406
Google gives Android users a way to install unverified apps if they worked hard for it(including waiting 24 hours) (android-developers.googleblog.com)
submitted 7 months ago by to c/technology@lemmy.world
125 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 86 points 7 months ago (13 children)
  • enable developer options
  • confirm that you are not tricked
  • restart phone and re-authenticate
  • wait one day
  • confirm with biometrics that you know what you are doing
  • decide if you only want unrestricted installs for 1 week or forever
  • confirm that you accept the risks
  • enjoy the few apps that still have developers motivated to develop for a user-base willing to put up with this
  • permalink
  • fedilink
  • source
  • hideshow 13 child comments
    •
  • [+] -11 points 7 months ago (8 children)

    I can understand this workflow being created to protect the legions of people who are tricked into installing spyware.

    It doesn't remotely affect me because I use GrapheneOS and if this is an issue for you then you're probably someone who should look at installing GOS or Lineage.

    I don't think Google should be able to do this and it is likely part of a longer-term strategy to strangle any competition. At the same time, I can understand how this change will save a lot of grandparents from clicking a link in a text from their 'grandchildren' and installing spyware that'll steal all of their bank information.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 17 points 7 months ago (2 children)

    GrapheneOS is built on AOSP, which is where the change is being made. Graphene and other custom ROMs will need to maintain a fork that cuts out the feature if they want to avoid. Google is also starting to close off Android to make that more difficult, so it'll become a genuine project to maintain the fork well.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 11 points 7 months ago (1 child)

    As far as I understand the enforcement depends on privileged play services. https://xcancel.com/Metr0pl3x/status/1960329785277571420#m

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 7 months ago (3 children)

    I mean... This is kind of why I never let people use my phone.

    I have installations from various sources enabled... Like my browser, because I know what I'm doing. But I wouldn't trust anyone as the process is currently effortless....

    If someone is trying to install spyware on you (like a partner or parent.) this might offer some notification and prevention.

    I don't really see the big deal. You do it once, enable it forever, and wipe up those tears.

    I think a better way would just to have maybe like a biometric/pin confirmation upon installation. Simple. Clean.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 7 months ago

    they want to suppress the developers, not users. By making it so bothersome, so many people will just stop using sources from outside google play. First they do this and at some later time they will add more hoops to it. If they manage to strangle any developers that make stuff, people will have nowhere to turn yet they cant complain either because google will have undeniable monopoly.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 7 months ago (1 child)

    The delay is almost assuredly to prevent live scamming. Like a grandparent picking up a random call or text and being tricked into thinking they're a family member/bank worker/etc.

    I'll admit it's annoying, and could be used by Google later to do more annoying shit.

    Taking their explanations in good faith and looking at it from an customer security point of view, I can see this cutting back on some common scam types. This is kind of like how, when you go to rustdesk.com there's a giant 'YOU'RE PROBABLY GETTING SCAMMED' banner across the top of the page:

    These little steps can seems pointless or annoying to us, as most of us are probably in the upper range of tech skills, but consider the average user and it starts to make a lot more sense.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 7 months ago

    The delay makes intuitive sense especially since it will give the target a chance to complain about it to their friends and family who will hopefully stop it from there.

    However, I’m not sure if it’s worth it. I imagine this would stop exfiltration apps which scan the users device to useful data and maybe passive screenshots but this pales in comparison to apps with subscription dark patterns, gambling and apps that harvest and sell your data legally already. If this was a case of apps prompting the user to enter sensitive information into a form then they could just use a browser.

    I don’t know. I think this is a good measure to prevent scams. I’m just uncomfortable about Google’s motivation.

  • permalink
  • fedilink
  • source
  • parent
    • load more comments (-1 replies)