12 ms·

Android now allows apps to block sideloading

161 points by kklisura 2y ago

wilsonnb3 2y ago
I wonder if Google will try to use this on the YouTube app to prevent revanced from working.
- badRNG 2y ago
  Couldn't they just patch out that check?
  - ranger_danger 2y ago
    Depends where the check is... most likely outside of the app itself. A regular phone with google play services already has a "backdoor" of sorts where google can push any code they want to you... which they have already used for dubious purposes like forcefully uninstalling certain apps from devices under the guise of security.
    - fngjdflmdflg 2y ago
      Revanced gives the app a new app ID (app.revanced.android.youtube) and resigns it, so Google cannot for example just check that apps using the youtube app id have a valid MD5.
      - ranger_danger 2y ago
        They could check for Revanced and friends too though, probably even dual-purpose that to disallow installing it entirely since it wouldn't be allowed on the play store in the first place.
        fngjdflmdflg 2y ago
        >They could check for Revanced and friends too though Not really, at least not at the app ID level, because revanced can change app ids indefinitely. Google generally only solves a problem when it can be automated, and manually adding revanced app ids to a blacklist cannot easily be automated. In fact, since revanced is patched on device, they could assign each user a unique app id which would make using app ids as a solution unworkable for Google.
        ranger_danger 2y ago
        You don't think they know how to automate downloading the latest Revanced and checking the app ID?
        fngjdflmdflg 2y ago
        Like I just said, you do not download a revanced youtube apk. You download a revanced patcher that patches the APK on your device. Right now, the patcher gives each app the same id, but theoretically it could give a random string as the app id that is generated by the user at runtime while patching, so that would not work. Even if that were not the case, Google would not set up a script to download latest revanced to check the id. It's only a few steps away from being manual because it would not work for other projects or even for revanced itself if they changed the website's code or domain name. What I mean by solving a problem with automation is like how Google detects copyrighted music in youtube videos and sends the ad revenue to the copyright owners.[0] Having someone constantly fix a script that "automates" finding app ids does not meet that bar. [0] https://support.google.com/youtube/answer/2797370?sjid=13102225573982517285-NA https://support.google.com/youtube/answer/2797370?sjid=13102...
        ranger_danger 2y ago
        The Play Store functions as a type of backdoor which allows them to run any code on your device that they want, which includes scanning for Revanced (regardless of the actual app ID, they could just look for the NAME of the app for example) and removing it. They have already used the play store in the past to delete apps from people's devices: https://android.stackexchange.com/questions/252066/does-google-still-have-the-ability-to-uninstall-apps-without-user-permission-in https://android.stackexchange.com/questions/252066/does-goog...
  - wilsonnb3 2y ago
    I think they probably could but I am unsure of the implementation details. Patching out the check might work for now, since they will be supporting older versions of the app for a while. If they eventually decide that the server needs to verify the check, it might need to be spoofed rather than removed which can be more difficult (again, depending on implementation details).
alextingle 2y ago
Isn't the possibility of side-loading one of the main things protecting Google Play Store from being hammered by the Digital Markets Act?
- croes 2y ago
  It's the app developer's decision if their app can be side loaded. Doesn't change the possibility as such.
- zaik 2y ago
  The possibility of sideloading != the possibility to side load specific apps that their developers don't want to be side loaded
  - Teever 2y ago
    If that's the case it's just a matter of time before the EU regulates away this anticonsumer choice by Google and the app developers.
    - type0 2y ago
      they won't, it was clear that Google would also embrace malicious compliance, it's just the first steps so far
      - Teever 2y ago
        Yes that's how the game goes. The regulator has to keep plugging holes that the non compliant corporate entity finds until there are no more holes worth exploiting by the corporate entity. It is an exhausting and practically unending task to defend consumers against malfeasant operators but it is one that governments can and must do.
    - buzzerbetrayed 2y ago
      What is anti consumer about an app developer only allowing their app to be installed through the play store? Genuinely wondering.
gjsman-1000 2y ago
This came up in GrapheneOS; because Google Play Services runs as root with no sandbox on stock devices. Almost anything is possible when you’re root…
rbut 2y ago
How will this affect those running MicroG? Is it as simple as implementing that API and returning "trustworthy", or is there some kind of signing going on that will make it harder?
xnx 2y ago
Is there anything like a thin virtualization/sandboxing tool for Android? As the user, I (not the Android OS), should have ultimate say in what information apps have access to. I should be able to feed any app fake GPS, contact, gallery, permissions, rooted state, and sideloaded state information as I choose.
- Onavo 2y ago
  Magisk
- saurik 2y ago
  FWIW, the ad industry--of which Google is the circus master--disagrees, and so your emulator wouldn't pass Google Play Integrity (previously SafetyNet Attestation) and its remote attestation DRM scheme. https://developer.android.com/google/play/integrity https://developer.android.com/google/play/integrity
- umbra07 2y ago
  Magisk. To a much, much lesser degree: Samsung's Secure Folder/Android's Work Profile.
  - digdugdirk 2y ago
    Do you have a recommendation for a starting point to learn about this? I went to the magisk github and it seems to assume that you already know what it is and why you should want it.
    - deleted 2y ago
      [deleted]
  - NoGravitas 2y ago
    Yes, but. As far as I know, it is possible to fake SafetyNet data with Magisk, but there's no bypassing Google Play attestation.
- bubblethink 2y ago
MathMonkeyMan 2y ago
Hot take: The word is "installing." There's no such thing as "sideloading."
- solardev 2y ago
  It's a useful word, descriptive and much shorter than "installing from outside the official app store using a third-party APK".
  - permo-w 2y ago
    and yet, when you do it on a PC, it's just called "installing". the point is that the word railroads you into the assumption that having an official app store is the default behaviour and installing software from elsewhere is somewhat underhanded and sneaky, which is convenient for Apple, Google and Microsoft's profit margins
    - solardev 2y ago
      It's not just an assumption, it actually is the default on iOS, Android, iPadOS, and macOS, and the user has to jump through hoops to get around it. I'm not saying this is a good thing, but having a name for it makes it easier to describe, search for, lobby for, and ultimately use. It's like rooting or jailbreaking or even something as innocent as a plug-in or forking: different techniques of modifying software functionality away from the default, but each with its own costs and benefits. If you tell someone to install Adguard, for example, then on iOS they're installing an app that gives them a Safari extension through the official mechanisms. It can block ads in Safari. But on Android they don't install it from the official store, they sideload an APK by disabling some built in system protections against unsanctioned apps. It's more hoops on Android because of the sideloading, but they get way more power (it acts as a VPN and also a HTTPS MITM cert and filters all your traffic). It can filter ads in all apps, even through HTTPS. The downside is that now all your data goes to this small ad blocking company and circumvents the billions of dollars Google's spent trying to keep your device safe. It's a meaningful difference and users should know both the risks and benefits of being able to sideload apps, just like they should understand the risks and benefits of fully rooting your phone.
S201 2y ago
This is how software freedom dies. If bs like this and that "web environment integrity" crap Google tried to push into Chrome last year isn't an obvious sign that Google is a monopoly and needs to be broken up then I don't know what is. It's a disgrace what Google has done to Android as a formerly open and developer friendly platform.
wlindley 2y ago
And this is why it is so shocking that even folks who should know better, who are technically savvy in the slightest, would ever consent to use such a brain-damaged computer system that runs nonfree software.
- Dalewyn 2y ago
  The irony is probably lost on you, considering FOSS evangelists scream bloody heresy at anyone daring to install non-FOSS filth upon their holy sand machines.
caseyy 2y ago
This seems historic. One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. I hope it doesn't become a slippery slope where for "security" Google would start blocking undesirable or ethically/politically inconvenient apps, too. For example, there are some medical apps that improve people's health outcomes (like custom blood glucose CGM apps and insulin pump closed loop apps for type 1 diabetics). Google does not seem to want them on the Play Store. They are undesirable apps from a business perspective – a liability with no upside. The tech we speak about today provides the infrastructure to block these undesirable apps, as I understand. This lays the foundation of not allowing software to be installed on many consumer Android phones without Google's approval. I do hope it never comes to Google overstepping like that, but it could be optimism or naivety. As a tool for app developers... where app developers make the decision... in this limited situation, it might be still somewhat okay. It's okay in the sense that the apps are their intellectual property and they might be entitled by law and common understanding to choose how it is distributed. But if Google ever decides to ban apps this way against the developers' wishes, it would be a massive overstep.
- shiroiushi 2y ago
  >This seems historic. One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. No, it isn't. AFAICT, this "feature" only prevents you from sideloading apps that don't want to be side-loaded. It's not going to prevent you from installing your favorite open-source apps from Fdroid or APKs. >For example, there are some medical apps that improve people's health outcomes... Google does not seem to want them on the Play Store. Then it would be very, very stupid for these apps to add this anti-side-loading feature, wouldn't it? Google isn't the one preventing side-loading, it's the individual apps (and their makers) themselves.
  - caseyy 2y ago
    Sorry, I was still editing my comment and clarifying my opinion as you responded. I agree with you but I think it could still be historic if this infrastructure is later abused. I'd delete the original comment as my late edit skewed the discussion but HN doesn't let me do that. Apologies.
rkagerer 2y ago
To whom should I point my middle finger? Is Google the one to thank for this?
- matheusmoreira 2y ago
  Absolutely. They implemented this hardware remote attestation nonsense which lets them cryptographically prove that "your" phone is still under their control. Android ceased to be a free ecosystem the second this feature showed up. It's basically equivalent to a video games console now. Cryptography empowers whoever has the keys, and it's not us. Apps "checking" whether they're running on "approved" hardware and software are the future. And it's only going to get worse from here. They should not even be able to know we're running custom software, much less be able to refuse to run because of it. And yet these corporations are doing just that.
  - HeatrayEnjoyer 2y ago
    The CPU requirement for Windows 11 that will obsolete computers as young as 2019 is for attestation reasons.
dugite-code 2y ago
I really wish there was a third competitor in the phone space. These are hand held computers but for some reason we've all fallen into having to accept restrictions that would have been unthinkable for a laptop or desktop not to long ago. Now similar restrictions are infiltrating the general computer space.
- _yb2s 2y ago
  All in the name of reliability and security supposedly. For example not being able to use banking apps on a rooted phone… yet I can use them on my perfectly secure regular computer where I have full root/admin access.
  - dmoy 2y ago
    > can use them on my perfectly secure regular computer where I have full root/admin access. yooooooo shhhhhh Don't give them any ideas :( Also it's not like insane security ideas around banking access compliance are unprecedented, see e.g. South Korea's insane Internet Explorer deal (transitively caused by US's ITAR on encryption) https://en.m.wikipedia.org/wiki/Web_compatibility_issues_in_South_Korea https://en.m.wikipedia.org/wiki/Web_compatibility_issues_in_...
    - matheusmoreira 2y ago
      Brazil once had a similar problem. Banks used to force users to install these obnoxious "security plugins" into their browsers. One day I got fed up with the inexplicable slowdown they were causing and decided to see what they were doing. Turned out they were intercepting every network connection. There is no limit whatsoever to what a bank feels is justified in doing when it comes to preventing fraud, money laundering or whatever else that impacts their bottom line. They literally believe they are entitled to any and all access.
  - lxgr 2y ago
    Can you confirm transactions there, though? Many banks in the EU require a smartphone for that at this point (or a dedicated authentication device). But instead of using actually secure technologies like Android’s protected confirmation (which couldn’t care less about running on a rooted phone, as it runs in a trusted HW enclave), they usually just settle for (often very spoofable) “root detection”. It’s quite sad.
g-b-r 2y ago
Even Ars Technica now?? And in two hours no one on HackerNews pointed it out?? It's a feature that's existed for years!!! They just changed the UI a little..!! https://developer.android.com/google/play/integrity https://developer.android.com/google/play/integrity
- matheusmoreira 2y ago
  Yup. It's just the latest iteration of hardware remote attestation. Whoever has the keys owns the machine, and it sure as hell ain't us.
  - g-b-r 2y ago
    It doesn't require hardware attestation, to my knowledge
    - matheusmoreira 2y ago
      Without hardware attestation it's probably easy enough to defeat it.
solarkraft 2y ago
So now, to sideload an app that the developer for some reason doesn’t want to be sideloaded, the app will have to be patched. This makes the apk untrusted, as it loses its signing in the process.
solarkraft 2y ago
So now, to sideload an app that the developer for some reason doesn’t want to be sideloaded, the app will have to be patched. This makes the apk untrusted, as it won’t be signed by the original developer anymore. Looks like a weakening of Android ecosystem security to me.
BLKNSLVR 2y ago
The near future - 1 cheapest possible phone to begrudgingly bend-the-knee to banking and other crybaby apps. - 1 decent phone for everything else.
- NoGravitas 2y ago
  That's the direction I think I'm heading.
nfriedly 2y ago
> ...allow for installation on incompatible devices (and resulting bad reviews)... I've had the opposite experience with my Retroid Pocket 3+ (think Nintendo Switch Lite, but running Android). A lot of apps/games that the Play Store marks as incompatible actually work fine when installed via the Aurora store. I try to always leave a review stating that the app actually works.
mostlyRice 2y ago
I really hope FTC breaks android and chrome away from google.
- ivanmontillam 2y ago
  I am rooting for that too. It's becoming unbearable, and I'm just not an Apple guy.
- AJ007 2y ago
  Between the convoluted EU rules and whatever the multiple US antitrust cases outcomes are, it could be a lot simpler: Chrome, Android, Youtube, and Gmail all must be divested. The ad & search business don't really appear separable, but everything else certainly is.
  - imglorp 2y ago
    How? Projects like Chrome are adj delivery and surveillance platforms wholly funded by the ad business for the benefit of the ad busines. What would a spinoff look like?
    - readams 2y ago
      Chrome exists to counter the previous platform browser monopoly from Microsoft, which was holding back the web from being a viable application platform. It was never been about surveillance and doesn't do a very good job of surveillance if that were the goal.
      - NoGravitas 2y ago
        Chrome was created to counter the previous platform browser monopoly from Microsoft. Once that was achieved, it pivoted. First to making sure Google has a controlling stake in setting web standards, and then to surveillance. Surveillance features: FLoC, Manifest v3, Web Attestation. The surveillance features have often flopped or been beaten back, but they keep being introduced.
  - 2y ago
matrix87 2y ago
I hope there's some way around this if you have it rooted
CatWChainsaw 2y ago
This is one of the cancerous outgrowths of "know your customer". It becomes "know everything about your customer" which becomes "control everything your customer does." This obsession with omnipotence, with a handful of billionaire techbros getting high off the ecstasy of absolutely controlling the other eight billion people on the planet, is why we're all fucked.
danbruc 2y ago
The author of an app wants their app only distribute through Play Store so they only offer it there. In addition they add a check that verifies that the app was indeed acquired through Play Store or else refuses to run. Am I missing something? What is the issue? Do we want to tell people how they have to distribute their apps? Nobody forced them to do this verification.
- bubblethink 2y ago
  The issue is that it's often not a conscious choice by the author. A lot of dubious features get bundled under 'play integrity', and since people tend to like words like security or integrity, they will just select that box (or it may even become the default). This creates a lock in for play services, google certification, etc., and locks out users of alternate operating systems and alternate stores.
  - danbruc 2y ago
    I am not an [Android] app developer, so I know nothing about the details, but the subheading does not make it sound like this is something you can activate by accident, quite to the contrary, it sounds like a privilege if you are able to make use of this. "Select Play Partners" can block unofficial installation of their apps. I would however agree, if this gets bundled together with other features and you get forced to enable this if you want to make use of the other stuff in the bundle, that seems more problematic. Even then you could argue that it is up to Google to decide what kind of features they want to offer and bundle together, but given the market dominance I would be more open to the point of view that they should not be allowed to do whatever they want.
    - bubblethink 2y ago
      Play integrity is a basket of features with different levels. App developers can choose how much they want to enforce. So typically, you'll see banks and media companies crank that to the max. Occasionally, you'll also see random apps (like a fast food app) crank that up for no reason. The play integrity stuff is also a lot of a theatre. It doesn't necessarily ensure security, because Android in the wild is wildly insecure with EOL devices that never get an update after they are sold, but it's a way to make the suits happy. They take comfort in the fact that google says it's secure. Notably, google is the only entity who can bless it with this badge.
plantain 2y ago
So often when traveling I find some app that is required to complete some menial task like recharging a public transport card, that is for some reason ONLY available in the app store of that country. If this blocks me loading those apps via APKPure or similar, it's going to suck.
- qingcharles 2y ago
  Ugh I used to keep a British iPhone on a British network in the USA just so I could access my bank accounts, because the app couldn't be downloaded in the USA. This situation really sucks.
  - privacyking 2y ago
    Have you not heard of a web browser?
    - TheChaplain 2y ago
      I see more and more companies shutting down their web portals in favour of mobile apps. At the company I work at the moment the customer base is 2-3% on web, rest is mobile. It's such an incredible waste of time and money to keep the portal functionality on par for such a low number, and I hope they shut it down soon.
    - qingcharles 2y ago
      From what I remember, for some reason there were specific features only available through the app. Believe me, any app use of mine is a very last resort.
    - aitchnyu 2y ago
      I've seen a mutual fund web app whose frontend loads fine but the backend is apparently disconnected.
rustcleaner 2y ago
I really wish customers would be insulted by these kinds of actions and hold grudges.
sundarurfriend 2y ago
There's a portion of Apple fanbase that believes that Android is just a cheaper and shittier version of an iPhone, and nothing more. Google has been trying their hardest with every version to prove them right, by taking away more and more of the user choice and flexibility that Android had in its favour. At this rate, I might just end up buying my first ever Apple device for my next phone.
maeil 2y ago
Example of a legit reason to need sideloading: bypassing wrongful assumptions. a US company I worked for at a non-US office (imagine it was e.g. Google Japan) gave most employees a corporate credit card. Citibank made it impossible to download their app through the Play Store from the country in question, even though it was required to use it. Only option was to sideload it. This kind of thing has happened on other occasions as well.
chenxiaolong 2y ago
I'm curious how the check is implemented in Google Play Services. If it's based on the package manager's initiatingPackageName field, it should be trivial to bypass on rooted devices (or unrooted custom ROMs).
exabrial 2y ago
You don't own your device. We need a third party OS where root is the norm.
- matheusmoreira 2y ago
  Even if we had one, it would not matter in the grand scheme of things. It's economical for them to ignore us and shut us out completely. Who cares about a bunch of Linux guys, right? Just cut them off from the banking system and communications and everything until they conform. The only way is to make this sort of DRM straight up illegal. Then every computer is a free computer, and they cannot afford to refuse to work on those computers. They have to suck it up. Governments will never do that though. Citizens having access to free computers is incredibly subversive. Computers have the power to wipe out entire industries, entire economies, entire countries. Computers can defeat police, judges, militaries. They do not want citizens to have unrestricted computers. The thought of citizens having access to technology such as cryptography is offensive and subversive to them. So they will never do this. They will do the opposite. They will look at the little digital fiefdoms the big techs have created for themselves and they will be inspired. They want that sort of control for themselves. And thus we keep inching towards the fabled cyberpunk hellscape that no doubt awaits us, if it's not already here.
  - exabrial 2y ago
    >The only way is to make this sort of DRM straight up illegal I agree with your statement on what needs to be done, but I disagree with the above ^ Companies will always skirt around laws because the dev cycle of regulations is thousands of times slower than the dev cycle of private companies. Just take Apple's intentional malicious app store compliance in the EU as an example. They would rather spend millions in legal fees to not comply than to simply comply. This is a pessimistic view, but it literally happens all the time. No the reason answer is choice. Making something so good and designing it around freedom and making it sexy is the way to go. Regulation is for people that think they can control human behavior with force, which rarely if ever works.
    - 2y ago
jakeogh 2y ago
The end goal here is to force everyone to make a google account. Right now, we can get around it with Aurora Store etc, but with this, which WILL become the default, mark my words, google is attempting to close the lock. They are using their monopolistic position to force everyone to do business with them. If that's not illegal, it should be.
- throw10920 2y ago
  This is a really good observation! Now that you point it out - it's very similar to what Microsoft has been doing with Windows for the past few years - pushing users harder and harder to create accounts in order to use Windows (by leveraging their monopoly). Hardware vs software, sure, but similar principle. Regulation is a sharp knife that is hard to wield properly, but we're well past the point of needing it here.
greatgib 2y ago
That totally sucks! I think that it is again a discrete anti competitive move by Google. Recent european regulations protected the right for publisher to distribute through any marketplace their apps for Apple and Android devices. But it looks like that they have found the loophole of this with the fact that the regulation does not entitle the user to install apps through any mean that they would like. My guess is that android was not really afraid of third party app store until then, but now that apple devices will have to be open to other store, there is the possibility that another store editor become major but being unique to Apple and Android devices. Let's imagine the "Microsoft app store for mobile devices" for example.
Quarondeau 2y ago
That's actually quite clever in a devious way: by giving app developers the control over blocking sideloading, Google essentially sidesteps the requirement to be fully open. They can now just point to the developers: it's them, not us!

161 points by kklisura 2y ago

wilsonnb3 2y ago

I wonder if Google will try to use this on the YouTube app to prevent revanced from working.

badRNG 2y ago
Couldn't they just patch out that check?
- ranger_danger 2y ago
  Depends where the check is... most likely outside of the app itself. A regular phone with google play services already has a "backdoor" of sorts where google can push any code they want to you... which they have already used for dubious purposes like forcefully uninstalling certain apps from devices under the guise of security.
  - fngjdflmdflg 2y ago
    Revanced gives the app a new app ID (app.revanced.android.youtube) and resigns it, so Google cannot for example just check that apps using the youtube app id have a valid MD5.
    - ranger_danger 2y ago
      They could check for Revanced and friends too though, probably even dual-purpose that to disallow installing it entirely since it wouldn't be allowed on the play store in the first place.
      - fngjdflmdflg 2y ago
        >They could check for Revanced and friends too though Not really, at least not at the app ID level, because revanced can change app ids indefinitely. Google generally only solves a problem when it can be automated, and manually adding revanced app ids to a blacklist cannot easily be automated. In fact, since revanced is patched on device, they could assign each user a unique app id which would make using app ids as a solution unworkable for Google.
        ranger_danger 2y ago
        You don't think they know how to automate downloading the latest Revanced and checking the app ID?
        fngjdflmdflg 2y ago
        Like I just said, you do not download a revanced youtube apk. You download a revanced patcher that patches the APK on your device. Right now, the patcher gives each app the same id, but theoretically it could give a random string as the app id that is generated by the user at runtime while patching, so that would not work. Even if that were not the case, Google would not set up a script to download latest revanced to check the id. It's only a few steps away from being manual because it would not work for other projects or even for revanced itself if they changed the website's code or domain name. What I mean by solving a problem with automation is like how Google detects copyrighted music in youtube videos and sends the ad revenue to the copyright owners.[0] Having someone constantly fix a script that "automates" finding app ids does not meet that bar. [0] https://support.google.com/youtube/answer/2797370?sjid=13102225573982517285-NA https://support.google.com/youtube/answer/2797370?sjid=13102...
        ranger_danger 2y ago
        The Play Store functions as a type of backdoor which allows them to run any code on your device that they want, which includes scanning for Revanced (regardless of the actual app ID, they could just look for the NAME of the app for example) and removing it. They have already used the play store in the past to delete apps from people's devices: https://android.stackexchange.com/questions/252066/does-google-still-have-the-ability-to-uninstall-apps-without-user-permission-in https://android.stackexchange.com/questions/252066/does-goog...
- wilsonnb3 2y ago
  I think they probably could but I am unsure of the implementation details. Patching out the check might work for now, since they will be supporting older versions of the app for a while. If they eventually decide that the server needs to verify the check, it might need to be spoofed rather than removed which can be more difficult (again, depending on implementation details).

alextingle 2y ago

Isn't the possibility of side-loading one of the main things protecting Google Play Store from being hammered by the Digital Markets Act?

croes 2y ago
It's the app developer's decision if their app can be side loaded. Doesn't change the possibility as such.
zaik 2y ago
The possibility of sideloading != the possibility to side load specific apps that their developers don't want to be side loaded
- Teever 2y ago
  If that's the case it's just a matter of time before the EU regulates away this anticonsumer choice by Google and the app developers.
  - type0 2y ago
    they won't, it was clear that Google would also embrace malicious compliance, it's just the first steps so far
    - Teever 2y ago
      Yes that's how the game goes. The regulator has to keep plugging holes that the non compliant corporate entity finds until there are no more holes worth exploiting by the corporate entity. It is an exhausting and practically unending task to defend consumers against malfeasant operators but it is one that governments can and must do.
  - buzzerbetrayed 2y ago
    What is anti consumer about an app developer only allowing their app to be installed through the play store? Genuinely wondering.

gjsman-1000 2y ago

This came up in GrapheneOS; because Google Play Services runs as root with no sandbox on stock devices. Almost anything is possible when you’re root…

rbut 2y ago

How will this affect those running MicroG? Is it as simple as implementing that API and returning "trustworthy", or is there some kind of signing going on that will make it harder?

xnx 2y ago

Is there anything like a thin virtualization/sandboxing tool for Android? As the user, I (not the Android OS), should have ultimate say in what information apps have access to. I should be able to feed any app fake GPS, contact, gallery, permissions, rooted state, and sideloaded state information as I choose.

Onavo 2y ago
Magisk
saurik 2y ago
FWIW, the ad industry--of which Google is the circus master--disagrees, and so your emulator wouldn't pass Google Play Integrity (previously SafetyNet Attestation) and its remote attestation DRM scheme. https://developer.android.com/google/play/integrity https://developer.android.com/google/play/integrity
umbra07 2y ago
Magisk. To a much, much lesser degree: Samsung's Secure Folder/Android's Work Profile.
- digdugdirk 2y ago
  Do you have a recommendation for a starting point to learn about this? I went to the magisk github and it seems to assume that you already know what it is and why you should want it.
  - deleted 2y ago
    [deleted]
- NoGravitas 2y ago
  Yes, but. As far as I know, it is possible to fake SafetyNet data with Magisk, but there's no bypassing Google Play attestation.
bubblethink 2y ago

MathMonkeyMan 2y ago

Hot take: The word is "installing." There's no such thing as "sideloading."

solardev 2y ago
It's a useful word, descriptive and much shorter than "installing from outside the official app store using a third-party APK".
- permo-w 2y ago
  and yet, when you do it on a PC, it's just called "installing". the point is that the word railroads you into the assumption that having an official app store is the default behaviour and installing software from elsewhere is somewhat underhanded and sneaky, which is convenient for Apple, Google and Microsoft's profit margins
  - solardev 2y ago
    It's not just an assumption, it actually is the default on iOS, Android, iPadOS, and macOS, and the user has to jump through hoops to get around it. I'm not saying this is a good thing, but having a name for it makes it easier to describe, search for, lobby for, and ultimately use. It's like rooting or jailbreaking or even something as innocent as a plug-in or forking: different techniques of modifying software functionality away from the default, but each with its own costs and benefits. If you tell someone to install Adguard, for example, then on iOS they're installing an app that gives them a Safari extension through the official mechanisms. It can block ads in Safari. But on Android they don't install it from the official store, they sideload an APK by disabling some built in system protections against unsanctioned apps. It's more hoops on Android because of the sideloading, but they get way more power (it acts as a VPN and also a HTTPS MITM cert and filters all your traffic). It can filter ads in all apps, even through HTTPS. The downside is that now all your data goes to this small ad blocking company and circumvents the billions of dollars Google's spent trying to keep your device safe. It's a meaningful difference and users should know both the risks and benefits of being able to sideload apps, just like they should understand the risks and benefits of fully rooting your phone.

S201 2y ago

This is how software freedom dies. If bs like this and that "web environment integrity" crap Google tried to push into Chrome last year isn't an obvious sign that Google is a monopoly and needs to be broken up then I don't know what is. It's a disgrace what Google has done to Android as a formerly open and developer friendly platform.

wlindley 2y ago

And this is why it is so shocking that even folks who should know better, who are technically savvy in the slightest, would ever consent to use such a brain-damaged computer system that runs nonfree software.

Dalewyn 2y ago
The irony is probably lost on you, considering FOSS evangelists scream bloody heresy at anyone daring to install non-FOSS filth upon their holy sand machines.

caseyy 2y ago

This seems historic. One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. I hope it doesn't become a slippery slope where for "security" Google would start blocking undesirable or ethically/politically inconvenient apps, too. For example, there are some medical apps that improve people's health outcomes (like custom blood glucose CGM apps and insulin pump closed loop apps for type 1 diabetics). Google does not seem to want them on the Play Store. They are undesirable apps from a business perspective – a liability with no upside. The tech we speak about today provides the infrastructure to block these undesirable apps, as I understand. This lays the foundation of not allowing software to be installed on many consumer Android phones without Google's approval. I do hope it never comes to Google overstepping like that, but it could be optimism or naivety. As a tool for app developers... where app developers make the decision... in this limited situation, it might be still somewhat okay. It's okay in the sense that the apps are their intellectual property and they might be entitled by law and common understanding to choose how it is distributed. But if Google ever decides to ban apps this way against the developers' wishes, it would be a massive overstep.

shiroiushi 2y ago
>This seems historic. One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. No, it isn't. AFAICT, this "feature" only prevents you from sideloading apps that don't want to be side-loaded. It's not going to prevent you from installing your favorite open-source apps from Fdroid or APKs. >For example, there are some medical apps that improve people's health outcomes... Google does not seem to want them on the Play Store. Then it would be very, very stupid for these apps to add this anti-side-loading feature, wouldn't it? Google isn't the one preventing side-loading, it's the individual apps (and their makers) themselves.
- caseyy 2y ago
  Sorry, I was still editing my comment and clarifying my opinion as you responded. I agree with you but I think it could still be historic if this infrastructure is later abused. I'd delete the original comment as my late edit skewed the discussion but HN doesn't let me do that. Apologies.

rkagerer 2y ago

To whom should I point my middle finger? Is Google the one to thank for this?

matheusmoreira 2y ago
Absolutely. They implemented this hardware remote attestation nonsense which lets them cryptographically prove that "your" phone is still under their control. Android ceased to be a free ecosystem the second this feature showed up. It's basically equivalent to a video games console now. Cryptography empowers whoever has the keys, and it's not us. Apps "checking" whether they're running on "approved" hardware and software are the future. And it's only going to get worse from here. They should not even be able to know we're running custom software, much less be able to refuse to run because of it. And yet these corporations are doing just that.
- HeatrayEnjoyer 2y ago
  The CPU requirement for Windows 11 that will obsolete computers as young as 2019 is for attestation reasons.

dugite-code 2y ago

I really wish there was a third competitor in the phone space. These are hand held computers but for some reason we've all fallen into having to accept restrictions that would have been unthinkable for a laptop or desktop not to long ago. Now similar restrictions are infiltrating the general computer space.

_yb2s 2y ago
All in the name of reliability and security supposedly. For example not being able to use banking apps on a rooted phone… yet I can use them on my perfectly secure regular computer where I have full root/admin access.
- dmoy 2y ago
  > can use them on my perfectly secure regular computer where I have full root/admin access. yooooooo shhhhhh Don't give them any ideas :( Also it's not like insane security ideas around banking access compliance are unprecedented, see e.g. South Korea's insane Internet Explorer deal (transitively caused by US's ITAR on encryption) https://en.m.wikipedia.org/wiki/Web_compatibility_issues_in_South_Korea https://en.m.wikipedia.org/wiki/Web_compatibility_issues_in_...
  - matheusmoreira 2y ago
    Brazil once had a similar problem. Banks used to force users to install these obnoxious "security plugins" into their browsers. One day I got fed up with the inexplicable slowdown they were causing and decided to see what they were doing. Turned out they were intercepting every network connection. There is no limit whatsoever to what a bank feels is justified in doing when it comes to preventing fraud, money laundering or whatever else that impacts their bottom line. They literally believe they are entitled to any and all access.
- lxgr 2y ago
  Can you confirm transactions there, though? Many banks in the EU require a smartphone for that at this point (or a dedicated authentication device). But instead of using actually secure technologies like Android’s protected confirmation (which couldn’t care less about running on a rooted phone, as it runs in a trusted HW enclave), they usually just settle for (often very spoofable) “root detection”. It’s quite sad.

g-b-r 2y ago

Even Ars Technica now?? And in two hours no one on HackerNews pointed it out?? It's a feature that's existed for years!!! They just changed the UI a little..!! https://developer.android.com/google/play/integrity https://developer.android.com/google/play/integrity

matheusmoreira 2y ago
Yup. It's just the latest iteration of hardware remote attestation. Whoever has the keys owns the machine, and it sure as hell ain't us.
- g-b-r 2y ago
  It doesn't require hardware attestation, to my knowledge
  - matheusmoreira 2y ago
    Without hardware attestation it's probably easy enough to defeat it.

solarkraft 2y ago

So now, to sideload an app that the developer for some reason doesn’t want to be sideloaded, the app will have to be patched. This makes the apk untrusted, as it loses its signing in the process.

solarkraft 2y ago

So now, to sideload an app that the developer for some reason doesn’t want to be sideloaded, the app will have to be patched. This makes the apk untrusted, as it won’t be signed by the original developer anymore. Looks like a weakening of Android ecosystem security to me.

BLKNSLVR 2y ago

The near future - 1 cheapest possible phone to begrudgingly bend-the-knee to banking and other crybaby apps. - 1 decent phone for everything else.

NoGravitas 2y ago
That's the direction I think I'm heading.

nfriedly 2y ago

> ...allow for installation on incompatible devices (and resulting bad reviews)... I've had the opposite experience with my Retroid Pocket 3+ (think Nintendo Switch Lite, but running Android). A lot of apps/games that the Play Store marks as incompatible actually work fine when installed via the Aurora store. I try to always leave a review stating that the app actually works.

mostlyRice 2y ago

I really hope FTC breaks android and chrome away from google.

ivanmontillam 2y ago
I am rooting for that too. It's becoming unbearable, and I'm just not an Apple guy.
AJ007 2y ago
Between the convoluted EU rules and whatever the multiple US antitrust cases outcomes are, it could be a lot simpler: Chrome, Android, Youtube, and Gmail all must be divested. The ad & search business don't really appear separable, but everything else certainly is.
- imglorp 2y ago
  How? Projects like Chrome are adj delivery and surveillance platforms wholly funded by the ad business for the benefit of the ad busines. What would a spinoff look like?
  - readams 2y ago
    Chrome exists to counter the previous platform browser monopoly from Microsoft, which was holding back the web from being a viable application platform. It was never been about surveillance and doesn't do a very good job of surveillance if that were the goal.
    - NoGravitas 2y ago
      Chrome was created to counter the previous platform browser monopoly from Microsoft. Once that was achieved, it pivoted. First to making sure Google has a controlling stake in setting web standards, and then to surveillance. Surveillance features: FLoC, Manifest v3, Web Attestation. The surveillance features have often flopped or been beaten back, but they keep being introduced.
- 2y ago

matrix87 2y ago

I hope there's some way around this if you have it rooted

CatWChainsaw 2y ago

This is one of the cancerous outgrowths of "know your customer". It becomes "know everything about your customer" which becomes "control everything your customer does." This obsession with omnipotence, with a handful of billionaire techbros getting high off the ecstasy of absolutely controlling the other eight billion people on the planet, is why we're all fucked.

danbruc 2y ago

The author of an app wants their app only distribute through Play Store so they only offer it there. In addition they add a check that verifies that the app was indeed acquired through Play Store or else refuses to run. Am I missing something? What is the issue? Do we want to tell people how they have to distribute their apps? Nobody forced them to do this verification.

bubblethink 2y ago
The issue is that it's often not a conscious choice by the author. A lot of dubious features get bundled under 'play integrity', and since people tend to like words like security or integrity, they will just select that box (or it may even become the default). This creates a lock in for play services, google certification, etc., and locks out users of alternate operating systems and alternate stores.
- danbruc 2y ago
  I am not an [Android] app developer, so I know nothing about the details, but the subheading does not make it sound like this is something you can activate by accident, quite to the contrary, it sounds like a privilege if you are able to make use of this. "Select Play Partners" can block unofficial installation of their apps. I would however agree, if this gets bundled together with other features and you get forced to enable this if you want to make use of the other stuff in the bundle, that seems more problematic. Even then you could argue that it is up to Google to decide what kind of features they want to offer and bundle together, but given the market dominance I would be more open to the point of view that they should not be allowed to do whatever they want.
  - bubblethink 2y ago
    Play integrity is a basket of features with different levels. App developers can choose how much they want to enforce. So typically, you'll see banks and media companies crank that to the max. Occasionally, you'll also see random apps (like a fast food app) crank that up for no reason. The play integrity stuff is also a lot of a theatre. It doesn't necessarily ensure security, because Android in the wild is wildly insecure with EOL devices that never get an update after they are sold, but it's a way to make the suits happy. They take comfort in the fact that google says it's secure. Notably, google is the only entity who can bless it with this badge.

plantain 2y ago

So often when traveling I find some app that is required to complete some menial task like recharging a public transport card, that is for some reason ONLY available in the app store of that country. If this blocks me loading those apps via APKPure or similar, it's going to suck.

qingcharles 2y ago
Ugh I used to keep a British iPhone on a British network in the USA just so I could access my bank accounts, because the app couldn't be downloaded in the USA. This situation really sucks.
- privacyking 2y ago
  Have you not heard of a web browser?
  - TheChaplain 2y ago
    I see more and more companies shutting down their web portals in favour of mobile apps. At the company I work at the moment the customer base is 2-3% on web, rest is mobile. It's such an incredible waste of time and money to keep the portal functionality on par for such a low number, and I hope they shut it down soon.
  - qingcharles 2y ago
    From what I remember, for some reason there were specific features only available through the app. Believe me, any app use of mine is a very last resort.
  - aitchnyu 2y ago
    I've seen a mutual fund web app whose frontend loads fine but the backend is apparently disconnected.

rustcleaner 2y ago

I really wish customers would be insulted by these kinds of actions and hold grudges.

sundarurfriend 2y ago

There's a portion of Apple fanbase that believes that Android is just a cheaper and shittier version of an iPhone, and nothing more. Google has been trying their hardest with every version to prove them right, by taking away more and more of the user choice and flexibility that Android had in its favour. At this rate, I might just end up buying my first ever Apple device for my next phone.

maeil 2y ago

Example of a legit reason to need sideloading: bypassing wrongful assumptions. a US company I worked for at a non-US office (imagine it was e.g. Google Japan) gave most employees a corporate credit card. Citibank made it impossible to download their app through the Play Store from the country in question, even though it was required to use it. Only option was to sideload it. This kind of thing has happened on other occasions as well.

chenxiaolong 2y ago

I'm curious how the check is implemented in Google Play Services. If it's based on the package manager's initiatingPackageName field, it should be trivial to bypass on rooted devices (or unrooted custom ROMs).

exabrial 2y ago

You don't own your device. We need a third party OS where root is the norm.

matheusmoreira 2y ago
Even if we had one, it would not matter in the grand scheme of things. It's economical for them to ignore us and shut us out completely. Who cares about a bunch of Linux guys, right? Just cut them off from the banking system and communications and everything until they conform. The only way is to make this sort of DRM straight up illegal. Then every computer is a free computer, and they cannot afford to refuse to work on those computers. They have to suck it up. Governments will never do that though. Citizens having access to free computers is incredibly subversive. Computers have the power to wipe out entire industries, entire economies, entire countries. Computers can defeat police, judges, militaries. They do not want citizens to have unrestricted computers. The thought of citizens having access to technology such as cryptography is offensive and subversive to them. So they will never do this. They will do the opposite. They will look at the little digital fiefdoms the big techs have created for themselves and they will be inspired. They want that sort of control for themselves. And thus we keep inching towards the fabled cyberpunk hellscape that no doubt awaits us, if it's not already here.
- exabrial 2y ago
  >The only way is to make this sort of DRM straight up illegal I agree with your statement on what needs to be done, but I disagree with the above ^ Companies will always skirt around laws because the dev cycle of regulations is thousands of times slower than the dev cycle of private companies. Just take Apple's intentional malicious app store compliance in the EU as an example. They would rather spend millions in legal fees to not comply than to simply comply. This is a pessimistic view, but it literally happens all the time. No the reason answer is choice. Making something so good and designing it around freedom and making it sexy is the way to go. Regulation is for people that think they can control human behavior with force, which rarely if ever works.
  - 2y ago

jakeogh 2y ago

The end goal here is to force everyone to make a google account. Right now, we can get around it with Aurora Store etc, but with this, which WILL become the default, mark my words, google is attempting to close the lock. They are using their monopolistic position to force everyone to do business with them. If that's not illegal, it should be.

throw10920 2y ago
This is a really good observation! Now that you point it out - it's very similar to what Microsoft has been doing with Windows for the past few years - pushing users harder and harder to create accounts in order to use Windows (by leveraging their monopoly). Hardware vs software, sure, but similar principle. Regulation is a sharp knife that is hard to wield properly, but we're well past the point of needing it here.

greatgib 2y ago

That totally sucks! I think that it is again a discrete anti competitive move by Google. Recent european regulations protected the right for publisher to distribute through any marketplace their apps for Apple and Android devices. But it looks like that they have found the loophole of this with the fact that the regulation does not entitle the user to install apps through any mean that they would like. My guess is that android was not really afraid of third party app store until then, but now that apple devices will have to be open to other store, there is the possibility that another store editor become major but being unique to Apple and Android devices. Let's imagine the "Microsoft app store for mobile devices" for example.

Quarondeau 2y ago

That's actually quite clever in a devious way: by giving app developers the control over blocking sideloading, Google essentially sidesteps the requirement to be fully open. They can now just point to the developers: it's them, not us!