Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android developer verification: Early access starts

android-developers.googleblog.com

Post reply on HN
Print view View original

591–600 of 694 posts

Re: Android developer verification: Early access starts

#591

Post by AdmiralAsshat »

In light of Google's recent push to eliminate this, I went and installed F-Droid to see what we'd be losing. I had thought about it for years, but always held off on doing it on my daily driver phone because I simply didn't want to open the floodgates on allowing apps to start randomly installing on my phone.

But having done it, I'm actually pretty impressed with the existing security. At least on my S24, you have to both enable sideloading at the system level, and enable each specific app to be allowed to "Install other apps" (e.g. when I first tried to launch the APK that I had downloaded from Firefox, I received a notification that I would need to whitelist Firefox to be allowed to install apps. I decided no, and instead whitelisted my File Manager app and then opened the APK through that).

I then installed F-Droid, allowed it to install other apps, installed NewPipe, and then toggled back off the system-level sideloading setting. NewPipe still works, and I don't think anything else can install. This satisfies my security paranoia that once the door to sideloading is opened that apps can install other apps willy-nilly. Not so.

So I really don't see what this new initiative by Google solves, other than, as others have said, control. The idea that somehow all user security woes come from sideloading apps and they would somehow be safe if they simply stuck strictly to the Play Store is patently untrue, given the number of malware-laden apps currently lurking in the Play Store.

Re: Android developer verification: Early access starts

#592

Post by advisedwang »

consp wrote: post #318
advisedwang wrote: post #169

Earlier quoted context omitted.

That doesn't say that you can just build an APK and distribute it. I suspect this path _still_ requires you to create a developer console account and distribute binaries signed by it... just that that developer account doesn't have to have completed identity verification.

So you will now need a useless and needless account to build and run your own apps? It's like Microsoft forcing online login on pcs.

useless, needless and terminateable at Google's pleasure!

Re: Android developer verification: Early access starts

#593

Post by nandomrumber »

bogwog wrote: post #540
leoedin wrote: post #364

Earlier quoted context omitted.

I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. How does Google know if someone has sold off their app? In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected.

> In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected. 1. The Android OS does not allow installing app updates if the new APK uses a different signing key than the existing one. It will outright refuse, and this works locally on device. There's no need to ask some third party server to verify anything. It's a fundamental part of…

You have to trust somebody.

Who is F-Droid? Why should I trust them?

How do I know they aren’t infiltrated by TLAs? (Three Letter Agencies), or outright bad-actors.

Didn’t F-Droid have 20 or so apps that contained known vulnerabilities back in 2022?

Who are all these people? Why should I trust them, and why do most of them have no link to a bio or repository, or otherwise no way to verify they are who they say they are and are doing what they claim to be doing in my best interests?

https://f-droid.org/en/about/

Re: Android developer verification: Early access starts

#594

Post by Lammy »

codethief wrote: post #402
Lammy wrote: post #210

Earlier quoted context omitted.

The name “Secure Boot” is such an effective way for them to guide well-meaning but naïve people's thought process to their desired outcome. Microsoft's idea of Security is security from me, not security for me. They use this overloaded language because it's so hard to argue against. It's a thought-terminating cliché. Oh, you don't use ?? You must not care about being secure, huh??? Dear Microsoft: fuck off; I refuse…

> Dear Microsoft: fuck off; I refuse to seek your permission-via-signing-key to run my own software on my own computer. No one is stopping you from installing your own keys, though?

I do not want to be in the business of key management. This is not something that needed encryption. More encryption ≠ better than.

I also dual-boot Windows and that's a whole additional can of worms; not sure it would even be possible to self-key that. Microsoft's documentation explicitly mentions OEMs and ODMs and not individual end users: https://learn.microsoft.com/en-us/windows-hardware/manufactu...

Re: Android developer verification: Early access starts

#595

Post by pessimizer »

tomrod wrote: post #36
svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

I bought the hardware, therefore I have the right to modify and repair. Natural right, full stop. That right ends are your nose, as the saying goes.

> I bought the hardware, therefore I have the right to modify and repair. Natural right, full stop.

There is absolutely nothing "natural" about trading your pile of government promises for the right to call government men with guns and sticks if you are alienated from the option to physically control an object. Your natural right is to control what you can defend.

Rights are what we decide them to be. Or rather, what people in power decide them to be, i.e. people who hold and issue large amounts of government promises, and recruit and direct the most men with guns and sticks.

Re: Android developer verification: Early access starts

#596

Post by AnthonyMouse »

nandomrumber wrote: post #425
AnthonyMouse wrote: post #204

Earlier quoted context omitted.

The "let's actually enforce antitrust laws" people are in the majority: https://today.yougov.com/economy/articles/47798-most-america... https://www.antitrustinstitute.org/wp-content/uploads/2024/1...

Your first link shows a graph that indicates more than 50% of Americans believe there is at least some competition, or a lot of competition; and that less than 1/3rd believe there is not enough, or no, competition in every sector of the economy that would be relevant to this discussion. And that most Americans believe that bigger companies tend to have lower prices than smaller ones. It’s not particularly clear then…

You're choosing the questions that have framing issues:

> more than 50% of Americans believe there is at least some competition, or a lot of competition in every sector of the economy that would be relevant to this discussion.

We're talking about Google and Apple but the relevant category would be "technology companies". Do phone platforms or mobile app distribution stores have "a lot of competition"? It's hard to see how anybody could think that. Do games and AI and web hosting? Sure they do. But they're lumping them all together.

They're also using "some competition" as the second-to-highest amount of competition even though that term could reasonably apply to a market where one company has 90% market share but not 100%, and it's confusingly similar to "not much competition". And they're somehow showing oil and gas as having less competition than telecommunications when oil and gas is a textbook fungible commodity and telecommunications is Comcast. That question has issues.

> And that most Americans believe that bigger companies tend to have lower prices than smaller ones.

This is the thing where Walmart has lower prices than the mom and pop. That doesn't imply that Walmart has better quality or service than a smaller company, and it doesn't imply that Walmart is operating in a consolidated market. Retail is objectively competitive in most areas.

Whereas when a big company is in a consolidated market, "big companies tend to have lower prices" doesn't hold and you get Google and Apple extracting 30%.

Moreover, the relevant part of that link was this part: More than two thirds of people, including the majority of both parties, support antitrust laws, six times as many people think they're not strict enough than think they're too strict and significantly more people agree with "the government should break up big tech" than disagree.

Re: Android developer verification: Early access starts

#597

Post by botanical76 »

nandomrumber wrote: post #593
bogwog wrote: post #540

Earlier quoted context omitted.

> In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected. 1. The Android OS does not allow installing app updates if the new APK uses a different signing key than the existing one. It will outright refuse, and this works locally on device. There's no need to ask some third party server to verify anything. It's a fundamental part of…

You have to trust somebody. Who is F-Droid? Why should I trust them? How do I know they aren’t infiltrated by TLAs? (Three Letter Agencies), or outright bad-actors. Didn’t F-Droid have 20 or so apps that contained known vulnerabilities back in 2022? Who are all these people? Why should I trust them, and why do most of them have no link to a bio or repository, or otherwise no way to verify they are who they say they a…

I understand your concern, though your suspicion is a little shortsighted. It can be personally dangerous to volunteer for projects that directly circumvent the control of the establishment.

Re: Android developer verification: Early access starts

#598

Post by Hizonner »

jlokier wrote: post #490
leoedin wrote: post #364

Earlier quoted context omitted.

I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. How does Google know if someone has sold off their app? In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected.

> In most cases, F-Droid couldn't know either. F-Droid is quite restrictive about what kinds of app they accept, they build the app from source code themselves, and the source code must be published under a FLOSS license. They have some checks that have to pass for each new version of an app. Although it's possible for a developer to transfer their accounts and private keys to someone shady, F-Droid's checks and open…

You know what? That's bullshit.

Anybody slightly competent can put horrendous back doors into any code, in such a way that they will pass F-Droid's "checks", Apple's "checks", and Google's "checks". Source code is barely a speed bump. Behavioral tests are a joke.

Re: Android developer verification: Early access starts

#599

Post by AshamedCaptain »

bogwog wrote: post #540
leoedin wrote: post #364

Earlier quoted context omitted.

I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. How does Google know if someone has sold off their app? In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected.

> In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected. 1. The Android OS does not allow installing app updates if the new APK uses a different signing key than the existing one. It will outright refuse, and this works locally on device. There's no need to ask some third party server to verify anything. It's a fundamental part of…

> F-Droid compiles all APKs on its store, and signs them with its own keys. Apps on F-Droid are not signed by the developers of those apps. They're signed by F-Droid, and thus can only be updated through and by F-Droid. F-Droid does not just distribute APKs uploaded by random people, it distributes APKs that F-Droid compiled themselves.

For most programs I use, they just publishing the developer's built (and signed) APK. They do their own build in parallel and ensure that the result is the same as the developer's build (thanks to reproducible builds), but they still end up distributing the developer's APK.

Re: Android developer verification: Early access starts

#600

Post by AshamedCaptain »

nandomrumber wrote: post #593
bogwog wrote: post #540

Earlier quoted context omitted.

> In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected. 1. The Android OS does not allow installing app updates if the new APK uses a different signing key than the existing one. It will outright refuse, and this works locally on device. There's no need to ask some third party server to verify anything. It's a fundamental part of…

You have to trust somebody. Who is F-Droid? Why should I trust them? How do I know they aren’t infiltrated by TLAs? (Three Letter Agencies), or outright bad-actors. Didn’t F-Droid have 20 or so apps that contained known vulnerabilities back in 2022? Who are all these people? Why should I trust them, and why do most of them have no link to a bio or repository, or otherwise no way to verify they are who they say they a…

Because you can literally verify every single step of what they do. That's the reason you can trust them.

You cannot apply this logic to almost anyone else. Apple, Google, etc. can only give you empty promises.

Post reply on HN