Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android developer verification: Early access starts

android-developers.googleblog.com

Post reply on HN
Print view View original

431–440 of 694 posts

Re: Android developer verification: Early access starts

#431

Post by 0xDEAFBEAD »

thw_9a83c wrote: post #386
xzjis wrote: post #330

Earlier quoted context omitted.

Why can't they just put up a big, red warning: "Never enable software installation if someone asks you to (over the phone or via message). If you're unsure, check out this article on scams."?

> "Never enable software installation if someone asks you..." Imagine a situation in which a frightened, stressed user sees such a message on their screen. Meanwhile, a very convincing fake police officer or bank representative is telling them over the phone that they must ignore this message due to specific dangerous emergency situation to save the money in their bank account. Would the user realize at that moment t…

What if there is a 12-hour delay to unlock "power user mode", and during that entire 12-hour unlock period, the phone keeps displaying various scam education information to help even an unsophisticated user figure out what's going on? Surely Google can devote a few full-time employees to keeping such educational materials up to date, so they ideally contain detailed descriptions of the most common scams a user is going to be subject to at any given time.

Re: Android developer verification: Early access starts

#432

Post by maybewhenthesun »

leoedin wrote: post #364
rom1v wrote: post #342

I want to be able to install apps from alternative app stores like F-Droid and receive automatic updates, without requiring Google's authorization for app publication. Manually installing an app via adb must, of course, be permitted. But that is not sufficient. > Keeping users safe on Android is our top priority. Google's mandatory verification is not about security, but about control (they want to forbid apps like R…

I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. How does Google know if someone has sold off their app? In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected.

That's true in theory. But as you can see in practice is that google does very little to protect their users, while F-Droid at least tries.

Which shows that the whole 'security' rigmarole by google is bullshit.

Re: Android developer verification: Early access starts

#433

Post by OrangeMusic »

fauigerzigerk wrote: post #419
lopis wrote: post #391

Earlier quoted context omitted.

If an app updates to require new permissions, or to suddenly require network access, or the owner contact details change, Google Play should ideally stop that during the update review process and let the users know. But that wouldn't be good for business.

>...or to suddenly require network access... That's the most baffling thing to me. There is simply no option to remove network permissions from any app on my Pixel phone. It's one of the reasons why I avoid using mobile apps whenever I can.

Google wants 0 friction for apps to display ads.

Re: Android developer verification: Early access starts

#434

Post by kragen »

gpm wrote: post #239
kragen wrote: post #159

Earlier quoted context omitted.

What would they have to offer Google in return for being granted this status? Would they have to ban NewPipe, for example?

Up to what a committee of 3 people (or in the alternate district court judge James Donato) believes this means, assuming the judge approves the proposed modification to the injunction in the first place > Google may create reasonable requirements for certification as a Registered App Store, including but not limited to review of the app store by Google’s Android team and the payment of reasonable fees to cover the op…

That sounds reasonable, but I doubt F-Droid can cough up the required US$1 million to pay 12 Google L7 SWEs to spend a month reviewing F-Droid once they get enough free time. I wonder if they'd require F-Droid to comply with PCI-DSS? That seems to be the trendy thing in review and certification processes, and naturally it's important for an "App Store" to have secure payments, isn't it? (Never mind that F-Droid doesn't accept payment except donations via liberapay.)

Re: Android developer verification: Early access starts

#435

Post by sharperguy »

GuB-42 wrote: post #428
leoedin wrote: post #364

Earlier quoted context omitted.

I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. How does Google know if someone has sold off their app? In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected.

The point here is that app developers have to identify themselves. Google has no intention to verify the content of sideloaded apps, just that it is signed by a real person, for accountability. They don't know if the person who signed the app is the developer, but should the app happen to be a scam and there is a police investigation, that is the person who will have to answer questions, like "who did you transfer th…

APKs are already signed. Now Google requries that they be signed by a key which is verified by their own signatures. Which means they can selectively refused to verify whichever keys are inconvenient to them.

Re: Android developer verification: Early access starts

#436

Post by fauigerzigerk »

OrangeMusic wrote: post #433
fauigerzigerk wrote: post #419

Earlier quoted context omitted.

>...or to suddenly require network access... That's the most baffling thing to me. There is simply no option to remove network permissions from any app on my Pixel phone. It's one of the reasons why I avoid using mobile apps whenever I can.

Google wants 0 friction for apps to display ads.

So does Apple apparently.

Re: Android developer verification: Early access starts

#437

Post by sharperguy »

OrangeMusic wrote: post #433
fauigerzigerk wrote: post #419

Earlier quoted context omitted.

>...or to suddenly require network access... That's the most baffling thing to me. There is simply no option to remove network permissions from any app on my Pixel phone. It's one of the reasons why I avoid using mobile apps whenever I can.

Google wants 0 friction for apps to display ads.

What incentive is there for OEMs to not add this option though? Does Google refuse to veriy their firmware if they offer this feature?

Re: Android developer verification: Early access starts

#438

Post by rcMgD2BwE72F »

yellow_lead wrote: post #420
poulpy123 wrote: post #410

I don't understand the title, it's exactly the reverse, they will force verification for sideloading, even if they say they would have lighter requirements for hobby apps with low install number

> Based on this feedback and our ongoing conversations with the community, we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified.

aka "Trust us bros"

Re: Android developer verification: Early access starts

#439

Post by sharperguy »

svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

Considering phone scammers often convince their victims to:

- install remote desktop software

- run commands in the windows terminal

- withdraw cash from the bank

- lie to the bank teller about their purpose

- insert their cash into a bitcoin ATM at a gas station

- ignore warnings about scams which appear on the screen of the ATM

- insert the scammers bitcoin address into the machine

It isn't a stretch to imagine they could convince the victim to install adb and sideload an app.

Post reply on HN