Google details new 24-hour process to sideload unverified Android apps

The "advanced flow" will be available before verification enforcement begins later this year.

See full article...

 

[CatNamedHugs]

Avoid unauthorized malware on your phone while Google harvests everything you do and create to train their next shitty LLM.

 

[RoryEjinn]

Ah yes, there it is. The fee to verify apps. That's a terrible choice. Also, a 24 hour waiting period? Not only is it buried in the settings, but they force you to wait 24 hours? Give me a break.

 

[Tactical Finesse]

Avoid unauthorized malware on your phone while Google harvests everything you do and create to train their next shitty LLM.

But how can surveillance capitalism do surveillance capitalism--if they can't surveillance capitalism?

This message brought to you by the Home Shopping Network of the Internet, AKA Alphabet Inc.

 

[ruet]

I hate everything!

 

[trevor_darley]

aimed at combating malware

Oh, yeah, sure. "Combating malware." That's the chief motivation, just like "saving the children" is the chief motivation in other contexts recently.

 

[vantharion]

I kind of think this article should've included information about why they are actually doing this: the Epic lawsuit rulings. Where Apple got off lighter than Play Store because of the open garden.

It feels like relevant context when they state it is malware driven yet provide no statistics or metrics supporting it.

 

[MrDweezil]

Well, we've gone from "no sideloading" to "sideloading, but its a pain in the ass" before they even detailed the policy. Lets see if that 24 hour waiting period even makes it to release.

 

[big-ted]

Perhaps they should concentrate on removing all the malware and scam apps from the Play Store first

 

[Tactical Finesse]

Perhaps they should concentrate on removing all the malware and scam apps from the Play Store first

But they can't do that and mass layoff workers to keep pumping their stock price--if they do that.

 

[fe3a8b63]

Seems a lot easier than ADB. I was mentally preparing to working with it on a constant basis to get apps on my phone. This is more streamlined.

Still annoying though.

Dev opt -> Allow unverified -> etc -> wait 24hrs

Is a lot less work than ADB.

Still wish they didn't do this shit

 

[WereCatf]

Pardon me, but this is just a fucking load of bullshit. I am especially disgusted by them requiring any random dev to provide their identification, signing keys and everything even when they don't want to put their stuff on the Play Store, that's just....malicious on Google's part.

 

[AxMi-24]

To verify, devs releasing apps outside of Google Play will have to provide identification, upload a copy of their signing keys, and pay a $25 fee.

Do I get this correct. Google will demand signing keys from the devs. Meaning that google can at any point create a modified app and sign it with those keys pretending to be devs?

 

[pjcamp]

this is designed to combat the rising use of high-pressure social engineering attacks

No it isn't. It is designed to make the process onerous and difficult so that you stay within the Play Store.

 

[Reaperman2]

I chose Android many years ago because I make my own apps. I'm not paying, and I'm not waiting 24 hours.

 

[gourdcaptain]

when do we get the mandatory "educational" film you have to watch showing the mangled corpses of people who enabled unverified apps lol

 

[vought1221]

Perhaps they should concentrate on removing all the malware and scam apps from the Play Store first

It’s working as intended.

 

[fuzzyfuzzyfungus]

an application package that “causes harm to the user’s device or personal data that the user did not intend.

I assume it would be in poor taste to mention all the 'legitimate' applications that fail that test?

 

[KrookedRooster]

Usually I have to install an app because I didn't know I needed it (because it is just some stupid wrapper for the internet but that's another whole thing)

What if it is used for some sort of event? And that event is happening TODAY.

That 24 hour wait time is gonna get some people real mad when it starts costing them $$$.

 

[b1LL_]

I've been running GrapheneOS on my Pixel for six months now with zero issues. Highly recommend to those with compatible devices.

Google can fuck right off with their enshittified bullshit disguised as "safety".

ETA: When I pay for a computer it needs to do what I tell it to do, when I tell it to. Nothing more, nothing less. For those of you who read this that work for these companies....for the love of fucking christ, stop being evil.

 

[TheNinja]

24 hours seems a bit too much for a process that already presents many other barriers to the average user. At the very least they aren't removing the ability to side load apps altogether. This is basically the only reason that makes Android the better choice for me and many others.

 

[schnackenpfefferhausen]

Here are the steps:

• Enable developer options by tapping the software build number in About Phone seven times
• In Settings > System, open Developer Options and scroll down to “Allow Unverified Packages.”
• Flip the toggle and tap to confirm you are not being coerced
• Enter device unlock code
• Restart your device
• Wait 24 hours
• Return to the unverified packages menu at the end of the security delay
• Scroll past additional warnings and select either “Allow temporarily” (seven days) or “Allow indefinitely.”
• Check the box confirming you understand the risks.
• You can now install unverified packages on the device by tapping the “Install anyway” option in the package manager.

“But the plans were on display…”
“On display? I eventually had to go down to the cellar to find them.”
“That’s the display department.”
“With a flashlight.”
“Ah, well, the lights had probably gone.”
“So had the stairs.”
“But look, you found the notice, didn’t you?”
“Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.”​

 

[schnackenpfefferhausen]

They left out one step:

start

 

[YesAndNo]

How does it measure the 24-hour wait time? Could I manually change the date on my phone to skip the wait, or is it smarter than that?

 

[younork]

I see that I am in the minority with this opinion, but I think the 24-hour cooldown is a really good compromise to help prevent coercion and, more likely, someone with temporary unauthorized access. And for the power user who needs to sideload apps all the time, it doesn't seem too onerous to wait 24-hours once when you get the phone and set it to indefinitely allow.

The $25 fee and other hurdles for developers seems like the much bigger issue here.

 

[LieutenantLefse]

How does it measure the 24-hour wait time? Could I manually change the date on my phone to skip the wait, or is it smarter than that?

It's obviously smarter than that.

You need to upload a photo of yourself holding up a copy of tomorrow's New York Times.

 

[Fatesrider]

Wont someone think of the boomers!?

Maybe they can use the age verification requirements to disable this crap for anyone born after 1980.

For the record, the Boomers don't give a shit about this. 99% of them see their phone as...

Wait for it...

A PHONE.

It also does text. And has a camera. And kind of surfs the Internet in a really shitty way.

That's about it. Side-loading is not a Boomer thing.

More to the point, side-loading is not MUCH of a thing in the first place. Yes, people do it. Yes it gets a lot of press. But I'd love to see some statistics on how many people actually know what the fuck it means, let alone actually do it.

It's most a straining at gnats/swallowing camels whole legal thing that Google has to allow, but no one told them they had to make it easy. It's at least doable, kinda, for those few who want to. For the rank and file, this isn't even a ripple in the ocean of shit out there today.

 

[LostFate]

Feels a bit like they are getting for the FDroid and Revanced crowds...

 

[evan_s]

Do I get this correct. Google will demand signing keys from the devs. Meaning that google can at any point create a modified app and sign it with those keys pretending to be devs?

I assume this is your typical public/private key situation where Google gets the public key so they can verify the apps are signed by the dev private key. They can't sign something as the dev just verify the packages are from a particular dev who has been verified.

I don't think the $25 for verifying is that bad. It's a one time thing for an account as far as I can tell. That's pretty minimal and then you can presumably release as many apps as you want with any updates you want at any time. You don't want to make it completely free because people abuse the verified accounts and treat them as disposable. At least if you've got a minor fee there is some cost and you can do things like looking for someone verifying dozens or hundreds of accounts with the same payment info to try to prevent abuse.

I also think the 24 hours thing is fine. Your average user is never going to go into this in the first place. If you know you want to be able to side load things just go in and do this when you first setup the phone and set it to indefinite. You've now opened it up to side load as much as you want with out any delays. You've got your behavior that you want. I don't have a problem with the assumption that your typical person suddenly wanting to sideload something is probably being scammed and a 24 hour road block is probably a good thing.

 

[Tactical Finesse]

I assume this is your typical public/private key situation where Google gets the public key so they can verify the apps are signed by the dev private key. They can't sign something as the dev just verify the packages are from a particular dev who has been verified.

I don't think the $25 for verifying is that bad. It's a one time thing for an account as far as I can tell. That's pretty minimal and then you can presumably release as many apps as you want with any updates you want at any time. You don't want to make it completely free because people abuse the verified accounts and treat them as disposable. At least if you've got a minor fee there is some cost and you can do things like looking for someone verifying dozens or hundreds of accounts with the same payment info to prevent abuse.

I also think the 24 hours thing is fine. You average user is never going to go into this in the first place. If you know you want to be able to side load things just go in and do this when you first setup the phone and set it to indefinite. You've now opened it up to side load as much as you want with out any delays. You've got your behavior that you want. I don't have a problem with the assumption that your typical person suddenly wanting to sideload something is probably being scammed and a 24 hour road block is probably a good thing.

One time fees never stay that way.

And this is yet another step Google is taking in the long road to coerce people into stopping modifying their phones from surveillance capitalism stock. It has been going this way for years. Arguably since Samsung debuted Knox and corporate America thought that Knox was a great idea.

 

[structuralnoise]

How exactly is this going to stop any malware and scams? A malicious actor will just register as someone else. It can't be that hard and $25 is just ridiculous if you really pull a decent scam. When one developer identity gets blocked you just register another.

 

[kelsonv]

Do I get this correct. Google will demand signing keys from the devs. Meaning that google can at any point create a modified app and sign it with those keys pretending to be devs?

I don't think so, at least if I read this correctly: https://developer.android.com/developer-verification/guides/android-developer-console

Looks like a regular key exchange where you give them the public key and then sign with your private key, and they can then associate that key pair with your ID.

Edit: evan_s beat me to it.

 

[lolnova]

While there are certainly reasons Google might like the control verification gives it, the Android team has felt real pressure from regulators in areas with malware issues to address platform security.

Next they'll be feeling pressure from regulators to not allow any apps which aren't approved by the government.

See also: ❝Age Verification,❞ which suddenly appeared simultaneously in every western country and is actually about social control by means of maintaining a database tying everyone's online identities to their physical identity.

Fuck every bit of that.

 

[lolnova]

I see that I am in the minority with this opinion, but I think the 24-hour cooldown is a really good compromise to help prevent coercion and, more likely, someone with temporary unauthorized access. And for the power user who needs to sideload apps all the time, it doesn't seem too onerous to wait 24-hours once when you get the phone and set it to indefinitely allow.

No.

It's my device. It is to do what I tell it, when I tell it. Period.

 

[fivemack]

Usually I have to install an app because I didn't know I needed it (because it is just some stupid wrapper for the internet but that's another whole thing)

What if it is used for some sort of event? And that event is happening TODAY.

That 24 hour wait time is gonna get some people real mad when it starts costing them $$$.

That’s on the event for not doing the trivial amount of work to get the app authorised on the App Store.

 

[sbradford26]

I see that I am in the minority with this opinion, but I think the 24-hour cooldown is a really good compromise to help prevent coercion and, more likely, someone with temporary unauthorized access. And for the power user who needs to sideload apps all the time, it doesn't seem too onerous to wait 24-hours once when you get the phone and set it to indefinitely allow.

The $25 fee and other hurdles for developers seems like the much bigger issue here.

I am mostly in agreement with you on the method to allow full sideloading like that. I have stopped people mid scam as someone on the phone was walking them through installing some malicious app. There are just too many scammers out there and the average user truly has no idea how their phone works or what they are doing.

Now for power users and developers there should be a faster way to bypass that, maybe something through ADB which should prove that it isn't a scammer situation and also wouldn't require spending money.

 

[Fred Duck]

The verification bypass is different and will not be revealed to users.

Wait, aren't there detailed instructions in this article?

Flip the toggle and tap to confirm you are not being coerced

So the next time I'm being coerced, that verification step will save me.

Although if the only difference between the earlier system is a (possibly) one-time twenty-four hour wait, then there's no material difference at all...

...which leads one to believe this workaround is not intended to remain available for very long.

 

[anguisette]

the article says you need a "device unlock code". what is one of those and how do you get one? is this the code that certain mobile providers are known for refusing to provide to people currently in contract with their device?