8 ms·

Quick note: Google's Advanced Protection program disallows sideloading apps, so you can't install F-droid. Edit: Note that the Advanced Protection program is o

Quick note: Google's Advanced Protection program disallows sideloading apps, so you can't install F-droid. Edit: Note that the Advanced Protection program is opt-in for users that require the highest degree of security Google can offer. Regular users won't be impacted by this. Edit: proof https://imgur.com/a/yktPNIc https://imgur.com/a/yktPNIc Edit 2: see @haunter's comment for a link to the change announcement

mongol 6y ago
What?
ce4 6y ago
I disagree - any proof for your statement?
- haunter 6y ago
  Not OP but that was announced back in March https://www.blog.google/products/android/new-malware-protections-advanced-protection-users/ https://www.blog.google/products/android/new-malware-protect...
  - ce4 6y ago
    Ok thanks. Somehow must have missed that one - I guess it's voluntary unless you install some work related app where company security policies pretty much default to switching off any possible loophole. I don't like where this path is going to lead :(
    - shawabawa3 6y ago
      The Advanced Protection program is opt-in for people with a high security posture It also means you _have_ to have 2 security keys set up to login to your Google account with no other 2 factors allowed as backup
- amingilani 6y ago
  I've added a screenshot.
iagovar 6y ago
? I have F-Droid in my phone, is this something new?
- amingilani 6y ago
  I believe so, I had it until I changed my phone. I've added a screenshot. Edit: See this comment for link to announcement https://news.ycombinator.com/item?id=25645554 https://news.ycombinator.com/item?id=25645554
- opencl 6y ago
  It only applies if the Google account on your phone is enrolled in the Advanced Protection Program.
- zyx321 6y ago
  Advanced Protection is an opt-in for people at risk of targeted attacks. Unless you have a company phone, it's unlikely to be enabled without your knowledge.
chrisrhoden 6y ago
This is specifically if your employer requires it for you to be logged into your work google account.
- fullstop 6y ago
  I am enrolled in Advanced Protection with my personal account. It's optional.
hyperpallium2 6y ago
This Advanced Protection program is optional, isn't it?
- vlunkr 6y ago
  Yes. You can disable it. https://support.google.com/accounts/answer/7539956 https://support.google.com/accounts/answer/7539956 . It would have been nice for the parent comment to include that, since it changes the situation significantly.
drKarl 6y ago
Wow! That is a very big deal!!! Almost all of the Apps I have on my Android phone are installed from F-Droid, and I try to avoid installing any Apps from other sources, exceptions force upon me by my social circle, like WhatsApp. I have a PinePhone but it is not yet ready as a daily driver, and also the difference in hardware performance between my Android phone (which I bought this year) and PinePhone (or even Librem) is abismal. I wish there was at least one (or many) linux phone ready to be a daily driver and with hardware comparable to modern Android phones (or iPhones), but unfortunately that is not yet the case, although the community has made a massive effort this year to advance the state of linux on phones, at least for PinePhone... I use a MacBook for work and same thing, almost all the apps I have I installed using homebrew (and the UI apps, with brew cask) EDIT: I see that, at least for now, it's optional and you can un-enroll, which is good.
- riedel 6y ago
  The problem will start with such offerings only if third parties (like employers or banks) demand turning this on. The patronizing of users that started with saftynet is horrifying. I think it will become crucial that some commercialy relevant group uses non play store content. Otherwise the affordance to use non main stream stuff will become higher and higher.
  - judge2020 6y ago
    I mean it makes sense. The employer requires you to only trust Google-approved apps since something like an evil maid (or mugging, or blackmail, etc) attack on an unlocked phone is part of their threat model.
    - velosol 6y ago
      And it seems reasonable for an employer. What about banks? The argument I'm coming up with just isn't as compelling for no other reason than I'm 'only' risking my money, not corporate access.
  - paulie_a 6y ago
berdario 6y ago
Wasn't aware of it, interesting https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ There are instructions here for how to unenroll: https://support.google.com/accounts/answer/7539956 https://support.google.com/accounts/answer/7539956
johnsoft 6y ago
Yikes. I use f-droid, and I'm lucky enough to be one Android version behind. Can someone who's upgraded let me know what to expect when I upgrade? The blog post mentions that adb still works. Does this mean I'll have to use adb once to install f-droid and have it work normally after that, or will _every_ app need to be installed using adb?
- suprfsat 6y ago
  You'll have to use ADB once to install F-droid and each new app not from the Play Store, but F-droid will be allowed to install updates.
gst 6y ago
> Quick note: Google's Advanced Protection program disallows sideloading apps, so you can't install F-droid. It's still possible to sideload apps if they are installed with ADB.
- deleted 6y ago
  [deleted]
- fullstop 6y ago
  Yes, I can confirm this. Advanced Protection is kind of cool but there are definitely some downsides.
sneak 6y ago
I learned recently that having Advanced Protection enabled also rewrites all URLs in your email messages to use the Google URL redirector, even when accessed via IMAP. It breaks PGP signatures, among other things. No way to turn it off without disabling all of Advanced Protection. Sweet, huh?
- est31 6y ago
  Which advantages does Advanced Protection give you in particular so that you have enabled it? It seems that things like hardware 2fA should work without it as well? Genuinely curious.
  - ufmace 6y ago
    I am on it and like it. It seems to explicitly forbid a bunch of edge cases in the login auth that would otherwise be tricky to configure properly and keep up to date. Yes, you can set up and use hardware key auth without it, but it's nice to guarantee that you can never login without a hardware key no matter what. IIRC it closes off a few other types of misconfiguration or over-authorization that might allow someone to exfiltrate data from your account.
  - sneak 6y ago
    It forbids 2FA with anything other than U2F hardware, which is practically unphishable. I don't really trust the Google auth system without the hard "disallow all non-hardware-based auth" restriction, due to the innumerable stories about sim swapping, et c.
    - est31 6y ago
      Fair point! Didn't know there was no other way of enabling this.
- liotier 6y ago
  Office 365 does that too - and Twitter by the way... Copying & pasting URL is becoming mostly a tedious rigmarole of opening the link, seeing what it finally resolves to - and only then copying & pasting...
Jubok 6y ago
And even if you disable it, it can still block you. I didn't try to reset my phone completely, but I have to Force Stop the Google Play Store and empty cache/user's data to install any apk
admax88q 6y ago
I wonder what the actual numbers are on malware installed via side-loading and malware installed from the play store. There is no shortage of sketchy apps on the play store. Through my personal bias I would imagine that most people side-loading apps tend to be people using F-Droid who know more or less what they're doing. Although I'm sure there are some people who blindly follow sketch website telling them to install sketchy APK directly. But do these people really outnumber people installing flashlight app from play store that steals your data? All this locking down your device "for your own protection" assumes that the play store software is actually vetted and secure, but that second piece never seems to fall in to place. This random article [1] suggests that 67% of malicious app installs comes from the play store itself. So this whole "Advanced Protection" scheme only protects against 23% of threats. Pretty weak IMO. [1] - https://www.zdnet.com/article/play-store-identified-as-main-distribution-vector-for-most-android-malware/ https://www.zdnet.com/article/play-store-identified-as-main-...
- tgsovlerkhgsel 6y ago
  There is "people intentionally side-loading", and "people getting social engineered into installing something they shouldn't".
  - adewinter 6y ago
    I think even when you sum those two quantities it'll still be less than the number of people getting hit by apps from the regular play store.
    - zamadatix 6y ago
      Likely but not because no filtering at is is better than mediocre filtering rather precisely because it's not easy for a user to "accidentally" side load.
      - coretx 6y ago
        Tons of apps are referencing 100% turing complete web content and not taking flak. NORPS don't "accidentally" side load by means of typing stuff in a terminal that makes them both feel hackerman and scared shitless at the same time. Only boomers and ties believe it's not about anti competitive behavior.
AsyncAwait 6y ago
> Note that the Advanced Protection program is opt-in for users that require the highest degree of security Google can offer. Regular users won't be impacted by this. Yet. Google seems to be restricting Android more and more with each release. I fully switched to the PinePhone last year because of this.
- ripdog 6y ago
  The AP program is optional and only for people with high security needs. The restrictions make it utterly inappropriate for unskilled users, so it will never be expanded to the general population. General sideloading? True, that's anyone's guess.
stjohnswarts 6y ago
Thanks for the clarification. I was going to say I might as well just switch to Apple if I can't sideload and enjoy some freedom with my phone even if it's not as free as I would like.
app4soft 6y ago
> Quick note: Google's Advanced Protection program disallows sideloading apps... According this rule, all web browsers should be removed from Google Play too, as JavaScript apps (embedded in webpages) are "sideloading apps" by design.
endgame 6y ago
> Regular users won't be impacted by this. Yet. Next step is to make it opt-out for the "safety" of the public.
tambeb 6y ago
You can sideload apps via ADB. And once an app is installed that way you can then update it normally with an APK going forward. (I have Advanced Protection and I do this.)

mongol 6y ago

What?

ce4 6y ago

I disagree - any proof for your statement?

haunter 6y ago
Not OP but that was announced back in March https://www.blog.google/products/android/new-malware-protections-advanced-protection-users/ https://www.blog.google/products/android/new-malware-protect...
- ce4 6y ago
  Ok thanks. Somehow must have missed that one - I guess it's voluntary unless you install some work related app where company security policies pretty much default to switching off any possible loophole. I don't like where this path is going to lead :(
  - shawabawa3 6y ago
    The Advanced Protection program is opt-in for people with a high security posture It also means you _have_ to have 2 security keys set up to login to your Google account with no other 2 factors allowed as backup
amingilani 6y ago
I've added a screenshot.

iagovar 6y ago

? I have F-Droid in my phone, is this something new?

amingilani 6y ago
I believe so, I had it until I changed my phone. I've added a screenshot. Edit: See this comment for link to announcement https://news.ycombinator.com/item?id=25645554 https://news.ycombinator.com/item?id=25645554
opencl 6y ago
It only applies if the Google account on your phone is enrolled in the Advanced Protection Program.
zyx321 6y ago
Advanced Protection is an opt-in for people at risk of targeted attacks. Unless you have a company phone, it's unlikely to be enabled without your knowledge.

chrisrhoden 6y ago

This is specifically if your employer requires it for you to be logged into your work google account.

fullstop 6y ago
I am enrolled in Advanced Protection with my personal account. It's optional.

hyperpallium2 6y ago

This Advanced Protection program is optional, isn't it?

vlunkr 6y ago
Yes. You can disable it. https://support.google.com/accounts/answer/7539956 https://support.google.com/accounts/answer/7539956 . It would have been nice for the parent comment to include that, since it changes the situation significantly.

drKarl 6y ago

Wow! That is a very big deal!!! Almost all of the Apps I have on my Android phone are installed from F-Droid, and I try to avoid installing any Apps from other sources, exceptions force upon me by my social circle, like WhatsApp. I have a PinePhone but it is not yet ready as a daily driver, and also the difference in hardware performance between my Android phone (which I bought this year) and PinePhone (or even Librem) is abismal. I wish there was at least one (or many) linux phone ready to be a daily driver and with hardware comparable to modern Android phones (or iPhones), but unfortunately that is not yet the case, although the community has made a massive effort this year to advance the state of linux on phones, at least for PinePhone... I use a MacBook for work and same thing, almost all the apps I have I installed using homebrew (and the UI apps, with brew cask) EDIT: I see that, at least for now, it's optional and you can un-enroll, which is good.

riedel 6y ago
The problem will start with such offerings only if third parties (like employers or banks) demand turning this on. The patronizing of users that started with saftynet is horrifying. I think it will become crucial that some commercialy relevant group uses non play store content. Otherwise the affordance to use non main stream stuff will become higher and higher.
- judge2020 6y ago
  I mean it makes sense. The employer requires you to only trust Google-approved apps since something like an evil maid (or mugging, or blackmail, etc) attack on an unlocked phone is part of their threat model.
  - velosol 6y ago
    And it seems reasonable for an employer. What about banks? The argument I'm coming up with just isn't as compelling for no other reason than I'm 'only' risking my money, not corporate access.
- paulie_a 6y ago

berdario 6y ago

Wasn't aware of it, interesting https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ There are instructions here for how to unenroll: https://support.google.com/accounts/answer/7539956 https://support.google.com/accounts/answer/7539956

johnsoft 6y ago

Yikes. I use f-droid, and I'm lucky enough to be one Android version behind. Can someone who's upgraded let me know what to expect when I upgrade? The blog post mentions that adb still works. Does this mean I'll have to use adb once to install f-droid and have it work normally after that, or will _every_ app need to be installed using adb?

suprfsat 6y ago
You'll have to use ADB once to install F-droid and each new app not from the Play Store, but F-droid will be allowed to install updates.

gst 6y ago

> Quick note: Google's Advanced Protection program disallows sideloading apps, so you can't install F-droid. It's still possible to sideload apps if they are installed with ADB.

deleted 6y ago
[deleted]
fullstop 6y ago
Yes, I can confirm this. Advanced Protection is kind of cool but there are definitely some downsides.

sneak 6y ago

I learned recently that having Advanced Protection enabled also rewrites all URLs in your email messages to use the Google URL redirector, even when accessed via IMAP. It breaks PGP signatures, among other things. No way to turn it off without disabling all of Advanced Protection. Sweet, huh?

est31 6y ago
Which advantages does Advanced Protection give you in particular so that you have enabled it? It seems that things like hardware 2fA should work without it as well? Genuinely curious.
- ufmace 6y ago
  I am on it and like it. It seems to explicitly forbid a bunch of edge cases in the login auth that would otherwise be tricky to configure properly and keep up to date. Yes, you can set up and use hardware key auth without it, but it's nice to guarantee that you can never login without a hardware key no matter what. IIRC it closes off a few other types of misconfiguration or over-authorization that might allow someone to exfiltrate data from your account.
- sneak 6y ago
  It forbids 2FA with anything other than U2F hardware, which is practically unphishable. I don't really trust the Google auth system without the hard "disallow all non-hardware-based auth" restriction, due to the innumerable stories about sim swapping, et c.
  - est31 6y ago
    Fair point! Didn't know there was no other way of enabling this.
liotier 6y ago
Office 365 does that too - and Twitter by the way... Copying & pasting URL is becoming mostly a tedious rigmarole of opening the link, seeing what it finally resolves to - and only then copying & pasting...

Jubok 6y ago

And even if you disable it, it can still block you. I didn't try to reset my phone completely, but I have to Force Stop the Google Play Store and empty cache/user's data to install any apk

admax88q 6y ago

I wonder what the actual numbers are on malware installed via side-loading and malware installed from the play store. There is no shortage of sketchy apps on the play store. Through my personal bias I would imagine that most people side-loading apps tend to be people using F-Droid who know more or less what they're doing. Although I'm sure there are some people who blindly follow sketch website telling them to install sketchy APK directly. But do these people really outnumber people installing flashlight app from play store that steals your data? All this locking down your device "for your own protection" assumes that the play store software is actually vetted and secure, but that second piece never seems to fall in to place. This random article [1] suggests that 67% of malicious app installs comes from the play store itself. So this whole "Advanced Protection" scheme only protects against 23% of threats. Pretty weak IMO. [1] - https://www.zdnet.com/article/play-store-identified-as-main-distribution-vector-for-most-android-malware/ https://www.zdnet.com/article/play-store-identified-as-main-...

tgsovlerkhgsel 6y ago
There is "people intentionally side-loading", and "people getting social engineered into installing something they shouldn't".
- adewinter 6y ago
  I think even when you sum those two quantities it'll still be less than the number of people getting hit by apps from the regular play store.
  - zamadatix 6y ago
    Likely but not because no filtering at is is better than mediocre filtering rather precisely because it's not easy for a user to "accidentally" side load.
    - coretx 6y ago
      Tons of apps are referencing 100% turing complete web content and not taking flak. NORPS don't "accidentally" side load by means of typing stuff in a terminal that makes them both feel hackerman and scared shitless at the same time. Only boomers and ties believe it's not about anti competitive behavior.

AsyncAwait 6y ago

> Note that the Advanced Protection program is opt-in for users that require the highest degree of security Google can offer. Regular users won't be impacted by this. Yet. Google seems to be restricting Android more and more with each release. I fully switched to the PinePhone last year because of this.

ripdog 6y ago
The AP program is optional and only for people with high security needs. The restrictions make it utterly inappropriate for unskilled users, so it will never be expanded to the general population. General sideloading? True, that's anyone's guess.

stjohnswarts 6y ago

Thanks for the clarification. I was going to say I might as well just switch to Apple if I can't sideload and enjoy some freedom with my phone even if it's not as free as I would like.

app4soft 6y ago

> Quick note: Google's Advanced Protection program disallows sideloading apps... According this rule, all web browsers should be removed from Google Play too, as JavaScript apps (embedded in webpages) are "sideloading apps" by design.

endgame 6y ago

> Regular users won't be impacted by this. Yet. Next step is to make it opt-out for the "safety" of the public.

tambeb 6y ago

You can sideload apps via ADB. And once an app is installed that way you can then update it normally with an APK going forward. (I have Advanced Protection and I do this.)