Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google details new 24-hour process to sideload unverified Android apps

arstechnica.com

Post reply on HN
Print view View original

481–490 of 1001 posts

Re: Google details new 24-hour process to sideload unverified Android apps

#481

Post by silver_sun »

Evidlo wrote: post #141
silver_sun wrote: post #34

It's a little inconvenient for someone setting up a new phone to have to wait a full day to install unregistered apps. But while I can't speak for others, it's a price I'm personally willing to pay to make the types of scams they mention much less effective. The perfect is the enemy of the good.

How would you feel about needing to wait 24 hours to visit an "unapproved" website on your phone? You would pay Google/Apple $25 to get whitelisted so people can browse to your personal website without getting a scary security message. This is the same thing since it applies to all apps, not just apps that need special permissions.

I don't think it's fair to extend the analogy to what amounts to censorship of websites since that's not the system they're proposing. Also isn't the owner of a website already identifying themselves when they register their domain name and/or rent a server? I think this is not the same as downloading an app by an unknown developer.

From the article I understood this to be a one-time delay, as opposed to having to go through the same waiting process for every single "unlicensed" app I want to install (which I would not accept). I'm just waiting 24 hours once to permanently change my device into a mode where I can install any app I like without any restrictions/delays whatsoever.

Re: Google details new 24-hour process to sideload unverified Android apps

#482

Post by brewdad »

pmontra wrote: post #350
frays wrote: post #32

Earlier quoted context omitted.

You don't use the HSBC or Citibank app then I assume?

They don't operate in my county AFAIK. However that reinforces my idea that the endgame will be a pristine Android phone in a drawer at home with the banking apps required for accessing their sites with 2FA and another phone in my pocket for daily use.

I’m not sure that Google/Android selling everyone two phones instead of one is the deterrent to this behavior that you envision.

Re: Google details new 24-hour process to sideload unverified Android apps

#484

Post by astra1701 »

MishaalRahman wrote: post #40
astra1701 wrote: post #14

This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? - One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably no…

>- Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? Hi, I'm the community engagement manager @ Android. It's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you tur…

Thank you so much for clarifying! That is most definitely not as bad as I had feared.

I still feel, though, that having to go ahead and proclaim “I am a developer!” just to enable sideloading is a bit much, as almost certainly the vast majority of sideloaders aren’t developers. Nonetheless, it does keep sideloading as an option, and I do see why, from Google’s perspective, using the already-existing developer mode to gate the feature would be convenient in the short term. Perhaps the announcement should specify this -- I suspect a number of people who read it also noticed the lack of that clarification.

And yes, good point on ADB. That does make this less inconvenient for developers or power users, though doesn’t help non-developers very much.

Re: Google details new 24-hour process to sideload unverified Android apps

#485

Post by aniviacat »

> In addition to the advanced flow we’re building free, limited distribution accounts for students and hobbyists. This allows you to share apps with a small group (up to 20 devices) without needing to provide a government-issued ID or pay a registration fee.

What stops scammers from simply creating a new hobbyist account for every 20 people they scam?

Re: Google details new 24-hour process to sideload unverified Android apps

#486

Post by dataflow »

anonym29 wrote: post #460
dataflow wrote: post #423

Earlier quoted context omitted.

Not the parent or agreeing/disagreeing with them, but to your question: if you get creative, there are a lot of things you could do, some more unorthodox than others. Tongue-in-cheek example, just to get the point across: instead of calling it Developer Mode, call it "Scam mode (dangerous)". Require pressing a button that says "Someone might be scamming me right now." Then require the user to type (not paste) in a lo…

The people falling for social engineering now won't be protected by this either. You could gate the functionality behind verification of an anti-scam awareness and education training and certification course, scammers would coach people through the entire course and the verification step, and people would still be victimized.

Nothing is perfect, but by what percentage would you think scams that leverage sideloading would drop? 1%? 10%? 50%? 90%? 99%?

Re: Google details new 24-hour process to sideload unverified Android apps

#487

Post by ninininino »

Zak wrote: post #414
ninininino wrote: post #74

Earlier quoted context omitted.

Because estimates suggest Americans lose about $119 billion annually to financial scams, which is a not insignificant fraction of our entire military budget, or more than 5% of annual social security expenditures.

What do scams have to do with having developer options enabled? This isn't a rhetorical question. There's no big red warning on the developer options screen saying it's dangerous. I haven't heard about real-world attacks leveraging developer settings. I suppose granting USB debug to an infected PC is dangerous, but if you're in that situation, you're already pwned. Is there a real vulnerability nobody talks about?

Android is attempting to discourage good / regular users from sideloading apps, rooting their phone, etc.

Android wants good / regular users to pass things like Play Integrity with the strongest verdicts.

This helps app distributors to separate regular good users from custom clients, API scripting etc that is often used to coordinate scamming, create bots, etc. If an app developer can just toss anyone who doesn't pass Play Integrity checks in the trash, they can increase friction for malicious developers.

Re: Google details new 24-hour process to sideload unverified Android apps

#488

Post by thin_carapace »

basilikum wrote: post #333

A lot of people here are looking for compromises. Any compromise on this means giving ground to Google's monopoly and the war on open computing and ultimately freedom. This is exactly what Google intended. This is why they started off by announcing completely removing device owner chosen installs (this is not side loading! It's simply installing.) and announced only apps allowed by Google would be available for insta…

im just as much of a hater of this as the next guy, because i depend on custom apks for work sometimes. pushing custom apks over adb is apparently going to be fine, so if that holds true, i dont care about this. at the end of the day, buying an android phone is buying a google device. i dont get the righteousness here. wouldnt this energy be better spent on discussing how we could make a new open source os to rival that of google? why would anyone at google (company at the forefront of anti privacy measures) care about what some nerds on the internet think about privacy? its like an ant screaming in front of an approaching bulldozer.

Re: Google details new 24-hour process to sideload unverified Android apps

#489

Post by tavavex »

scoofy wrote: post #411
skeaker wrote: post #397

Earlier quoted context omitted.

[flagged]

It's very obviously not irrelevant . Google is not going to let their main phone app product become associated with Grandma losing her savings! That's not going to help the free software folks... it's going to send everyone over to iOS.

> Google is not going to let their main phone app product become associated with Grandma losing her savings!

How did they manage to survive as the grandma-account-draining brand for over 15 years, though? They're still the market leader.

One of the best arguing tactics the pro-control side has come up with is "The way it works right now is JUST not good enough". And then you don't need to argue any further or substantiate that. You just force your opponent into coming up with new measures because obviously right now we have an emergency that must be dealt with immediately. So far, this reasoning has worked for program install restrictions, de-anonymizing internet users, all sorts of other random attestation and verification measures, and it will be used for so much more.

My question to all that is - what has happened NOW that changed the situation from how it was just a couple years back?. Google hasn't been sitting idle for all these years, they've been adding measures to Android to detect malicious software and prevent app installs by clueless users - measures that were striking a balance between safety and freedom. Why is everything safety-related in the last few years suddenly an emergency that must be rectified by our corporate overlords immediately and in the most radical ways? How did we even survive the 2010s if people are less secure and more prone to being scammed with the new restrictions right now than they were back then?

I'm not saying there's not an issue, but without hard stats, these issues will always be magnified by companies as much as possible as the wedge to put in measures that benefit them in ways other than the good-natured safeguarding of the consumer. In an open society, there's always a point where you balance the ability to act freely with ensuring that the worst actors can't prosper in the environment. Only one of these things is bad, but you can't have both. You need a middle ground.

Re: Google details new 24-hour process to sideload unverified Android apps

#490

Post by NotPractical »

GeekyBear wrote: post #281
grishka wrote: post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

> People who are unwilling to figure out the risks just should not use smartphones and the internet People who aren't technically sophisticated should choose the smartphone ecosystem that was designed to offer the safety of a walled garden from the start. Google sold Android as the ecosystem that gave users the freedom to do anything they like, including shooting themselves in the foot. Google should not be allowed t…

Choosing an iPhone is not sufficient to avoid the risks of technology. The majority of online scams require nothing more than two pre-installed apps: Safari and Phone.
Post reply on HN