Android Developer Verification: Threat masquerading as protection • Hacker News Board

Re: Android Developer Verification: Threat masquerading as protection

#781

Post by Aachen » Sun, Jul 05, 2026, 11:19 PM UTC

HybridStatAnim8 wrote: post #550

kuschku wrote: post #395

Earlier quoted context omitted.

"extremely reduced security" That's such a fun statement. Any security measures taken always remove agency from one person and give it to another. iOS takes my control away, and in turn gives that control to Apple. GrapheneOS takes my control away and gives that to the GrapheneOS developers. The "security" you're talking about doesn't prevent certain data from being accessed, it just changes who controls the access.…

Root access takes agency away from you and gives it to 3rd party software. It doesnt expand freedom at all, it just allows other software to abuse the user. With a proper security model and verified boot, you can be certain you, the user, are running exactly the OS you expect to run. You can also properly revoke permissions to software and gate access as you see fit. With root, you cannot guarantee you are running wh…

> Root access takes agency away from you and gives it to 3rd party software

The mind bending people get into to prove GrapheneOS' statements right. Do you realise GrapheneOS is a third party as seen from yourself? Their system updater can sure as hell install (and cause to run) any code they like

If you can't give yourself root but a third party holds all the cards, you don't have more agency than a scenario in which you can issue commands at the same permission level as the OS

Re: Android Developer Verification: Threat masquerading as protection

#782

Post by Aachen » Sun, Jul 05, 2026, 11:24 PM UTC

kuschku wrote: post #686

HybridStatAnim8 wrote: post #653

Earlier quoted context omitted.

You would install your own build of GrapheneOS. Not the official images. Its not advisable to run anything as root, at all. Or expose access to it in any form. You can make userdebug builds to access a form of root that doesnt undermine the entire security model, in ADB. Afaik this lets you access apps internal directories but is not recommended for production devices.

> You would install your own build of GrapheneOS. Not the official images. Awesome, so you're advising against installing GrapheneOS for anyone that wants control over their own data. Sorry for twisting the words slightly, but that's the essence of the issue here, isn't it? > Its not advisable to run anything as root, at all. Or expose access to it in any form. And then you advise for exposing access to it in pretty…

> It'd be funny if it wasn't so exhausting.

That's GrapheneOS users and developers every time the topic comes up. I'm reading the thread and really admire the matter-of-fact tone you keep while calling out the illogical parts of each new attempt at justifying why GrapheneOS doesn't grant users full device access. Thanks for seeing this thread through!

Re: Android Developer Verification: Threat masquerading as protection

#783

Post by Aachen » Sun, Jul 05, 2026, 11:33 PM UTC

alfiedotwtf wrote: post #512

Aachen wrote: post #126

Earlier quoted context omitted.

Yet on LineageOS you're not affected. It seems you can build Android that isn't affected by Google, at least if you're willing to personally adjust the code to do what you want. You'd have to get exceptionally busy before it's not recognisable as an Android distribution anymore

How’s LineageOS compatibility these days? And besides F-droid, is there a place where mobile apps are plentiful without being full of malware? Also, how’s isolation on LineageOS for mobile apps? I think I’m getting to the point where I’m thinking of ditching Apple again

Aurora 'Store' is a client for Google Play that lets you filter on apps without ads or in-app purchases. My experience is that that's be a decent proxy for "don't show me all the bullshit".

It's also a good proxy for "no results" but then at least you know there is no free app that does what you want just yet :)

Anyway that's what I use to get the proprietary government and other societally required apps, and while I'm not on Lineage right now, it's meant to work there

Re: Android Developer Verification: Threat masquerading as protection

#784

Post by br0ceph » Mon, Jul 06, 2026, 3:33 AM UTC

@grapheneos Can the upcoming motorola phone have a microsd or somekind of removeable/expandeable mass storage? One of the most annoying things on modern phones, and all the pixels, is the lack of storage expansion. Its a constant battle to maintain free space on the device. Remote storage is largely useless to me due to datacaps and slow service. MicroSD slot and some kind of automatic but secure removeable disk encryption would be very desireable to me. Obv theres a threat vector here, so id appreciate a hardware/software solution that mitigates this. Maybe requiring user confirmation before any hardware pins are active, and some kind of removal/tamper/evilmaid detection. Also easy servicing hardware issues like a bad battery

Re: Android Developer Verification: Threat masquerading as protection

#785

Post by u8080 » Mon, Jul 06, 2026, 2:25 PM UTC

Arnt wrote: post #416

LtWorf wrote: post #392

Earlier quoted context omitted.

But it is suspicious they want to defend vs attacks that don't happen while doing absolutely nothing to stop the attacks that do happen. Seems like security isn't a goal here? (I didn't get scammed, I sometimes am curious on what the scam is so i lead them on a bit)

Are you in Brazil, Indonesia, Singapore or Thailand? Those were the four worst-affected countries IIRC. Although I seen to remember Ecuador or Bolivia as well? (They do something about other scams too. There was another thing they published recently, I didn't pay attention since no side effect of that concerned me, something to do with caller ID.)

Russia is also under heavy attack of phone scammers. Govt using that to shut down and ban messengers, lol, how convinient.

Re: Android Developer Verification: Threat masquerading as protection

#786

Post by br0ceph » Mon, Jul 06, 2026, 4:13 PM UTC

fossman wrote: post #767

grosswait wrote: post #303

Earlier quoted context omitted.

I was surprised to hear Librem failed, but a quick search show this is not true. Quite alive and hopefully well.

Librem 5 / Liberty Phone will be working well after many of these Androids reach 'EoL' and end up in the landfill. That is because it is modular and supports hardware upgrades (like a computer which it is), something unheard of in the mobile world. Purism already released a Wifi/Bluetooth hardware upgrade, and according to their newsletter, a cellular modem upgrade is in the works.

i wanted the librem5 to be awesome. some things really bothered me about it , as a smartphone alternative: shitty screen shitty camera shitty cpu shitty battery life shitty os shitty support for modern video codecs shitty physical security if i cant take decent pictures, watch locally stored hd h264/265 videos, have a full day of battery life, and resist cellebrite extraction attempts... what is it really good for. they shoulda targetted it as a secure hotspot for a wifi only or tethered device, rather than the smartphone usecase.

Re: Android Developer Verification: Threat masquerading as protection

#787

Post by hollerith » Mon, Jul 06, 2026, 6:35 PM UTC

ufocia wrote: post #752

HybridStatAnim8 wrote: post #704

Earlier quoted context omitted.

Android is not at the expense of either freedom or privacy. Desktop Linux OSs come at the cost of both. It would be better to direct effort to AOSP projects as it is a much better base to build from.

How so? Please elaborate.

AOSP is just as open-source as desktop Linux (and desktop Linux subsystems reconfigured for use on a phone) is, and has vastly better security.

People sometimes say, "maybe desktop Linux lacks in security, but its privacy is first-rate," which IMHO is silly because if your OS can be completely and totally pwned by your visiting a web page, your opening image file or your using some IDE to inspect some source-code repo, how much privacy do you really have?

GrapheneOS is just as free from data collection by megacorporations as desktop Linux is and has about 1000 times better security.

Re: Android Developer Verification: Threat masquerading as protection

#788

Post by jonathanstrange » Mon, Jul 06, 2026, 9:32 PM UTC

gruez wrote: post #457

jonathanstrange wrote: post #276

Earlier quoted context omitted.

The problem is easy to solve by making 99% of all apps normal apps that don't get any special privileges and don't require any developer certification, and having a certified developer program with heavily locked down run mode for the 1% of high security apps like banking and payment apps. It's not hard to attest unambiguously to the user in some way whether they are running one of these rare secure apps or a normal…

>and having a certified developer program with heavily locked down run mode for the 1% of high security apps like banking and payment apps. How do you determine/enforce whether an app is a "payment app" without a centralized developer program? They don't require any special privileges. After all, most banking apps have web equivalents.

You need a centralized developer program but only for the apps for the secure enclave. The whole point is that they would require special privileges.

Re: Android Developer Verification: Threat masquerading as protection

#789

Post by LtWorf » Wed, Jul 08, 2026, 2:03 PM UTC

u8080 wrote: post #785

Arnt wrote: post #416

Earlier quoted context omitted.

Are you in Brazil, Indonesia, Singapore or Thailand? Those were the four worst-affected countries IIRC. Although I seen to remember Ecuador or Bolivia as well? (They do something about other scams too. There was another thing they published recently, I didn't pay attention since no side effect of that concerned me, something to do with caller ID.)

Russia is also under heavy attack of phone scammers. Govt using that to shut down and ban messengers, lol, how convinient.

While Europe doing chatcontrol is very free and democratic?

Re: Android Developer Verification: Threat masquerading as protection

#790

Post by lern_too_spel » Wed, Jul 08, 2026, 4:50 PM UTC

curt15 wrote: post #742

lern_too_spel wrote: post #480

Earlier quoted context omitted.

This is no different from before. If you want consumers to be able to install your app without a warning on Google builds, you have to jump through verification hoops. The only thing that ADV changes for developers is that now they can distribute their apps outside the system app stores without a warning as well, which is a new benefit, not a new restriction. The correct thing to complain about is requiring developer…

What happens if Google says "nope" to a developer who applied for ADV? Does the developer retain the ability to distribute their software to end users through whatever non-Google-approved channels they use today?

Yes. That doesn't change. The only thing ADV changes is that it adds another way to distribute apps that can be installed without a warning.