Starting in 2027, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID.
Every app and every device, worldwide, with no opt-out.
This includes apps shared between friends, distributed through F-Droid, built by hobbyists for personal use.
Independent developers, church and community groups, and hobbyists alike will all be frozen out of being able to develop and distribute their software.
Registration requires:
- Paying a fee to Google
- Agreeing to Google's Terms and Conditions
- Surrendering your government-issued identification
- Providing evidence of your private signing key
- Listing all current and all future application identifiers
If a developer does not comply, their apps get silently blocked on every Android device worldwide.
Every moat, every walled garden, every infrastructure piece can be rebuilt with AI.
We're seeing it with desktop apps, with games. It will happen to infrastructure and platforms. I'm itching at the opportunity to build open cloud primitives and P2P social protocols.
We don't need big tech anymore. We just need to be able to run our models.
I want to see every *aaS’s functionality required to be offered -on reasonable and non-discriminatory terms- as an API
Who is Ford to tell me I can’t have a widget for each of my ford EVs visible at the same time? Or even that the single-car widget they do allow has has to be four times bigger than I want it to be, and waste screen real estate on dead space and things that I don’t want?
I typically tell them I don't have an Apple or Google play store. That typically confuses them enough that I can avoid explaining more than just telling them that that is indeed possible.
Although many people do say that there's an issue with banking apps on GrapheneOS, I don't believe that's actually the case. Many banking apps work just fine. In cases where other apps refuse to run, GrapheneOS has compatibility toggles. After toggling those on, many banking apps that complain start working again.
In other cases, banks add Play Integrity checks to their apps, which is a more complex subject. In short, many banking apps check for the basic integrity verdict, which GrapheneOS can get. In other cases, the checks are not implemented properly, and GrapheneOS has a toggle which often gets those apps to work. Finally, a very small number of banking apps require the strong integrity verdict and the apps will refuse to run on GrapheneOS.
Although there are no statistics about this, it does seem that a majority of banking apps work or can be made to work with different compatibility toggles.
It's not a banking app, but there are definitely apps that don't work on GrapheneOS that can't be made to work. A friend of mine is "required" to use Microsoft Authenticator for his work MFA, which won't run. He's looking at having to carry another phone.
I have to use the awful thing, too, so if I go to GrapheneOS next year when, hopefully, a non-Google phone supports it, I'll have to carry two phones. Ugh.
Not at all. The app that is enforcing the change is a privileged Google app. Even if someone tried installing it on GrapheneOS, it wouldn't be able to do anything like remove apps, block installation, or disable apps.
And my experience has been that it's frequently harder to sidestep Google's bullshit on GrapheneOS because you don't have as much control of your phone, in the interest of security.
Honestly at this point, I'm just gonna start transitioning to Ubuntu Touch. The Android experiment has run its course.
What you're saying doesn't make any sense. I literally just said that GrapheneOS isn't affected.
The narrative that GrapheneOS is so focused on security that it affects usability, especially given the context, is nonsense. The change that's being discussed here doesn't affect GrapheneOS or other non-GMS operating systems. The only affected OSes are the ones that install Google apps with privileged permissions.
If you want to switch to something else, go ahead. GrapheneOS is still a better overall choice.
That is not the case. It is significantly easier to the point it is entirely optional. GrapheneOSs privacy and security features do not make avoiding google more difficult.
On stock OSs, google signs major portions of the OS and is highly privileged, which is impossible to sidestep.
I understand why you didn't mention it, but there is an opt-out: you enable developer mode and wait 24 hours.
As it runs through Google Play Services, it's pretty likely they'll boil the frog and make it even harder in the future. Moving to an open platform is a good idea.
The stated intention is to discourage scams. Bur this is exactly the same way Xiaomi makes their devices "unlockable" and in reality they just turned off their unlock server years ago and the button doesn't do anything, so you can't unlock.
IIRC it is a cooldown to prevent less tech-savvy individuals from being tricked into installing malicious apps.
I don't think Google is doing this out of some egotistical obsession over "control," it's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.
There are plenty of problems with walled gardens, but IMO this isn't one of them.
> It's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.
Maybe it's because direct installs are too hard to do already? Fortnite tried to go to that route and failed, if Fortnite couldn't make it who can?
And let's be real, I'm not going to accept any talk of "security" from Google when I type "chatgpt" in the search bar of the play store and I have an app with a counterfeit logo coming up at the top spot.
As I understand they're being pressured into it by governments like the Brazilian government to prevent a widespread form of scam there, but of course they're happy to comply because it means they have more control as well
We'd all be safest in a cage but no one wants to live like that
I doubt they care about the Brazilian government. They're not going to lose customers there, the only alternative is iPhones and those are completely unaffordable in Brazil due to their local manufacturing laws. Only the rich few can afford one. They cost about twice as much as anywhere else and this is in a country where people have much less money.
So sanctioning Google means taking the smartphone away from 95% of their population. Which isn't going to happen.
The worst problem with walled gardens is when everything is walled. Android is not supposed to be an "ecosystem", it is a damn OS on compatible hardware.
> I don't think Google is doing this out of some egotistical obsession over "control," it's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.
It's also that that fraction is one they don't get any income from. We don't use Google accounts, Google apps or services etc.
So they don't get to track us as much except the few things you can't turn off in play services. Not everyone can work with custom rom (on those the new restriction obviously doesn't apply at all)
This keeps getting missed out every time it's reported. I can't figure out whether people genuinely don't know, or they're trying to push a narrative that this is worse than it is
Firstly, TFA has a bright red banner describing the opt-out mechanism. It's probably the second most attention-grabbing element on the page, after the countdown. Secondly, initially Google didn't mention any plans for an opt-out at all[1]. That was was only ceded after pushback[2].
They do not. If you /root/ your device play-protect, and apps that depend on it (many banking, security and 2fa apps) decide you're compromised. If you turn on developer mode - nothing happens... except you get menu options for a developer and can upload your APKs (or any others if you're a scofflaw)
There are certainly apps that stop working (at least in significant part) only because of Developer Mode, on otherwise stock Android, no root, Pixel phone.
Though the only example I’ve encountered is the SumUp Business App’s Tap To Pay feature. If you use e.g. Geto to hide (automatically disable and later re-enable) the developer options, it works fine.
I seem to recall some apps refusing to run if developer mode is enabled. A workaround that means I can no longer use the apps I use every day isn't much of a workaround.
Or, we're going to have to start choosing banks without apps or with apps that don't have such ridiculous restrictions. Fortunately, at least in the USA there is an abundance of banks and credit unions, so if one of them treats you like this, just move your account over to a different one. I've changed my primary bank in a single day--It's not hard.
Is it Developer mode those apps trip on or USB debugging? I've seen several examples of the latter but haven't come across the former yet. I run Google-free Android (14, 15, 16) devices which run the Swedish and Dutch banking and e-ID apps I use on, some of these only work when USB debugging is disabled while others don't care. Some of them complain about Google Play Services not being available but they run nevertheless, that warning is produced by some part of the SDK which gets imported at build time but it does not (yet...) disable anything.
As of Android 17, "Developer Mode" consists of an extra options panel that is enabled through a sort of "Easter egg" process. It's not really even a mode. It's simply a bundle of options that are somewhat dangerous or confusing to twiddle. Users don't need to enter this mode for any practical reason, but entering this "mode" doesn't do anything except exposing more options behind one big toggle.
It doesn't affect the phone's security in any way, unless you specifically tweak a security-related option in that panel. It doesn't degrade the device encryption or Google Play Services. I don't see how any app could balk while it's enabled. There are no apps I have that even run differently. I use the same banking apps and all the other things as normal, whether or not this mode is enabled for me.
Yes these days it is. It didn't use to be like that.
In the early days of BYOD, all they could do is delete the device if it would be lost. Which was not really a bother to me because I back it up to my own servers anyway, and in that case it would be lost anyway. And they would enforce a few basic things like setting a decent pincode and device encryption.
But lately the MDM and antimalware solutions have become more intrusive. Recently my work's MDM complained about an app I had on the personal side of my phone, something they should have no visibility of. Also they now want to route all the traffic through their VPN to inspect it which was obviously a non-starter.
Android 5 is where capabilities really took off, including the Device Owner profile which has pretty ultimate control over the device -- they've actually done some work to limit what admins could see across profiles in Android 11+
Android 7 is when always-on-vpn was could be enforced by an admin, in 2016.
Once enabled, it stays enabled even after developer mode is turned back off. It's also associated to the Google account (if any) so later device purchase don't have to wait the 24 hours period
As I understand it, you yourself will also need a google account to unlock the setting to "sideload" in the hidden "developer options" before waiting 24 hours.
What I am not sure is what will happen if I then remove the "google account" which I don't want in my device.
Obviously this does not affect “every device worldwide”. I don’t have a single Android phone, and the devices I own that do run Android are not affected.
there are plenty of android devices without google apps, I was running many of them in the last 10 years, my current phone is after long time still with enabled gapps, though no google account, I have zero problem to stop using gapps
Removing freedom, and control will never get rid of scammers. Nor will it get rid of the plethora of poorly written corporate owned apps that will still be allowed to fester. It won't even get rid of the apps that scammers use to scam.
At best it gets rid of some scams, certainly not most of them or poorly written apps, which continue to flood the Google PlayStore.
Despite Google's best efforts to automatically ban malicious developers, catching many legitimate developers in the crossfire, their store isn't exactly a bastion of quality or scam-free.
> Despite Google's best efforts to automatically ban malicious developers, catching many legitimate developers in the crossfire, their store isn't exactly a bastion of quality or scam-free.
I honestly doubt their "best efforts".
Fact of life is they make money off apps including malicious ones. For the same reason a lot of promoted content on Google search is clickbait and they even serve malicious apps. Money corrupts.
and installing AI-monitored CCTV that calls the cops when it thinks you're up to no good in every room of every dwelling would reduce the number of murders and rapes by at least half.
I'm sure you will not object when that happens. you are not a murderer or rapist, are you?
I wouldn't, as long as humans aren't viewing it, think of the murders/abuse prevented, it could even monitor your behaviour and be like a pre-cog so if it thinks you sound weird or creepy it sends a robot round to question/arrest you.
24/7 omnipresent behavioral monitoring by an uncompromising algorithm, its hand always hovering over the button that ruins my life? Hell yeah sign me up!
I hope this isn't satire, because it's hilarious how often when someone logically extends the arguments of the authoritarian corporate tech overlords until they turn into a direct retelling of dystopian nightmares from the past, someone pops up and goes "Yes that is my dream world, I would like that please"
I just don't like crime, abuse, murders etc. Giving up a little privacy to stop thousands of murders of innocents is a trade-off im willing to make. What is wrong with people who argue 'No let those kids die, I want to be able to pirate movies'
Not quite. When the update is pushed, there will be an initial 24 hour waiting period to unlock your device. And then you can install unsigned APKs from hobbyist devs or Fdroid as before
Not to mention, one of the most important things, the absolute best app out there for controlling insulin pumps for diabetics is an open source app you have to "sideload." I'm not usually one to make hyperbolic accusations, but in this case Google attempting to kill sideloading could put real people's lives in danger, or substantially damage their quality of life.
You pay that fee once to setup your publishing account (unless they close it on you, in that case you won't be able to reopen the account.. you'll have to start fresh and pay again). Not per app-publish, not per-year.
Hotels have a reasonable need to know that I am the person who paid for the service, so I can get what I paid for. The hotel also does not remember, a human glances at your ID to compare your name and that's that.
Google has no need to know who anyone is here. I want to provide an app, someone else wants to use my app, all entirely off Google's sacred platforms. We should be able to work together, but in comes a middleman who demands to see our IDs because he owns the platform and can just do that. That ID, of course, is digitally stored and will be retained indefinitely.
IMHO, this is a great time to push PWAs even harder. I know they're not a fit for every use case, but most of the apps I saw and/or use would work just fine as PWAs. If Mozilla wants to do the right thing this time, they could reconsider bringing first-class PWA support back across all platforms.
I am being completely honest here - what is the reason that the government id thing is a problem here? And why is attesting the private key (evidence that you have it) an issue?
I get the rest but I can’t get my head around people who find these two things upsetting.
Because the Company have no support and it is all AI and Bots… their verifications don't work..
I have a company with both App Store and Play Store apps out, but when I wanted to use my Personal account to distribute a free app, it took with Apple 1 hour with registration and then one phone call to their EU Developer support to get approved.
4 months later and I am nowhere with Googles new system and have given up..
My app is now iOS and APK only, which mean no none nerd users on Android.
Google play store was ruled a monopoly and the Apple App store was not. Google allows alternatives on their platform and Apple strictly forbids it.
If the legal system dictates that open = monopoly and closed = fair game, then you get dumb shit like this.
Probably one of the dumbest rulings in tech ever, but few people know about it. Basically set precedent to never share your platform if you don't want legal scrutiny.
Your app ecosystem might decrease as developers who don't want to register lose interest and the number of users supporting open source projects decreases.
In short, it doesn't affect you. Even if you tried installing the app that enforces the changes on GrapheneOS, it wouldn't have the necessary privileges to do anything.
I thought Google was adding more hoops to jump through for F-Droid, Termux and the like. Did that change? Obviously the more hoops the less happy we will be, but it'd be nice to know.
Keep in mind they’re crippling devices. You’ve already paid for, it’s not like I’m gonna go to the store tomorrow and buy a new phone with significantly reduced functionality. Instead Google is reducing the functionality I already paid for.
I'd just turn off my phone before midnight, boot it into fastboot and reflash lineage 2 days later, missing the window for them to push anything. No gapps btw.
Pretty dead for me when they don't support the messaging app I need (yeah yeah people should use open protocol blah blah, but pretty much everyone in my country use them and I won't be able to convert them), nor transport (regular cabs can easily cost twice), and last I heard they don't even support copy paste between apps.
There isn't even any high res large touch screen KaiOS phone. I want to watch HD movies and read articles in comfort without scrolling all the time.
The 24 hour waiting period is absolutely ridiculous. The article says to download alternative stores but I thought they too are impacted as it is the installation mechanic.
The waiting period is the best way to combat coercion. If I’m setting up a new phone, the setup already takes multiple hours that adding 24 hours doesn’t really mean much. It does a wonderful job of making sure you actually really want this app.
What about when you're not setting up a new phone? A waiting period doesn't combat coercion. Look at the people who have been kidnapped and held for days because the ATM has daily withdrawal limits.
> The EFF calls app gatekeeping "an ever-expanding pathway to internet censorship."
I think what's interesting, and what our grandchildren will look back on, was how naive the early internet was. There was almost this sense of "the government is powerless" whether it be piracy or jailbreaking or casual death threats [8647 style] or who knows what else. Combined with also a sense that devices will always be exploitable, there's always a way around, resistance from government and corporations will always be futile.
This is not the problem it is presented to be, and I see more benefits to this than prejudice.
There is a very concerning amount of illegal apps/scams distributed through ads that I've casual users install somewhat banally with the aid of short walkthroughs.
Any sufficiently advanced user is barely affected by this, as the procedure is just complex enough to block average people from getting scammed/using illegal services unknowingly, but simple enough to barely be an inconvenience for anyone who cares enough and can go through it.
"This is barely an inconvenience, it's just a 9-step, 24h-long step through a proprietary service, and mandatory sign-up with governmental ID for the developers, everyone technical enough can easily bypass it"
I believe this is usually referred to as "boiling the frog".
it's not hard to imagine Google stating "we're removing this opt-out path because next to no-one uses it, and it will help streamline Android, which will protect the children!"
This sort of breathless outrage rhetoric would be a lot easier to take seriously if it spent even a minute acknowledging the very real risk to users that this is meant to mitigate: tech support scams where people are walked through installing an app that takes over their phone and steals their money, private data, and identity.
You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.
Tech is cool, but it's not an end in itself. Serving people should be. And if people are getting hurt, it's not working well, even if those people are not the ones that read Hacker News.
I am certain that its not about harm but rather US supremacy doctrine. They are tightening their noose. You have to be approved to live in their digital world and pay rent.
Yup.. thats what I think.. little steps towards monopoly worldwide. How did the current admin came about? why are these lakes of gulfs are being named America-yada-yada then and the private corps had the legal rights not to do it. Who do you think backs them up to collect rent worldwide and appose any regulation that reduces their hold? They want access and full control; that's whats about.
I remind you that Ai can reverse compile and find viruses and crap and they could have tested multiple gazillion apps simultaneously even before Ai.
Being naive is one thing and that is fine but trying to advocate naivety is something else.
In my opinion, its about collecting new money and forced compliance worldwide to collect more and more. Every software company wants to collect rent from around world and that is why they are tightening their noose once their they know that they have some form of monopoly. It is not just mere accident in universe.
It's like locking people out of their own home, and then when people express outrage the concern troll steps in from out of frame to point out that they're not acknowledging the very real risk that if they could access their own house gasp they might accidentally let the wrong person in, or break something, or whatever.
Many scams are committed thru apps like AnyDesk, TeamViewer, RustDesk...
That are apps already in the store. That is a very cheap, easy, proven way of doing it.
Fear, uncertainty, and doubt is a propaganda technique that tech companies have used for long against open source and competitors. The propaganda is to pretend that a 24 hour cooldown and making it difficult to install externals apps is for the good of the user meanwhile stealing their data and giving it to anybody that pays for it.
People are getting hurt. Mass spying should stop now.
Or even Whatsapp, which people already have installed on their phone. No need to go to the store to install anything.
A scammer managed to convince a relative to share their screen during a Whatsapp video call. Luckly, said relative didn't use banking apps on the phone, the bank rejected as suspicious the transaction on the computer which would have sent money to the scammer, and the relative asked me for help before going to the ATM to unblock the account (I then contacted the bank and had them fully block the account as a precaution, and told my relative to go to the bank branch the next day to change the passwords and unblock the account).
2) don't put it on a timer. What's most damning, in my opinion, is that this is the very definition of a bait-and-switch. Any rational person thinks this won't apply to their existing phone because it came before the rollout, right? It's only android 15 and onward? No. That's wrong, it'll apply to YOUR phone. Google. Non-Google. Doesn't matter. Android 12, 13, 14? Nope applies to them all. That's just an accident then?
Phone carriers can't be bothered to police their networks to mitigate flagrant bad actors, who can't be shut down by state law enforcement, so your software company needs to take control of your device away from you. "For your own safety."
It's just a public confession that none of these organizations - not the carriers, not the government, and not Evil Google, are fit for the responsibilities they've claimed.
Huh? You’re arguing for carriers to inspect all traffic to block scammers? That’s way more intrusive than google blocking sideloading. The outrage on places like HN would be deafening.
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
The propaganda I'm seeing is coming from Google. I can't tell you how many times lately I've seen ads on TV/streaming pushing the security narrative for Play Store. Google knows what it is doing is blatantly anti-consumer and they very much want public sentiment to think it's not.
There will always be means to scam individuals through technology. Pulling stunts like this is not justified simply because it closes off one means of doing so.
I don't think you can just do anything you want in the name of security and protecting users. This will make installing apps needlesly difficult. There is already a warning when enabling installation of apps from unknown sources. That should be enough. If users don't read that's on them.
The real problem here is not that Google is doing this bad thing. The real problem is that they can do this bad thing. They shouldn't have this power. Something needs to be done to rain in Google and take back Android as an open platform.
Users don’t read warnings. Most scams capitalise on urgency. When given more time to stop and think something through, it often becomes obvious what’s happening.
Courts make you liable for results, not intentions, like the way Quad9 is now an illegal piracy operation in France because it doesn't block pirate sites.
If you had a big corpo being affected by every knife murder, you'd be sure that they would be liable. Since murders usually "only" affect an individual nothing is being done
First, courts do hold manufacturers responsible for manufacturing or design defects.
Then, generally, "software is just a tool like a knife" doesn't hold because software today is more a service than a tangible good. Companies continue to update the programs and things can happen in the cloud with limited user control.
Nobody reads warnings or errors. StackOverflow is full of questions where someone pastes a clear error message and asks what they have to do when the very error message tells them the solution.
Also, scammers just tell people to ignore warnings and they do it. If someone is able to convince you that your child is in danger and that you have to bypass all warnings to help them, you _will_ do it.
Should Google be less than an asshole in all things? Yes.
I think there’s this like “something must be done now!” attitude of self-important, busybodies I can’t get behind… even if they’re right.
Why have people convinced themselves into thinking now is the most important thing in the world? That if it doesn’t happen now so that it makes me happy instantly it isn’t an option?
Evolution; social, tech, biological, legal, just fucking takes time, and that’s a feature.
There will be a period in which there’s a ton of food over there but your little fishy fins can’t get to it, and that sucks, but deal with it yourself, or just chill and let things happen. I promise if it’s important someone will solve it eventually and the scales do not need to be tipped for every little thing like phone app permissiveness.
In the meantime, you are free to not buy an android phone if you don’t like the system that Google has produced. You seem to think that because you can see its insides that it is collectively owned. It isn’t. Google owns it. Talk of talking it from its owners, is theft. In this case, justified entirely because you don’t like a process they decided on.
Don’t make me defend Google, I fucking hate Google.
I have huge incentives to have a phone. It means Android or Apple. not exactly a flourishing free market of choices. Banks, the government, places I want to go to all either force me to use an app, or create costs in money and time if I want to avoid using one.
> That should be enough. If users don't read that's on them.
The phone scammers who are saying the FBI/NSA/IRS will arrest you unless you install sketchy remote access software or other malware are rather convincing to a certain demographic of people and no amount of text on the screen will stop that. It all comes down to whether or not you view the tradeoff being that vulnerable people are worth protecting with this measure worldwide or not.
You understand then that there is absolutely no possible fix for that right?
If your grandma will follow current instructions, she will follow these new instructions including a 24 hour wait.
Your grandma will follow instructions to walk down to walgreens and buy a brand new device if they tell her. The solution has nothing to do with the device and everything to do with you needing to be an adult and figure out how to get your grandma to not follow directions of scammers.
This isn't a tech problem and you cannot solve it with tech.
This is not true. Scams rely on continuous urgency and want the entire process completed without you ever hanging up the phone, and cooling-off periods routinely break the illusion.
I can think of 2 examples, in my personal life, in the last few years where a simple passing comment in conversation perked the ears of a more experienced person and kept a couple of young people from being scammed. The addition of time was key in both.
There is a very real usability issue that has to analysed when developing high risk products, and that's popup fatigue.
A huge number of people just click accept to any popup they get because they're so fed up with seeing them. It's something that is often analysed in design of medical products
I experienced this problem in semiconductor manufacturing.
It was really difficult to explain to Korea that the additional warnings they wanted me to put in front of the tool operators were actually causing more harm than good. The cultural divide made this really difficult to approach.
"What do you mean the American mfg staff don't actually read everything?!"
"Yeah... Especially at the ATX line. We kind of go off vague shapes around here"
> Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.
The best solution would have been to be able to mark ANY alternative app store like fdroid as trusted and no such cooldown period would hit every time people install an app from there. This avoids that people can immediately use installed apps downloaded from an arbitrary URL but at the same time keeps the alternative app stores as a good alternative. Google decided to play unfair again.
Oh, ok, thanks for the information. But if it is a one-time, device-level wait, not per source and not per app, then I'm unsure how this should prevent scammers in the long term?
I'm pretty convinced it is just Google testing boiling the water steady and slowly :)
Scammers often create a sense of urgency/emergency, especially over the phone, and putting a 24hr limit on it gives the person more time to possibly realize they're getting scammed.
It's not 100% perfect, but it helps reduce scams. And with AI, scams are probably going to get more frequent and harder to realize it's a scam.
If you know you want your phone unlocked, just start the process as soon as you get your phone, and then it's yours. It's like an extra day of shipping.
-
Edit: Google explains this more:
In these scenarios, scammers exploit fear – using threats of financial ruin, legal trouble, or harm to a loved one – to create a sense of extreme urgency. They stay on the phone with victims, coaching them to bypass security warnings and disable security settings before the victim has a chance to think or seek help.
According to a 2025 report from the Global Anti-Scam Alliance (GASA), 57% of surveyed adults experienced a scam in the past year, resulting in a global consumer loss of $442 billion.
> It's not 100% perfect, but it helps reduce scams.
We don't know that, as it's not even live yet.
In fact it might even open a whole new market for 'unlock scammers' who do the initial groundwork and then sell their vulnerable mark to the next scammer.
That is a real concern, but I don’t for a minute believe that it’s Google’s only motivation. This is also securing a revenue stream and making it harder for others to compete.
Full disclosure, I am an iPhone user in part because I personally like living in the walled garden. But I also acknowledge that it has its downsides. I have a separate Android device just for language learning because the open source language learning app ecosystem is basically nonexistent on Apple’s locked-down platform. I’m not thrilled about the possibility of that ecosystem withering and dying on Android, too.
This sounds like know-it-all propaganda as well. Why not make it opt-in? Google (and other Big Tech companies) seem to think they know better than everyone else, even though they are also completely untransparent about what they do.
After researching this for some time, the majority of scams are perpetrated with apps that are already in the Play Store and are remote access apps. The entire premise that the Play Store is safe and everything else is dangerous is not borne out by the empirical evidence.
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
I would turn this right around and say that until the proponents of this measure acknowledge that the Play Store is not safe and is in fact a primary vector for scams, you're just doing propaganda.
It's exactly the same as the people crying conspiracy about parts-locking for repairability, not acknowledging the real effects it had on phone thefts and the pressure at the national and governmental level to help solve the epidemic.
There is already many warnings and if the can get you to do that they can get you to other types of scams rather don't require installing an app like sharing data, putting info on websites.
When I was still on android, I installed F-Droid to avoid the google app store entirely, since the google app store's vetting is -uh- not very good.
The correct move is to remove the (icon for) the google app store from inexperienced user's phones. (I'm dead serious, and it works)
Unfortunately, that's exactly the move that now gets sabotaged by this google change.
So sure I'll acknowledge the very real risk to users that this is meant to mitigate. It does in fact marginally mitigate the precise narrow risk they state, but introduces a fatal flaw in its place. Probably unwise to let naive users use android at all anymore after this.
Sorry, I get where your emotions are coming from with this, but it is just technically wrong on every level.
The vast majority of tech support scams come through apps on the Play Store. Not only that, but malicious apps get approved on the Play Store constantly.
There is no reason to take any claim that this change is meant to mitigate scams seriously, because there's no evidence to support that it makes a noticeable dent in such activity.
What this change does noticeably and impactfully do, is prevent, via chilling effects, users from being able to use their phones in ways that could lose Google and its partner vendors post-sales revenue.
As you said, serving people should be the end in itself, and this change doesn't do that - it hurts people.
I'm somebody who likes lifting weights. I often lift weights heavy enough that, if done improperly, could harm me greatly and grossly.
There are people at my gym who often have very bad form who I worry about. I will occasionally chat them up so they're not, for example, shoulder pressing with their arms outside of the scapular plane [0] or benching without any arch in their back [1]. Sometimes they appreciate it and ask me more questions. Sometimes they give me a terse 'thanks' and go back to doing it the way they want to do it.
If somehow every gym started forbidding people from using any equipment with which they could harm themselves unless they could prove, with a 24h cooling off period, that they knew the form and dangers in detail, I'm sure it would probably save a few people from suffering temporary injuries. I think it would also drive a lot of people away from any kind of sustained resistance training and be an overall net negative for public health.
Personally, I don't think such a nanny-state implementation is necessary? That you should be able to easily toggle off such a feature if you like and what happens to you happens. Perhaps there should be a 'tech-illiterate' mode toggled on by default but easily toggled off if you know how to access Developer Options with a little more forewarning about common scams. Perhaps gyms (or Google) could pay people to proactively assist and help people they see as the most vulnerable to certain kinds of exploits. Perhaps instead of spending time training Gemini to be a general-assist LLM they could train a very small local model to hyperspecifically guard against known intrusions.
There are so many more pro-social, less-draconian ways of tackling safety issues, from socialization to ongoing support to education efforts. A lockdown that just happens to also help ensure that they can extract their pound of flesh inside the abattoir that is Google Play seems at best overly protective and at worst just more corporate extraction of surplus value from individuals.
If that's really what it is, Google should put their money where their mouth is. I'd be ok with this change if you had to go through all the same hoops to install apps through the Play store.
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
I strongly agree with this statement.
If a piece of public communication is intended to sway the reader's opinion without informing them (or while selectively informing them, which is close to the same thing), it is propaganda.
> I think the 24h cooldown is an excellent compromise
I don't. An hour would make the same point and provide the same level of protection. So would clicking through a few screens with very simple and easy to understand warning messages about the risk of scams. Sure, it's a compromise, but it's pretty much the opposite of excellent.
A scammer would stay on the phone for an hour so they don't talk to anyone else about it. A few screens would be ignored.
24 hours might not be enough, and there is a risk that a scammer gets a user to go into developer mode and then calls back a few days later to try and 'fix the issue' or something. At least in 24 hours the victim might talk to someone about it and then find they're being scammed.
The topic has been discussed multiple times, and propaganda really feels like not acknowledging past discussions. You might not have seen past discussions so I'll give you a pass and restate my argument.
One important way that scams reach end users are through the willing participation of ad platforms, and even before DSA (not that much has changed) people (myself included) have done countless reports of straight up scam ads with no recourse and a templated "we have found nothing wrong with the ad".
As a data point, have you not seen the Tai Chi AI ads on YouTube that will "make you a different person by the end of the week" which where run by a company that sold you a subscription via dark patterns with all the surprises that brings (like a big headache of an unsubscribe process).
Or the fact that Meta knows that X% of it's ads are scam/phising and do nothing about it because it hurts the bottomline (an AI chat will help you with references).
The hypocrisy is too much coming from Google since they are owners of the machine that feed scams right to your doorstep.
And let's not ignore all the other fronts they are fighting on to further lock down the Android platform (such as not making source available immediately and moving more of the runtime in their play services and platform integrity nonsense).
I'm fine with this as long as F-Droid and other stores are treated equally.
If I have to wait 24h to install an app from another store, I demand the same to apply to AppStore. I see app stores just like browsers: users must have the ability to choose which browser they want when installing an operating system, and for Android, users must be able to select which app store they want and they should work the same way.
> the very real risk to users that this is meant to mitigate:
The risk of people cutting themselves is not a responsibility nor a concern for the knife manufacturers. I would be very upset if one day all kitchen knives would be sold blunt just to mitigate some clueless people from cutting their fingers off.
Similarly, I seriously and absolutely don't get it why people falling for scams should be a reason to require KYC to distribute apps.
Especially given that KYC-passed accounts are easily obtainable online for pennies.
Uh it absolutely is a concern and a responsibility . Different knives are made the way they are precisely to avoid people cutting themselves accidentally during various kinds of cutting motions. Additionally blunt knives are significantly more dangerous than sharp ones which is why they don't ship blunt ones.
Maybe before trying to go off half assed exactly like this outrage website does, you should take 5 minutes to be bothered to see if what you are saying is even mildly correct. Even five seconds of searching would tell you pretty much everything you wrote is wrong.
Lots of things are compromises intended to serve multiple goals rather than just drive one particular goal to the extreme. In that sense knives are exactly like what is happening here. You may not like that. But it is at least accurate, unlike what you wrote
This is nothing but a business decision to extort money from developers and you know it. It's anti-competitive at its core, locking out other, more reliable app stores and taking control of an open source operating system. It's just one more measure in a long trend of fulfilling the wet dreams of large tech, namely killing personal computing and controlling everything people can do with devices they've bought.
So Google is going to tackle scams on youtube too right? Because they care so much about the poor scam victims, and this has nothing to do with establishing overarching control.
I’m all for trying to stop those who are getting harmed from being harmed, but at what point do we acknowledge the ignorance of those people? Installing random apps, provenance truly unknown, to your phone is a bad idea because of the security risk in doing so. I’d have the same advice for someone operating a windows PC. Don’t be downloading and installing random .exe to your environment, you’re gonna have a bad time. The former seems to be this mysterious new idea, unable to comprehend. Most people seem to know the latter and you get flamed for admitting “I installed this random .exe recommended to me by this dude on the phone who said he’s helping me.”
People gotta learn. Sometimes the best teacher is pain and suffering. I wish that weren’t true, but in my time on this planet, there has never been more truth to “you can lead a horse to water, but you certainly can’t make it drink it.”
Trying to save people against their will just doesn’t seem the best path. I’d rather more effort be put into education on best practices, or investment in an app sniffer that can try and identify common attack vectors. Idk, anything other than “some people are too stupid for their own good, so now we all have less freedom.” I mean truly, if you’re worried about grandma’s phone safety, only let her buy an iPhone. No android for mi-ma.
All I see here is Google snatching at the opportunity to get some of that scrumptious walled garden money.
> This sort of breathless outrage rhetoric would be a lot easier to take seriously if it spent even a minute acknowledging the very real risk to users that this is meant to mitigate: tech support scams where people are walked through installing an app that takes over their phone and steals their money, private data, and identity.
1. Is requiring developers to submit government ID actually an effective way to prevent tech support scams? Will scammers actually be deterred by a government ID requirement in addition to the existing developer registration process?
2. Is requiring developers to submit government ID the best option to prevent tech support scams? Are there other options that Google could use to make Android user less susceptible to tech support scams?
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
The tradeoff, such as it is, is acknowledged on keepandroidopen.org under the "But wait, isn't this...just about security?" section:
> The security rationale is a smokescreen. Google Play Protect already scans for malware independent of developer identity. Requiring a government ID doesn't make code safer.
Finally:
> Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.
I don't think this is an excellent compromise. Scammers are persistent. I'm not convinced a 24 hour cooldown is enough to deter them in any meaningful way. I, on the other hand, am not persistent enough to wait 24 hours to install an Android app from F-Droid just to try it out.
>You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
There is a third position beside "I agree/disagree with the tradeoff", which is "I don't consider the tradeoff as stated truthful and refuse to frame the conversation that way".
Every closing of rights comes with a legitimate-sounding reason. Protect the children, etc. Most activist have been through this process enough times to see the play coming a mile away.
It is also surprising to see, on a place called hacker news, people defending closed systems and removal of agency from end users by giant corporations.
> There is a third position beside "I agree/disagree with the tradeoff", which is "I don't consider the tradeoff as stated truthful and refuse to frame the conversation that way".
Thank you. When you see it once, it becomes so obvious everywhere else. Every single time it's just assertions without hard statistics, always perpetrated by the side that also happens to profit from it or accomplishes something else they really want to do. I'm not going to deny that the number of people who get scammed through sideloading isn't zero, but I don't have to accept as unwritten fact that these lockdowns are actually about that, or that this number of people is significant at all compared to everyone who just wants to install off-Google Play apps, like what Google implied and almost everyone here just accepted.
> It is also surprising to see, on a place called hacker news, people defending closed systems and removal of agency from end users by giant corporations.
The suddenness of the shift is shocking. One of my most popular comments, from no more than several months ago, was about this very topic. It was about the way Google will, like all other corporations, slowly ratchet up their 'measures' until there's no way left but their way. I basically just retold that comment here with very few real changes, and it's already greyed out at the near bottom of the thread. But the shift itself isn't unexpected. Lots of people here aren't the customizer, tinkerer, off the beaten path kind of 'hacker', but the tech enthusiast kind. Lots have direct links to Silicon Valley and the tech overlords of today. As the tech industry consumes everything else in the world, their rhetoric shifts from "Look at all these things we'll let you do!" to "We own you", so does the average sentiment of the users.
Why do we keep having to sacrifice our freedom for the fake safety of the ignorant and their continued freedom to be ignorant?
Why do we have to be lectured on how important this change is for their safety, while the Play store continues to be the primary location scam apps come from?
When do the companies get to be the ones that have to give up their own freedoms in favor of everyone else's safety?
Googler propaganda. Huge majority of scams is through play store apps and AdMob ads. Google doesn't care about scams, they care about control and sucking up money.
Filippo, I'm rather surprised and disappointed to see this come from you. I'd much rather see Google working on preventing abuse of apps already installable via the Play Store, instead of imposing restrictions on those who do not want to use their store to begin with.
I don't mind warnings and even brief cool downs but 24 hours is ridiculous.
If I lose or break my phone, I have to wait 24 hours after acquiring my new phone to use the apps I previously used? It's just absurd.
If I had to explain to clients that I was unable to do work until tomorrow, I'd be ridiculed.
These scams regularly go on for days anyway. Now the scammer just gets them to install it and says "we'll call you back tomorrow to finish getting rid of the viruses"
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
I would argue pretending like this is actually for anyone's security is propaganda hiding the fact that this is all for Google to tighten its grip on Android.
Personally, I'm sick and tired of dealing with corporate overreach based on the excuse that so many people are too stupid to operate the device responsibly.
I'm on a 3rd party, no goggle account, AOSP built OS. So I don't think this immediate change in 2027 will affect me.
While AOSP is a current workaround, this whole ability to build a non-goggle android via AOSP is also under threat from goggle lockdown.
That means this trend of having to part with the OS intended for the too stupid population is only going to increase.
So, needing to depart from android completely is in the near term.
Linux phones become ever more usable, including android in a jail.
The phone was never yours. You have a nice, granular set of permissions which (attempt to) control what apps can do ... but you don't really have any permissions that prevent you from _Google_ spying on you and selling your data or giving it up to law enforcement. It's like the propaganda radio you can turn down, but never off. You're given just enough control to feel like you have a choice.
I guess the an alternative open unix based operating system that can upload existing apps from both android as well as apple is needed or the greed will not ever end. This is about corporations that constantly need growth using new ways to collect rent from the rest of the world. They are chocking the world to collect new monies.
They are recommending installing F-droid.. and not accepting android's demands. Its time to have open source smart phone operating system that can not be taken hostage.
The problem is that these OSes have achieved regulatory lock-in. Your bank app won't work on an alternative OS because it's not trusted. In some countries that means you can't access online government services through the standard path either.
I switched to GrapheneOS this week, and it looks like I lucked out with my country in that regard.
Government digital signature app fully trusts GrapheneOS since it uses hardware attestation rather than Play Integrity, so I have access to all government services.
My bank's app runs on GrapheneOS but doesn't fully trust it. Device is labeled as insecure, biometric login is disabled, and transaction limits are significantly lower, but is otherwise functional for daily use.
Bank accepts logins authenticated with government digital signature app, so I can use that to login into the bank's web app and make transactions without reduced limits there.
The bank's app relies on Google Wallet for contactless payments, which doesn't work on GrapheneOS, but it looks like there are workarounds for this like Curve Pay that do work on GrapheneOS. Haven't tested this myself, since I just use a physical card.
This is increasingly becoming the case. There have been a few posts on Reddit of people successfully porting Arch and other distros to phone hardware (typically seems to be OnePlus?). My handheld game console, a Snapdragon 8 Gen2-based Android device by Retroid, just got official first-party support for running Linux on it.
Regulation by 3rd parties. People use phones for payments and accessing sensitive services. But these apps work only on Android / iOS. There those who don't seek this use case, but there are rather small and increasingly shrinking minority. This is compounded by the knowhow needed to install non-stock OS on phone in the first place.
But I mean what are you saying really? An iPhone absolutely doesn't allow you to just randomly install stuff from the web unless there's been some update that I don't know about.
We don't know that it's once per device. It's been said by Google that it'll be once per device, but we haven't seen the code and we don't know the method of tracking that. What if I wipe my OS? What if I wipe data in play services? Will a future silent play services update conveniently break my p2p messaging app during a protest?
Free install by ADB, and Developer-moding once per device, not once per app / install? Yeah, OK. I don't quite get the outrage, then.
Before you @ me, HN, I run GrapheneOS. I fully understand and practice "own your own hardware". Most people probably shouldn't, though, because they lack the technical ability / interest to do so safely, and throwing them to the wolves strikes me as ideology pushed to the point of foolishness.
People are more worried about the inevitable tightening of the noose that will happen from now on. 24 hour delay is just the start IMO. Eventually it will be adb only. Then adb but only valid for a week, like Apple...
You can still install unsigned APKs via ADB. Or you can install unsigned APKs following an initial 24 hour wait. Or you can install APKs on non-Play Protect devices
Or the adb escape hatch. IIRC, their adb equivalent is limited to having a small number of apps installed at the same time, needs each app to be periodically reinstalled at short intervals (IIRC, one week), and you need to have your expensive Apple laptop with you for that reinstall.
Even with Android becoming much more closed, it's still more open than Apple.
> Having a small number of apps installed at the same time, needs each app to be periodically reinstalled at short intervals (IIRC, one week), and you need to have your expensive Apple laptop with you for that reinstall.
Not true if one pays up ($99/yr), in which case the interval becomes one year. Also apps that sign and install other apps with one's cert exist.
I said for my family. I will likely still be buying android for myself, probably the grapheneos one if it comes out.
But for most people, the existing flow to allow external sources is already too much. For other people to install my APKs, while possible, is a slow and painful procese. Add waiting 24 hours? As good as blocked.
I moved to Android in 2022 from the iPhone ecosystem. I've been thru one phone replacement cycle and it was glorious. I got by without ever using Google Play and never had to tie my phone to any "ecosystem".
I had "sideloaded" all the APKs for the software I used on the old phone and saved the APKs. Moving to a new phone was just a matter of loading all the software and copying my rsync'd backups onto the new phone. It was wonderful. Just like moving to a new PC.
I guess I'm happy I got to have this experience for a little while.
Edit: I've found a few apps I can't used because they require Play attestation. Eventually I'll hit one of those that I need and I'll be at an impasse irrespective of this particular power grab.
I am using a Pixel 7 now, bought specifically to ensure I can run Graphene, but there is a high likelihood I will be getting a Moto phone for my next one!
Note that GrapheneOS won't be supported on current Motorola phones. Only the yet to be released models with the new Snapdragon flagship SoC like the Signature 27 will be supported. Others, don't meet the requirements.
Good catch. I wouldn't want people to get that impression. My reference to being a current Motorola Customer was a statement about liking their build quality (and their not being Google).
I've already said this, but here is roughly how this progression is going to go:
1. You own your device and can install anything you want on it (what we have today)
2. Google gently yanks you away from the simple workflows, leaving you with ADB or their 24 hour hoop to jump through. If you opt for the second, you get a choice between allowing 'unverified' installs for 7 days or indefinitely. Huh, that's weird, who would ever pick the 7 day option, right?
3. The dust settles and some time passes. Google decides that the indefinite option is just way too dangerous, the users are not safe if they are allowed to use this freedom. They'll just claim there's countless clueless grandmas getting entangled in multi-day-long scams that hinge on the sideloading feature, and they simply can't let them suffer so much. They will generously disable the 'indefinite' option.
4. 7 days may still be too much, maybe the sensible decision is to move to a 24 hour countdown per app. I mean, if you want it so badly, you have to work for it - that means you'll have more time to mull over the security of every single app you put on your phone.
5. Huh, for some reason it looks like almost no users are installing apps from outside Google Play anymore. We'll keep the feature on life support for a while, and then retire the legacy unverified installation workflow, to be replaced by a temporary limited permission for verified developers to briefly install their own in-development apps on their device. That ought to be enough.
This pathway for extinguishing features that are inconvenient for massive corporations isn't new. I really do not understand how everyone supporting Google's side here doesn't see this, and why they're so willing to wholeheartedly and without reservation believe them on matters of security where pushing one opinion also happens to conveniently align with their profit motive.
I hope that at step 4 this choice will still be as easy as it is today. When we get to that level of lockdown (which may take some years, but we'll get there), it's entirely plausible that Google will move to restrict bootloader unlocking on any phones that ship with Google services. It is 'more safe' after all. That will limit you to the niche of old or special de-Googled smartphones from small manufacturers, or maybe some Chinese market phones. All of this of course also comes with loads of their own anti-competitive kneecapping - you'll lose all attestation or 'integrity' features, so any feature or app that decided it was important enough will no longer work for you, which will probably be the vast majority of them by that point.
No matter what you do, it will never be as good as it once was. We've moved from a world where custom, 'hacker' type stuff could coexist with convenient apps and corporate or government services to a world where anything custom or unauthorized effectively doesn't exist, except for a few restrictive and mangled exceptions that require a lot of pain to get to and limit your device in many ways.
The thing that this enables are governments locking down apps used for protesting, e.g. Indian government petitioned to take down the „BitChat“ app by Jack Dorsey, as it was (successfully) used to circumvent the mobile carrier shutdown: https://en.wikipedia.org/wiki/BitChat#Usage
To echo other comments, it would be really good if posts on this subject were more complete about the details of what's happening if for no other reason thаn it's difficult to understand the situation without those details. I'm pretty anti-corporate but it's hard to be anti-corporate without a level, complete picture.
Concretely in my case, I read all the fdroid materials that were linked to from the fdroid pop-ups and they left me hanging, trying to understand what was actually happening. I finally looked it up, and what I found was a lot more clear and actionable than what was communicated by, for example, Fdroid. Obviously Google's motives are clear, but I had to work pretty hard to figure out what was going on.
This style of communication is what will will undo graphene and fdroid and all these other organizations because it's just not useful, professional or appealing.
What does GrapheneOS have to do with the post or the website? We didn't make the website nor did we help with its messaging. We agreed to be listed on the website, but we describe the changes differently when it comes up in our community spaces, when asked via email email, or otherwise.
"Starting in 2027, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID."
Will not apply if updates are blocked
Good to have old phones, i.e., not primary phone, where user can block updates
Some users may want a portable, pocket-sized computer that the user can reasonably control (old phone) in addition to one controlled by Google or Apple (primary phone)
Maybe think of it like an "A/B test". Primary phone with the update and old phone without the update
For some users, the "threat model" may be Google and the long list of its government, corporate and other partners
Maybe some users just want relief from data collection, surveillance and ads
Not every user is the same
Some (not all) users may be willing to sacrifice some alleged "security" provided by an ad services company (wtf) in exchange for more _user control_
This will not arrive through Android updates but through Google Play Services.
You can try to block Play Services using DNS trickery, but it's like whackamole. The only way to be guaranteed safe from this update is to run a ROM without Google services installed.
No "DNS trickery" is required to block this update but the user does need to control the phone's access to DNS, obviously. Users concerned about "keeping Android open" are probably doing this already
It's the user's phone. The user paid for it. The user pays for the internet connection. The phone belongs to the user not to Google. The user can control traffic to and from the phone if he so chooses
I have been blocking connections to Google servers, e.g., "updates", Google Play Services, and many, many others, on old phones for years. There are many ways to do it
For example, a local forward proxy works well; I run proxies on the phone and on the gateway
Blocking can also be done using only Android apps, e.g., Netguard, etc.
Just to highlight as this often gets misreported when this is raised.
You will still be able to install unsigned APKs, but the first-time procedure to unlock the ability will include a 24 hour wait. After that, unsigned APKs can still be installed as usual
And APKs outside of the Play store can still be distributed unsigned, subject to the 24 hour wait for Play Protect devices
Honestly, I'm less concerned with the initial wait and more concerned about how this is run entirely through Google Play Services, leaving Google with the ability to alter the deal next time they have another benevolent security decree.
This is just the beginning. Whine much as you (we) like, Google was absolutely prepared for our complaints and pushback when they made this decision. And no amount of our feedback changed their path.
Thus, we should absolutely expect next steps for Android to slowly go into walled garden mode: no dev unlocking for certain devices, dev unlock after mandatory KYC, etc, etc.
> Starting in 2027, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID.
Android is owned by Google, so in all fairness they can do whatever they want, so they don't need anyone consent.
It took about 2 years. April 1998, Larry Page and Sergey Brin [0].
"Currently, the predominant business model for commercial search engines is advertising. We expect that advertising funded search engines will be inherently biased towards the advertisers and away from the needs of the consumers... we believe the issue of advertising causes enough mixed incentives that it is crucial to have a competitive search engine that is transparent and in the academic realm."
For the defenders of Google's (and previously Apple's) behavior, I'd like to point out that if any of this was for the sake of security, developer ID certification would be left to an independent international organization and not be under company control. That would also clearly have legal advantages.
That's how it's done with domain names, with security advisories and disclosures, etc. That they don't do it for developers shows that it's about control and anti-competitive business behavior (preventing other app stores).
IMO a more precise framing is that what is being removed is the ability of anonymous developers to have wide distribution on Android devices. That is, after these changes, you (as an app developer) can either:
- be a registered developer, and target all Android users (Google Play Store, F-Droid, distributing .apk files, etc), or
- remain anonymous, and target only a subset of Android users (all "power users" who do the one-time 24-hour cooldown, or a small number of users if you use the student/hobbyist path, and of course anyone can install their own apps on their own device with adb).
No, no it is not. If Google didn't love these changes, they'd do what Apple does with the EU. Malicious compliance, or at worst, only complying there. The LLM providers do the same.
Google loves, wants, and has instigated these changes. They are not being rolled out because some governments are asking for them. Those governments would never have specifically asked for these measures anyway; they'd have asked "can you reduce these scams?". And if Google had wanted to act on this, they wouldn't have done this either because they know that the overwhelming majority of these scams are from Play Store apps or from ads, often through AdMob itself, never passing through non-store apps. Those are a sliver of scams.
That's fair; there is some slight evidence in the linked comments of pressure from those governments, but you're right, Google's own comments show it agreeing with the principle. E.g. they say that identifying and banning malicious apps isn't very effective if the developers can make slight changes and distribute modified apps immediately. So the basic idea of anonymous apps having wide distribution is what is being targeted.
I don't think users are as susceptible to scam as companies portray. I also think an hour of class at school will teach people enough. In fact, people grew up with Internet don't even seem to need that.
Nowadays it seems that there's dumbing down of everything. Don't let technology replace education and common sense.
Not trying to go to bat for Google here, but this smells to me like them trying to abide by Know Your Customer regulation.
I don't love it either, but "why doesn't Google just ignore that regulation?" doesn't seem viable. (Companies only ignore laws when it's profitable, of course.)
Google started that push some time ago [0], this is a different policy. How does that require preventing the installation of unknown-to-Google apps on devices that belong to unknown-to-Google users?
And how is a 24-hour wwaiting period related to KYC, when it doesn't require a user to pass an ID check?
A 24-hour wait (or "cooldown period") prior to installing the F-Doid app doesn't require an ID check, just patience and the (IMO delusional) belief that Google will never tighten up that workaround. You might have to expand on how this is in any way related to KYC
Will this affect Shizuku + InstallerX Revived? I mean worst case I will disable gapps or even better finally unlock my Xiaomi bootloader, in the last 15 years I've had unlocked bootloader (or at least root) on pretty much every single device, it was just too troublesome to unlock Xiaomi though there is already offline workaround so might as well do it finally.
With SafetyNet the phone already hasn't been yours for years. Banking apps and weirdly a lot of public transit apps and random games refuse to work on rooted phones. I'd switch to iPhone but that's even worse, if there's an actual open phone ecosystem let me know.
[OP] NackerHughes | 19 hours ago
Every app and every device, worldwide, with no opt-out.
This includes apps shared between friends, distributed through F-Droid, built by hobbyists for personal use.
Independent developers, church and community groups, and hobbyists alike will all be frozen out of being able to develop and distribute their software.
Registration requires:
- Paying a fee to Google - Agreeing to Google's Terms and Conditions - Surrendering your government-issued identification - Providing evidence of your private signing key - Listing all current and all future application identifiers
If a developer does not comply, their apps get silently blocked on every Android device worldwide.
electric_mayhem | 19 hours ago
Aozora7 | 18 hours ago
nkjoep | 18 hours ago
The issue will be your bank, your gov, your uni, and school not releasing a compatible app for you.
And nowadays a device that cannot communicate or be trusted by other actors of the network (internet) is pretty much useless.
I hope those entities will wake up and start serving equivalents functionalities via the open web.
That is why we have the good old WWW for.
echelon | 18 hours ago
We can use AI to take back the entire tech stack.
Every moat, every walled garden, every infrastructure piece can be rebuilt with AI.
We're seeing it with desktop apps, with games. It will happen to infrastructure and platforms. I'm itching at the opportunity to build open cloud primitives and P2P social protocols.
We don't need big tech anymore. We just need to be able to run our models.
electric_mayhem | 18 hours ago
Who is Ford to tell me I can’t have a widget for each of my ford EVs visible at the same time? Or even that the single-car widget they do allow has has to be four times bigger than I want it to be, and waste screen real estate on dead space and things that I don’t want?
arsome | 17 hours ago
cheesemonk66 | 18 hours ago
contravariant | 17 hours ago
HybridStatAnim8 | 16 hours ago
cyanydeez | 17 hours ago
Can you imagine of those "de-banking" people actually existed and could read?
other8026 | 17 hours ago
In other cases, banks add Play Integrity checks to their apps, which is a more complex subject. In short, many banking apps check for the basic integrity verdict, which GrapheneOS can get. In other cases, the checks are not implemented properly, and GrapheneOS has a toggle which often gets those apps to work. Finally, a very small number of banking apps require the strong integrity verdict and the apps will refuse to run on GrapheneOS.
Although there are no statistics about this, it does seem that a majority of banking apps work or can be made to work with different compatibility toggles.
EvanAnderson | 16 hours ago
I have to use the awful thing, too, so if I go to GrapheneOS next year when, hopefully, a non-Google phone supports it, I'll have to carry two phones. Ugh.
other8026 | 18 hours ago
glorth | 18 hours ago
Honestly at this point, I'm just gonna start transitioning to Ubuntu Touch. The Android experiment has run its course.
other8026 | 17 hours ago
The narrative that GrapheneOS is so focused on security that it affects usability, especially given the context, is nonsense. The change that's being discussed here doesn't affect GrapheneOS or other non-GMS operating systems. The only affected OSes are the ones that install Google apps with privileged permissions.
If you want to switch to something else, go ahead. GrapheneOS is still a better overall choice.
HybridStatAnim8 | 16 hours ago
On stock OSs, google signs major portions of the OS and is highly privileged, which is impossible to sidestep.
Optional is obviously easier than impossible.
rjh29 | 19 hours ago
As it runs through Google Play Services, it's pretty likely they'll boil the frog and make it even harder in the future. Moving to an open platform is a good idea.
roosterIllusi0n | 18 hours ago
barelysapient | 18 hours ago
Vaushite | 18 hours ago
Volundr | 18 hours ago
StableAlkyne | 18 hours ago
I don't think Google is doing this out of some egotistical obsession over "control," it's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.
There are plenty of problems with walled gardens, but IMO this isn't one of them.
realusername | 17 hours ago
Maybe it's because direct installs are too hard to do already? Fortnite tried to go to that route and failed, if Fortnite couldn't make it who can?
And let's be real, I'm not going to accept any talk of "security" from Google when I type "chatgpt" in the search bar of the play store and I have an app with a counterfeit logo coming up at the top spot.
LtWorf | 7 hours ago
sureMan6 | 17 hours ago
We'd all be safest in a cage but no one wants to live like that
wolvoleo | 17 hours ago
So sanctioning Google means taking the smartphone away from 95% of their population. Which isn't going to happen.
Google is doing this because Google wants to.
catlikesshrimp | 17 hours ago
wolvoleo | 17 hours ago
It's also that that fraction is one they don't get any income from. We don't use Google accounts, Google apps or services etc.
So they don't get to track us as much except the few things you can't turn off in play services. Not everyone can work with custom rom (on those the new restriction obviously doesn't apply at all)
jasonm23 | 6 hours ago
ChrisRR | 18 hours ago
gsich | 17 hours ago
ChrisRR | 17 hours ago
superkuh | 16 hours ago
queenkjuul | 15 hours ago
Such as...?
0xdde | 16 hours ago
GrantMoyer | 15 hours ago
[1]: https://web.archive.org/web/20260312134021/https://developer...
[2]: https://web.archive.org/web/20260328133800/https://developer...
LtWorf | 7 hours ago
gnabgib | 7 hours ago
MinorTom | 2 hours ago
Though the only example I’ve encountered is the SumUp Business App’s Tap To Pay feature. If you use e.g. Geto to hide (automatically disable and later re-enable) the developer options, it works fine.
Volundr | 18 hours ago
extraextra | 17 hours ago
sam_lowry_ | 17 hours ago
rjh29 | 15 hours ago
ryandrake | 13 hours ago
hagbard_c | 15 hours ago
ButlerianJihad | 14 hours ago
It doesn't affect the phone's security in any way, unless you specifically tweak a security-related option in that panel. It doesn't degrade the device encryption or Google Play Services. I don't see how any app could balk while it's enabled. There are no apps I have that even run differently. I use the same banking apps and all the other things as normal, whether or not this mode is enabled for me.
j027 | 17 hours ago
I’m not sure if you would have to re-enable it every time to sideload updates or new apps. You can also install via adb with no waiting period.
petcat | 17 hours ago
Is this confirmed? If so, that largely removes my issue with the 24 hour waiting period for enabling/disabling dev mode.
kube-system | 17 hours ago
https://android-developers.googleblog.com/2026/03/android-de...
calciphus | 16 hours ago
wolvoleo | 17 hours ago
And my work doesn't permit it even with byod, it's so annoying. I've stopped running byod for that reason but now I'm stuck with two phones again.
kube-system | 17 hours ago
wolvoleo | 13 hours ago
In the early days of BYOD, all they could do is delete the device if it would be lost. Which was not really a bother to me because I back it up to my own servers anyway, and in that case it would be lost anyway. And they would enforce a few basic things like setting a decent pincode and device encryption.
But lately the MDM and antimalware solutions have become more intrusive. Recently my work's MDM complained about an app I had on the personal side of my phone, something they should have no visibility of. Also they now want to route all the traffic through their VPN to inspect it which was obviously a non-starter.
kube-system | 13 hours ago
Android 7 is when always-on-vpn was could be enforced by an admin, in 2016.
diggernet | 16 hours ago
wolvoleo | 13 hours ago
Besides, I would not comply anyway. I would just delete the device.
jasonm23 | 6 hours ago
again IANAL but be careful.
martheen | 17 hours ago
catlikesshrimp | 17 hours ago
What I am not sure is what will happen if I then remove the "google account" which I don't want in my device.
ChocolateGod | 17 hours ago
The amount of misinformation to scare people is alarming.
BoxwoodSeed | 17 hours ago
jacquesm | 17 hours ago
aembleton | 17 hours ago
jacquesm | 16 hours ago
fsflover | 12 hours ago
KMnO4 | 18 hours ago
Obviously this does not affect “every device worldwide”. I don’t have a single Android phone, and the devices I own that do run Android are not affected.
Eddy_Viscosity2 | 18 hours ago
Markoff | 17 hours ago
BoxwoodSeed | 12 hours ago
pessimizer | 17 hours ago
small_model | 18 hours ago
Georgelemental | 18 hours ago
fishgoesblub | 18 hours ago
user43928 | 18 hours ago
Despite Google's best efforts to automatically ban malicious developers, catching many legitimate developers in the crossfire, their store isn't exactly a bastion of quality or scam-free.
wolvoleo | 17 hours ago
I honestly doubt their "best efforts".
Fact of life is they make money off apps including malicious ones. For the same reason a lot of promoted content on Google search is clickbait and they even serve malicious apps. Money corrupts.
vlyan | 18 hours ago
I'm sure you will not object when that happens. you are not a murderer or rapist, are you?
graemep | 17 hours ago
small_model | 17 hours ago
tavavex | 17 hours ago
I hope this isn't satire, because it's hilarious how often when someone logically extends the arguments of the authoritarian corporate tech overlords until they turn into a direct retelling of dystopian nightmares from the past, someone pops up and goes "Yes that is my dream world, I would like that please"
queenkjuul | 14 hours ago
small_model | 14 hours ago
queenkjuul | 34 minutes ago
Thousands of murders are not happening inside private homes. Almost every single murder that happens in my city happens on the street.
Something is in fact wrong with you. You want political dissidents arrested for the fake safety of preventing nonexistent murders.
prmoustache | 15 hours ago
queenkjuul | 14 hours ago
ChrisRR | 18 hours ago
graemep | 17 hours ago
ChrisRR | 17 hours ago
deaton | 17 hours ago
hn_submit | 17 hours ago
hsuduebc2 | 17 hours ago
gnabgib | 12 hours ago
wellhowdoyou | 17 hours ago
RansomStark | 17 hours ago
Please don't use one loss of privacy to justify more.
Something, something, slippery slope.
tavavex | 13 hours ago
Google has no need to know who anyone is here. I want to provide an app, someone else wants to use my app, all entirely off Google's sacred platforms. We should be able to work together, but in comes a middleman who demands to see our IDs because he owns the platform and can just do that. That ID, of course, is digitally stored and will be retained indefinitely.
hansvm | 17 hours ago
dig1 | 17 hours ago
opengrass | 17 hours ago
fsflover | an hour ago
queenkjuul | 15 hours ago
foobiekr | 17 hours ago
I get the rest but I can’t get my head around people who find these two things upsetting.
queenkjuul | 15 hours ago
xquce | 13 hours ago
I have a company with both App Store and Play Store apps out, but when I wanted to use my Personal account to distribute a free app, it took with Apple 1 hour with registration and then one phone call to their EU Developer support to get approved. 4 months later and I am nowhere with Googles new system and have given up..
My app is now iOS and APK only, which mean no none nerd users on Android.
UncleMeat | 17 hours ago
WarmWash | 19 hours ago
If the legal system dictates that open = monopoly and closed = fair game, then you get dumb shit like this.
Probably one of the dumbest rulings in tech ever, but few people know about it. Basically set precedent to never share your platform if you don't want legal scrutiny.
npodbielski | 19 hours ago
phoghed | 19 hours ago
Rooster61 | 18 hours ago
pamcake | 18 hours ago
https://linmob.net/my-setup-with-danctnix-archlinuxarm/ (2021)
skeeter2020 | 18 hours ago
Two types of people will benefit: 1. the genuine & naive who want to help but don't make much progress; 2. those who attended Harvard.
npodbielski | 16 hours ago
goda90 | 18 hours ago
other8026 | 17 hours ago
ezequiel-garzon | 19 hours ago
ChrisRR | 17 hours ago
999900000999 | 17 hours ago
Keep in mind they’re crippling devices. You’ve already paid for, it’s not like I’m gonna go to the store tomorrow and buy a new phone with significantly reduced functionality. Instead Google is reducing the functionality I already paid for.
Markoff | 17 hours ago
queenkjuul | 4 hours ago
tosti | 19 hours ago
I'd just turn off my phone before midnight, boot it into fastboot and reflash lineage 2 days later, missing the window for them to push anything. No gapps btw.
randyrand | 19 hours ago
skinfaxi | 19 hours ago
eimrine | 18 hours ago
martheen | 17 hours ago
There isn't even any high res large touch screen KaiOS phone. I want to watch HD movies and read articles in comfort without scrolling all the time.
fsflover | 17 hours ago
https://nura.eco/
queenkjuul | 4 hours ago
skinfaxi | 19 hours ago
kccqzy | 18 hours ago
skinfaxi | 17 hours ago
erelong | 19 hours ago
gjsman-1000 | 18 hours ago
I think what's interesting, and what our grandchildren will look back on, was how naive the early internet was. There was almost this sense of "the government is powerless" whether it be piracy or jailbreaking or casual death threats [8647 style] or who knows what else. Combined with also a sense that devices will always be exploitable, there's always a way around, resistance from government and corporations will always be futile.
lookeey | 18 hours ago
There is a very concerning amount of illegal apps/scams distributed through ads that I've casual users install somewhat banally with the aid of short walkthroughs.
Any sufficiently advanced user is barely affected by this, as the procedure is just complex enough to block average people from getting scammed/using illegal services unknowingly, but simple enough to barely be an inconvenience for anyone who cares enough and can go through it.
qrobit | 18 hours ago
24h delay is not all of it, there's developer verification.
dpark | 18 hours ago
ChrisRR | 17 hours ago
ishouldnotbutk8 | 18 hours ago
I believe this is usually referred to as "boiling the frog".
karussell | 18 hours ago
Any sources for this claim? I don't buy it.
gonzalohm | 18 hours ago
skeeter2020 | 18 hours ago
FiloSottile | 18 hours ago
You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.
Tech is cool, but it's not an end in itself. Serving people should be. And if people are getting hurt, it's not working well, even if those people are not the ones that read Hacker News.
silverFork | 18 hours ago
criddell | 18 hours ago
I think this was probably a very easy decision for Google after they weighed benefits and harms to users and developers.
silverFork | 18 hours ago
criddell | 17 hours ago
silverFork | 16 hours ago
I remind you that Ai can reverse compile and find viruses and crap and they could have tested multiple gazillion apps simultaneously even before Ai.
Being naive is one thing and that is fine but trying to advocate naivety is something else.
In my opinion, its about collecting new money and forced compliance worldwide to collect more and more. Every software company wants to collect rent from around world and that is why they are tightening their noose once their they know that they have some form of monopoly. It is not just mere accident in universe.
functionmouse | 18 hours ago
Also. I regularly remove malware from people's android phones pro bono in and around my community. It all comes from the play store.
sophrosyne42 | 18 hours ago
Frieren | 18 hours ago
Fear, uncertainty, and doubt is a propaganda technique that tech companies have used for long against open source and competitors. The propaganda is to pretend that a 24 hour cooldown and making it difficult to install externals apps is for the good of the user meanwhile stealing their data and giving it to anybody that pays for it.
People are getting hurt. Mass spying should stop now.
cesarb | 18 hours ago
A scammer managed to convince a relative to share their screen during a Whatsapp video call. Luckly, said relative didn't use banking apps on the phone, the bank rejected as suspicious the transaction on the computer which would have sent money to the scammer, and the relative asked me for help before going to the ATM to unblock the account (I then contacted the bank and had them fully block the account as a precaution, and told my relative to go to the bank branch the next day to change the passwords and unblock the account).
spwa4 | 18 hours ago
1) make it optional
2) don't put it on a timer. What's most damning, in my opinion, is that this is the very definition of a bait-and-switch. Any rational person thinks this won't apply to their existing phone because it came before the rollout, right? It's only android 15 and onward? No. That's wrong, it'll apply to YOUR phone. Google. Non-Google. Doesn't matter. Android 12, 13, 14? Nope applies to them all. That's just an accident then?
GolfPopper | 18 hours ago
It's just a public confession that none of these organizations - not the carriers, not the government, and not Evil Google, are fit for the responsibilities they've claimed.
gjsman-1000 | 18 hours ago
Small businesses getting blocked by Gmail, Twilio, etc. for legitimate activities is constant.
skrebbel | 18 hours ago
Vaushite | 16 hours ago
Rooster61 | 18 hours ago
The propaganda I'm seeing is coming from Google. I can't tell you how many times lately I've seen ads on TV/streaming pushing the security narrative for Play Store. Google knows what it is doing is blatantly anti-consumer and they very much want public sentiment to think it's not.
There will always be means to scam individuals through technology. Pulling stunts like this is not justified simply because it closes off one means of doing so.
blfr | 18 hours ago
collinmanderson | 18 hours ago
And then you have the option:
- unverified packages either temporarily (7 days)
- or indefinitely
Official docs here:
https://android-developers.googleblog.com/2026/03/android-de...
gamer191 | 18 hours ago
egorfine | 18 hours ago
Mr_Modulo | 18 hours ago
The real problem here is not that Google is doing this bad thing. The real problem is that they can do this bad thing. They shouldn't have this power. Something needs to be done to rain in Google and take back Android as an open platform.
neilalexander | 18 hours ago
egorfine | 18 hours ago
Why should that be a concern to a phone OS provider? A concern so important that they are willing to cripple couple billions of devices.
Vaushite | 18 hours ago
egorfine | 17 hours ago
Vaushite | 17 hours ago
furst-blumier | 17 hours ago
cvhc | 16 hours ago
Then, generally, "software is just a tool like a knife" doesn't hold because software today is more a service than a tangible good. Companies continue to update the programs and things can happen in the cloud with limited user control.
braiamp | 17 hours ago
hk__2 | 18 hours ago
Nobody reads warnings or errors. StackOverflow is full of questions where someone pastes a clear error message and asks what they have to do when the very error message tells them the solution.
Also, scammers just tell people to ignore warnings and they do it. If someone is able to convince you that your child is in danger and that you have to bypass all warnings to help them, you _will_ do it.
braiamp | 17 hours ago
SV_BubbleTime | 18 hours ago
Should Google be less than an asshole in all things? Yes.
I think there’s this like “something must be done now!” attitude of self-important, busybodies I can’t get behind… even if they’re right.
Why have people convinced themselves into thinking now is the most important thing in the world? That if it doesn’t happen now so that it makes me happy instantly it isn’t an option?
Evolution; social, tech, biological, legal, just fucking takes time, and that’s a feature.
There will be a period in which there’s a ton of food over there but your little fishy fins can’t get to it, and that sucks, but deal with it yourself, or just chill and let things happen. I promise if it’s important someone will solve it eventually and the scales do not need to be tipped for every little thing like phone app permissiveness.
In the meantime, you are free to not buy an android phone if you don’t like the system that Google has produced. You seem to think that because you can see its insides that it is collectively owned. It isn’t. Google owns it. Talk of talking it from its owners, is theft. In this case, justified entirely because you don’t like a process they decided on.
Don’t make me defend Google, I fucking hate Google.
graemep | 17 hours ago
Shank | 18 hours ago
The phone scammers who are saying the FBI/NSA/IRS will arrest you unless you install sketchy remote access software or other malware are rather convincing to a certain demographic of people and no amount of text on the screen will stop that. It all comes down to whether or not you view the tradeoff being that vulnerable people are worth protecting with this measure worldwide or not.
loco5niner | 17 hours ago
Hard disagree. My grandma is just going to follow the scammers directions.
mrguyorama | 17 hours ago
If your grandma will follow current instructions, she will follow these new instructions including a 24 hour wait.
Your grandma will follow instructions to walk down to walgreens and buy a brand new device if they tell her. The solution has nothing to do with the device and everything to do with you needing to be an adult and figure out how to get your grandma to not follow directions of scammers.
This isn't a tech problem and you cannot solve it with tech.
pie_flavor | 16 hours ago
loco5niner | 10 hours ago
ChrisRR | 17 hours ago
A huge number of people just click accept to any popup they get because they're so fed up with seeing them. It's something that is often analysed in design of medical products
bob1029 | 17 hours ago
It was really difficult to explain to Korea that the additional warnings they wanted me to put in front of the tool operators were actually causing more harm than good. The cultural divide made this really difficult to approach.
"What do you mean the American mfg staff don't actually read everything?!"
"Yeah... Especially at the ATX line. We kind of go off vague shapes around here"
ChrisRR | 17 hours ago
You can put a very clear warning symbol front and centre, and people will just mentally gloss over it
karussell | 18 hours ago
The best solution would have been to be able to mark ANY alternative app store like fdroid as trusted and no such cooldown period would hit every time people install an app from there. This avoids that people can immediately use installed apps downloaded from an arbitrary URL but at the same time keeps the alternative app stores as a good alternative. Google decided to play unfair again.
catgirlinspace | 18 hours ago
karussell | 18 hours ago
I'm pretty convinced it is just Google testing boiling the water steady and slowly :)
collinmanderson | 18 hours ago
It's not 100% perfect, but it helps reduce scams. And with AI, scams are probably going to get more frequent and harder to realize it's a scam.
If you know you want your phone unlocked, just start the process as soon as you get your phone, and then it's yours. It's like an extra day of shipping.
-
Edit: Google explains this more:
In these scenarios, scammers exploit fear – using threats of financial ruin, legal trouble, or harm to a loved one – to create a sense of extreme urgency. They stay on the phone with victims, coaching them to bypass security warnings and disable security settings before the victim has a chance to think or seek help.
According to a 2025 report from the Global Anti-Scam Alliance (GASA), 57% of surveyed adults experienced a scam in the past year, resulting in a global consumer loss of $442 billion.
https://android-developers.googleblog.com/2026/03/android-de...
karussell | 18 hours ago
dingaling | 53 minutes ago
We don't know that, as it's not even live yet.
In fact it might even open a whole new market for 'unlock scammers' who do the initial groundwork and then sell their vulnerable mark to the next scammer.
bunderbunder | 18 hours ago
Full disclosure, I am an iPhone user in part because I personally like living in the walled garden. But I also acknowledge that it has its downsides. I have a separate Android device just for language learning because the open source language learning app ecosystem is basically nonexistent on Apple’s locked-down platform. I’m not thrilled about the possibility of that ecosystem withering and dying on Android, too.
aestetix | 18 hours ago
rpdillon | 18 hours ago
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
I would turn this right around and say that until the proponents of this measure acknowledge that the Play Store is not safe and is in fact a primary vector for scams, you're just doing propaganda.
misnome | 18 hours ago
kelvinjps10 | 18 hours ago
Kim_Bruning | 18 hours ago
The correct move is to remove the (icon for) the google app store from inexperienced user's phones. (I'm dead serious, and it works)
Unfortunately, that's exactly the move that now gets sabotaged by this google change.
So sure I'll acknowledge the very real risk to users that this is meant to mitigate. It does in fact marginally mitigate the precise narrow risk they state, but introduces a fatal flaw in its place. Probably unwise to let naive users use android at all anymore after this.
devmor | 18 hours ago
The vast majority of tech support scams come through apps on the Play Store. Not only that, but malicious apps get approved on the Play Store constantly.
There is no reason to take any claim that this change is meant to mitigate scams seriously, because there's no evidence to support that it makes a noticeable dent in such activity.
What this change does noticeably and impactfully do, is prevent, via chilling effects, users from being able to use their phones in ways that could lose Google and its partner vendors post-sales revenue.
As you said, serving people should be the end in itself, and this change doesn't do that - it hurts people.
paimapi | 18 hours ago
There are people at my gym who often have very bad form who I worry about. I will occasionally chat them up so they're not, for example, shoulder pressing with their arms outside of the scapular plane [0] or benching without any arch in their back [1]. Sometimes they appreciate it and ask me more questions. Sometimes they give me a terse 'thanks' and go back to doing it the way they want to do it.
If somehow every gym started forbidding people from using any equipment with which they could harm themselves unless they could prove, with a 24h cooling off period, that they knew the form and dangers in detail, I'm sure it would probably save a few people from suffering temporary injuries. I think it would also drive a lot of people away from any kind of sustained resistance training and be an overall net negative for public health.
Personally, I don't think such a nanny-state implementation is necessary? That you should be able to easily toggle off such a feature if you like and what happens to you happens. Perhaps there should be a 'tech-illiterate' mode toggled on by default but easily toggled off if you know how to access Developer Options with a little more forewarning about common scams. Perhaps gyms (or Google) could pay people to proactively assist and help people they see as the most vulnerable to certain kinds of exploits. Perhaps instead of spending time training Gemini to be a general-assist LLM they could train a very small local model to hyperspecifically guard against known intrusions.
There are so many more pro-social, less-draconian ways of tackling safety issues, from socialization to ongoing support to education efforts. A lockdown that just happens to also help ensure that they can extract their pound of flesh inside the abattoir that is Google Play seems at best overly protective and at worst just more corporate extraction of surplus value from individuals.
[0] https://brookbushinstitute.com/glossary/scapular-plane
[1] https://www.strongerbyscience.com/how-to-bench/#:~:text=it%2...
Shiggy_ | 18 hours ago
Simply add a setting to the phone for the technologically illiterate and/or young and old.
I can't even imagine how locked down and terrible the internet would be if we had this rhetoric around in the 90s.
ChrisRR | 17 hours ago
nonfunctional | 18 hours ago
BoxwoodSeed | 12 hours ago
cfiggers | 18 hours ago
I strongly agree with this statement.
If a piece of public communication is intended to sway the reader's opinion without informing them (or while selectively informing them, which is close to the same thing), it is propaganda.
stronglikedan | 18 hours ago
I don't. An hour would make the same point and provide the same level of protection. So would clicking through a few screens with very simple and easy to understand warning messages about the risk of scams. Sure, it's a compromise, but it's pretty much the opposite of excellent.
aembleton | 16 hours ago
24 hours might not be enough, and there is a risk that a scammer gets a user to go into developer mode and then calls back a few days later to try and 'fix the issue' or something. At least in 24 hours the victim might talk to someone about it and then find they're being scammed.
mhitza | 18 hours ago
One important way that scams reach end users are through the willing participation of ad platforms, and even before DSA (not that much has changed) people (myself included) have done countless reports of straight up scam ads with no recourse and a templated "we have found nothing wrong with the ad".
As a data point, have you not seen the Tai Chi AI ads on YouTube that will "make you a different person by the end of the week" which where run by a company that sold you a subscription via dark patterns with all the surprises that brings (like a big headache of an unsubscribe process).
Or the fact that Meta knows that X% of it's ads are scam/phising and do nothing about it because it hurts the bottomline (an AI chat will help you with references).
The hypocrisy is too much coming from Google since they are owners of the machine that feed scams right to your doorstep.
And let's not ignore all the other fronts they are fighting on to further lock down the Android platform (such as not making source available immediately and moving more of the runtime in their play services and platform integrity nonsense).
tvbusy | 18 hours ago
If I have to wait 24h to install an app from another store, I demand the same to apply to AppStore. I see app stores just like browsers: users must have the ability to choose which browser they want when installing an operating system, and for Android, users must be able to select which app store they want and they should work the same way.
egorfine | 18 hours ago
The risk of people cutting themselves is not a responsibility nor a concern for the knife manufacturers. I would be very upset if one day all kitchen knives would be sold blunt just to mitigate some clueless people from cutting their fingers off.
Similarly, I seriously and absolutely don't get it why people falling for scams should be a reason to require KYC to distribute apps.
Especially given that KYC-passed accounts are easily obtainable online for pennies.
DannyBee | 17 hours ago
Maybe before trying to go off half assed exactly like this outrage website does, you should take 5 minutes to be bothered to see if what you are saying is even mildly correct. Even five seconds of searching would tell you pretty much everything you wrote is wrong.
Lots of things are compromises intended to serve multiple goals rather than just drive one particular goal to the extreme. In that sense knives are exactly like what is happening here. You may not like that. But it is at least accurate, unlike what you wrote
jonathanstrange | 18 hours ago
bad_haircut72 | 18 hours ago
snohobro | 18 hours ago
People gotta learn. Sometimes the best teacher is pain and suffering. I wish that weren’t true, but in my time on this planet, there has never been more truth to “you can lead a horse to water, but you certainly can’t make it drink it.”
Trying to save people against their will just doesn’t seem the best path. I’d rather more effort be put into education on best practices, or investment in an app sniffer that can try and identify common attack vectors. Idk, anything other than “some people are too stupid for their own good, so now we all have less freedom.” I mean truly, if you’re worried about grandma’s phone safety, only let her buy an iPhone. No android for mi-ma.
All I see here is Google snatching at the opportunity to get some of that scrumptious walled garden money.
upheaval7276 | 17 hours ago
howunfortunate | 17 hours ago
Apple's is a scam in comparison and must be repaid every year.
bariumbitmap | 17 hours ago
1. Is requiring developers to submit government ID actually an effective way to prevent tech support scams? Will scammers actually be deterred by a government ID requirement in addition to the existing developer registration process?
2. Is requiring developers to submit government ID the best option to prevent tech support scams? Are there other options that Google could use to make Android user less susceptible to tech support scams?
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
The tradeoff, such as it is, is acknowledged on keepandroidopen.org under the "But wait, isn't this...just about security?" section:
> The security rationale is a smokescreen. Google Play Protect already scans for malware independent of developer identity. Requiring a government ID doesn't make code safer.
Finally:
> Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.
I don't think this is an excellent compromise. Scammers are persistent. I'm not convinced a 24 hour cooldown is enough to deter them in any meaningful way. I, on the other hand, am not persistent enough to wait 24 hours to install an Android app from F-Droid just to try it out.
torben-friis | 17 hours ago
There is a third position beside "I agree/disagree with the tradeoff", which is "I don't consider the tradeoff as stated truthful and refuse to frame the conversation that way".
Every closing of rights comes with a legitimate-sounding reason. Protect the children, etc. Most activist have been through this process enough times to see the play coming a mile away.
It is also surprising to see, on a place called hacker news, people defending closed systems and removal of agency from end users by giant corporations.
oortoo | 17 hours ago
tavavex | 17 hours ago
Thank you. When you see it once, it becomes so obvious everywhere else. Every single time it's just assertions without hard statistics, always perpetrated by the side that also happens to profit from it or accomplishes something else they really want to do. I'm not going to deny that the number of people who get scammed through sideloading isn't zero, but I don't have to accept as unwritten fact that these lockdowns are actually about that, or that this number of people is significant at all compared to everyone who just wants to install off-Google Play apps, like what Google implied and almost everyone here just accepted.
> It is also surprising to see, on a place called hacker news, people defending closed systems and removal of agency from end users by giant corporations.
The suddenness of the shift is shocking. One of my most popular comments, from no more than several months ago, was about this very topic. It was about the way Google will, like all other corporations, slowly ratchet up their 'measures' until there's no way left but their way. I basically just retold that comment here with very few real changes, and it's already greyed out at the near bottom of the thread. But the shift itself isn't unexpected. Lots of people here aren't the customizer, tinkerer, off the beaten path kind of 'hacker', but the tech enthusiast kind. Lots have direct links to Silicon Valley and the tech overlords of today. As the tech industry consumes everything else in the world, their rhetoric shifts from "Look at all these things we'll let you do!" to "We own you", so does the average sentiment of the users.
hgoel | 17 hours ago
Why do we have to be lectured on how important this change is for their safety, while the Play store continues to be the primary location scam apps come from?
When do the companies get to be the ones that have to give up their own freedoms in favor of everyone else's safety?
deaux | 17 hours ago
xyzzy_plugh | 16 hours ago
I don't mind warnings and even brief cool downs but 24 hours is ridiculous.
If I lose or break my phone, I have to wait 24 hours after acquiring my new phone to use the apps I previously used? It's just absurd.
If I had to explain to clients that I was unable to do work until tomorrow, I'd be ridiculed.
hbn | 15 hours ago
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
I would argue pretending like this is actually for anyone's security is propaganda hiding the fact that this is all for Google to tighten its grip on Android.
johnea | 14 hours ago
Personally, I'm sick and tired of dealing with corporate overreach based on the excuse that so many people are too stupid to operate the device responsibly.
I'm on a 3rd party, no goggle account, AOSP built OS. So I don't think this immediate change in 2027 will affect me.
While AOSP is a current workaround, this whole ability to build a non-goggle android via AOSP is also under threat from goggle lockdown.
That means this trend of having to part with the OS intended for the too stupid population is only going to increase.
So, needing to depart from android completely is in the near term.
Linux phones become ever more usable, including android in a jail.
The current furiphone is a great example.
https://furilabs.com/
cam_l | 11 hours ago
accountrequired | 18 hours ago
everdrive | 18 hours ago
silverFork | 18 hours ago
They are recommending installing F-droid.. and not accepting android's demands. Its time to have open source smart phone operating system that can not be taken hostage.
Aerroon | 18 hours ago
silverFork | 18 hours ago
Also people should and could use the browser interface rather than apps for their banking but certain applications don't exist in browser world.
Aerroon | 9 hours ago
silverFork | 9 hours ago
Aozora7 | 4 hours ago
Government digital signature app fully trusts GrapheneOS since it uses hardware attestation rather than Play Integrity, so I have access to all government services.
My bank's app runs on GrapheneOS but doesn't fully trust it. Device is labeled as insecure, biometric login is disabled, and transaction limits are significantly lower, but is otherwise functional for daily use.
Bank accepts logins authenticated with government digital signature app, so I can use that to login into the bank's web app and make transactions without reduced limits there.
The bank's app relies on Google Wallet for contactless payments, which doesn't work on GrapheneOS, but it looks like there are workarounds for this like Curve Pay that do work on GrapheneOS. Haven't tested this myself, since I just use a physical card.
glorth | 18 hours ago
silverFork | 18 hours ago
Aozora7 | 18 hours ago
amelius | 18 hours ago
100percentjake | 18 hours ago
clarionbell | 18 hours ago
dethos | 16 hours ago
JSRR1991 | 18 hours ago
otherwise my next phone will be linux
Haunt1000 | 18 hours ago
ChrisRR | 17 hours ago
Haunt1000 | 13 hours ago
amelius | 17 hours ago
adelekeabdulgan | 18 hours ago
whats the way forward?
rjh29 | 18 hours ago
You can't just click a random apk in a website and install it. At least without the 24 hour wait workaround, done once per device.
adelekeabdulgan | 18 hours ago
emidln | 18 hours ago
dpark | 18 hours ago
Almost certainly that would reset this. Why would it not?
> What if I wipe data in play services?
No idea. Is this a thing people do?
> Will a future silent play services update conveniently break my p2p messaging app during a protest?
Google can already do that today.
eszed | 18 hours ago
Before you @ me, HN, I run GrapheneOS. I fully understand and practice "own your own hardware". Most people probably shouldn't, though, because they lack the technical ability / interest to do so safely, and throwing them to the wolves strikes me as ideology pushed to the point of foolishness.
Now, y'all can flame my ass.
egorfine | 17 hours ago
Because it's just the beginning.
rjh29 | 15 hours ago
queenkjuul | 2 hours ago
ChrisRR | 17 hours ago
kykat | 18 hours ago
habitue | 18 hours ago
cesarb | 18 hours ago
Even with Android becoming much more closed, it's still more open than Apple.
TuxSH | 17 hours ago
Not true if one pays up ($99/yr), in which case the interval becomes one year. Also apps that sign and install other apps with one's cert exist.
kykat | 15 hours ago
But for most people, the existing flow to allow external sources is already too much. For other people to install my APKs, while possible, is a slow and painful procese. Add waiting 24 hours? As good as blocked.
ericyd | 18 hours ago
kykat | 18 hours ago
lawn | 18 hours ago
Zambyte | 18 hours ago
everyday7732 | 18 hours ago
...
30 cents out of every dollar, you say?
fooqux | 18 hours ago
andrewla | 18 hours ago
aestetix | 18 hours ago
chilipepperhott | 18 hours ago
hk__2 | 18 hours ago
nicce | 17 hours ago
hansvm | 17 hours ago
hk__2 | 16 hours ago
prmoustache | 15 hours ago
There is plenty of warning and friction to be able to do that already.
aembleton | 16 hours ago
xtracto | 14 hours ago
max-privatevoid | 18 hours ago
glorth | 18 hours ago
EvanAnderson | 18 hours ago
I had "sideloaded" all the APKs for the software I used on the old phone and saved the APKs. Moving to a new phone was just a matter of loading all the software and copying my rsync'd backups onto the new phone. It was wonderful. Just like moving to a new PC.
I guess I'm happy I got to have this experience for a little while.
Edit: I've found a few apps I can't used because they require Play attestation. Eventually I'll hit one of those that I need and I'll be at an impasse irrespective of this particular power grab.
limagnolia | 17 hours ago
EvanAnderson | 17 hours ago
Edit: I have at least one app that won't run under GrapheneOS (Microsoft Authenticator) so I'll be stuck with a two-phone carry, too. >sigh<
limagnolia | 16 hours ago
tranq_cassowary | 16 hours ago
EvanAnderson | 15 hours ago
tavavex | 18 hours ago
1. You own your device and can install anything you want on it (what we have today)
2. Google gently yanks you away from the simple workflows, leaving you with ADB or their 24 hour hoop to jump through. If you opt for the second, you get a choice between allowing 'unverified' installs for 7 days or indefinitely. Huh, that's weird, who would ever pick the 7 day option, right?
3. The dust settles and some time passes. Google decides that the indefinite option is just way too dangerous, the users are not safe if they are allowed to use this freedom. They'll just claim there's countless clueless grandmas getting entangled in multi-day-long scams that hinge on the sideloading feature, and they simply can't let them suffer so much. They will generously disable the 'indefinite' option.
4. 7 days may still be too much, maybe the sensible decision is to move to a 24 hour countdown per app. I mean, if you want it so badly, you have to work for it - that means you'll have more time to mull over the security of every single app you put on your phone.
5. Huh, for some reason it looks like almost no users are installing apps from outside Google Play anymore. We'll keep the feature on life support for a while, and then retire the legacy unverified installation workflow, to be replaced by a temporary limited permission for verified developers to briefly install their own in-development apps on their device. That ought to be enough.
This pathway for extinguishing features that are inconvenient for massive corporations isn't new. I really do not understand how everyone supporting Google's side here doesn't see this, and why they're so willing to wholeheartedly and without reservation believe them on matters of security where pushing one opinion also happens to conveniently align with their profit motive.
aembleton | 16 hours ago
tavavex | 16 hours ago
No matter what you do, it will never be as good as it once was. We've moved from a world where custom, 'hacker' type stuff could coexist with convenient apps and corporate or government services to a world where anything custom or unauthorized effectively doesn't exist, except for a few restrictive and mangled exceptions that require a lot of pain to get to and limit your device in many ways.
queenkjuul | 2 hours ago
Covzire | 18 hours ago
fschuett | 18 hours ago
artursapek | 18 hours ago
timcobb | 18 hours ago
Concretely in my case, I read all the fdroid materials that were linked to from the fdroid pop-ups and they left me hanging, trying to understand what was actually happening. I finally looked it up, and what I found was a lot more clear and actionable than what was communicated by, for example, Fdroid. Obviously Google's motives are clear, but I had to work pretty hard to figure out what was going on.
This style of communication is what will will undo graphene and fdroid and all these other organizations because it's just not useful, professional or appealing.
other8026 | 17 hours ago
1vuio0pswjnm7 | 18 hours ago
Will not apply if updates are blocked
Good to have old phones, i.e., not primary phone, where user can block updates
Some users may want a portable, pocket-sized computer that the user can reasonably control (old phone) in addition to one controlled by Google or Apple (primary phone)
Maybe think of it like an "A/B test". Primary phone with the update and old phone without the update
For some users, the "threat model" may be Google and the long list of its government, corporate and other partners
Maybe some users just want relief from data collection, surveillance and ads
Not every user is the same
Some (not all) users may be willing to sacrifice some alleged "security" provided by an ad services company (wtf) in exchange for more _user control_
dingaling | 16 hours ago
This will not arrive through Android updates but through Google Play Services.
You can try to block Play Services using DNS trickery, but it's like whackamole. The only way to be guaranteed safe from this update is to run a ROM without Google services installed.
1vuio0pswjnm7 | 14 hours ago
It's the user's phone. The user paid for it. The user pays for the internet connection. The phone belongs to the user not to Google. The user can control traffic to and from the phone if he so chooses
I have been blocking connections to Google servers, e.g., "updates", Google Play Services, and many, many others, on old phones for years. There are many ways to do it
For example, a local forward proxy works well; I run proxies on the phone and on the gateway
Blocking can also be done using only Android apps, e.g., Netguard, etc.
hakube | 18 hours ago
ChrisRR | 18 hours ago
You will still be able to install unsigned APKs, but the first-time procedure to unlock the ability will include a 24 hour wait. After that, unsigned APKs can still be installed as usual
And APKs outside of the Play store can still be distributed unsigned, subject to the 24 hour wait for Play Protect devices
jscd | 17 hours ago
ChrisRR | 17 hours ago
throwfaraway135 | 18 hours ago
We need a truly open-source os, everything else is going to be a patch over a bullet hole.
egorfine | 18 hours ago
Thus, we should absolutely expect next steps for Android to slowly go into walled garden mode: no dev unlocking for certain devices, dev unlock after mandatory KYC, etc, etc.
LetMeLogin | 17 hours ago
> Starting in 2027, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID.
Android is owned by Google, so in all fairness they can do whatever they want, so they don't need anyone consent.
quantum_state | 17 hours ago
deaux | 17 hours ago
"Currently, the predominant business model for commercial search engines is advertising. We expect that advertising funded search engines will be inherently biased towards the advertisers and away from the needs of the consumers... we believe the issue of advertising causes enough mixed incentives that it is crucial to have a competitive search engine that is transparent and in the academic realm."
October 2000: Google adds ads.
[0] https://research.google/pubs/the-anatomy-of-a-large-scale-hy...
jonathanstrange | 17 hours ago
That's how it's done with domain names, with security advisories and disclosures, etc. That they don't do it for developers shows that it's about control and anti-competitive business behavior (preventing other app stores).
sublinear | 17 hours ago
nephihaha | 17 hours ago
DaveChurchill | 17 hours ago
svat | 17 hours ago
- be a registered developer, and target all Android users (Google Play Store, F-Droid, distributing .apk files, etc), or
- remain anonymous, and target only a subset of Android users (all "power users" who do the one-time 24-hour cooldown, or a small number of users if you use the student/hobbyist path, and of course anyone can install their own apps on their own device with adb).
This is definitely an unfortunate step backwards from Android's prior openness, but is still more open than iOS (my comparison from a previous discussion: https://news.ycombinator.com/item?id=47939361), and is basically Google being forced by the governments of certain countries (Brazil, Indonesia, Singapore, Thailand) where malicious-app phone scams have led to a lot of people losing their savings (https://news.ycombinator.com/item?id=47152069 https://news.ycombinator.com/item?id=45909348).
deaux | 17 hours ago
No, no it is not. If Google didn't love these changes, they'd do what Apple does with the EU. Malicious compliance, or at worst, only complying there. The LLM providers do the same.
Google loves, wants, and has instigated these changes. They are not being rolled out because some governments are asking for them. Those governments would never have specifically asked for these measures anyway; they'd have asked "can you reduce these scams?". And if Google had wanted to act on this, they wouldn't have done this either because they know that the overwhelming majority of these scams are from Play Store apps or from ads, often through AdMob itself, never passing through non-store apps. Those are a sliver of scams.
This is propaganda with zero backing in evidence.
svat | 17 hours ago
teekert | 17 hours ago
rat_on_the_run | 17 hours ago
Nowadays it seems that there's dumbing down of everything. Don't let technology replace education and common sense.
yaro330 | 17 hours ago
PurelyApplied | 17 hours ago
I don't love it either, but "why doesn't Google just ignore that regulation?" doesn't seem viable. (Companies only ignore laws when it's profitable, of course.)
contravariant | 17 hours ago
yaro330 | 17 hours ago
29083011397778 | 17 hours ago
And how is a 24-hour wwaiting period related to KYC, when it doesn't require a user to pass an ID check?
[0] https://testerbee.com/blog/google-play-developer-verificatio...
tencentshill | 16 hours ago
29083011397778 | 17 hours ago
edukite | 17 hours ago
mrbonner | 17 hours ago
Markoff | 17 hours ago
hnarn | 16 hours ago
penguin_booze | 16 hours ago
1vuio0pswjnm7 | 14 hours ago
1771953671 | Open Letter to Google on Mandatory Developer Registration for App Distribution | https://keepandroidopen.org/open-letter/ | https://news.ycombinator.com/item?id=47139765 | 381 comments
1776257256 | Keep Android Open | https://keepandroidopen.org/cta/ | https://news.ycombinator.com/item?id=47778274 | 69 comments
1777389660 | Your phone is about to stop being yours | https://keepandroidopen.org/en/ | https://news.ycombinator.com/item?id=47935853 | 910 comments
1778236465 | Keep Android Open | https://keepandroidopen.com/ | https://news.ycombinator.com/item?id=48061201 | 3 comments
1788273664 | Why did the Android side loading lockdown change from Sept to January 2027? | https://keepandroidopen.org/faq/ | https://news.ycombinator.com/item?id=49522647
renata | 43 minutes ago