Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android developer verification: Early access starts

android-developers.googleblog.com

Post reply on HN
Print view View original

481–490 of 694 posts

Re: Android developer verification: Early access starts

#481

Post by [deleted] »

Arnt wrote: post #460
sharperguy wrote: post #437

Earlier quoted context omitted.

What incentive is there for OEMs to not add this option though? Does Google refuse to veriy their firmware if they offer this feature?

The network permission was displayed in the first versions of Android, then removed. I heard ( hearsay alert ) at the time that it was because so many apps needed it, and they wanted to get rid of always-yes questions. IIRC this happened before the rise of in-app advertising. If people always answer yes, they grow tired and eventually don't notice the question. I've seen it happen with "do you want to overwrite the p…

[deleted]

Re: Android developer verification: Early access starts

#482

Post by wiseowise »

notepad0x90 wrote: post #145

This is the worst of both worlds, you can spread your malware as a sideloaded apk just fine, but when it's so big that you're probably burned anyways, then you need to verify your account. I think a better compromise would have been for google to require developer verification, but also allow third party appstores like f-droid that don't require verification but still are required to "sign" the apks, instead of users…

Why do I need a store to install something on my phone that I own?

Re: Android developer verification: Early access starts

#483

Post by klabb3 »

Zak wrote: post #111
klabb3 wrote: post #102

Earlier quoted context omitted.

> > intercepts the victim's notifications > And who controls these notifications and forces application developers to use a specific service? Am I alone in being alarmed by this? Are they admitting that their app sandboxing is so weak that a malicious app can exfil data from other unaffiliated apps? And they must instead rely on centralized control to disable those apps after the crime? So.. what’s the point of the s…

> Are they admitting that their app sandboxing is so weak that a malicious app can exfil data from other unaffiliated apps? An app can read the content of notifications if the appropriate permissions are granted, which includes 2FA codes sent by SMS or email. That those are bad ways to provide 2FA codes is its own issue. I want that permission to exist. I use KDE Connect to display notifications on my laptop, for exa…

Yes, but see my last paragraph. Reading notifications doesn’t apply to the majority of apps. It’s not a binary choice. On iOS, you need special entitlements for certain high level privileges. Isn’t it already the same on Android?

Re: Android developer verification: Early access starts

#484

Post by zoobab »

gowthamgts12 wrote: post #94

so still distributing with f-droid is messed up? i now have to pay a fee to develop an open-source app via f-droid to everyone? this is a misleading title. they only allow side-loading unverified apps only on fewer devices.

"this is a misleading title"

Marketing at work, I am not giving away my ID to publish an app on an alternative app store, like F-Droid.

Google is abusing their "gatekeeper" status, like Apple does.

Re: Android developer verification: Early access starts

#485

Post by exe34 »

Aachen wrote: post #416
exe34 wrote: post #379

Earlier quoted context omitted.

I've switched banks for less.

Until there are no banks left to switch to Maybe this sounds dark but see also how the net is tightening around phones that allow you to run open firmware after you've bought the hardware for the full and fair price. We're slowly being relegated to crappy hobbyist projects once the last major vendors decide on this as well, and I don't even understand what crime it is I'm being locked out for We're too small a group…

I think pretty soon I'll carry a "normal" phone in my bag for things like communication and banking/ticketing, but I'll carry a device I actually like in my pocket. It'll be the best of both worlds - content I want to see often and easily in my pocket, and the stuff I don't want to be distracted by will be harder to reach on a whim.

Re: Android developer verification: Early access starts

#486

Post by klabb3 »

Groxx wrote: post #144
klabb3 wrote: post #102

Earlier quoted context omitted.

> > intercepts the victim's notifications > And who controls these notifications and forces application developers to use a specific service? Am I alone in being alarmed by this? Are they admitting that their app sandboxing is so weak that a malicious app can exfil data from other unaffiliated apps? And they must instead rely on centralized control to disable those apps after the crime? So.. what’s the point of the s…

yes, they're admitting that their APIs are powerful enough to build accessibility tools (which often must read notifications) and many other useful things (e.g. Pushbullet) that are not possible on iOS. powerful stuff has room for abuse. I didn't really think there's much of a way to make that not the case. it's especially true for anything that you grant accessibility-level access to, and "you cannot build accessibi…

You may be overthinking it. Verification of some sort isn’t the end of the world, it’s arguably an acceptable damage control stop-gap that has precedent on other platforms like special entitlements on iOS and kernel extensions on Windows.

Googles proposal was to require everyone to verify to publish any app through any channel. That would be the equivalent of a web browser enforcing a whitelist of websites, because one scam site asked for access to something bad.

If scam apps use an API designed by Google to steal user data, then they should fix that, without throwing the baby out with the bathwater.

Re: Android developer verification: Early access starts

#487

Post by u8080 »

Arnt wrote: post #460
sharperguy wrote: post #437

Earlier quoted context omitted.

What incentive is there for OEMs to not add this option though? Does Google refuse to veriy their firmware if they offer this feature?

The network permission was displayed in the first versions of Android, then removed. I heard ( hearsay alert ) at the time that it was because so many apps needed it, and they wanted to get rid of always-yes questions. IIRC this happened before the rise of in-app advertising. If people always answer yes, they grow tired and eventually don't notice the question. I've seen it happen with "do you want to overwrite the p…

Could have been easily solved by granting it by default, but I doubt that was original intent.

Re: Android developer verification: Early access starts

#488

Post by crtasm »

qwertox wrote: post #461

I'm already annoyed by the fact that when I upgrade my own apps, self-developed and only used by me, which are installed either from Android Studio or by letting the app itself download the update from my server (with the app installation permission) and me then installing it, that I must send the app to Google for them to make a security check. It's not an option, even if they pretend it to be one: if I click the te…

Is ADB over wifi also a non-starter?

Re: Android developer verification: Early access starts

#490

Post by jlokier »

leoedin wrote: post #364
rom1v wrote: post #342

I want to be able to install apps from alternative app stores like F-Droid and receive automatic updates, without requiring Google's authorization for app publication. Manually installing an app via adb must, of course, be permitted. But that is not sufficient. > Keeping users safe on Android is our top priority. Google's mandatory verification is not about security, but about control (they want to forbid apps like R…

I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. How does Google know if someone has sold off their app? In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected.

> In most cases, F-Droid couldn't know either.

F-Droid is quite restrictive about what kinds of app they accept, they build the app from source code themselves, and the source code must be published under a FLOSS license. They have some checks that have to pass for each new version of an app.

Although it's possible for a developer to transfer their accounts and private keys to someone shady, F-Droid's checks and open source requirements limit the damage the new developer can do.

https://f-droid.org/docs/Inclusion_Policy/

https://f-droid.org/docs/Anti-Features/

Post reply on HN