Live data from Hacker News

Google details new 24-hour process to sideload unverified Android apps

arstechnica.com

521–530 of 1001 posts

Re: Google details new 24-hour process to sideload unverified Android apps

#521
I hate it of course, but I think for once there is a solution: just go for an alternative AOSP-based OS. Preferably GrapheneOS (soon available on Motorola phones).

The truth is that 99.9% of the people don't care. The remaining 0.1% is perfectly capable to use GrapheneOS.

Re: Google details new 24-hour process to sideload unverified Android apps

#522
post #447
post #418

Earlier quoted context omitted.

A minuscule amount of nerds being slightly annoyed is definitely worth when it hinders scammers from ruining a persons live.

There's no way this is really about scammers. I have never heard of scammers pushing sideloaded apps upon their victims in order to carry out their scams. Would welcome evidence to the contrary. Is this truly a threat model that's seen in the wild? My gut says no because social engineering is about hijacking legitimate, first-party processes. Scammers attack login credentials, MFA flows, and use first-party apps to m…

>There's no way this is really about scammers. I have never heard of scammers pushing sideloaded apps upon their victims in order to carry out their scams.

I also never got targeted by pig butchering scams[1], and neither did my immediate friends/family, so I guess those must not exist either?

[1] https://en.wikipedia.org/wiki/Pig_butchering_scam

Re: Google details new 24-hour process to sideload unverified Android apps

#523
post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

>Ruining Android for everyone Are they really though? does the average person really care about side loading? I think we are in an echo chamber. I can't picture any of the people in my life installing things from outside of an app store on their phone. However I realize that's purely anecdotal, it would be nice to see actual statistics on this to have a more informed decision.

Of course the average person doesn't care. Similar to how the average person doesn't care about age verification for social media. '

But it will affect them all the same.

Re: Google details new 24-hour process to sideload unverified Android apps

#524

'Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety.' - Benjamin Franklin

Sure, but what's "essential"?

Being able to decide yourself the software that is allowed to run on the hardware you own.

Re: Google details new 24-hour process to sideload unverified Android apps

#525

This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? - One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably no…

Didn't Google already lose a case over making it hard to install alternative app stores? How is this not going to get them hit again? This is way worse than what Epic sued over.

Re: Google details new 24-hour process to sideload unverified Android apps

#526
post #394

Earlier quoted context omitted.

I don't think Google should be changing Android this way at all, and fear that it will later be used for evil. That said, I thought of an improvement: Allow a toggle with no waiting period during initial device setup. The user is almost certainly not being guided by a scammer when they're first setting up their device, so this addresses the concern Google claims is driving the verification requirement. I'll be pretty…

> Allow a toggle with no waiting period during initial device setup I like this idea in principle but I think it could become a workaround that the same malicious entities would be willing to exploit, by just coercing their victims to "reset" their phones to access that toggle.

None of this is stopping a malicious entity. We keep trying to use tech (poorly thought out tech at that) to solve issues of social engineering. And no one is asking for a solution, either; it's being jammed in for control.

Re: Google details new 24-hour process to sideload unverified Android apps

#527
post #87

At this point I'm convinced that there's something deeply wrong with how our society treats technology. Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company. People who are unwilling…

I agree. In fact, one of the things I frequently propose is that we disallow the elderly and mentally disabled from using advanced technology without government proctor. In this way we can protect them. Everyone else can choose to turn off their scam protection.

People frequently talk about this with respect to AI and ads and how it’s bad for people to be use these things. I recommend we disallow the internet entirely for classes of people whose minds are not ready for the downsides of the tech.

With your Adderall prescription should come a phone number to sign up to the government proctoring service.

Re: Google details new 24-hour process to sideload unverified Android apps

#528
post #500

Earlier quoted context omitted.

GrapheneOS phones are still an option, it’s unaffected by these rules.

They have terrible support for banking apps and any app that needs play integrity

And what kind of support do you think a Linux phone will have? While also having trash tier security. I don’t see that as an issue (for Americans at least since most banks here don’t use NFC/wallets in their apps), just use the web browser to access your bank.

Also GrapheneOS has in my experience decent banking app support outside of a handful of apps (including, ironically, my main bank which disabled GrapheneOS support a week or two ago). There is a maintained list of working apps that you can see for yourself: https://privsec.dev/posts/android/banking-applications-compa...

Re: Google details new 24-hour process to sideload unverified Android apps

#529
post #184
post #57

Earlier quoted context omitted.

So... we're just going to move the scam into convincing the end user to run an application on their PC to ADB sideload the Scam App. Got it, simple enough. It's not hard to coach a user into clicking the "no, I'm not being coached" button, too, to guide them towards the ADB enable flow.

I think this is a "don't let the perfect be the enemy of the good thing". It's technically possible to get around, but adding more speed bumps in the way of scammers tends to drastically reduce the number of people who get scammed.

It's adding more speedbumps because one drunk person a few years ago ran into a tree. it still won't stop that, but now everyone suffers.

Re: Google details new 24-hour process to sideload unverified Android apps

#530

This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? - One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably no…

>- Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? Hi, I'm the community engagement manager @ Android. It's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you tur…

Will third party apps like bank apps be able to detect whether advanced mode is enabled or not, like how they currently detect if developer options is enabled?
Post reply on HN