Android developer verification: Early access starts • Hacker News Board

Re: Android developer verification: Early access starts

#521

Post by Sophira » Thu, Nov 13, 2025, 2:22 PM UTC

jlokier wrote: post #490

leoedin wrote: post #364

Earlier quoted context omitted.

I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. How does Google know if someone has sold off their app? In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected.

> In most cases, F-Droid couldn't know either. F-Droid is quite restrictive about what kinds of app they accept, they build the app from source code themselves, and the source code must be published under a FLOSS license. They have some checks that have to pass for each new version of an app. Although it's possible for a developer to transfer their accounts and private keys to someone shady, F-Droid's checks and open…

One thing worth noting, these checks and restrictions only apply if you're using the original F-Droid repository.

Many times I've seen the IzzyOnDroid repository recommended, but that repo explicitly gives you the APKs from the original developers, so you don't get these benefits.

Re: Android developer verification: Early access starts

#522

Post by Groxx » Thu, Nov 13, 2025, 2:25 PM UTC

klabb3 wrote: post #486

Groxx wrote: post #144

Earlier quoted context omitted.

yes, they're admitting that their APIs are powerful enough to build accessibility tools (which often must read notifications) and many other useful things (e.g. Pushbullet) that are not possible on iOS. powerful stuff has room for abuse. I didn't really think there's much of a way to make that not the case. it's especially true for anything that you grant accessibility-level access to, and "you cannot build accessibi…

You may be overthinking it. Verification of some sort isn’t the end of the world, it’s arguably an acceptable damage control stop-gap that has precedent on other platforms like special entitlements on iOS and kernel extensions on Windows. Googles proposal was to require everyone to verify to publish any app through any channel. That would be the equivalent of a web browser enforcing a whitelist of websites, because o…

might have meant to reply to someone else? I haven't said anything about verification here

Re: Android developer verification: Early access starts

#523

Post by rpdillon » Thu, Nov 13, 2025, 2:25 PM UTC

So an interesting intellectual exercise is to try to figure out how you would create a power user toggle that is coercion resistant. The best I've been able to come up with is a timed lockout that is random in how long it takes to allow you to finally move into power user mode. So like a random value between 1 hour and 24 hours and you say I want to be a power user and then it says you have to wait 3 hours and 27 minutes before you can become a power user. Randomness because a scammer could optimize around a particular time period that was predictable.

Other thoughts on how you could make a coercion resistant power user toggle? I'm very excited that Google's thinking about offering this because it gives me faith that just because I chose to be in a minority, I won't be relegated.

On the flip side, I was so shaken by the original announcement that would kill off F-Droid that I've been very actively looking into building my own mobile device that runs Linux. I purchased the components for a Hackberry Pi that I'm hoping to build in the next couple of months, but knowing that Android won't kill off F-Droid entirely is heartening.

Re: Android developer verification: Early access starts

#524

Post by Groxx » Thu, Nov 13, 2025, 2:27 PM UTC

realusername wrote: post #269

klabb3 wrote: post #102

Earlier quoted context omitted.

> > intercepts the victim's notifications > And who controls these notifications and forces application developers to use a specific service? Am I alone in being alarmed by this? Are they admitting that their app sandboxing is so weak that a malicious app can exfil data from other unaffiliated apps? And they must instead rely on centralized control to disable those apps after the crime? So.. what’s the point of the s…

> Are they admitting that their app sandboxing is so weak that a malicious app can exfil data from other unaffiliated apps? It's not news, both iOS and Android sandboxing are Swiss cheese compared to a browser. People should only install apps from trusted publishers (and not everything from the store is trusted as the store just gors very basic checks)

browsers are really not much better. on an absolute level, I definitely agree they're better (e.g. they have per-url and only-after-click permissions for some things), but they've all got huge gaps still once you start touching extensions. and beyond that it remains to be seen, since OS-level permissions are significantly broader-possibility than in-browser due to being able to touch far more sensitive data.

Re: Android developer verification: Early access starts

#525

Post by tomhow » Thu, Nov 13, 2025, 2:30 PM UTC

arnaudsm wrote: post #423

poulpy123 wrote: post #410

I don't understand the title, it's exactly the reverse, they will force verification for sideloading, even if they say they would have lighter requirements for hobby apps with low install number

@dang this post title was editorialized against the rules, and is highly misleading. Should we revert it ?

Reverted now, thanks!

Re: Android developer verification: Early access starts

#526

Post by Zak » Thu, Nov 13, 2025, 2:31 PM UTC

klabb3 wrote: post #483

Zak wrote: post #111

Earlier quoted context omitted.

> Are they admitting that their app sandboxing is so weak that a malicious app can exfil data from other unaffiliated apps? An app can read the content of notifications if the appropriate permissions are granted, which includes 2FA codes sent by SMS or email. That those are bad ways to provide 2FA codes is its own issue. I want that permission to exist. I use KDE Connect to display notifications on my laptop, for exa…

Yes, but see my last paragraph. Reading notifications doesn’t apply to the majority of apps. It’s not a binary choice. On iOS, you need special entitlements for certain high level privileges. Isn’t it already the same on Android?

It's similar. I think there's a difference in that special entitlements have to be approved by Apple. Read/manage notifications is under "special app access", which has a different prompt where the user has to pick the app from a list and flip a toggle to grant the permission rather than just tapping OK.

Re: Android developer verification: Early access starts

#527

Post by ori_b » Thu, Nov 13, 2025, 2:35 PM UTC

nandomrumber wrote: post #407

KurSix wrote: post #367

Earlier quoted context omitted.

I'm not sure it's entirely fair to say this is just Google flexing control

Last year Australians reported losing AU$20 million to phishing attacks, and AU$318 million to scams of all types. It stands to reason that financial service industry peak bodies are in conversation with governments and digital service providers, including data providers, to try to better protect users. There are obvious conflicting goals, and the banks / governments can’t really appear to be doing nothing. And techn…

Does that mean that the Google and the government are taking full legal liability for protecting me from scams?

Re: Android developer verification: Early access starts

#528

Post by prmoustache » Thu, Nov 13, 2025, 2:37 PM UTC

nandomrumber wrote: post #412

reddalo wrote: post #359

Earlier quoted context omitted.

Installing apps from sources that are not the Play Store requires a bit of technical knowledge anyway. My grandma is not going to download a random APK and give all the necessary permissions to install it and run it.

It’s been a few months since I used an Android device. What was the process? Enable developer mode and grant ’can install apps’ to a browser or file browser? Am I remembering this correctly? The only other step is to download a file from the internet, or otherwise receive one. That’s not a technical-knowledge step though

no, that is not done via developer mode. When You download or try to open an apk from any app, it asks you if you want to allow it to install apps and send you to the configuration dialog. You still have to validate the app installation manually tbrough another dialog. In that case I usually leave the config dialog open while the app is installed, then disable the app permission right after install because that option is usually not easy to find. I usually only do it once on a new smartphone to install f-droid from a browser then allow f-droid and aurora store permanently.

I think that is the part that should be fixed, users should be able to allow a one time exception to avoid letting that permission activated by mistake. I don't need to allow permanently a web browser to install apps.

Re: Android developer verification: Early access starts

#529

Post by maxloh » Thu, Nov 13, 2025, 2:38 PM UTC

rpdillon wrote: post #523

So an interesting intellectual exercise is to try to figure out how you would create a power user toggle that is coercion resistant. The best I've been able to come up with is a timed lockout that is random in how long it takes to allow you to finally move into power user mode. So like a random value between 1 hour and 24 hours and you say I want to be a power user and then it says you have to wait 3 hours and 27 min…

That could be done by requiring the use of ADB. Normal users would found it troublesome to setup a phone through command line.

To make it even harder, they could also require a verification code from your phone manufacturer, or the package of your device, which makes it impossible to automate the switch into power-user mode.

Re: Android developer verification: Early access starts

#530

Post by rollcat » Thu, Nov 13, 2025, 2:38 PM UTC

nirui wrote: post #499

Excuse me, what exactly is "sideloading"? If I wanted to run third-party code on a system through the means that's supported by the system, then it should be called "running", it's a part of normal operation. The word "sideload" made it sound like you're smuggle something you shouldn't onto the system. Subtle word tricks like this could sneak poisons into your mind, be watchful.

You can't make people just stop using a word. The best course of action is to reclaim it. Look at us, we're posting on Hacker News. With a sideloaded browser.