5 ms·
> Unfortunately, these functions are also incredibly useful for malicious apps [..] Google has already limited which apps on Google Play can use the Accessibili
by car_analogy 4y ago
> Unfortunately, these functions are also incredibly useful for malicious apps [..] Google has already limited which apps on Google Play can use the Accessibility API, and in Android 13, they’re taking things one step further by heavily restricting API access for apps that the user has sideloaded from outside of an app store.
An API that is so limited that malicious apps cannot abuse it, is too limited to be useful for non-malicious apps. This is just boiling the frog to make sideloading entirely useless, so users need permission from Google for any app they wish to run.
- ars 4y agoThe article explains how what you said is not correct. You do NOT need Google's permission.
- deleted 4y ago[deleted]
- tragictrash 4y agoFrom the article: These restrictions are tied to a new permission in Android 13 called ACCESS_RESTRICTED_SETTINGS. This permission controls whether or not the user can enable an app’s accessibility service. When an app has been sideloaded using the non-session method, ACCESS_RESTRICTED_SETTINGS is first set to “deny”. After viewing the “restricted setting” dialog, ACCESS_RESTRICTED_SETTINGS is set to “ignore.” At this point, the user can go to the app info page for the app in question, tap the three-dot menu, and then tap “allow restricted settings” to unblock access to the accessibility service. The user will then be asked to authenticate themselves, and if they pass, ACCESS_RESTRICTED_SETTINGS will be set to “allow” for the app. The system does not tell the user they can do this, but this could change in future Android 13 builds. Sounds like the accessibility apis are behind another settings screen now.
- interpol_p 4y agoThis is similar to allowing full network access for custom keyboards on iOS. You can't allow it via an easy prompt, you must navigate into settings and explicitly enable it Same for always-on location access. I think this is the right way, users who intend to enable these things should really have to think about it and know what they are doing to allow an app that much access
- MishaalRahman 4y agoAndroid's AccessibilityService API already requires the user to navigate into settings and explicitly enable the service for any given app. The "restricted settings" dialog adds another explicit warning for users to acknowledge, which is IMO a good thing. The system currently doesn't tell the user how they can "allow restricted settings" for an app, though, which I think is because this feature is a WIP as of Beta 1. (The "allow restricted settings" button is in a different area of settings entirely from Settings --> Accessibility, and the dialog makes no mention of it/doesn't link to help material about the restriction. Definitely a WIP.)
- guelo 4y agoApple does this with a lot of their security interfaces where they block it with little explanation and then expect motivated users to figure it out by googling. Personally I find it offensive. Year over year we slowly lose control of our computers in the name of security. Where does it end? Our most personal invasive tools are not there to serve us anymore, they have other masters.
- deleted 4y ago[deleted]
- kllrnohj 4y agoPer the article, alternative stores like F-Droid are not impacted. So no, Google's permission is not required. No frogs are being boiled, that's FUD. The actual specifics of the change seem about as carefully & considerately done as possible for what is a dangerous & nuanced situation.