Android verification is coming: Google confirms timeline and supported app stores - Ars Technica
4 days ago by iturnedintoanewt to c/privacy
[...]
In the new blog post, Google’s Matthew Forsythe confirms that the developer verification system is slated to come online on September 30 of this year. The initial deployment will be limited to countries with a high level of app scams: Brazil, Indonesia, Singapore, and Thailand.
[...]
Google released its new developer console back in March, inviting external developers the opportunity to pay $25 and verify their identities early. Developers who don’t register will find that their apps cannot be sideloaded on Google-certified Android devices once verification has rolled out. Google says that almost every app in the Play Store is now ready for the change, and a “large majority” of apps outside Google Play have completed verification.
[...]
Google says it will verify the apps in the following stores when it begins enforcing the new restrictions.
Google (Google Play)
Honor (HONOR App Market)
OPlus (OPPO App Market)
Samsung (Galaxy Store)
Transsion (Palm Store)
vivo (V-Appstore)
Xiaomi (GetApps)
[...]
The next step toward verifying apps will come this month as Google deploys a new system service on most certified devices. The package (com.google.android.verifier) will appear on phones and tablets running Android 8 or higher, allowing Google to block the installation of unverified apps. It will remain dormant until verification is activated in your specific region.
In July, Google plans to roll out the new developer APIs and begin testing for “limited distribution” accounts. This is Google’s solution for hobbyists who want to make their own apps and share them with a small group. Limited accounts won’t require a fee or government ID verification, but you can install these apps on up to 20 devices.
In August, the advanced flow will become available globally ahead of verification becoming mandatory in the first markets. As detailed a few months ago, the advanced flow will allow users to bypass verification, but the process isn’t easy. You’ll have to navigate to a buried menu, confirm you understand the risks multiple times, and wait a whole day before completing the process.
And that brings us to September, when Android devices in Brazil, Indonesia, Singapore, and Thailand will begin checking verification status before installing apps. However, things get murky after that. Google will undoubtedly monitor how verification works as millions of users are suddenly limited to verified apps, which could affect how it moves forward. Google says it intends to expand developer verification in 2027, eventually making it a global device policy.
I don't know, I'm not hopeful.
Stallman played a BIG role in the insurgence of Linux (and FOSS in general), but he famously disregards smartphones as he thinks people should just not use them.
Plus, phones are built different: many have a locked bootloader, and there is no standard like BIOS/UEFI, meaning you must compile a slightly different OS for each model.
What I'm saying is the mobile ecosystem is built in a way that makes it very difficult for a serious AOSP ecosystem to build up, let alone a different kind of Linux
Should be a challenge, “how can I help Linux get there?” If more of the general public tech enthusiasts were interested in developing this out, I have no doubt it could be done in months time. Ref: be the change you want to see in the world.
Best thing we can do is donate to PostmarketOS, and if you can, install it on a compatible phone and make bug reports of what doesn't work.
The bar for entry for contributing to these projects is too high. Can we instead do work to lower the bar? I don’t want to accept that there’s nothing we can do beside open our wallets. Not that I’m against donating, it’s just that money isn’t my strongest asset.
Hey Google, could you not dictate what I'm allowed to install on my own damn device for my "safety"? I don't need a third parent, and if I had to pick one it wouldn't be you.
Up until now, I haven't been overwhelmingly emotional about all the horrible things happening right now.
I don't know why this news hit me particularly hard. Reading it made me feel like a part of me died. Got glassy eyed. This kind of feels like the final betrayal in a sense. Not the ultimate betrayal, but one super close to my heart.
Hey, it's gonna be alright
- You still will be able to sideload apps, they just add a nasty 24-hour cooldown
- In the meantime, it's worth having a migration strategy to a mobile OS that actually respects you - be it Graphene, Lineage, or Linux/Sailfish.
be it Graphene, Lineage, or Linux/Sailfish.
The prob comes when the ONLY mobile OS that work for the things ppl want to do are IOS and Android. We could see a world where MOST web sites are locked behind chain-of-trust reqs. Certainly all the important ones needed for normal life.
We're not quite there today. But it is the direction.
Then you cancel that service and let them know exactly why you did. Hit them in the only thing they care about - money. One doesn't matter, but 100k would.
Be the change you want to see.
One doesn’t matter, but 100k would.
Yup I agree about that. Financial pressure might be our best hope. Prob is, the HUGE majority of ppl don't care about things like this. Or even know about them. It's too abstract for them.
TBH I'm not sure Google would care about 100k! There are allegedly about 3-4B Android users in the world. 100k would be like 0.0033%. Maybe 100 million, and they would begin to notice. That's a lot to get on side, tho.
I dispair badly. So many ppl have no clue when it comes to their own tech future. Also what is their alternative? IOS is even worse in this way. The masses aren't gonna install Graphene or w/e. What alternative may we even suggest to them?
Yep, it's time to start moving away from these big tech companies and develop utz competitors
I hope this leads to the death of Androud and the rise of something more open to replace it. There was a huge market for it when Android came out in competition with Apple's closed model, but now that Google is closing up Android, let's hope alternatives get some attention. Unfortunately, alternatives will mean no tap to pay, no RCS, etc., for a long time, since Apple, Google, et al., turned these things as proprietary as possible, but I'd still like a decent alternative to get enough power to eventually change those things.
Fantastic idea. As soon as we have that option, that's what I'll do. Until then I suppose I'll watch the two parties full of right wingers ruin everything.
GrapheneOS is the way to go
I switched a couple months ago and it's been absolutely fantastic
Google, you stick to your guns, I'll stick to mine. Sayonara.
This is like if Walmart started policing what products Target can sell and policing what products can go into your house, while not bothering to police their own store.
Installing F-Droid (or anything outside of "official" stores) already gets you a bunch of scary warnings that non-techy users would perceive as "omg malware!!" and withdraw from. I'm confident that the Venn diagram between F-Droid users and people who would be willing to use ADB to keep it is a circle. The real problem is that this cuts off anyone without a computer
Oh I didnt mean anyone else should I was just trying to confirm my thoughts on whether this would work
Trust me fuck Google and this is horrid news for FOSS so I hope there can be some fight back against this dictatorial censorship... Google is evil for trying to create a walled garden like Apple's out of android
That's not what I meant. I meant that yes, there are technical ways to get around this garden wall.
But only a very small percentage of users will know of it, or dare open a terminal to issue adb commands to their phone.
So the majority will be locked out of open and free app stores despite the technical possibility to keep using them.
And with fewer users, there will be fewer developers and fewer apps available.
Or just reinstall the OS without google.
We're about to see a bunch of cell phone repair shops offer this service.
Why? I have never owned a phone with google. Works great.
If thats one of the fixes available to grapheneOS users then yes Im pretty sure thats how you can get push on GOS
Not super sure you can strip google out of your android install and replace it with MicroG though (id love to be proven wrong though) and my bootloaders locked down (fuck you Semensnug you filthy animals)
Maybe at first, until their customers realise that all their apps need those services. And this is assuming the average person even notices the change in the first place and cares about it.
AOSP is lacking google.
It actually requires an extra step to install Google when you install an OS on an android device.
Just go through the process of installing the OS yourself, and skip the "install gapps" step. You'll have a phone without google, and this app blocking shite will have no impact on you
LineageOS is the way.
Let's see. I won't ever buy a Pixel. And Motorola is... iffy.
See the "socialist" up there ☝️?
Price is a component of "freedom"
does anyone know why would anyone use any of the mentioned stores instead of the play store? using f-droid has a clear benefit (they are also not on the supported list). but what is the purpose of those mainly manufacturer specific stores?
Money, and monopolistic behavior. Samsung, for instance, constantly pushes the "Samsung Account" on all their devices. Constantly. For the first two weeks after getting a new Samsung device you will be spammed with "finish setting up your phone" notifications that just want you to sign up for their tracking, and conveniently, when you're logged into a Samsung account, their app store is the default. And you will get notifications from their app store to download or buy whatever app they recommend. I can only assume the other stores mentioned do similar things.
The answer is they don’t choose.
Most people just use whatever the default is, and don’t really know a better option is available until it’s presented explicitly.
For samsung as oem they use exclusives of stuff only on their app store, and have forced integration.
If you buy a mainland China phone the app store will be local, for example Oppo store, and Play will be only available as a workaround. I think mainland China phones will be unaffected by Google's sideloading restriction.
yeah, I am also considering buying a huawei phone with HarmonyOS
Communist cute kitten, I do not advise you get a Huawei phone with HarmonyOS unless you are actually fluent in Chinese, based in China, and not interested in apps outside China. Given your name, 可爱小猫, you might be fluent. But given your use of Lemmy, I doubt you are a mainland local.
HarmonyOS latest update is a fully localized OS that uses a localized app store and can only run a few non-Chinese apps in a virtual machine, with restricted memory access. If that appeals to you, go for it.
Edit: Huawei is a special case. It has been heavily sanctioned and has cut ties to the Android ecosystem. Oppo / Oneplus phones are available in China variant, and they run Android. They are pretty much the same as a local phone, as long as your cell provider doesn't IMEI blacklist you. Mine runs on Canadian wireless providers when I'm in Canada.
Here's a copy/paste, sans hyperlinks:
Developer verification will be enforced on certified devices with Google Play Services installed, which is the majority of Android devices. There are options to bypass the restriction:
- Use a free, uncensored Android system like /e/os, LineageOS, or GrapheneOS that does not preinstall Google Play Services.
- "Degoogle" by removing Google Play Services. If it is a system app, you can uninstall it using ADB.
- Install apps via ADB. Google has already confirmed that ADB will continue to work in the future. You can either use ADB from a PC as described below or use a wireless ADB based installer like anyapk.
Android is open source (and also Linux), so there are many custom OSs that aren't "fancy linux", but just Android without Google apps. See: LineageOS, GrapheneOS, e/OS. You might be able to install one of them on your phone if it's compatible!
Just reinstall the OS without google.
Or you could buy a new or used device that's already degoogled. Or go to your local phone repair shop and pay them to do it for you.
Yeah, you just go into settings and unlock the bootloader.
If you have some really shitty phone that you can't unlock the bootloader, then you don't own the phone. Put it in the nearest electronics recycling bin, and buy one that you can own. You can buy phones that are already degoogled for a few hundred.
Fortunately its illegal in many countries to sell a phone whose boot loader can't be unlocked.
How can I stop it from happening on a Samsung s25? Can I just not update Google services somehow? Atleast until I can import a phone with graphene or Motorola releases one? I dont care about the apps from outside store but I do about the verified device shit.
Reinstall the OS without google.
Or you could buy a new or used device that's already degoogled. Or go to your local phone repair shop and pay them to do it for you.
I really just hope that this "com.google.android.verifier" package won't become a system app so i can just uninstall it whenever it appears on my device.
I can almost garantee it will be part of the secure safenet or how is it called (can't remember the name now) - the shit that all banking apps and stuff listen to and don't allow to run them if it returns issues. One time I had some debug flag on (it was on lineage), flag that doesn't do harm and can be only removed by rooting the phone and my bank verification app just refused to work because the device was insecure... If I rooted it would still said its insecure because its rooted...
Ehh, if they had foresight, they wouldn't be putting a hardcoded block for all web browsers on the Commodore phone. Instead, it's mostly just Peri commercializing his personal ideas of what a phone should be based on his past videos.
$500?
I thought that was reasonable. All electronics are expensive these days.
Considering the hardware in it and that it is a flip phone, I'd definitely call it over priced. I realize that it is going to be a low production run and they want to make some money, but $500 is too much for what it offers IMO. I am quite literally the prime market for such a phone, but the price and the forced browser block are stopping me.
I hate this timeline
An additional sting for some of us -
In Australia, not only is 3G deprecated (I miss my Nokia n91), but 4G / 5G must be of the VoLTE variety. To date, there is no after market OS that is fully VoLTE compatible (Legacy, Graphine etc) here - its hit or miss. Additionally, most (but not all) overseas phones are on IMEI black lists by default.
Essentially, because the OEM are lock step with Google, you can't avoid this issue by purchasing a common phone, unlocking your boot loader (assuming you could in the first place) and flashing CFW. Do that and you can't make phone calls. Don't do it, and you get caught up with this new app verification slop.
They think they're winning... but I think "lol. Keep going. I have a flip phone." As soon as this Samsung dies (adb debloated and all), I'm out entirely.
My Galaxy A20 has been going strong since 2019. If I get anything, I'll either be something from that era or just go full flip phone.
PS: someone mentioned the commodore flipphone. I like Perri and the C64 revival but let's be honest here...the Callback 8020 phone is $$$ for pretty bog standard dumb phone parts. The components don't justify it (barring perhaps the 48MP camera), let alone some of the design decisions.
If you look, I imagine you can find a local equivalent of this instead -
https://www.officeworks.com.au/...
(TTfone or Sunbeam I think?)
With right launcher and larger battery, I find it perfectly cromulent, with very good keyboard. It even runs FUTO voice STT (albeit slowly), my banking apps, Signal, FB messenger, maps, 5MP camera etc. It's not going to replace flagship anything... but maybe it doesn't need to. And it's 1/8th the cost.
There's a good YouTube channel for anyone considering such devices -
Yeah, that’s the fun bit. It’s not that Graphene can’t do calls.
It’s that in Australia, post-3G, “works on 4G” is no longer enough. The phone / firmware / carrier combo has to play nicely with VoLTE, IMS provisioning, and 000 emergency calling. If the carrier doesn’t like that exact combo, you can have perfectly good LTE data and still lose service or get nuked by IMEI/TAC filtering.
Graphene on a supported Pixel is probably the best-case scenario. Sadly, that doesn’t generalise to other phones here. It's a dice roll.
TL;DR: VoLTE is carrier-blessed black magic. Same bands, same radio hardware on paper...very different outcomes.
Very cromulent system. Much consumer choice.
Oh, cool, didn't know there were so many alternative app stores. Based on a quick google search it seems Xiaomi is the only one with a web interface and that hosts Qobuz and Discord.
?
I’m not happy about this but they really have no choice.
The android app marketplace is infested with spyware and Android devices were recently found to be the vector for one of if not the worlds biggest botnet (super/bad box).
If you wanna be able to keep using your os to make ad money you gotta lock it down and since Android is largely open source and used by tons of oems that means locking down some part that you could conceivably do without but no one really will.
None of this even attempts to address the problem of Google Play (the primary android app marketplace) being filled with malware. Every single app that's being distributed through Google Play today already has a "verified" developer by the same criteria they're applying system-wide. That malware can continue working as it already does without any changes.
This is exclusively about Google imposing control on all apps distributed through channels that otherwise used to be outside Google's control.
Google's claimed reasoning is that this control is a good thing and makes them be able to block apps made by malware developers in the same way they already do in Google Play, even for users who install apps from other sources. Critics disagree because Google forcibly taking personal information and money from all software developers and wielding the ability to remotely kill any app they don't like for any reason have far wider consequences than protecting users from malware, and the proliferation of malware on Google Play shows how (in)effective Google's measures against it are. Neither side believes or claims this can or will make Google Play any safer.
Yes it does.
It forces developers to register if they wanna distribute software. Now they can’t just pivot to a new identity whenever they’re under investigation.
It prevents devices from running software from unverified developers. Now the malware developer can’t just use a third party store to bypass the verification requirements.
That’s both sides of the coin, but wait, there’s more:
End users can disable it if they’re willing to go without play services or can do their own sideloading and support with a “limited” developer account.
The end result is not a panacea that fixes every problem with Android but a move to bring the various official android marketplaces in line with the ios app store.
It prevents devices from running software from unverified developers. Now the malware developer can’t just use a third party store to bypass the verification requirements.
they didn't need to use a third party store to begin with. the play store is filled with malware.
End users can disable it if they’re willing to go without play services or can do their own sideloading and support with a “limited” developer account.
that is wrong on multiple counts, fortunately they did not lock it down that much (yet). that wouldn't just be very complicated but that would also disable a couple of unrelated features of the phone.
The end result is not a panacea that fixes every problem with Android but a move to bring the various official android marketplaces in line with the ios app store.
as if that's a good thing.
Part of what made badbox/superbox so successful (along with the marketing, mlm stuff, glut of cheap arm/risc decoders, environment of 69 fucking subscriptions a month your average person has to maintain just to watch terminator when they get home from a shift) was the presentation of malware payload apps from third party marketplaces alongside “legit” apps from the first party ones.
It’s the gas station effect. Of course you can trust the Tamriel rebuilt branded rhino pill, it’s on the same rack as the goodys powder and tums!
That same mixing made it very difficult for everyone trying to figure out what was happening to actually get something taken down. Apps on the play store would be barely legal or skirting the law but interacting with or funneling data around apps from third party stores that were definitely doing something “wrong”.
When takedown notices were sent for the play store apps they didn’t have any effect on the third party hosted ones.
So for the whole thing to run how it did, yeah, they needed third party repositories.
You might not see this as a good thing, but Google does. And tbh they’re right. It’s bad for the minuscule number of users who actually load stuff from third party sources, but its incredibly good for them as a company and a brand.
They should police their own store then. Fuck this "oh they have to" shit.
This is what it looks like when they police their store.
This is what it looks like when they try to police the software that's NOT from their store (or their partners).
All the Google-verified malware that infests Google's marketplace will continue to be a problematic vector after this change. But this change will put obstacles in my attempts to install safe alternatives that are free of malware and not part of Google's junkyard or spyware full of anti-features.
The phone someone purchased from Samsung isn't "their store" bud. The play store is.
And someone can either disable the system service that does this and go without play services (which is their store) or get a “limited” developer account and keep doing whatever they’re doing.
Google already does what it should: sideloading apps requires you to manually approve the source, and when you do, a popup appears warning user of potential dangers. No need to play daddy any more than this.
Having a locked ecosystem is very convenient and profitable for Google, but terrible for its users. Google wants this walled garden not out of safety, but to get a tight grip on the app stores - and get a solid buck while doing it.
look, I trust F-droid and open source apps more than I trust the sponsored garbage on play store alongside shit like kalshi and candycrush. The security point is moot. The call is coming from inside the house.
As for ad money, being one of the most grossly profitable corporations in the world isn't enough? Must line go up always? At what point is having an absurd amount of profit enough? Where is the line?
@lemmy.ml
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
go to feed...
@lemmy.ml
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
go to feed...
I'm so tired of everything being made shittier all the time and being able to do nothing about it.
save