Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android Developer Verification: Threat masquerading as protection

f-droid.org

Post reply on HN
Print view View original

441–450 of 793 posts

Re: Android Developer Verification: Threat masquerading as protection

#441

Post by birdsongs »

duskdozer wrote: post #318
birdsongs wrote: post #255

Earlier quoted context omitted.

But I can't use my Norwegian BankID unless I have an apple store or play store account. This is required for every aspect of society. Heathcare, banking, taxes, driving, using my debit card online. They removed SMS 2FA options recently, the only non-tech monopoly method is a 2fa codebrick that's getting harder and harder to acquire (there are new ridiculous facial ID and passport scanning requirements, run by a priva…

That's much worse than I expected. Is it a hard play store requirement or can you install the apk? Are there really no other workarounds?

It truly is. We are a completely digital society and everything is authenticated with BankID. The name is a misnomer, it's not just banking but every single government service (including healthcare).

I might be wrong but as far as I'm aware there's no legitimate APK downloads. And even if you get a hold of it, they use google services to attest the phone is secure, so there's no running it on a google-less OS.

The workaround used to be SMS codes, scratch off cards, and a physical 2FA codebrick. They cancelled SMS and the card, and currently you can't acquire a codebrick until they figure out some new bullshit about ID verification. Even the app is warning us it will quit functioning if we don't submit a passport and biometric face scan to some private company: https://bankid.no/en/help/confirm-identity

It's fucking dire.

Re: Android Developer Verification: Threat masquerading as protection

#442

Post by birdsongs »

artisinal wrote: post #345
birdsongs wrote: post #255

Earlier quoted context omitted.

But I can't use my Norwegian BankID unless I have an apple store or play store account. This is required for every aspect of society. Heathcare, banking, taxes, driving, using my debit card online. They removed SMS 2FA options recently, the only non-tech monopoly method is a 2fa codebrick that's getting harder and harder to acquire (there are new ridiculous facial ID and passport scanning requirements, run by a priva…

What Norway has sounds pretty crazy to me. If I am reading this correctly, Trump can disable the entire Norwegian healthcare system by calling Apple and Google and having them block BankID.

Yes, he can. Along with taxes, car registrations, banking, money transfers, rent payments, etc.

I really hope we figure something out.

Re: Android Developer Verification: Threat masquerading as protection

#443

Post by notpushkin »

TZubiri wrote: post #414

>Should a developer — contrary to our recommendation — elect to register themself with Google as a “verified” developer, they should expect to sign up for an account and pay a fee, surrender detailed personal information and upload government-issued identification Again, there is a tradeoff between protecting consumers and protecting vendors. If you protect the privacy of vendors, you do so at the expense of increasi…

> If you want to make software and distribute it anonymously, go ahead and submit it to one of the many malware riddled distributors that don't do any due diligence

Like F-Droid, one of the most famous malware dens in the Android ecosystem.

Re: Android Developer Verification: Threat masquerading as protection

#444

Post by teddyh »

dachris wrote: post #200
devsda wrote: post #185

Earlier quoted context omitted.

What happens if you "accidentally" become persona non grata with both Google and Apple? If you want to participate in the society, you will forever have to resort to shady tactics. Shady can be defined something as arbitrary as using GrapheneOS. A temporary workaround like using alternatives like GrapheneOS for those affected will only delay the inevitable but it doesn't stop it at all.

If you've accidentally become a persona non grata, then obviously because you've not exercised sufficient self-censorship. This is real already. Recently saw a petition for EU to rein in big tech (there are several initiatives advocating this). Had this nagging voice at the back of my head ... what if signing that gets your Google Account terminated. I'll leave it open to you whether I signed it. For developers relyi…

This has been true for many years: https://news.ycombinator.com/item?id=26876681>

Re: Android Developer Verification: Threat masquerading as protection

#445

Post by noisy_boy »

austinthetaco wrote: post #435
avaer wrote: post #108

Earlier quoted context omitted.

The blast radius is far worse than any "malware" Google could protect you from. TFA is playing it up, but it is arguable that this is a real virus, except the shady hackers are Google.

Was this comment made by an LLM? i dont know anyone who drops "blast radius" in casual conversation besides claude.

People in security space use it all the time.

Re: Android Developer Verification: Threat masquerading as protection

#446

Post by empyrrhicist »

Limit5332 wrote: post #425
devsda wrote: post #185

Earlier quoted context omitted.

What happens if you "accidentally" become persona non grata with both Google and Apple? If you want to participate in the society, you will forever have to resort to shady tactics. Shady can be defined something as arbitrary as using GrapheneOS. A temporary workaround like using alternatives like GrapheneOS for those affected will only delay the inevitable but it doesn't stop it at all.

GrapheneOS is not shady at all, since when is wanting to use an actually secure OS that doesn't sell your data to palantir or some other ACTUALLY shady shit like that shady?

That was their point.

Re: Android Developer Verification: Threat masquerading as protection

#447

Post by noisy_boy »

daakni wrote: post #285
matheusmoreira wrote: post #209

Earlier quoted context omitted.

> And you’ll never reach a human to sort it out. Unless you blog about it angrily enough that you somehow make it to the HN front page and some insider sees it and solves the problem for you. Getting my own domain and setting up email on it is one of the best things I've ever done.

About to go down that route as well, just need to find a email provider with ideally servers in the EU

Fastmail has been working well for me.

Re: Android Developer Verification: Threat masquerading as protection

#448

Post by NDlurker »

devsda wrote: post #380
dachris wrote: post #200

Earlier quoted context omitted.

If you've accidentally become a persona non grata, then obviously because you've not exercised sufficient self-censorship. This is real already. Recently saw a petition for EU to rein in big tech (there are several initiatives advocating this). Had this nagging voice at the back of my head ... what if signing that gets your Google Account terminated. I'll leave it open to you whether I signed it. For developers relyi…

It doesn't even have to be censorship of speech. If you are wrongly charged a significant amount by either Google or Apple and their service is of no help, what would you do? Most people would weigh the options, then just eat the cost than anger them with a chargeback and lose their email/phone access. That's self-censorship financially too. What if Google reinstates their old G+ and YouTube real name policy for its…

I was in that situation a few years ago. I started a hemp related business in 2019 and Ad Sense didn't like my ads and gave me an error message saying I couldn't run my ads because of certain keywords being banned. I forgot about it until a couple of years later when I saw a $300 charge on my credit card bill. Google changed their policy as CBD/hemp had become more mainstream and started running my ads. By this time my business had already failed so I did not want those ads running. I couldn't figure out how to contact a human, so I ended up just paying because I didn't want to risk getting my account closed.

Re: Android Developer Verification: Threat masquerading as protection

#449

Post by somehnguy »

transcriptase wrote: post #25

I think the most fun part with Google is that if some wayward algorithm decides it doesn’t like you, along with nuking your app and developer account it will probably nuke your 20 year old gmail, your kids Google Drive accounts, your wife’s YouTube premium, the Adsense account of some company you worked for in 2008, and disable your Nest cameras. And you’ll never reach a human to sort it out.

This is why I don't mess with any of Google's AI offerings right now. Losing access to my Gmail (technically a google apps for our domain) account would be devastating. I think the risk that some google ai decides I'm abusing their ai and bans me is too high.
Post reply on HN