Google’s new arrangement for installing unverified apps on Android takes effect this Thursday (Oct. 1st) here in Brazil.
Indonesia, Singapore, and Thailand are also among the first countries to be affected.
F-Droid and other free and/or Google-independent initiatives have been raising a ruckus over the changes. They are, indeed, an extra hurdle for apps distributed without Google’s blessing. Verifying an app means identifying yourself to Google, which — understandably — many developers don’t want to do.
Heads-up! In July, Google announced that the first phase, running from now through 2027, will only affect apps distributed through specific stores: its own Play Store, Honor, Oppo, Samsung, Transsion, Vivo/Jovi, and Xiaomi. In other words, F-Droid got a breather until 2027. What a mess!
I covered the story [pt_BR] here at Manual before Google unveiled the so-called “advanced flow” for enabling the phone to install unverified apps. The flow, as per Google, works like this:
- Enable developer mode in system settings. Activating this is simple. This prevents accidental triggers or “one-tap” bypasses often used in high-pressure scams.
- Restart your phone and reauthenticate. This cuts off any remote access or active phone calls a scammer might be using to watch what you’re doing.
- Come back after the protective waiting period and verify. There is a one-time, one-day wait and then you can confirm that this is really you who’s making this change with our biometric authentication (fingerprint or face unlock) or device PIN. Scammers rely on manufactured urgency, so this breaks their spell and gives you time to think.
- Install apps. Once you confirm you understand the risks, you’re all set to install apps from unverified developers, with the option of enabling for 7 days or indefinitely. For safety, you’ll still see a warning that the app is from an unverified developer, but you can just tap “Install Anyway.”
I’ll play devil’s advocate here and say… this seems like a good measure? I know that in an ideal world (or for those who live and breathe tech) the phone is yours and you do whatever you want with it, but in the real world there are millions of elderly people, people with low literacy, teenagers, and people who simply have better things to do, all left at the mercy of scammers all day, every day.
It’s worth noting that this arrangement only applies to phones running Google-certified Android. On alternative systems without Google’s underpinnings, such as LineageOS (without microG), GrapheneOS, and HarmonyOS (Huawei’s), nothing changes.
For those who know what they’re doing, the “advanced flow” only needs to be done once. Its effects even carry over to new phones.
Coincidentally, the start of Android’s app verification coincides with Brazil’s ban on online gambling, enacted by the Lula administration through a provisional measure (an executive order with the force of law) last Friday (25th). The extra difficulty in installing unverified apps may help defend against illegal betting apps, as long as they aren’t verified with Google — which isn’t the case for operators that were licensed in the country.