Debugging", otherwise cool trick for "rootless root", if it only didn't require being connected to Wi-Fi (and not just a Wi-Fi, but the same AP, breaking when device roams in multi-AP networks).

- Don't announce the fact that this is on to everyone. Many commercial vendors, including those who shouldn't and those who have no business caring, are very interested in knowing whether your device is running with debugging features enabled, and if so, deny service.

Unfortunately, in a SaaS world it's the service providers that have all the leverage - if they don't like your device, they can always refuse service. Increasingly many do.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#277

Post by 201984 »

mormegil wrote: post #224
hbn wrote: post #154

Earlier quoted context omitted.

You can add 5 layers of "are you sure you want to do this unsafe thing" and it just adds 5 easy steps to the scam where they say "agree to the annoying popup"

You could even make this an installation-time option. If you want to enable the switch afterwards, you have to do a factory reset. Then, the attackers convincing the victims would get nothing.

And now if I want to send a .apk to someone, they have to wipe their entire phone to install it? No thanks.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#278

Post by TeMPOraL »

pmontra wrote: post #266
mormegil wrote: post #224

Earlier quoted context omitted.

You could even make this an installation-time option. If you want to enable the switch afterwards, you have to do a factory reset. Then, the attackers convincing the victims would get nothing.

Or make sideloading available only after 24 hours since enabling it. I would enable it on my new devices and wait 24 hours before installing F-Droid and other apps. Not a problem. Scammers might wait one day too but it decreases the chances of success because friends and family members can interfere. But I'm afraid that this is security theater and the true goal is to protect revenues by making it hard or impossible…

> But I'm afraid that this is security theater and the true goal is to protect revenues by making it hard or impossible to install apps that impact Alfabet bottom line (eg third party YouTube clients.)

It's not just them. Every other SaaS, from banks to media providers to E2EE[0] chat clients to random apps whose makers feel insecure, or are obsessed with security [theater] best practices, just salivate at the thought of being able to check if you're a deviant running with root or debugging privileges, all because ${complex web of excuses that often sound plausible if you don't look too closely}. There's a huge demand for device attestation, remote or otherwise.

--

[0] - End-to-end Enshittified.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#279

Post by thefounder »

RobotToaster wrote: post #105
thefounder wrote: post #31

Earlier quoted context omitted.

the main issue is the bank using sms and OTP apps instead of something like passkeys and mandatory in bank setup.

One of my banks uses a card reader and pin to log in, seems more secure.

That’s just as bad. You need to take out the human error out of the equation.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#280

Post by jhasse »

jamesnorden wrote: post #125
drnick1 wrote: post #8

Isn't the obvious solution to use an AOSP fork that does not have to comply with the registration requirements? Distributions like Graphene and Lineage are completely unaffected.

No bank in my country has an app that works with those, so it's not an option for me anymore.

Have yoz really checked for GrapheneOS? Which country?
Post reply on HN