10 ms·

Google restricts Android sideloading

424 points by fsflover 1y ago

throwaway290 1y ago
[flagged]
- robmccoll 1y ago
  False dichotomy. They're both perfectly capable of doing things that are potentially detrimental to consumers but good for bottom line.
  - throwaway290 1y ago
    You are totally right, except you forgot to mention how for one of them the main customers are hardware buyers and the other's main customers are advertisers
mcraiha 1y ago
I don't really understand why all sideloads are put into same category. Because the APK must be signed, and e.g. you could easily verify Facebook/Microsoft/bigcompany signatures.
- josephcsible 1y ago
  I don't want a world where people can only sideload apps from big companies like Facebook and Microsoft.
  - cdmckay 1y ago
    I think what’s being suggested is that you could install any app but verify if it’s legit via the signature.
    - hedora 1y ago
      Facebook was just caught using loopback networking to completely bypass app sandboxes. If anything, I’d want to block any app that contains a dependency they signed.
      - charcircuit 1y ago
        >bypass app sandboxes Apps on android are freely able to talk to each other. It is not a bypass to be able to do so.
superkuh 1y ago
Let's not adopt the newspeak of the megacorps here. The actual headline is, "Google Restricts Android Application Installation–What It Means for User Autonomy and Freedom" The idea that you're not allowed to install any application without it coming directly from $megacorp is the new wierd thing. The idea of installing applications yourself on your computer is well established and normal. "Sideloading" is a dangerous word that implicitly gives up freedoms. It should not be used.
- mouse_ 1y ago
  Good take
- f1shy 1y ago
  Actually in computers, there are also „safeward“ criping in… It is imperative to avoid the term. It is just installing sw in the device you pay and own. I do not want any big-(brother)-tech protecting me. At most I would find ok if there is a config option, so I can set it to my parents, but no more than that.
- soulofmischief 1y ago
  Agreed, if we argue in their language we have already lost the debate.
- g-b-r 1y ago
  I could never believe how that word acquired widespread usage
- cowboylowrez 1y ago
  yeah lets create new language for the average computer user already fatigued by the garbage being produced by the entire computer industry, this will be the only thing that works!!!! haha u guyz reminds me of talking with libertarians (I forget whether big L or little l but whatever), before you can even engage then in discussions you have to learn their terminology, "taxes" is not a word, its "theft". being a regular citizen is "enslavement." One mental strategy I like when debating an issue is to see how my argument looks using normal terms. Heck if I have spare time and am bored, I'll even reframe arguments in my debate partners terms if they're one of "those" but thats just something done for amusement, like trying to rewrite linux in brainfuck, in theory its possible but its not how you normally want to do things.
rafram 1y ago
This is a few paragraphs of fluff and then an ad for Purism.
- fsflover 1y ago
  Obviously, from the upvotes, people are worried about the direction of Android development and are interested in the alternative.
  - hn8726 1y ago
    The article is a blatant clickbait not written in good faith, and not painting the whole picture. Obviously
    - rrix2 1y ago
      Obviously, you're free to submit an article that discusses this better or from a primary source, i'd love to read it!
  - raincole 1y ago
    Obviously, from the upvotes, people only read the title.
  - deleted 1y ago
    [deleted]
- zodiakzz 1y ago
  I immediately mentally discarded everything I read once I realized it's an ad. Can we please get a better link @dang.
Aurornis 1y ago
> In a pilot program launched in Singapore, the tech giant now blocks the installation of certain sideloaded apps—particularly those requesting sensitive permissions such as SMS access or accessibility services—if they are downloaded via web browsers, messaging apps, or file managers. There are a lot of qualifiers on this: Only in Singapore, only on apps requesting certain permissions frequently used by scams, and only when downloaded via certain paths. I don’t see the full details but this implies that it’s still possible for advanced users to side load whatever they want. They don’t want to make it easy for the average user to start sideloading apps that access SMS permissions or accessibility controls. If it takes a few extra steps for the advanced user to sideload these apps that’s not really a big infringement on freedom like this purism PR piece is trying to imply. Unfortunately sideloaded apps are a problematic scam avenue for low-tech users. > The move, developed in partnership with Singapore’s Cyber Security Agency, is designed to prevent fraud and malware-enabled scams. This explains why it’s only in Singapore for now.
- blacksmith_tb 1y ago
  Unless they block ADB, I wouldn't say it's accurate to claim they're "blocking sideloading". That said, it's clearly a balancing act between protecting people from installing malware but allowing them to intentionally install things they really do want to install, regardless of what permissions they need.
  - jeroenhd 1y ago
    They don't, and they don't even block F-Droid. You can also just disable Play Protect (though Google won't let you while you're on a call, probably a smart move). According to the Singapore police, scammers also have victims download VPNs of Google Play to work around the regional restrictions. I don't think the restrictions are doing much for victims. I assume Google was pressured into doing this by the authorities, or may be doing this to get in a good spot politically.
  - cAtte_ 1y ago
    requiring a user to own a PC in order to sideload apps (with adb) would, in fact, count as blocking sideloading, albeit partially. so i don't think that's the right limit
mouse_ 1y ago
the only security paradigm that is 100% foolproof is to assume breach. Taking away any number of users freedoms, big or small, does not change that. Old computers, before sandboxing and Windows defender and real-time protection, were more secure, because people were less likely to plug their bank account information, social security number, birth date, and home address into them. At a certain point we have got to level with the idea that a smartphone is no longer a general purpose computer in your pocket. It's more like a cyber passport. It knows everything about you and authenticates formal activities.
- shadowgovt 1y ago
  Sure, but by the same logic old roads were safer because we used horses on them instead of cars and a horse won't generally plow into the oncoming lane if you fall asleep at the reigns. It feels like this analysis really downplays some advantages making sandboxes and Windows defender and realtime protection got us in the average case (even if in the edge case someone can get hurt).
- minitech 1y ago
  > Old computers, before sandboxing and Windows defender and real-time protection, were more secure, because people were less likely to plug their bank account information, social security number, birth date, and home address into them. So they weren’t actually more secure – they were less secure and less useful (setting aside the questionable historical accuracy of where popular online banking sits in the timeline relative to OS security measures in that claim). Maybe if we relax the made up constraint that a change must create 100% foolproof security, we can have a more nuanced discussion about ways to improve security.
ethagnawl 1y ago
I like Purism as an idea but, lord, is their marketing annoying. Between FUD like this and regular emails inviting me to become some kind of investor (if I search my inbox for "purism investor" I get dozens of results), I've begun tuning them out.
- A4ET8a8uTh0_v2 1y ago
  Sigh, same. I am clearly a 'believer', because I keep trying various alternatives and am disappointed that they come up short. And now that work started to effectively require phone to log in ( remote mostly ), I am genuinely considering apple as my next move. And I dislike apple a fair bit.
zb3 1y ago
Google should not be allowed to own Android, it gives them too much control.
- hiddenfinance 1y ago
  Well they can, but isn't debian and freebsd on mobile here now? I know they are rough around the edges, but who still cares about Android or iOS in the long run? If I can run my mobile device with root access using debian or freebsd, why still bother with Google and Apple?
  - zb3 1y ago
    Which devices are you talking about? Do they have cameras, modems, NFC? And you're not talking about running these systems on top of android, right?
    - fsflover 1y ago
      The article advertises one such device, Librem 5.
    - hiddenfinance 1y ago
      Volla is one that comes to mind. Ubuntu touch, it is German, but there should be more coming. Not really advertising them, but should be more that is coming. Why bother with iOS and Android?
  - gausswho 1y ago
    A healthy competitor that grandma could use would change the world. Your alternatives are not there yet, and probably won't ever be.
    - bigstrat2003 1y ago
      It doesn't even need to be something that Grandma can use. It just needs to be something that will let you pass the various "you must have a smartphone to participate in society" checks. But considering banks and the like won't even let you use AOSP in many cases, I sincerely doubt one can get a Debian phone to work.
awoimbee 1y ago
I can't find sources to this one sided article nor can I find anything recent when searching for it
- jeroenhd 1y ago
  The change itself isn't recent: https://security.googleblog.com/2024/02/piloting-new-ways-to-protect-Android-users-from%20financial-fraud.html https://security.googleblog.com/2024/02/piloting-new-ways-to... A few months ago they improved their security somewhat by not letting you disable Play Protect while on the phone: https://9to5google.com/2025/01/29/google-play-protect-calls/ https://9to5google.com/2025/01/29/google-play-protect-calls/ You also can't turn off Play Protect if you've enabled Advanced Protection on your account (which also enforces a range of other security measures) but that's fully opt-in and hasn't even been availble to the wide public for all that long.
aftbit 1y ago
As long as AOSP and its various flavors continue to be viable alternatives, Android is still better than Apple. If you run Lineage or Graphene, I'm sure you can still "sideload" just fine.
- Zak 1y ago
  Google works pretty hard (e.g. with SafetyNet/Play Integrity) to ensure those are only viable alternatives for people with a very high level of technical sophistication and tolerance for hassle.
- hedora 1y ago
  I tried graphene, and came to the conclusion that it’s not a viable alternative to iOS. 1) Apps like uber, lyft, ev charging and parkmobile would crash with null pointer exceptions some weeks but not others, so for the use cases that force me to carry a phone, it doesn’t work. 2) There isn’t a modern e2e sync ecosystem, and backup is completely broken. 3) The camera sort of worked out of the box (pixel pro 6), but to get all the modes, I had to install sandboxed google play services, which halved the standby battery life. Has this changed in the last 3-4 years?
  - gausswho 1y ago
    I would say it has improved substantially in the past years To your items, and my experience on Pixels 7, 9, and 9a running GrapheneOS regularly for the last two years: 1. I use Uber and Lyft semi-regularly (disabled when not actively using) and don't recall experiencing any crashes. Can't speak to ev or parking apps. 2. It may not meet your definition of modern, but I am very happy with Syncthing Fork on phone alongside Syncthing on linux laptop and desktop (where I run restic nightly backups.) It takes some effort to set up compared to handing the keys to the big corps, I will give you that. I'm still unsatisfied with GrapheneOS backups, but mainly because I want them written to storage where my syncing can send them along, and be able to flash a new phone as if it were a regular drive. But that's maybe asking a lot on phone hardware? 3. Pixel Camera app I pull down from Aurora Store, decline Network permission, and takes photos seamlessly even without Play services. It won't let you actually view photos in app without the Google Photos app which is a bummer. I've taken to using Files to view them, which is cumbersome. Maybe I should just install Photos and decline network.
shadowgovt 1y ago
Do these restrictions require the phone to support Play Services and the Play Store? I'd imagine on a non-Play-Store phone this still won't be a thing, yeah?
wrs 1y ago
This would have been a great time to explain how Purism protects users from malware better than Google while giving users more freedom, instead of just repeating the word “security”. If, in fact, that is the case.
- fsflover 1y ago
  Here you go: https://source.puri.sm/Librem5/community-wiki/-/wikis/Frequently-Asked-Questions#43-how-secure-is-the-librem-5-compared-to-an-android-phone https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...
pirateships 1y ago
as long as I can continue to pirate android apps. one thing I hate about apple is that I have to pay for everything. annoying. information needs to be free as in no payment. the great thing about android is that it's so easy to find the APKs for any app, and unlock paid purchases and what not. luckily for me and other others who are sailing is that you cannot keep sideloading without enabling pirating as well. the rich techies can downvotes if they want but I and others in India don't have money to pay for your silly todo apps. ha ha.
charcircuit 1y ago
The way this is worded suggests that installing using alternate appstores (that set the installer metatadata) will still work. Also it's not clear what exactly it means. Does it have a dialog you can click through like play protect, does adb install still work, etc.
microtonal 1y ago
The sideloading restriction is easily solved by installing GrapheneOS, which has all the security benefits of Google's Android on Pixel. In parallel, Google has rolled out its Play Integrity API, which allows developers to limit app functionality when sideloaded, effectively pushing users to install apps only through the Google Play Store. The issue is even bigger. Even when using Play Store on GrapheneOS with a locked bootloader (which is the recommended configuration by the GrapheneOS project), Google refuses to let apps use the hardware attestation support in the Play Integrity API [1], which blocks certain banking apps, Google Wallet, etc. It's insane that Google lets Android vendors that have a lot of dubious security practices (months-late security updates, etc.) pass, while an OS that implements more security mitigations than PixelOS and is sometimes faster than Google rolling out security updates is excluded. The move, developed in partnership with Singapore’s Cyber Security Agency, is designed to prevent fraud and malware-enabled scams. Time to block the Facebook/Instagram apps then, given https://localmess.github.io https://localmess.github.io ? [1] https://grapheneos.social/@GrapheneOS/112878070618462132 https://grapheneos.social/@GrapheneOS/112878070618462132
- fsflover 1y ago
  > solved by installing GrapheneOS See replies to this: https://news.ycombinator.com/item?id=32496220 https://news.ycombinator.com/item?id=32496220
- charcircuit 1y ago
  Android's key attestation API is supported on GrapheneOS that apps can integrate with. https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu...
  - NoGravitas 1y ago
    Yes, but vanishingly few apps actually use that, rather than Google Play Integrity. As a result, in general it is fair to say that Android apps that require hardware attestation will not run on GrapheneOS. I say this as a satisfied GrapheneOS user.
jeroenhd 1y ago
What a weird thing to write a blog post about now. Did someone forget to hit publish on this back when it was written? The programme in question, announced a year and four months ago: https://security.googleblog.com/2024/02/piloting-new-ways-to-protect-Android-users-from%20financial-fraud.html https://security.googleblog.com/2024/02/piloting-new-ways-to... AFAIK this only applies within Singapore (not sure if this applies to visiting devices) for apps requesting certain permissions (RECEIVE_SMS, READ_SMS, BIND_NOTIFICATIONS, and accessibility) downloaded outside of app stores (F-Droid is fine) and opened directly on the device (adb install is fine). You can probably bypass the restriction by just disabling Play Protect if you don't want Google to tell you what you can and cannot install, but I'm not in Singapore so I can't confirm if that will work or not. That said, Google has made it impossible to disable Play Protect while on a call, that's probably a smart move. Based on this article from the Singapore police, the approach doesn't seem to have helped much: https://www.police.gov.sg/media-room/news/20250417_police_advisory_on_the_prevalence_of_malware_scams_affecting_android_users https://www.police.gov.sg/media-room/news/20250417_police_ad... > In some cases, before downloading the malicious APK file, victims would also be guided to disable Google Play Protect that helps to prevent harmful downloads. Once Google Play Protect is disabled, victims would not receive alerts that there is malware introduced into their mobile phones. Victims may also be asked to download Virtual Private Network (VPN) applications from Google Play Store which would facilitate scammers’ connection to their Android device. Scammers would then be able to bypass the banking anti-malware measures and remotely access the victims’ banking accounts with the phished ibanking login credentials.
- skybrian 1y ago
  Also, people in Singapore seem to be particularly vulnerable to scams: > Pang is just one of tens of thousands of Singaporeans to fall foul of scams last year, who lost a total of S$1.1bn, according to police, a 70 per cent increase on the previous year. The true figure could be even higher, according to the Global Anti-Scam Alliance, which estimates that more than two-thirds of Singaporean victims did not report their experience. > This is a small part of a global criminal enterprise worth an estimated $1tn, but Singaporeans, affluent, digitally advanced and compliant, are particularly vulnerable to these scams. As one person involved in the recovery of assets put it: “They are rich and naive”. https://archive.is/fCmW1 https://archive.is/fCmW1
transpute 1y ago
Outside the app store, Android 15 on Google Pixels supports Debian Linux "Terminal" pKVM VM with access to Debian Arm packages. It doesn't yet support accelerated (v)GPU graphics, in development for Android and shipped on some Chromebooks.
Animats 1y ago
Ignoring the Purism ad, does this break F-Droid?
- jeroenhd 1y ago
  According to Google: > This enhanced fraud protection will analyze and automatically block the installation of apps that may use sensitive permissions frequently abused for financial fraud when the user attempts to install the app from an Internet-sideloading source (web browsers, messaging apps or file managers). It probably hasn't since they started doing this last year, but once scammers find out you can publish your own malware F-Droid repo, they might.
  - fluidcruft 1y ago
    Fully open source malware via f-droid's automated builds. That's some popcorn.
krunck 1y ago
As long as AOSP - or /e/ in my case - doesn't go down this road I'm ok with it.
- JCattheATM 1y ago
  Are you finding advantages with /e/ over Lineage?
tdeck 1y ago
I've got to say, some of the comments here are pretty funny. > "The sideloading restriction is easily solved by installing GrapheneOS" > "Unless they block ADB, I wouldn't say it's accurate to claim they're "blocking sideloading"". Not to pick on these folks but it's like we on HN have forgotten that ordinary people use phones too. For some of us, it's not a limitation as long as we can solder a JTAG debugger to some test pads on the PCB and flash our own firmware, but for most users that's just about as possible as replacing the OS.
- rvnx 1y ago
  And official Android-based OS bring advantages too. For example, Samsung has lot of proprietary and useful features, and GrapheneOS you cannot use Google Pay (one major feature of a phone).
  - deleted 1y ago
    [deleted]
  - umbra07 1y ago
    The primary reason why I haven't bought a Pixel and switched to GrapheneOS is because Samsung's OneUI is just so far ahead of the curve. They innovate new software features years before anyone else does.
    - behnamoh 1y ago
      I mean, Samsung and Xiaomi at this point pretty much just copy Apple, sometimes shamelessly.
      - nashashmi 1y ago
        First Sam/Xiam create something new. Then it does not catch on. So they kill it. Then when Apple launches it, they recreate it and launch it again. sideloading apps was a feature that did not catch on. Now they kill it. Then when Apple launches it, watch them tout it again as a feature.
nikodunk 1y ago
Time to get serious about contributing to and using projects like https://postmarketos.org https://postmarketos.org! We can continue to fork Android every release, but that's just re-arranging deck chairs on the titanic without upstream driver support.
- fsflover 1y ago
  Or PureOS mentioned in TFA.
NoSalt 1y ago
After all these years, and they are still following Apple's playbook. Sad.
j3s 1y ago
this is literally just an advertisement.
- fsflover 1y ago
  Your comment is literally a repetition of another one here: https://news.ycombinator.com/item?id=44193459 https://news.ycombinator.com/item?id=44193459
gbin 1y ago
I am the first to be on the "I own my phone let me do whatever the heck I want with it" but recently something hit me. DJI forces you to side load their app for their Air Units and Drones. And this is scary. It looks like the rule they violate for the play store is that their app can self modify. Let that sink in ... Any tension or whatever political bull crap happens and you have a state controlled malware on your device that can do anything it wants with your drone. Millions of people installed this without really understanding what could be the consequences...
- teitoklien 1y ago
  I don't know why you're getting downvoted when its very possibly true. Just one month ago they found intentionally embedded Kill Switches in chinese provided solar panels [0][1]. Not even complex apps require capabilities of such self-modification, the fact that a DJI drone app, requires such capabilities, is quite suspicious especially as they are heavily involved in PLA Drone Warfare R&D and Capacity building. [0](https://www.reuters.com/sustainability/climate-energy/ghost-machine-rogue-communication-devices-found-chinese-inverters-2025-05-14/ https://www.reuters.com/sustainability/climate-energy/ghost-...) [1](https://www.rickscott.senate.gov/2025/6/sens-rick-scott-marsha-blackburn-call-for-investigation-into-communist-china-s-potential-solar-power-kill-switch https://www.rickscott.senate.gov/2025/6/sens-rick-scott-mars...)
- OsrsNeedsf2P 1y ago
  Nations already work with tech giants to get this in via OEMs. Blocking side loading only prevents hackers from disabling this malware.
- Ajedi32 1y ago
  This is why "do whatever the heck I want with it" ought to apply to software, not just hardware. This is one thing I think Richard Stallman got right, all the way back in 1988: > the freedom to change a program, so that you can control it instead of it controlling you; for this, the source code must be made available to you. We're a long way from that ideal today. Software controls us all the time. Usually that just leads to anti-consumer annoyances like lock screen ads or DLC seat heaters. But when the one controlling the software that controls you is a communist government... Not sure what the short term practical solution to this is though.
xbmcuser 1y ago
To me this is ironic as Singapore Government own lottery and sports betting app has to be side loaded as Google play does not allow gambling apps.
- harvey9 1y ago
  That's odd because the UK has a lottery and it's app is in Google Play.
  - xbmcuser 1y ago
    does it have sports betting as well?
    - roryirvine 1y ago
      Yep. All the main UK bookmakers & betting exchanges have apps on Google Play.
CaffeineLD50 1y ago
I'm pretty sure my degoogled Murena /e/ OS pixel 5 won't have this problem.
- fsflover 1y ago
  Until it becomes too hard to fork and support the Google OS.
- strcat 1y ago
  You wouldn't have this problem with a stock OS Android device either. It's worth noting that you're using an insecure end-of-life device and are missing a large number of High and Critical severity privacy/security patches including ones being exploited in the wild. Due to the device being end-of-life, you don't have firmware/driver patches, which are not being provided by your OS despite it continuing to support it. You're also missing important non-device-related OS patches due to /e/OS lagging behind and not shipping them properly. You should really replace the device if you care at all about privacy and security. The 3 years of support for the Pixel 5 was not adequate for a significant portion of users. The past 2 generations of Pixels have 7 years of support from launch, which should be enough for most people. /e/OS also doesn't ship proper signed production releases and doesn't keep the standard privacy/security model or features intact. It greatly reduces privacy and security compared to LineageOS which reduces them compared to the Android Open Source Project. Purism's Librem 5 is definitely not the answer. It had dramatically worse hardware, firmware and software security than Pixels or iPhones from day one along with not providing high importance firmware updates to users. Presenting it as the answer to minor app compatibility issues also makes little sense since throwing out compatibility with most open source mobile apps and nearly all mainstream apps hardly resolves a subset of banking/financial apps and a tiny number of other apps banning using a non-stock OS.
CommenterPerson 1y ago
Hate the $megacorps too, soPurism sounded like a good idea. But half the links on their site are broken. It makes them look like a scammer unfortunately.
- fsflover 1y ago
  There are many people happily using their devices. Sent from my Librem 5.
msgodel 1y ago
The smartphone app ecosystem is a net loss for most users sideloading or not.
JimDabell 1y ago
As I’ve mentioned here before, sideloading is a genuine security concern, not merely an excuse for Apple to exert control. There is a never-ending stream of people losing their life savings. It happens on Android and not iOS because Android allows sideloading and iOS doesn’t. There is a very real human cost to this. > Police warn new Android malware scam can factory reset phones; over S$10 million lost in first half of 2023 > There have been more than 750 cases of victims downloading the malware into their phones in the first half of 2023, with losses of at least S$10 million (US$7.3 million). — https://www.channelnewsasia.com/singapore/android-malware-scam-factory-reset-phone-police-3785801 https://www.channelnewsasia.com/singapore/android-malware-sc... > DBS, UOB become latest banks to restrict access if unverified apps are found on customers' phones > They are the latest banks in Singapore to do so – after OCBC and Citibank – amid a spate of malware scams targeting users of Android devices. — https://www.channelnewsasia.com/singapore/dbs-uob-anti-scam-sideloaded-app-malware-measure-latest-bank-restrict-app-access-3796806 https://www.channelnewsasia.com/singapore/dbs-uob-anti-scam-... > 74-year-old man loses $70k after downloading third-party app to buy Peking duck > “I couldn’t believe the news. I thought: Why am I so stupid? I was so angry at myself for being cheated of my life savings. My family is frustrated and I ended up quarrelling with my wife,” said Mr Loh, who has three children. — https://www.straitstimes.com/singapore/74-year-old-man-loses-70k-after-downloading-third-party-app-to-buy-roast-duck https://www.straitstimes.com/singapore/74-year-old-man-loses... > Singapore Android users to be blocked from installing certain unverified apps as part of anti-scam trial > "Based on our analysis of major fraud malware families that exploit these sensitive runtime permissions, we found that over 95 per cent of installations came from internet-sideloading sources," it added. — https://www.channelnewsasia.com/business/anduril-secures-305-billion-valuation-latest-fund-raise-5167971 https://www.channelnewsasia.com/business/anduril-secures-305... > CNA Explains: Are Android devices more prone to malware and how do you protect yourself from scams? > Why are scammers more likely to target Android users? How do you spot a fake app and what should you do if your device is infected by malware? — https://www.channelnewsasia.com/singapore/android-malware-scams-google-apple-operating-systems-cybersecurity-cna-explains-3661566 https://www.channelnewsasia.com/singapore/android-malware-sc... > Nearly 2,000 victims fell for Android malware scams, at least S$34.1 million lost in 2023 > In 2023, about 1,899 cases of Android malware scams were reported in Singapore. The average amount lost was about S$17,960. — https://www.channelnewsasia.com/singapore/android-malware-scam-millions-lost-cpf-savings-banks-police-4128246 https://www.channelnewsasia.com/singapore/android-malware-sc... > Android users in Singapore tried to install unverified apps nearly 900,000 times in past 6 months > These attempts were blocked by a security feature rolled out by Google six months ago as part of a trial to better protect users against malware scams, which led to at least S$34.1 million (US$25.8 million) in losses last year with about 1,900 cases reported. — https://www.channelnewsasia.com/singapore/android-users-install-malware-unverified-apps-google-fund-anti-scam-4550026 https://www.channelnewsasia.com/singapore/android-users-inst...
flmontpetit 1y ago
The inexorable process of using security as a pretext to enshittify your platform carries on. I don't believe there is a meaningful difference between Google and Apple anymore.
b0a04gl 1y ago
[dead]
cft 1y ago
I am on Google ecosystem since the original T-Mobile G1 - now at Pixel 9 Pro XL. The moment this is rolled out, I am getting iPhones for me and family.
- g-b-r 1y ago
  Where side loading is easier? How about getting a linux phone? (or a dumbphone + a linux portable device)
aiauthoritydev 1y ago
> In a pilot program launched in Singapore, the tech giant now blocks the installation of certain sideloaded apps—particularly those requesting sensitive permissions such as SMS access or accessibility services—if they are downloaded via web browsers, messaging apps, or file managers. The move, developed in partnership with Singapore’s Cyber Security Agency, is designed to prevent fraud and malware-enabled scams. This is a reasonable restriction and I am surprised this restriction is coming now and not ten years ago. Sideloading must be limited to tech savvy users only who know what they are doing.
- g-b-r 1y ago
  > Sideloading must be limited to tech savvy users only who know what they are doing. Who says so?
  - cowboylowrez 1y ago
    I don't think "common sense" is an actual person haha I'm not picking sides, but I try to help myself understand things by visiting both sides of the arguments and there is clearly a side interested in cutting down on fraud, just as there is a side promoting freedom in their computing. Limiting sideloading seems a sort of pragmatic move, and leaving the possibility of sideloading open seems to be likewise a pragmatic move, especially if there are guardrails and warning signs everywhere, we do this in society when faced with hazardous situations. I am very open to counterpoints here, at least if I can read them before they get too greyed out!
reify 1y ago
there has never been Autonomy and Freedom, not from google, ever. I have never ever used a fully loaded android phone with all the spying, surveillance apps and play services, amazon, facecrook, whatshit, running. why on earth do muppets insist that they cannot live a life without google and the rest. I have installed the latest AOSP on all my phones, including family aand friends. I currently have a motorola edge 20 pro with android 15 installed. and my very old oneplus 5T also has android 15 installed. all my family and friends have either lineage or E/os installed. I dont see the problem here. I hear no complaints. fool me once, More fool anyone who thinks google, facecrook and whatshit is their friend. Autonomy for me, MEANS, self regulation. this is severely absent in the lives of the modern human being.
theodric 1y ago
The flexibility afforded by sideloading, which allows that that an Android phone is still for the most part a pocket-sized computer that can operate in a mode not intended by its creators (as opposed to a restricted consumption appliance like the iPhone) is what has kept me on the platform for 16 years and counting. If they take that away, then I really don't see a compelling difference between the two platforms. Android has been getting markedly more flaky for me ON MULTIPLE GOOGLE PIXEL DEVICES since 2018. My current Pixel 8a on Android 15 regularly has the underlying UI controls (separate from the launcher) crash and force me to restart if I want to use the app overview switcher since day 1. I also have no app overview button in the stock Android calculator since Android 14, the shipped OS, so if I want to switch between a calculation and another app I must first return to the home screen. Wasn't like this in previous releases! Furthermore, the day/date is routinely cut off in the statusbar and its pulldown. This product passed multiple reviews and 2 major OS releases with these (and many other) obvious and irritating bugs and shows no signs of improvement. If they left these holes in the surface, I can only imagine what's underneath. It's ridiculous, but I guess we're cranking out complexity at a rate that exceeds our ability to manage it (or our ability to manufacture new fucks at a rate exceeding their consumption). If Purism is shopping for new users, all they would eventually need to do is not get worse at a rate as fast as Android, or more expensive at a rate as fast as iOS devices. Based on what I've seen from them so far...they're not at that point yet: meager specifications, high prices. I will continue to cling to my Android device, but I'll cheer them on from the sidelines.
- throwaway290 1y ago
  > as opposed to a restricted consumption appliance like the iPhone You can root iphones
  - cowboylowrez 1y ago
    I didn't know apple supported rooted iphones (I do not keep up with apple). Does apple at least provide a warning about invalidating warranties or whatever?
    - 1y ago
garbagecoder 1y ago
It's OK if it's not Apple doing it———Someone, probably.
mvdtnz 1y ago
This is an ad
casenmgreen 1y ago
It seems to me this was inevitable. Google could do this, and it's in their interest. It happened.
londons_explore 1y ago
> [blocking apps] requesting sensitive permissions such as SMS access or accessibility services These are the permissions most used to impersonate a user. SMS access lets an app log into every service you use and get OTP codes. Accessibility tools lets the app open your banking apps etc. whilst you're sleeping. Singapore has big issues with identity 'trading' - and there are big signs saying things like "if a stranger offers to buy your phone number from you, and you accept, we will send you to prison for 5 years". Same with bank accounts, credit cards, etc. Basically, if something is tied to your identity, and you let someone else use it for crime, then they're gonna punish you heavily.
dismalaf 1y ago
How the hell does this get upvoted? This is major FUD by an Android "competitor". First of all, it just introduces an addition level of security, at the request of the government of Singapore. Second, it's a year and a half old. Third, it obviously hasn't affected side loading in other parts of the world 1.5 years later. The other restriction, allowing app makers to restrict side loading, is to combat piracy and it's again, up to the app makers themselves. Garbage article. Also embarrassing so many fell for it.
- fsflover 1y ago
  This development clearly shows the direction of Android development officially chosen by Google. It doesn't matter when it happened or where. It's just another checkpoint on the way to not owning your device that knows everything about you and has access to practically all your secrets. People saying "Android is still better than Apple" will not be right for long. This "competitor" offers a rare opportunity to support the escape path from the dystopia using free software. Sent from my Librem 5.
michalpleban 1y ago
And how is it supposed to work in China, where the Google Play Store is blocked and sideloading is very common to install apps on Android phones? Looks like Google plans to throw its Chinese users under the bus.
- tomComb 1y ago
  What Chinese users? Google pulled out of China like a decade ago when they insisted that Google censor search results.
- throitallaway 1y ago
  How does this work for iOS devices? Sideloading on those through sketchy workarounds is a PITA.
pinoy420 1y ago
[dead]
kleiba 1y ago
EU regulators to the rescue!
qbane 1y ago
The Google input method on my phone is patched by myself. So is the calculator, and many other everyday apps. I cannot imagine owning an Android phone without the ability of sideloading. Maybe I will consider rooting my phone and void my warranty on the first day with my every future Android phone.
Aldipower 1y ago
My Motorola Razr 3 doesn't have this problem.
mfuzzey 1y ago
Will this affect alternative app stores like F-droid or is it only about downloading and installing an APK with a web browser? An example of "normal" users that side load (through F-droid or direct APK) is most Ingress players. While Ingress itself is in the playstore most people use the "companion" intel app called IITC which isn't in the playstore as it's technically against the ToS.
throitallaway 1y ago
I enjoy Android is because of its relatively nonrestrictive nature. It trusts that I know what I'm doing. The highly locked down nature of iOS is a reason why I will never buy one of their devices. Google will drive me further away from their services (and into GrapheneOS, which has "no" Google hooks) with moves like this. From the article, I presume this is being done in the name of "cyber security" (least common denominator strikes again.) In newer versions of Android, a few warnings/confirmations are shown prior to sideloading an app. I think the best solution here is to gate-keep sideloading behind Developer Mode. Enabling Developer Mode, then enabling side loading, would be complex enough to stop brain dead drive-by side loading from occurring. And (mostly) only people that know what they're doing enable Developer Mode.
throitallaway 1y ago
> In parallel, Google has rolled out its Play Integrity API, which allows developers to limit app functionality when sideloaded How about Google focuses on proper sandboxing and permissions models? With those in place where an app comes from should not be a concern.
- Zak 1y ago
  That change is not for the benefit of the end user; it's for app developers with an adversarial relationship to their users who want to trust the client not to do anything unprofitable. (And probably game anti-cheat)
mcflubbins 1y ago
Can anyone using a Librem 5 as their daily phone report back as to how well it works. Specifically, how reliable are the most basic, and crucial SMS and calling functions? How's battery life? I had a Pinephone a couple of years ago and receiving phone calls wasn't very reliable.
- fsflover 1y ago
  Librem 5 is my daily driver, buy I'll just give links to good, extensive reviews: https://forums.puri.sm/t/nine-months-librem-5-as-my-only-phone-my-review-and-workflow/23268 https://forums.puri.sm/t/nine-months-librem-5-as-my-only-pho... https://forums.puri.sm/t/a-l5-review-1-week-to-my-ready-to-ship-l5-anniversary/23181 https://forums.puri.sm/t/a-l5-review-1-week-to-my-ready-to-s... Tl;dr: calls and texts work fine, battery life is not as good as Android/Apple but usable. Also you can replace the battery on the go.
butz 1y ago
It would be great to have more devices running PureOS available, especially a bit smaller ones than current generation "phablets". Where did all 4" devices gone?
EwanToo 1y ago
Is this not from 2024? https://techcrunch.com/2024/02/07/google-starts-blocking-users-from-sideloading-certain-apps-in-singapore/ https://techcrunch.com/2024/02/07/google-starts-blocking-use...
Zigurd 1y ago
The way this is designed appears to be entirely intentional and sensible. Yes, you can still install malware using ADB. It's just harder. That seems really sensible. It's a speed bump, but not a prohibition. I also haven't seen any specific examples of software that's frequently sideloaded that would be unjustly discriminated against.
- samtheprogram 1y ago
  Alternative app stores. See Epic v. Google. I’m an Apple user, but above all I value choice. Isn’t the point of Android that it’s an open ecosystem? ADB is arguably worse than what Apple did in the EU for sideloading to abide court orders, and Apple was lambasted.
  - Zigurd 1y ago
    I'm not a user of them so I can't tell you much about them or if they're all lame, but there are third-party app stores in the Google Play store. Are there high quality or especially useful apps stores that are not in the Play store.
ReptileMan 1y ago
>These policies reinforce Google’s control over Android’s ecosystem under the guise of security but have sparked renewed concern over digital autonomy, innovation suppression, and user rights. Ahhh yes. You want some of the action apple is getting from EU commission don't you? Talking about the api-s that discriminate between playstore and side loaded aps. Which is not clear if are Singapore only
AstralStorm 1y ago
Is it forking time? It feels like it's forking time. Seriously, just restrict it to signed applications unless debugging mode is active. With explicit permission from the user.
- fsflover 1y ago
  > Is it forking time? /e/OS already exists and can even be bought preinstalled on Fairphone.
everyone 1y ago
Smartphones are just trash.. Totally stupid human interface design + the worst OSes imaginable. I've totally gotten into modern AI, cus its actually useful, but I've always been a "luddite" re. smartphones. I've always thought they suck. Smartphone = a computer that's shitty and dumb enough to be popular.
miki123211 1y ago
This will impact the blind community in a pretty serious way. In countries where Android is popular and iPhones are expensive, Commentary (Jieshuo) screen reader is a popular and arguably much better alternative to TalkBack, the built-in Android screen reader. Because it's a Chinese app and there's no major conglomerate behind it, it's not on the Play Store. Because it needs to be able to read all screen contents and drive the entire system UI (that's literally what a screen reader is for), the permissions it requests are quite intrusive. Blocking it from accessing sensitive apps would entirely defeat its purpose, after all, if you need a screen reader in the first place, one that doesn't work in banking apps will be pretty useless to you. Googlers will probably point to Webaim[1] and say that nobody uses the app so it's not a problem, entirely forgetting that Webaim is mostly filled out by well-off English speakers. If you look at data sources that better represent the global population at large, like the Yandex user survey, you will see something very different. [1] https://webaim.org/projects/screenreadersurvey10/ https://webaim.org/projects/screenreadersurvey10/
Lockal 1y ago
A person from Singapore here. In practice, this changes nothing (from the news standpoint). The most critical applications are already integrated with Play Integrity API. Singpass (ID system) is 100% unavoidable for every long-term visitor and has strict Play Integrity integration (but attacker can select SMS flow and nullify the protection). Banks and all financial organizations require Singpass too, also use Play Integrity in most cases. The biggest bank DBS has extra checks, like "if there is an .apk in Downloads directory, then device is considered as compromised" (and they recently disabled SMS bypass). The most funny case that a similar protection is used in McDonald's app (again, maybe enforced only in specific countries): have something sus on your phone -- no burgers for you! They also have extra checks (i. e. device passes "strong integrity test", but app refuses to work). Another note: this obviously does not prevent people from having multiple phones, feel free to buy an extra phone and install LineageOS/Gentoo/whatever you want.
Geraldwarr 1y ago
[dead]
Geraldwarr 1y ago
[dead]
smithpron 1y ago
[flagged]

424 points by fsflover 1y ago

throwaway290 1y ago

[flagged]

robmccoll 1y ago
False dichotomy. They're both perfectly capable of doing things that are potentially detrimental to consumers but good for bottom line.
- throwaway290 1y ago
  You are totally right, except you forgot to mention how for one of them the main customers are hardware buyers and the other's main customers are advertisers

mcraiha 1y ago

I don't really understand why all sideloads are put into same category. Because the APK must be signed, and e.g. you could easily verify Facebook/Microsoft/bigcompany signatures.

josephcsible 1y ago
I don't want a world where people can only sideload apps from big companies like Facebook and Microsoft.
- cdmckay 1y ago
  I think what’s being suggested is that you could install any app but verify if it’s legit via the signature.
  - hedora 1y ago
    Facebook was just caught using loopback networking to completely bypass app sandboxes. If anything, I’d want to block any app that contains a dependency they signed.
    - charcircuit 1y ago
      >bypass app sandboxes Apps on android are freely able to talk to each other. It is not a bypass to be able to do so.

superkuh 1y ago

Let's not adopt the newspeak of the megacorps here. The actual headline is, "Google Restricts Android Application Installation–What It Means for User Autonomy and Freedom" The idea that you're not allowed to install any application without it coming directly from $megacorp is the new wierd thing. The idea of installing applications yourself on your computer is well established and normal. "Sideloading" is a dangerous word that implicitly gives up freedoms. It should not be used.

mouse_ 1y ago
Good take
f1shy 1y ago
Actually in computers, there are also „safeward“ criping in… It is imperative to avoid the term. It is just installing sw in the device you pay and own. I do not want any big-(brother)-tech protecting me. At most I would find ok if there is a config option, so I can set it to my parents, but no more than that.
soulofmischief 1y ago
Agreed, if we argue in their language we have already lost the debate.
g-b-r 1y ago
I could never believe how that word acquired widespread usage
cowboylowrez 1y ago
yeah lets create new language for the average computer user already fatigued by the garbage being produced by the entire computer industry, this will be the only thing that works!!!! haha u guyz reminds me of talking with libertarians (I forget whether big L or little l but whatever), before you can even engage then in discussions you have to learn their terminology, "taxes" is not a word, its "theft". being a regular citizen is "enslavement." One mental strategy I like when debating an issue is to see how my argument looks using normal terms. Heck if I have spare time and am bored, I'll even reframe arguments in my debate partners terms if they're one of "those" but thats just something done for amusement, like trying to rewrite linux in brainfuck, in theory its possible but its not how you normally want to do things.

rafram 1y ago

This is a few paragraphs of fluff and then an ad for Purism.

fsflover 1y ago
Obviously, from the upvotes, people are worried about the direction of Android development and are interested in the alternative.
- hn8726 1y ago
  The article is a blatant clickbait not written in good faith, and not painting the whole picture. Obviously
  - rrix2 1y ago
    Obviously, you're free to submit an article that discusses this better or from a primary source, i'd love to read it!
- raincole 1y ago
  Obviously, from the upvotes, people only read the title.
- deleted 1y ago
  [deleted]
zodiakzz 1y ago
I immediately mentally discarded everything I read once I realized it's an ad. Can we please get a better link @dang.

Aurornis 1y ago

> In a pilot program launched in Singapore, the tech giant now blocks the installation of certain sideloaded apps—particularly those requesting sensitive permissions such as SMS access or accessibility services—if they are downloaded via web browsers, messaging apps, or file managers. There are a lot of qualifiers on this: Only in Singapore, only on apps requesting certain permissions frequently used by scams, and only when downloaded via certain paths. I don’t see the full details but this implies that it’s still possible for advanced users to side load whatever they want. They don’t want to make it easy for the average user to start sideloading apps that access SMS permissions or accessibility controls. If it takes a few extra steps for the advanced user to sideload these apps that’s not really a big infringement on freedom like this purism PR piece is trying to imply. Unfortunately sideloaded apps are a problematic scam avenue for low-tech users. > The move, developed in partnership with Singapore’s Cyber Security Agency, is designed to prevent fraud and malware-enabled scams. This explains why it’s only in Singapore for now.

blacksmith_tb 1y ago
Unless they block ADB, I wouldn't say it's accurate to claim they're "blocking sideloading". That said, it's clearly a balancing act between protecting people from installing malware but allowing them to intentionally install things they really do want to install, regardless of what permissions they need.
- jeroenhd 1y ago
  They don't, and they don't even block F-Droid. You can also just disable Play Protect (though Google won't let you while you're on a call, probably a smart move). According to the Singapore police, scammers also have victims download VPNs of Google Play to work around the regional restrictions. I don't think the restrictions are doing much for victims. I assume Google was pressured into doing this by the authorities, or may be doing this to get in a good spot politically.
- cAtte_ 1y ago
  requiring a user to own a PC in order to sideload apps (with adb) would, in fact, count as blocking sideloading, albeit partially. so i don't think that's the right limit

mouse_ 1y ago

the only security paradigm that is 100% foolproof is to assume breach. Taking away any number of users freedoms, big or small, does not change that. Old computers, before sandboxing and Windows defender and real-time protection, were more secure, because people were less likely to plug their bank account information, social security number, birth date, and home address into them. At a certain point we have got to level with the idea that a smartphone is no longer a general purpose computer in your pocket. It's more like a cyber passport. It knows everything about you and authenticates formal activities.

shadowgovt 1y ago
Sure, but by the same logic old roads were safer because we used horses on them instead of cars and a horse won't generally plow into the oncoming lane if you fall asleep at the reigns. It feels like this analysis really downplays some advantages making sandboxes and Windows defender and realtime protection got us in the average case (even if in the edge case someone can get hurt).
minitech 1y ago
> Old computers, before sandboxing and Windows defender and real-time protection, were more secure, because people were less likely to plug their bank account information, social security number, birth date, and home address into them. So they weren’t actually more secure – they were less secure and less useful (setting aside the questionable historical accuracy of where popular online banking sits in the timeline relative to OS security measures in that claim). Maybe if we relax the made up constraint that a change must create 100% foolproof security, we can have a more nuanced discussion about ways to improve security.

ethagnawl 1y ago

I like Purism as an idea but, lord, is their marketing annoying. Between FUD like this and regular emails inviting me to become some kind of investor (if I search my inbox for "purism investor" I get dozens of results), I've begun tuning them out.

A4ET8a8uTh0_v2 1y ago
Sigh, same. I am clearly a 'believer', because I keep trying various alternatives and am disappointed that they come up short. And now that work started to effectively require phone to log in ( remote mostly ), I am genuinely considering apple as my next move. And I dislike apple a fair bit.

zb3 1y ago

Google should not be allowed to own Android, it gives them too much control.

hiddenfinance 1y ago
Well they can, but isn't debian and freebsd on mobile here now? I know they are rough around the edges, but who still cares about Android or iOS in the long run? If I can run my mobile device with root access using debian or freebsd, why still bother with Google and Apple?
- zb3 1y ago
  Which devices are you talking about? Do they have cameras, modems, NFC? And you're not talking about running these systems on top of android, right?
  - fsflover 1y ago
    The article advertises one such device, Librem 5.
  - hiddenfinance 1y ago
    Volla is one that comes to mind. Ubuntu touch, it is German, but there should be more coming. Not really advertising them, but should be more that is coming. Why bother with iOS and Android?
- gausswho 1y ago
  A healthy competitor that grandma could use would change the world. Your alternatives are not there yet, and probably won't ever be.
  - bigstrat2003 1y ago
    It doesn't even need to be something that Grandma can use. It just needs to be something that will let you pass the various "you must have a smartphone to participate in society" checks. But considering banks and the like won't even let you use AOSP in many cases, I sincerely doubt one can get a Debian phone to work.

awoimbee 1y ago

I can't find sources to this one sided article nor can I find anything recent when searching for it

jeroenhd 1y ago
The change itself isn't recent: https://security.googleblog.com/2024/02/piloting-new-ways-to-protect-Android-users-from%20financial-fraud.html https://security.googleblog.com/2024/02/piloting-new-ways-to... A few months ago they improved their security somewhat by not letting you disable Play Protect while on the phone: https://9to5google.com/2025/01/29/google-play-protect-calls/ https://9to5google.com/2025/01/29/google-play-protect-calls/ You also can't turn off Play Protect if you've enabled Advanced Protection on your account (which also enforces a range of other security measures) but that's fully opt-in and hasn't even been availble to the wide public for all that long.

aftbit 1y ago

As long as AOSP and its various flavors continue to be viable alternatives, Android is still better than Apple. If you run Lineage or Graphene, I'm sure you can still "sideload" just fine.

Zak 1y ago
Google works pretty hard (e.g. with SafetyNet/Play Integrity) to ensure those are only viable alternatives for people with a very high level of technical sophistication and tolerance for hassle.
hedora 1y ago
I tried graphene, and came to the conclusion that it’s not a viable alternative to iOS. 1) Apps like uber, lyft, ev charging and parkmobile would crash with null pointer exceptions some weeks but not others, so for the use cases that force me to carry a phone, it doesn’t work. 2) There isn’t a modern e2e sync ecosystem, and backup is completely broken. 3) The camera sort of worked out of the box (pixel pro 6), but to get all the modes, I had to install sandboxed google play services, which halved the standby battery life. Has this changed in the last 3-4 years?
- gausswho 1y ago
  I would say it has improved substantially in the past years To your items, and my experience on Pixels 7, 9, and 9a running GrapheneOS regularly for the last two years: 1. I use Uber and Lyft semi-regularly (disabled when not actively using) and don't recall experiencing any crashes. Can't speak to ev or parking apps. 2. It may not meet your definition of modern, but I am very happy with Syncthing Fork on phone alongside Syncthing on linux laptop and desktop (where I run restic nightly backups.) It takes some effort to set up compared to handing the keys to the big corps, I will give you that. I'm still unsatisfied with GrapheneOS backups, but mainly because I want them written to storage where my syncing can send them along, and be able to flash a new phone as if it were a regular drive. But that's maybe asking a lot on phone hardware? 3. Pixel Camera app I pull down from Aurora Store, decline Network permission, and takes photos seamlessly even without Play services. It won't let you actually view photos in app without the Google Photos app which is a bummer. I've taken to using Files to view them, which is cumbersome. Maybe I should just install Photos and decline network.

shadowgovt 1y ago

Do these restrictions require the phone to support Play Services and the Play Store? I'd imagine on a non-Play-Store phone this still won't be a thing, yeah?

wrs 1y ago

This would have been a great time to explain how Purism protects users from malware better than Google while giving users more freedom, instead of just repeating the word “security”. If, in fact, that is the case.

fsflover 1y ago
Here you go: https://source.puri.sm/Librem5/community-wiki/-/wikis/Frequently-Asked-Questions#43-how-secure-is-the-librem-5-compared-to-an-android-phone https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...

pirateships 1y ago

as long as I can continue to pirate android apps. one thing I hate about apple is that I have to pay for everything. annoying. information needs to be free as in no payment. the great thing about android is that it's so easy to find the APKs for any app, and unlock paid purchases and what not. luckily for me and other others who are sailing is that you cannot keep sideloading without enabling pirating as well. the rich techies can downvotes if they want but I and others in India don't have money to pay for your silly todo apps. ha ha.

charcircuit 1y ago

The way this is worded suggests that installing using alternate appstores (that set the installer metatadata) will still work. Also it's not clear what exactly it means. Does it have a dialog you can click through like play protect, does adb install still work, etc.

microtonal 1y ago

The sideloading restriction is easily solved by installing GrapheneOS, which has all the security benefits of Google's Android on Pixel. In parallel, Google has rolled out its Play Integrity API, which allows developers to limit app functionality when sideloaded, effectively pushing users to install apps only through the Google Play Store. The issue is even bigger. Even when using Play Store on GrapheneOS with a locked bootloader (which is the recommended configuration by the GrapheneOS project), Google refuses to let apps use the hardware attestation support in the Play Integrity API [1], which blocks certain banking apps, Google Wallet, etc. It's insane that Google lets Android vendors that have a lot of dubious security practices (months-late security updates, etc.) pass, while an OS that implements more security mitigations than PixelOS and is sometimes faster than Google rolling out security updates is excluded. The move, developed in partnership with Singapore’s Cyber Security Agency, is designed to prevent fraud and malware-enabled scams. Time to block the Facebook/Instagram apps then, given https://localmess.github.io https://localmess.github.io ? [1] https://grapheneos.social/@GrapheneOS/112878070618462132 https://grapheneos.social/@GrapheneOS/112878070618462132

fsflover 1y ago
> solved by installing GrapheneOS See replies to this: https://news.ycombinator.com/item?id=32496220 https://news.ycombinator.com/item?id=32496220
charcircuit 1y ago
Android's key attestation API is supported on GrapheneOS that apps can integrate with. https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu...
- NoGravitas 1y ago
  Yes, but vanishingly few apps actually use that, rather than Google Play Integrity. As a result, in general it is fair to say that Android apps that require hardware attestation will not run on GrapheneOS. I say this as a satisfied GrapheneOS user.

jeroenhd 1y ago

What a weird thing to write a blog post about now. Did someone forget to hit publish on this back when it was written? The programme in question, announced a year and four months ago: https://security.googleblog.com/2024/02/piloting-new-ways-to-protect-Android-users-from%20financial-fraud.html https://security.googleblog.com/2024/02/piloting-new-ways-to... AFAIK this only applies within Singapore (not sure if this applies to visiting devices) for apps requesting certain permissions (RECEIVE_SMS, READ_SMS, BIND_NOTIFICATIONS, and accessibility) downloaded outside of app stores (F-Droid is fine) and opened directly on the device (adb install is fine). You can probably bypass the restriction by just disabling Play Protect if you don't want Google to tell you what you can and cannot install, but I'm not in Singapore so I can't confirm if that will work or not. That said, Google has made it impossible to disable Play Protect while on a call, that's probably a smart move. Based on this article from the Singapore police, the approach doesn't seem to have helped much: https://www.police.gov.sg/media-room/news/20250417_police_advisory_on_the_prevalence_of_malware_scams_affecting_android_users https://www.police.gov.sg/media-room/news/20250417_police_ad... > In some cases, before downloading the malicious APK file, victims would also be guided to disable Google Play Protect that helps to prevent harmful downloads. Once Google Play Protect is disabled, victims would not receive alerts that there is malware introduced into their mobile phones. Victims may also be asked to download Virtual Private Network (VPN) applications from Google Play Store which would facilitate scammers’ connection to their Android device. Scammers would then be able to bypass the banking anti-malware measures and remotely access the victims’ banking accounts with the phished ibanking login credentials.

skybrian 1y ago
Also, people in Singapore seem to be particularly vulnerable to scams: > Pang is just one of tens of thousands of Singaporeans to fall foul of scams last year, who lost a total of S$1.1bn, according to police, a 70 per cent increase on the previous year. The true figure could be even higher, according to the Global Anti-Scam Alliance, which estimates that more than two-thirds of Singaporean victims did not report their experience. > This is a small part of a global criminal enterprise worth an estimated $1tn, but Singaporeans, affluent, digitally advanced and compliant, are particularly vulnerable to these scams. As one person involved in the recovery of assets put it: “They are rich and naive”. https://archive.is/fCmW1 https://archive.is/fCmW1

transpute 1y ago

Outside the app store, Android 15 on Google Pixels supports Debian Linux "Terminal" pKVM VM with access to Debian Arm packages. It doesn't yet support accelerated (v)GPU graphics, in development for Android and shipped on some Chromebooks.

Animats 1y ago

Ignoring the Purism ad, does this break F-Droid?

jeroenhd 1y ago
According to Google: > This enhanced fraud protection will analyze and automatically block the installation of apps that may use sensitive permissions frequently abused for financial fraud when the user attempts to install the app from an Internet-sideloading source (web browsers, messaging apps or file managers). It probably hasn't since they started doing this last year, but once scammers find out you can publish your own malware F-Droid repo, they might.
- fluidcruft 1y ago
  Fully open source malware via f-droid's automated builds. That's some popcorn.

krunck 1y ago

As long as AOSP - or /e/ in my case - doesn't go down this road I'm ok with it.

JCattheATM 1y ago
Are you finding advantages with /e/ over Lineage?

tdeck 1y ago

I've got to say, some of the comments here are pretty funny. > "The sideloading restriction is easily solved by installing GrapheneOS" > "Unless they block ADB, I wouldn't say it's accurate to claim they're "blocking sideloading"". Not to pick on these folks but it's like we on HN have forgotten that ordinary people use phones too. For some of us, it's not a limitation as long as we can solder a JTAG debugger to some test pads on the PCB and flash our own firmware, but for most users that's just about as possible as replacing the OS.

rvnx 1y ago
And official Android-based OS bring advantages too. For example, Samsung has lot of proprietary and useful features, and GrapheneOS you cannot use Google Pay (one major feature of a phone).
- deleted 1y ago
  [deleted]
- umbra07 1y ago
  The primary reason why I haven't bought a Pixel and switched to GrapheneOS is because Samsung's OneUI is just so far ahead of the curve. They innovate new software features years before anyone else does.
  - behnamoh 1y ago
    I mean, Samsung and Xiaomi at this point pretty much just copy Apple, sometimes shamelessly.
    - nashashmi 1y ago
      First Sam/Xiam create something new. Then it does not catch on. So they kill it. Then when Apple launches it, they recreate it and launch it again. sideloading apps was a feature that did not catch on. Now they kill it. Then when Apple launches it, watch them tout it again as a feature.

nikodunk 1y ago

Time to get serious about contributing to and using projects like https://postmarketos.org https://postmarketos.org! We can continue to fork Android every release, but that's just re-arranging deck chairs on the titanic without upstream driver support.

fsflover 1y ago
Or PureOS mentioned in TFA.

NoSalt 1y ago

After all these years, and they are still following Apple's playbook. Sad.

j3s 1y ago

this is literally just an advertisement.

fsflover 1y ago
Your comment is literally a repetition of another one here: https://news.ycombinator.com/item?id=44193459 https://news.ycombinator.com/item?id=44193459

gbin 1y ago

I am the first to be on the "I own my phone let me do whatever the heck I want with it" but recently something hit me. DJI forces you to side load their app for their Air Units and Drones. And this is scary. It looks like the rule they violate for the play store is that their app can self modify. Let that sink in ... Any tension or whatever political bull crap happens and you have a state controlled malware on your device that can do anything it wants with your drone. Millions of people installed this without really understanding what could be the consequences...

teitoklien 1y ago
I don't know why you're getting downvoted when its very possibly true. Just one month ago they found intentionally embedded Kill Switches in chinese provided solar panels [0][1]. Not even complex apps require capabilities of such self-modification, the fact that a DJI drone app, requires such capabilities, is quite suspicious especially as they are heavily involved in PLA Drone Warfare R&D and Capacity building. [0](https://www.reuters.com/sustainability/climate-energy/ghost-machine-rogue-communication-devices-found-chinese-inverters-2025-05-14/ https://www.reuters.com/sustainability/climate-energy/ghost-...) [1](https://www.rickscott.senate.gov/2025/6/sens-rick-scott-marsha-blackburn-call-for-investigation-into-communist-china-s-potential-solar-power-kill-switch https://www.rickscott.senate.gov/2025/6/sens-rick-scott-mars...)
OsrsNeedsf2P 1y ago
Nations already work with tech giants to get this in via OEMs. Blocking side loading only prevents hackers from disabling this malware.
Ajedi32 1y ago
This is why "do whatever the heck I want with it" ought to apply to software, not just hardware. This is one thing I think Richard Stallman got right, all the way back in 1988: > the freedom to change a program, so that you can control it instead of it controlling you; for this, the source code must be made available to you. We're a long way from that ideal today. Software controls us all the time. Usually that just leads to anti-consumer annoyances like lock screen ads or DLC seat heaters. But when the one controlling the software that controls you is a communist government... Not sure what the short term practical solution to this is though.

xbmcuser 1y ago

To me this is ironic as Singapore Government own lottery and sports betting app has to be side loaded as Google play does not allow gambling apps.

harvey9 1y ago
That's odd because the UK has a lottery and it's app is in Google Play.
- xbmcuser 1y ago
  does it have sports betting as well?
  - roryirvine 1y ago
    Yep. All the main UK bookmakers & betting exchanges have apps on Google Play.

CaffeineLD50 1y ago

I'm pretty sure my degoogled Murena /e/ OS pixel 5 won't have this problem.

fsflover 1y ago
Until it becomes too hard to fork and support the Google OS.
strcat 1y ago
You wouldn't have this problem with a stock OS Android device either. It's worth noting that you're using an insecure end-of-life device and are missing a large number of High and Critical severity privacy/security patches including ones being exploited in the wild. Due to the device being end-of-life, you don't have firmware/driver patches, which are not being provided by your OS despite it continuing to support it. You're also missing important non-device-related OS patches due to /e/OS lagging behind and not shipping them properly. You should really replace the device if you care at all about privacy and security. The 3 years of support for the Pixel 5 was not adequate for a significant portion of users. The past 2 generations of Pixels have 7 years of support from launch, which should be enough for most people. /e/OS also doesn't ship proper signed production releases and doesn't keep the standard privacy/security model or features intact. It greatly reduces privacy and security compared to LineageOS which reduces them compared to the Android Open Source Project. Purism's Librem 5 is definitely not the answer. It had dramatically worse hardware, firmware and software security than Pixels or iPhones from day one along with not providing high importance firmware updates to users. Presenting it as the answer to minor app compatibility issues also makes little sense since throwing out compatibility with most open source mobile apps and nearly all mainstream apps hardly resolves a subset of banking/financial apps and a tiny number of other apps banning using a non-stock OS.

CommenterPerson 1y ago

Hate the $megacorps too, soPurism sounded like a good idea. But half the links on their site are broken. It makes them look like a scammer unfortunately.

fsflover 1y ago
There are many people happily using their devices. Sent from my Librem 5.

msgodel 1y ago

The smartphone app ecosystem is a net loss for most users sideloading or not.

JimDabell 1y ago

As I’ve mentioned here before, sideloading is a genuine security concern, not merely an excuse for Apple to exert control. There is a never-ending stream of people losing their life savings. It happens on Android and not iOS because Android allows sideloading and iOS doesn’t. There is a very real human cost to this. > Police warn new Android malware scam can factory reset phones; over S$10 million lost in first half of 2023 > There have been more than 750 cases of victims downloading the malware into their phones in the first half of 2023, with losses of at least S$10 million (US$7.3 million). — https://www.channelnewsasia.com/singapore/android-malware-scam-factory-reset-phone-police-3785801 https://www.channelnewsasia.com/singapore/android-malware-sc... > DBS, UOB become latest banks to restrict access if unverified apps are found on customers' phones > They are the latest banks in Singapore to do so – after OCBC and Citibank – amid a spate of malware scams targeting users of Android devices. — https://www.channelnewsasia.com/singapore/dbs-uob-anti-scam-sideloaded-app-malware-measure-latest-bank-restrict-app-access-3796806 https://www.channelnewsasia.com/singapore/dbs-uob-anti-scam-... > 74-year-old man loses $70k after downloading third-party app to buy Peking duck > “I couldn’t believe the news. I thought: Why am I so stupid? I was so angry at myself for being cheated of my life savings. My family is frustrated and I ended up quarrelling with my wife,” said Mr Loh, who has three children. — https://www.straitstimes.com/singapore/74-year-old-man-loses-70k-after-downloading-third-party-app-to-buy-roast-duck https://www.straitstimes.com/singapore/74-year-old-man-loses... > Singapore Android users to be blocked from installing certain unverified apps as part of anti-scam trial > "Based on our analysis of major fraud malware families that exploit these sensitive runtime permissions, we found that over 95 per cent of installations came from internet-sideloading sources," it added. — https://www.channelnewsasia.com/business/anduril-secures-305-billion-valuation-latest-fund-raise-5167971 https://www.channelnewsasia.com/business/anduril-secures-305... > CNA Explains: Are Android devices more prone to malware and how do you protect yourself from scams? > Why are scammers more likely to target Android users? How do you spot a fake app and what should you do if your device is infected by malware? — https://www.channelnewsasia.com/singapore/android-malware-scams-google-apple-operating-systems-cybersecurity-cna-explains-3661566 https://www.channelnewsasia.com/singapore/android-malware-sc... > Nearly 2,000 victims fell for Android malware scams, at least S$34.1 million lost in 2023 > In 2023, about 1,899 cases of Android malware scams were reported in Singapore. The average amount lost was about S$17,960. — https://www.channelnewsasia.com/singapore/android-malware-scam-millions-lost-cpf-savings-banks-police-4128246 https://www.channelnewsasia.com/singapore/android-malware-sc... > Android users in Singapore tried to install unverified apps nearly 900,000 times in past 6 months > These attempts were blocked by a security feature rolled out by Google six months ago as part of a trial to better protect users against malware scams, which led to at least S$34.1 million (US$25.8 million) in losses last year with about 1,900 cases reported. — https://www.channelnewsasia.com/singapore/android-users-install-malware-unverified-apps-google-fund-anti-scam-4550026 https://www.channelnewsasia.com/singapore/android-users-inst...

flmontpetit 1y ago

The inexorable process of using security as a pretext to enshittify your platform carries on. I don't believe there is a meaningful difference between Google and Apple anymore.

b0a04gl 1y ago

[dead]

cft 1y ago

I am on Google ecosystem since the original T-Mobile G1 - now at Pixel 9 Pro XL. The moment this is rolled out, I am getting iPhones for me and family.

g-b-r 1y ago
Where side loading is easier? How about getting a linux phone? (or a dumbphone + a linux portable device)

aiauthoritydev 1y ago

g-b-r 1y ago
> Sideloading must be limited to tech savvy users only who know what they are doing. Who says so?
- cowboylowrez 1y ago
  I don't think "common sense" is an actual person haha I'm not picking sides, but I try to help myself understand things by visiting both sides of the arguments and there is clearly a side interested in cutting down on fraud, just as there is a side promoting freedom in their computing. Limiting sideloading seems a sort of pragmatic move, and leaving the possibility of sideloading open seems to be likewise a pragmatic move, especially if there are guardrails and warning signs everywhere, we do this in society when faced with hazardous situations. I am very open to counterpoints here, at least if I can read them before they get too greyed out!

reify 1y ago

there has never been Autonomy and Freedom, not from google, ever. I have never ever used a fully loaded android phone with all the spying, surveillance apps and play services, amazon, facecrook, whatshit, running. why on earth do muppets insist that they cannot live a life without google and the rest. I have installed the latest AOSP on all my phones, including family aand friends. I currently have a motorola edge 20 pro with android 15 installed. and my very old oneplus 5T also has android 15 installed. all my family and friends have either lineage or E/os installed. I dont see the problem here. I hear no complaints. fool me once, More fool anyone who thinks google, facecrook and whatshit is their friend. Autonomy for me, MEANS, self regulation. this is severely absent in the lives of the modern human being.

theodric 1y ago

The flexibility afforded by sideloading, which allows that that an Android phone is still for the most part a pocket-sized computer that can operate in a mode not intended by its creators (as opposed to a restricted consumption appliance like the iPhone) is what has kept me on the platform for 16 years and counting. If they take that away, then I really don't see a compelling difference between the two platforms. Android has been getting markedly more flaky for me ON MULTIPLE GOOGLE PIXEL DEVICES since 2018. My current Pixel 8a on Android 15 regularly has the underlying UI controls (separate from the launcher) crash and force me to restart if I want to use the app overview switcher since day 1. I also have no app overview button in the stock Android calculator since Android 14, the shipped OS, so if I want to switch between a calculation and another app I must first return to the home screen. Wasn't like this in previous releases! Furthermore, the day/date is routinely cut off in the statusbar and its pulldown. This product passed multiple reviews and 2 major OS releases with these (and many other) obvious and irritating bugs and shows no signs of improvement. If they left these holes in the surface, I can only imagine what's underneath. It's ridiculous, but I guess we're cranking out complexity at a rate that exceeds our ability to manage it (or our ability to manufacture new fucks at a rate exceeding their consumption). If Purism is shopping for new users, all they would eventually need to do is not get worse at a rate as fast as Android, or more expensive at a rate as fast as iOS devices. Based on what I've seen from them so far...they're not at that point yet: meager specifications, high prices. I will continue to cling to my Android device, but I'll cheer them on from the sidelines.

throwaway290 1y ago
> as opposed to a restricted consumption appliance like the iPhone You can root iphones
- cowboylowrez 1y ago
  I didn't know apple supported rooted iphones (I do not keep up with apple). Does apple at least provide a warning about invalidating warranties or whatever?
  - 1y ago

garbagecoder 1y ago

It's OK if it's not Apple doing it———Someone, probably.

mvdtnz 1y ago

This is an ad

casenmgreen 1y ago

It seems to me this was inevitable. Google could do this, and it's in their interest. It happened.

londons_explore 1y ago

> [blocking apps] requesting sensitive permissions such as SMS access or accessibility services These are the permissions most used to impersonate a user. SMS access lets an app log into every service you use and get OTP codes. Accessibility tools lets the app open your banking apps etc. whilst you're sleeping. Singapore has big issues with identity 'trading' - and there are big signs saying things like "if a stranger offers to buy your phone number from you, and you accept, we will send you to prison for 5 years". Same with bank accounts, credit cards, etc. Basically, if something is tied to your identity, and you let someone else use it for crime, then they're gonna punish you heavily.

dismalaf 1y ago

How the hell does this get upvoted? This is major FUD by an Android "competitor". First of all, it just introduces an addition level of security, at the request of the government of Singapore. Second, it's a year and a half old. Third, it obviously hasn't affected side loading in other parts of the world 1.5 years later. The other restriction, allowing app makers to restrict side loading, is to combat piracy and it's again, up to the app makers themselves. Garbage article. Also embarrassing so many fell for it.

fsflover 1y ago
This development clearly shows the direction of Android development officially chosen by Google. It doesn't matter when it happened or where. It's just another checkpoint on the way to not owning your device that knows everything about you and has access to practically all your secrets. People saying "Android is still better than Apple" will not be right for long. This "competitor" offers a rare opportunity to support the escape path from the dystopia using free software. Sent from my Librem 5.

michalpleban 1y ago

And how is it supposed to work in China, where the Google Play Store is blocked and sideloading is very common to install apps on Android phones? Looks like Google plans to throw its Chinese users under the bus.

tomComb 1y ago
What Chinese users? Google pulled out of China like a decade ago when they insisted that Google censor search results.
throitallaway 1y ago
How does this work for iOS devices? Sideloading on those through sketchy workarounds is a PITA.

pinoy420 1y ago

[dead]

kleiba 1y ago

EU regulators to the rescue!

qbane 1y ago

The Google input method on my phone is patched by myself. So is the calculator, and many other everyday apps. I cannot imagine owning an Android phone without the ability of sideloading. Maybe I will consider rooting my phone and void my warranty on the first day with my every future Android phone.

Aldipower 1y ago

My Motorola Razr 3 doesn't have this problem.

mfuzzey 1y ago

Will this affect alternative app stores like F-droid or is it only about downloading and installing an APK with a web browser? An example of "normal" users that side load (through F-droid or direct APK) is most Ingress players. While Ingress itself is in the playstore most people use the "companion" intel app called IITC which isn't in the playstore as it's technically against the ToS.

throitallaway 1y ago

I enjoy Android is because of its relatively nonrestrictive nature. It trusts that I know what I'm doing. The highly locked down nature of iOS is a reason why I will never buy one of their devices. Google will drive me further away from their services (and into GrapheneOS, which has "no" Google hooks) with moves like this. From the article, I presume this is being done in the name of "cyber security" (least common denominator strikes again.) In newer versions of Android, a few warnings/confirmations are shown prior to sideloading an app. I think the best solution here is to gate-keep sideloading behind Developer Mode. Enabling Developer Mode, then enabling side loading, would be complex enough to stop brain dead drive-by side loading from occurring. And (mostly) only people that know what they're doing enable Developer Mode.

throitallaway 1y ago

> In parallel, Google has rolled out its Play Integrity API, which allows developers to limit app functionality when sideloaded How about Google focuses on proper sandboxing and permissions models? With those in place where an app comes from should not be a concern.

Zak 1y ago
That change is not for the benefit of the end user; it's for app developers with an adversarial relationship to their users who want to trust the client not to do anything unprofitable. (And probably game anti-cheat)

mcflubbins 1y ago

Can anyone using a Librem 5 as their daily phone report back as to how well it works. Specifically, how reliable are the most basic, and crucial SMS and calling functions? How's battery life? I had a Pinephone a couple of years ago and receiving phone calls wasn't very reliable.

fsflover 1y ago
Librem 5 is my daily driver, buy I'll just give links to good, extensive reviews: https://forums.puri.sm/t/nine-months-librem-5-as-my-only-phone-my-review-and-workflow/23268 https://forums.puri.sm/t/nine-months-librem-5-as-my-only-pho... https://forums.puri.sm/t/a-l5-review-1-week-to-my-ready-to-ship-l5-anniversary/23181 https://forums.puri.sm/t/a-l5-review-1-week-to-my-ready-to-s... Tl;dr: calls and texts work fine, battery life is not as good as Android/Apple but usable. Also you can replace the battery on the go.

butz 1y ago

It would be great to have more devices running PureOS available, especially a bit smaller ones than current generation "phablets". Where did all 4" devices gone?

EwanToo 1y ago

Is this not from 2024? https://techcrunch.com/2024/02/07/google-starts-blocking-users-from-sideloading-certain-apps-in-singapore/ https://techcrunch.com/2024/02/07/google-starts-blocking-use...

Zigurd 1y ago

The way this is designed appears to be entirely intentional and sensible. Yes, you can still install malware using ADB. It's just harder. That seems really sensible. It's a speed bump, but not a prohibition. I also haven't seen any specific examples of software that's frequently sideloaded that would be unjustly discriminated against.

samtheprogram 1y ago
Alternative app stores. See Epic v. Google. I’m an Apple user, but above all I value choice. Isn’t the point of Android that it’s an open ecosystem? ADB is arguably worse than what Apple did in the EU for sideloading to abide court orders, and Apple was lambasted.
- Zigurd 1y ago
  I'm not a user of them so I can't tell you much about them or if they're all lame, but there are third-party app stores in the Google Play store. Are there high quality or especially useful apps stores that are not in the Play store.

ReptileMan 1y ago

>These policies reinforce Google’s control over Android’s ecosystem under the guise of security but have sparked renewed concern over digital autonomy, innovation suppression, and user rights. Ahhh yes. You want some of the action apple is getting from EU commission don't you? Talking about the api-s that discriminate between playstore and side loaded aps. Which is not clear if are Singapore only

AstralStorm 1y ago

Is it forking time? It feels like it's forking time. Seriously, just restrict it to signed applications unless debugging mode is active. With explicit permission from the user.

fsflover 1y ago
> Is it forking time? /e/OS already exists and can even be bought preinstalled on Fairphone.

everyone 1y ago

Smartphones are just trash.. Totally stupid human interface design + the worst OSes imaginable. I've totally gotten into modern AI, cus its actually useful, but I've always been a "luddite" re. smartphones. I've always thought they suck. Smartphone = a computer that's shitty and dumb enough to be popular.

miki123211 1y ago

This will impact the blind community in a pretty serious way. In countries where Android is popular and iPhones are expensive, Commentary (Jieshuo) screen reader is a popular and arguably much better alternative to TalkBack, the built-in Android screen reader. Because it's a Chinese app and there's no major conglomerate behind it, it's not on the Play Store. Because it needs to be able to read all screen contents and drive the entire system UI (that's literally what a screen reader is for), the permissions it requests are quite intrusive. Blocking it from accessing sensitive apps would entirely defeat its purpose, after all, if you need a screen reader in the first place, one that doesn't work in banking apps will be pretty useless to you. Googlers will probably point to Webaim[1] and say that nobody uses the app so it's not a problem, entirely forgetting that Webaim is mostly filled out by well-off English speakers. If you look at data sources that better represent the global population at large, like the Yandex user survey, you will see something very different. [1] https://webaim.org/projects/screenreadersurvey10/ https://webaim.org/projects/screenreadersurvey10/

Lockal 1y ago

A person from Singapore here. In practice, this changes nothing (from the news standpoint). The most critical applications are already integrated with Play Integrity API. Singpass (ID system) is 100% unavoidable for every long-term visitor and has strict Play Integrity integration (but attacker can select SMS flow and nullify the protection). Banks and all financial organizations require Singpass too, also use Play Integrity in most cases. The biggest bank DBS has extra checks, like "if there is an .apk in Downloads directory, then device is considered as compromised" (and they recently disabled SMS bypass). The most funny case that a similar protection is used in McDonald's app (again, maybe enforced only in specific countries): have something sus on your phone -- no burgers for you! They also have extra checks (i. e. device passes "strong integrity test", but app refuses to work). Another note: this obviously does not prevent people from having multiple phones, feel free to buy an extra phone and install LineageOS/Gentoo/whatever you want.

Geraldwarr 1y ago

[dead]

Geraldwarr 1y ago

[dead]

smithpron 1y ago

[flagged]