Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google details new 24-hour process to sideload unverified Android apps

arstechnica.com

Post reply on HN
Print view View original

971–980 of 1001 posts

Re: Google details new 24-hour process to sideload unverified Android apps

#971

Post by nickorlow »

cobbal wrote: post #18

Can you set your clock forward or does this also require phoning home to a central server to install an app on your computer?

It'll be interesting to see how the timing is enforced. Can you just set up your own NTP server to fool your phone into thinking it's really the future (and not just you adjusting your phone's clock manually). Will Google run a clock that you have to get a timestamp from (would it be easy to setup your own MITM proxy to get around this?). If the time somehow jumped backwards, would you lose the ability to install apps? Can google remotely disable this after it's already enabled (I think yes)?

Re: Google details new 24-hour process to sideload unverified Android apps

#972

Post by nickorlow »

gasull wrote: post #680

As someone who has been forced at the Australian border to unlock my phone, and seen it taken away, maybe this isn't a bad idea.

I'd think it'd be useful to opt-in to a 24-hr app installation blackout for scenarios like this.

But also, Google would definitely give 5-eyes a tool to bypass this for whatever they wanted to do to your phone.

Re: Google details new 24-hour process to sideload unverified Android apps

#974

Post by tiberious726 »

al_borland wrote: post #581
vachina wrote: post #550

Earlier quoted context omitted.

Why are you even using the Gmail as your mail app?

The switching cost on a 20+ year old email address is high. It’s basically impossible to totally migrate away from. On top of that, since Google does their own thing, it doesn’t fit well into standard IMAP that most clients use. Sparrow made Gmail a great experience, but Google bought it and shut it down. I’m still rather bitter about that. It’s the only email client that actually made me enjoy email.

I still use emacs gnus with Gmail. You need a token instead of old fashioned imap auth, but it works fine

Re: Google details new 24-hour process to sideload unverified Android apps

#975

Post by chr15m »

yonatan8070 wrote: post #704
chr15m wrote: post #389

In addition to a enabling it in this onerous way, this should be a thing you can set when you first set up the phone after factory default: "I am technologically literate and I accept the risks of side loading indefinitely." If it's set once during set up then none of the vulnerable people will have it set for the lifetime of their phone. A scammer would have to factory reset their phone which would defeat the purpos…

I feel like even the "indefinite" option would be about as indefinite as setting your default browser on Windows

Probably true. Asking a tech company to stay good is like asking a lion to stay vegetarian.

Re: Google details new 24-hour process to sideload unverified Android apps

#976

Post by summermusic »

MishaalRahman wrote: post #143
summermusic wrote: post #53

24 hour mandatory wait time to side load!? All apps I want to use on my phone are not in the Play Store. So I buy a new phone (or wipe a used phone) and then I can’t even use it for 24 hours?

1) The one-time, one-day waiting period only applies if you go through the advanced flow to allow installing unregistered apps. You can still install registered apps (ie. apps made by developers who have verified their identity) even if they're distributed outside the Play Store. 2) You can use ADB to immediately install unregistered apps. ADB installs are not subject to the waiting period.

1) Fuck

2) Google

Re: Google details new 24-hour process to sideload unverified Android apps

#977

Post by gasull »

nickorlow wrote: post #972
gasull wrote: post #680

As someone who has been forced at the Australian border to unlock my phone, and seen it taken away, maybe this isn't a bad idea.

I'd think it'd be useful to opt-in to a 24-hr app installation blackout for scenarios like this. But also, Google would definitely give 5-eyes a tool to bypass this for whatever they wanted to do to your phone.

Good point.

Re: Google details new 24-hour process to sideload unverified Android apps

#978

Post by jwrallie »

MishaalRahman wrote: post #967
jwrallie wrote: post #544

Earlier quoted context omitted.

Why don’t you create an option to bypass this whole thing permanently on adb then? You can even add your 24h delay. I’m not convinced this is really to protect users from being hurt by scammers, it is really about protecting the users from doing what hurts your company interests.

>Why don’t you create an option to bypass this whole thing permanently on adb then? You can even add your 24h delay. When you enable the advanced flow and choose the 'indefinite' option, that allows you to install unregistered apps 'permanently', which is effectively what you're asking for, no? (I've gotten questions on whether this setting can be restored after a factory reset or when setting up a new device - I'll…

> When you enable the advanced flow and choose the 'indefinite' option, that allows you to install unregistered apps 'permanently', which is effectively what you're asking for, no?

Is it a process that you do once and applies to any unregistered app I install now or in the future? Or do you have to repeat it for installing or upgrading different apps?

If it is the former then yes, it is effectively the same.

Re: Google details new 24-hour process to sideload unverified Android apps

#979

Post by headsman771 »

MishaalRahman wrote: post #959
headsman771 wrote: post #237

Earlier quoted context omitted.

Why do you keep harping on about ADB installs. That's not helpful. It doesn't help me install open source apps from FDroid. It's ridiculous that you think booting up a computer and using ADB is a reasonable workaround. It isn't.

If you enable the advanced flow as described in the Android Developers Blog, then you can install unregistered apps regardless of source. That includes apps from sources like F-Droid.

Don't be mistaken, it's the delay I'm complaining about, not how to instal F-Droid or apps through it.

It is not reasonable to advocate for ADB if the 24 hour wait is too long.

I'll copy what I wrote elsewhere. Fraud uses social tactics and legitimate tools in the vast majority of cases. Developer verification will have absolutely no effect on that.

Impinging on my property rights cannot and will not protect or help fraud victims.

Post reply on HN