Google To Allow 'Experienced Users' To Install Unverified Android Apps 33
Google says it will build a new "advanced flow" to allow experienced users to install Android apps from unverified developers, easing up on restrictions it proposed in late August. The company said earlier that Android would block such installations starting next year. The new flow will include clear warnings about security risks but will give users final control over the decision.
Google said it is designing the system to resist coercion and prevent users from being tricked into bypassing safety checks. The company is currently gathering early feedback on the feature's design. Google also announced that developers who distribute apps exclusively outside the Play Store can now join an early access program for developer verification.
Google said it is designing the system to resist coercion and prevent users from being tricked into bypassing safety checks. The company is currently gathering early feedback on the feature's design. Google also announced that developers who distribute apps exclusively outside the Play Store can now join an early access program for developer verification.
Already an option for 'advanced users' (Score:2)
Re:Already an option for 'advanced users' (Score:5, Informative)
The point was that that was going to go away as a route for unsigned apps to be replaced with a requirement for signatures even when using ADB or other alternative installation methods. Google is backing off that change for now. This should mean that things like Obtainium [imranr.dev] keep working in future.
Re: (Score:3)
Obtainium is such a useful tool. As well as open source apps, it can update apps that you aren't allowed to install in your region via Google Play. Very handy if you travel a lot, as developers often put regional restrictions on things like transport and loyalty apps.
Re: (Score:3)
It's called ADB.
The point was that that was going to go away as a route for unsigned apps to be replaced with a requirement for signatures even when using ADB or other alternative installation methods
This is not correct. Per the information on Google's developer console [google.com] sideloading of unverified apps via ADB was not going to be disallowed:
Re: (Score:1)
'advanced' doesn't and shouldn't have to be a synonym for 'incredibly inconvenient'
Re: (Score:2)
It needs to be inconvenient and convoluted enough that clueless users can't be tricked into doing it via phishing.
Re: (Score:3)
False. It's the Dancing Pigs [wikipedia.org] problem.
As long as there's a method, someone will write instructions that people will follow. And malware actors will hijack whatever method to install ransomware. You can bet one step will have people running command line commands and there was that ransomware installed via the command line.
The urge to get pirated apps will drive people to whatever the method is. Th
Re: (Score:2)
>"As long as there's a method, someone will write instructions that people will follow."
While this is true, additional warnings and hoops can and will dissuade a large number of users. Is the goal 100% perfection, or perhaps a 50% or 75% improvement?
One idea would be a mandatory waiting period. Say an hour. Where you have to check back in and complete the process later. That would give someone time to think about it and also help stop impulsive actions. Annoying, yes. But security is always annoyin
Re: (Score:3)
It has to be at least a little inconvenient, though. The end users DO NOT READ. No matter how scary the warnings are, whatever told them to do it is scarier and they ignore these warnings. We're at the point now where we don't even need malware to steal someone's bank account information. Just fake virus warnings on a web page with a toll-free number. And this is across the board, at all education levels. Critical thinking skills work against this but even those with the skills forget to put them to u
Re: (Score:2)
It has to be at least a little inconvenient, though. The end users DO NOT READ. No matter how scary the warnings are, whatever told them to do it is scarier and they ignore these warnings.
They read, they just don't have infinite attention to dedicate to vendor nonsense. The source of software isn't relevant. What software is allowed to do is what matters. Misplaced focus especially given the fact Google app store itself is full of malware only contributes to fatigue swaying attention away from what is important to what is not.
If an OS vendor really cared about what was in the best interest of the user they would never place the user in a situation where they face take it or leave it deman
Re: (Score:2)
>"If an OS vendor really cared about what was in the best interest of the user they would never place the user in a situation where they face take it or leave it demands for privileges from app vendors."
^^^ THIS, 1000%
But the reason we don't get such fine-grained controls is that the ecosystem is designed to maximize simplicity and the ability of the OS and apps to spy, advertise, and control the user.
Re: (Score:3)
But there is a reason why they do not read. Because most the time no bad consequences happen.
When you tell users bad things might happen and no bad things happen, they stop taking your warnings serious.
Keep your warnings for things that indeed may happen.
Installing an untrusted apk won't defeat the app sandbox, that is built so you don't have to trust app developers. With just that sandbox an app is much more secure than the setup.exe people are clicking on their Windows PC. I also never encountered a malic
Re: Already an option for 'advanced users' (Score:2)
Re:Already an option for 'advanced users' (Score:4, Funny)
'advanced' doesn't and shouldn't have to be a synonym for 'incredibly inconvenient'
DOS ain't done til Lotus won't run
Re:Already an option for 'advanced users' (Score:4, Interesting)
Re: (Score:2)
Whatever method it is, it will probably defeat the purpose of ending unsigned side loading. Whatever the hoops are, users will be trained to jump through them.
Re: (Score:2)
Advanced users. Regular ones already have a hard time to use alternative stores that have differently colored buttons.
Re: (Score:3)
Whatever method it is, it will probably defeat the purpose of ending unsigned side loading. Whatever the hoops are, users will be trained to jump through them.
This is sadly true. They're going to attempt to throw up a lot of warning dialogs to dissuade users, but we know from long experience that users will click through anything to get to cat videos.
This is actually not a change, really, since they were already going to leave sideloading via ADB open, so their plan already included an "advanced user option" which users could be trained to do. This new thing must presumably be easier than ADB. My guess is that it will feature more scary warnings than enablin
Re: (Score:3)
The problem is that alternate app stores would have had to verify all their apps with Google which defeats the purpose of being alternate.
How so? The developer verification does not require compliance with any of the Play store policies or anything at all other than the rule "don't distribute malware", since distributing malware would result in the developer account (and signing certificate) being revoked, which is the point of the whole thing, to enable Google to shut down malware authors. Or at least to slow them down, since they'd have to register for a new account, with a different government ID.
This does leave determination of "what i
Unpossible (Score:2)
How can this be? I was told that Mr. Google was evilly rubbing his hands in glee at the thought of take even more control of your phone, cackling away as lightning flashed outside an arched window behind his throne.
He gave up on the much hated Privacy Sandbox too, which was going to send all your data to Google. That said he also decided to keep third party cookies, which kinda sucks.
Re:Unpossible (Score:5, Insightful)
It's called "testing the water". Everytime, we progress a bit more toward that. You think draconian ID checking online came out of the blue? The idea's been marinating for years. Full control over user devices is a dream for these business. They're in a position to enforce that on mobile, and will keep trying, normalizing the idea. They also looked into doing the same for web browsers, backed out, but still, push the standards towards including more and more component to serve that purpose.
Minimizing this because they walked back one step after walking forward two steps is silly.
Re: (Score:2)
Isn't Fire TV cracking down on third-party apps because of unlicensed streaming right now?
Are you sure? (Score:2)
Are you really really sure?
Are you sure-to-the-power-infinity?
Ok then, go ahead.
They're asking for shit! (Score:2)
Re: (Score:3)
The point is that, on your own device, if you want to do something, you can do it.
They say "advanced users" in the sense that your uncle that's technologically inept would have to jump through hoops and ignore many warning labels that would usually drive them toward being cautious (or calling their all-knowing nephew) in an attempt to thwart unwanted apk installation.
Yes, that mean that nowadays, "advanced users" means "know how to read".
Anyway, it does not have anything to do with the quality, safety, or w
Re: (Score:2)
Alas, knowing how to read isn't enough now, if it ever was. All too many computer lusers (not misspelled) are aliterate [wikipedia.org] and won't bother to read any warnings that accompany those links. To paraphrase an old saying, you can show a person all the warnings you want, but you can't make them read them.
Shouldn't have done that (Score:2)
This is, basically, going to appease a lot of people. Give me control over my damn device.
It seems obvious that this was a way to test the water for more drastic measures in the future, though. It always is.
At least something (Score:3)
I guess they read a few EU laws and came to the conclusion that they need to provide a bare minimum by themselves if they don't want the EU to decide what they are required to provide.
Re: (Score:2)
I guess they read a few EU laws and came to the conclusion that they need to provide a bare minimum by themselves if they don't want the EU to decide what they are required to provide.
Nah, their previous plan already provided the bare minimum, since it didn't restrict sideloading of unverified apps via ADB. This is just an attempt to calm the complaints by offering an even easier sideloading option. Unfortunately, it will probably make the whole scheme pointless, since malware authors will just train users to click through the scary warnings.
say what???? (Score:2)
Experienced users can be idiots! They are the ones who think nothing will happen to them because they know better. In a lot of ways, it is the inexperienced users that are more cautious.