8 ms·

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember

• Lammy 11mo ago
  Google have their own reasons too. They would love to kill off YouTube ReVanced and other haxx0red clients that give features for free which Google would rather sell you on subscription. Just look at everything they've done to break yt-dlp over and over again. In fact their newest countermeasure is a frontpage story right beside this one: https://news.ycombinator.com/item?id=45898407 https://news.ycombinator.com/item?id=45898407
  • charcircuit 11mo ago
    You would still be able to adb installs them. They wouldn't die.
    • AuthError 11mo ago
      how many people ll do this though? i would expect sub 1% conversion from existing users if they had to do that
    • gblargg 11mo ago
      Somehow I think having to use ADB instead of something like F-Droid with automatic updates would put a damper on things.
    • deleted 11mo ago
      [deleted]
    • gdulli 11mo ago
      Developers of these apps would have little motivation if the maximum audience size was cut down to the very few who would use adb. The ecosystem would die.
      • userbinator 11mo ago
        Or someone comes up with an easy adb wrapper and now it becomes the go-to way to install apps.
        • xyzzy_plugh 11mo ago
          Shizuku[0][1] already exists, it would certainly suck but it wouldn't be the end of the world. Of course I would be much happier if I didn't need to use Shizuku in the first place. [0]: https://play.google.com/store/apps/details?id=moe.shizuku.privileged.api https://play.google.com/store/apps/details?id=moe.shizuku.pr... [1]: https://shizuku.rikka.app/ https://shizuku.rikka.app/
          • celsoazevedo 11mo ago
            That uses a workaround based on WiFi debugging even though it's all local. It doesn't run if you're not connected to a trusted WiFi network, you have to set it all up when connecting to a new network, etc. Not only users are not connected to WiFi all the time, but in many developing countries people often have no WiFi at home and rely on mobile data instead. It's a solution, but not a solution for everyone or a solution that works all the time.
      • wolvesechoes 11mo ago
        And how do you estimate the audience that even cares about those issues? I think number of people caring about alternative app stores, F-droid or whatever is very similar to the number of people willing to use adb if necessary, so rather small.
        • gdulli 11mo ago
          But the ecosystem exists, regardless of what the absolute number is, and it would be bad to lose it. If the platform was more open like Windows the ecosystem would grow, if it was less open like iOS it would die.
  • Aurornis 11mo ago
    You’re still proving the point above, which is ignoring the fact that the restriction is specifically targeted at a small number of countries. Google is also rolling out processes for advanced users to install apps. It’s all in the linked post (which apparently isn’t being read by the people injecting their own assumptions) Google is not rolling this out to protect against YouTube ReVanced but only in a small number of countries. That’s an illogical conclusion to draw from the facts.
    • unsungNovelty 11mo ago
      Its my device. Not google's. Imagine telling you which NPM/PIP packages you can install from your terminal. Also, its not SIDE loading. Its installing an app.
      • freefaler 11mo ago
        Well... it would be good if this was true, but read the ToS and it looks more like a licence to use than "ownership" sadly :(
        • AnthonyMouse 11mo ago
          "Android" is really a lot of different code but most of it is the Apache license or the GPL. Google Play has its own ToS, but why should that have to do with anything when you're not using it?
        • johnnyanmac 11mo ago
          Google doesn't own AOSP. We don't need any google apps on an andoid phone for it to function.
      • xnx 11mo ago
        I agree, but I don't see why Google gets more critical attention than the iPhone or Xbox.
        • _blk 11mo ago
  • svat 11mo ago
    I can easily believe that Google's YouTube team would love to kill off such apps, if they can make a significant (say ≥1%) impact on revenue. (After all, being able to make money from views is an actual part of the YouTube product features that they promise to “creators”, which would be undermined if they made it too easy to circumvent.) But having seen how things work at large companies including Google, I find it less likely for Google's Android team to be allocating resources or making major policy decisions by considering the YouTube team. :-) (Of course if Android happened to make a change that negatively affected YouTube revenue, things may get escalated and the change may get rolled back as in the infamous Chrome-vs-Ads case, but those situations are very rare.) Taking their explanation at face value (their anti-malware team couldn't keep up: bad actors can spin up new harmful apps instantly. It becomes an endless game of whack-a-mole. Verification changes the math by forcing them to use a real identity) seems justified in this case. My point though was that whatever the ultimate stable equilibrium becomes, it will be one in which the set of apps that the average person can easily install is limited in some way — I think Google's proposed solution here (hobbyists can make apps having not many users, and “experienced users” can opt out of the security measures) is actually a “least bad” compromise, but still not a happy outcome for those who would like a world where anyone can write apps that anyone can install.
    • Zak 11mo ago
      I would like a world where buying something means you get final say over how it operates even if you might do something dangerous/harmful/illegal.
      • deleted 11mo ago
        [deleted]
      • miki123211 11mo ago
        I would like a world where I have the final say over whether I should have a final say. One way to achieve this is to only allow sideloading in "developer mode", which could only be activated from the setup / onboarding screen. That way, power users who know they'll want to sideload could still sideload. The rest could enjoy the benefits of an ecosystem where somebody more competent than their 80-year-old nontechnical self can worry about cybersecurity. Another way to do this would be to enforce a 48-hour cooldown on enabling sideloading, perhaps waived if enabled within 48 hrs of device setup. This would be enough time for most people to literally "cool off" and realize they're being scammed, while not much of an obstacle for power users.
  • ashleyn 11mo ago
    yt-dlp's days are fairly numbered as Google has a trump card they can eventually deploy: all content is gated behind DRM. IIRC the only reason YouTube content is not yet served exclusively through DRM is to maintain compatibility with older hardware like smart TVs.
    • potwinkle 11mo ago
      All levels of Widevine are cracked, but only the software-exclusive vulnerabilities are publicly available. It's only used for valuable content though (netflix/disney+/primevideo), so it might still work out for YouTube as no one will want to waste a vulnerability on a Mr. Beast slop video.
      • AnthonyMouse 11mo ago
        The reason they have different levels is that the DRM pitchmen got tired of everyone making fun of their ineffective snake oil, so they tried to make a version that was harder to break at the cost of not supporting most devices. Naturally that got broken too, and even worse, broken when it's only supported by a minority of devices and content, because the more devices and content it's used for the easier it is to break and the larger the incentive to do it. If you tried to require that for all content then it would have to be supported by all devices, including the bargain bin e-waste with derelict security, and what do you expect to happen then?
      • darkwater 11mo ago
        Do you have any link? All the things I can find are about the 2019 L3 crack
        • kotaKat 11mo ago
          I don’t have any personal links but know that there is a constant cat-and-mouse game of cracking Widevine devices for their L1 keyboxes and using them on high-value content (as mentioned). That’s why a lot of low end Android devices often have problems playing DRMed content on the Web: their keyboxes got cracked open and leaked wide enough for piracy that they got revoked and downgraded down to L3.
  • khannn 11mo ago
    Too bad that I'm going iPhone if Google removes sideloading and now I know about revanced so they aren't getting any more than the zero dollars that youtube and youtube music are worth from me If I'm going to live in a walled garden it's going to the fanciest
    • m4rtink 11mo ago
      I still don't get this mindset - all is lost, I am not going to do anything aboit that AND I will punish them by going with the even worse option!
      • Perz1val 11mo ago
        If neither does what you want, you'll use other metrics, which often make ios a better choice. Simple as that
        • khannn 11mo ago
          If they're going to reduce me to a user, iOS is the better choice. I had an iPhone before and it's a picture taking, instagram, social media machine with iMessage—bringing the console wars to normies since inception. Because the hardware is so constrained an iphone lasts forever compared to a similar android. My two year old pixel is slow now, but I know people completely happy with a five year old iphone. Pause, I checked and the oldest iphone that receives updates is an iphone 11, which is the exact model I had before going back to android.
          • akimbostrawman 11mo ago
            I have multiple generations of pixel phones and could not tell the difference in performance between them in basic tasks. Maybe because i installed GrapheneOS which makes both stock android and ios feel like a bloat and spyware riddled toy.
            • khannn 11mo ago
• tomrod 11mo ago
  I bought the hardware, therefore I have the right to modify and repair. Natural right, full stop. That right ends are your nose, as the saying goes.
  • Aurornis 11mo ago
    > Natural right, full stop. You’re still missing the point the comment is making: In countries where governments are dead set on holding Google accountable for what users do on their phones, it doesn’t matter what you believe to be your natural right. The governments of these countries have made declarations about who is accountable and Google has no intention of leaving the door open for that accountability. You can do whatever you want with the hardware you buy, but don’t confuse that with forcing another company to give you all of the tools to do anything you want easily.
    • brazukadev 11mo ago
      That's deflection, there's Google blocking users from installing apps and there's OP insinuating that it might be because of governments coercion but there's no evidence to support this. Scammers pay Google to show ads to install apps, that's what the governments are holding Google responsible and it won't change with blocking installing apps.
      • vachina 11mo ago
        Malicious app delivery goes beyond Google ads. In Singapore, most scam app installs are from social engineering, e.g. install new app to receive payment, install new app to buy something for cheap. I’m amazed at how gullible some people are but that’s how it is.
        • brazukadev 11mo ago
          That's not how it is, Google helps scammers and make a lot of money from it so they are responsible and should pay for it
  • 11mo ago
• Aurornis 11mo ago
  > because the governments of countries where such scams are widespread will hold Google responsible. This is the unsurprising consequence of trying to hold big companies accountable for the things people do with their devices: The only reasonable response is to reduce freedoms with those devices, or pull out of those countries entirely. This happened a lot in the early days of the GDPR regulations when the exact laws were unclear and many companies realized it was safer to block those countries entirely. Despite this playing out over and over again, there are still constant calls on HN to hold companies accountable for user-submitted content, require ID verification, and so on.
  • jacquesm 11mo ago
    These two things are not the same. The GDPR afforded rights to common people. Those companies that would pull out are the ones that were abusing data that was never theirs and could no longer do so.
    • fingerlocks 11mo ago
      Nah. I know of several startups that had nothing but anonymous telemetry and they blocked all Europe because there was no capacity for compliance. I was at an incubator at the time and the decision was unanimous across a dozen or so companies. It’s not like anyone was going to lose out on VC money from that market
      • sebastiennight 11mo ago
        > anonymous telemetry is not covered by GDPR. And it's a bit hard to believe that these several startups functioned without ever collecting names, emails, IP, phone number, or address of any lead or customer ever.
        • fingerlocks 11mo ago
          Maybe they did? Who knows? Never gonna find out because no one had time to look into it. It certainly wasn’t done with malicious intent, perhaps by accident or oversight, which is likely the situation in most small companies.
• wmf 11mo ago
  Or maybe Google just has empathy for people losing millions to scams?
  • jacquesm 11mo ago
    No, then the results of many google web searches would not put scam sites at the top over the official sites. Google is fine with people being scammed. As long as they get their cut. Large corporations don't have empathy.
    • vachina 11mo ago
      Meta ads too. It’s bonkers the type of ads they approve, straight up scams or obvious misinformation (some prominent figure is in jail! Click here to find out!)
  • spaqin 11mo ago
    From what I've seen, millions lost to scams are with social engineering; through cold calls masquerading as the authorities, phishing, pig butchering; plenty of scam apps on the Play store harvesting data as well, but not a single real life instance of malware installed outside the officially sanctioned platform.
  • tjpnz 11mo ago
    The same scams Google's ad network facilitates and Google in turn profits from?
  • sunaookami 11mo ago
    The Play Store is full of of scam apps so obviouly they don't.
  • hooverd 11mo ago
    Tell that to their advertising arm.
• jacquesm 11mo ago
  That's a disingenuous argument though: they are in that position because they chose to make themselves the only way that a 'normal' user is able to install software on these devices. If not for that these governments wouldn't have a point to apply pressure on in the first place.
  • m4rtink 11mo ago
    BTW, Stallman and FSF have been saying this the whole time - if you become the only gatekeeper, don't be surprised when government people show up and force you to ban apps or users from your platform.
• LoganDark 11mo ago
  It's not possible to provide a path for advanced users that a stupid person can't be coerced to use. Moreover, it's not possible to provide a path for advanced users that a stupid person won't use by accident, either. These are what drive many instances of completely missing paths for advanced users. It's not possible to stop coercion or accidents. It is literally impossible. Any company that doesn't want to take the risk can only leave advanced users completely out of the picture. There's nothing else they can do. Google will fail to prevent misuse of this feature, and advanced users will eventually be left in the dust completely as Google learns there's no way to safely provide for them. This is inevitable.
  • edent 11mo ago
    Android could have, for example, a 24 hour "cooling off" period for sideloading approval. Much like some bootloader unlocking - make it subject to a delay. That immediately takes the pressure off people who are being told that their bank details are at immediate risk.
    • cesarb 11mo ago
      > Android could have, for example, a 24 hour "cooling off" period for sideloading approval. And, to prevent the scammer from simply calling back once the 24 hours are gone, make it show a couple of warnings (at random times so they can't be predicted by the scammer) explaining the issue, with rejecting these warnings making the cooling off timer reset (so a new attempt to enable would need another full 24 hours).
    • hattmall 11mo ago
      The people gullible enough to fall for a scam like that are also gullible enough to follow more instructions 24 hours later. I think if you could force a call to the phone and have an agent or even AI that talks to user and makes sure no scam is involved then gives an unlock code based on deviceID or something. But that would cost money and scammers would work around it anyway.
  • 0xDEAFBEAD 11mo ago
    >It's not possible to provide a path for advanced users that a stupid person can't be coerced to use. I actually think you might be wrong about this? Imagine if Google forced you to solve a logic puzzle before sideloading. The puzzle could be very visual in nature, so even if a scammer asked the victim to describe the puzzle over the phone, this usually wouldn't allow the scammer to solve it on the victim's behalf. The puzzle could be presented in a special OS mode to prevent screenshots, with phone camera disabled so the puzzle can't be photographed in a mirror, and phone call functionality disabled so a scammer can't talk you through it as easily. Scammers would tell the victim to go find a friend, have the friend photograph the puzzle, and send the photo to the scammer. At which point the friend hopefully says "wait, wtf is going on here?" (Especially if the puzzle has big text at the top like "IF SOMEONE ASKS YOU TO PHOTOGRAPH THIS, THEY ARE LIKELY VICTIM OF AN ONGOING SCAM, YOU SHOULD REFUSE", and consists of multiple stages which need to be solved sequentially.) In addition to logic puzzles, Google could also make you pass a scam awareness quiz =) You could interleave the quiz questions with logic puzzle stages, to help the friend who's photographing the puzzle figure out what's going on. I guess this could fail for users who have two devices, e.g. a laptop plus a phone, but presumably those users tend to have a little more technical sophistication. Maybe display a QR code in the middle of the puzzle which opens up scam awareness materials if photographed? Or, instead of a "scam awareness quiz" you could could give the user an "ongoing scam check", e.g.: "Did a stranger recently call you on the phone and tell you to navigate to this functionality?" If the user answers yes, disable sideloading for the next 48 hours and show them scam education materials.
• thisislife2 11mo ago
  I don't buy this argument at all that this specific implementation is under pressure from the government - if the problem is indeed malware getting access to personal data, then the very obvious solution is to ensure that such personal data is not accessible by apps in the first place! Why should apps have access to a user's SMS / RCS? (Yeah, I know it makes onboarding / verification easy and all, if an app can access your OTP. But that's a minor convenience that can be sacrificed if it's also being used for scams by malware apps). But that kind of privacy based security model is anathema to Google because its whole business model is based on violating its users' privacy. And that's why they have come with such convoluted implementation that further give them control over a user's device. Obviously some government's too may favour such an approach as they too can then use Google or Apple to exert control over their citizens (through censorship or denial of services). Note also that while they are not completely removing sideloading (for now) they are introducing further restrictions on it, including gate-keeping by them. This is just the "boil the frog slowly" approach. Once this is normalised, they will make a move to prevent sideloading completely, again, in the future.
  • cesarb 11mo ago
    > Why should apps have access to a user's SMS / RCS? It could be an alternative SMS app like TextSecure. One of the best features of Android is that even built-in default applications like the keyboard, browser, launcher, etc can be replaced by alternative implementations. It could also be a SMS backup application (which can also be used to transfer the whole SMS history to a new phone). Or it could be something like KDE Connect making SMS notifications show up on the user's computer.
    • thisislife2 11mo ago
      That's all indeed valid. > One of the best features of Android is that even built-in default applications like the keyboard, browser, launcher, etc can be replaced by alternative implementations. When sideloading is barred all that can easily change. If you are forced to install everything from the Google Play Store, Google can easily bar such things, again in the name of "security" - alternate keyboards can steal your password, alternate browsers can have adware / malware, alternate launcher can do many naughty things etc. etc. And note that if indeed giving apps access to SMS / RCS data is really such a desirable feature, Google could have introduced gate-keeping on that to make it more secure, rather than gate-keeping sideloading. For example, their current proposal says that they will allow sideloading with special Google Accounts. Instead of that, why not make it so that an app can access SMS / RCS only when that option is allowed when you have a special Google Account? The point is that they want to avoid adding any barriers where a user's private data can't be easily accessed.
• xg15 11mo ago
  > there cannot exist an easy way for a typical non-technical user to install “unverified apps” (whatever that means), because the governments of countries where such scams are widespread will hold Google responsible. You can also view this as a "tragedy of the commons" situation. Unverified apps and sideloading is actively abused by scammers right now. > Meanwhile this very fact seems fundamentally unacceptable to many, so there will be no end to this discourse IMO. I get that viewpoint and I'm also very glad an opt-out now exists (and the risk that the verification would be abused is also very real), but yeah, more information what to do against scammers then would also be needed.
• m463 11mo ago
  this is an unresolvable issue security = 1/convenience or in this case: security = 1/freedom or agency
  • procaryote 11mo ago
    Security isn't an absolute and this doesn't notably improve it
• makeitdouble 11mo ago
  > the governments of countries where such scams are widespread will hold Google responsible. This argument is FUD at this point. Sovereign governments have ways to make clear what they want: they pass laws, and there needs to be no back deal or veiled threats. If they intend to punish Google for the rampant scams, they'll need a legal framework for that. That's exactly how it went down with the DMA, and how other countries are dealing with Google/Apple. Otherwise we're just fantasizing on vague rumors, exchanges that might have happened but represent nothing (some politicians telling bullshit isn't a law of the country that will lead to enforcement). This would be another story if we're discussing exchanges with the mafia and/or private parties, but here you're explicitely mentionning governments.
  • hexage1814 11mo ago
    > they'll need a legal framework for that Not really. It should, but Google operate in a bunch of contries without proper rule of law.
• phendrenad2 11mo ago
  If nobody pushed back on anything we'd all be subjected to the laws of the worst country on earth, because big tech companies want to do business there, and putting an if/else around the user's country takes effort.
• wkat4242 11mo ago
  Then let them do that for those countries. Not for everyone. I'm not in any of those autocratic countries. Or offer an opt out in the countries where this isn't a thing. Using adb is not really great for doing updates. And also, I'm the owner of my device. Not my country.
  • m4rtink 11mo ago
    Once they do it in one country, there will be much more pressure and incentives to do it everywhere.
  • curtisnewton 11mo ago
    > I'm not in any of those autocratic countries Autocratic Albania banned by law ads on YouTube so if you are in Albania (or your VPN is - wink! wink!) you get to watch YouTube without ads legally I, too, hate those autocratic countries were government act for the good of the people, instead of ruling in favour of greedy billionaires
• deleted 11mo ago
  [deleted]
• thaumasiotes 11mo ago
  > there cannot exist an easy way for a typical non-technical user to install “unverified apps” (whatever that means), because the governments of countries where such scams are widespread will hold Google responsible. What, the same way they hold Microsoft responsible for the fact that you can install whatever you want in Windows? Obviously, there can exist an easy way for a non-technical user to install unverified apps, because there has always been one.
  • svat 11mo ago
    This is actually a good point, and something I've been wondering about too. What changed between the 90s and now, that Microsoft didn't get blamed for malware on Windows, but Google/Apple would be blamed now for malware on their devices? It seems that the environment today is different, in the sense that if (widespread) PCs only came into existence now, the PC makers would be considered responsible for harms therefrom (this is a subjective opinion of course). Assuming this is true (ignore if you disagree), why is that? Is it that PCs never became as widespread as phones (used by lots of people who are likely targets for scammers and losing their life savings etc), or technology was still new and lawmakers didn't concern themselves with it, or PCs (despite the name) were still to a large extent "office" devices, or the sophistication of scammers was lower then, or…? Even today PCs are being affected by ransomware (for example) but Microsoft doesn't get held responsible, so why are phones different?
    • wmf 11mo ago
      I always blamed Microsoft for Windows insecurity. But seriously, Windows did not have any vetting process for apps and apps didn't really have access to money. Google's problem is that they claim Android is a secure way to do banking but it isn't.
    • pmontra 11mo ago
      What changed is that Apple made the masses familiar with the concept of installing software only from a store with a vetting process. For short, the walled garden. That was mostly an alien thing in the world of software. All of us grew with the possibility of getting an installer and install it whenever we wanted. There were some form of protections against piracy but nothing else. Once Apple created the walled garden every other company realized how good it could be for their bottom lines and attempted to do the same thing. So, to answer your question, Microsoft got blamed for viruses and made fun of but there wasn't a better way in the mainstream. There is one now. PCs will resist this trend for a while because it's also mainstream that they are used to do work. Many people use a PC every day with some native application from a company they have a direct contract with. For example: accounting software. Everybody can add another example from their own experience. Those programs don't come from the Windows store and it will be a long term effort to gatekeep everything into the store or move them into a web browser. The .NET MAUI technology we had a post about yesterday is one of the bricks that can build the transition.
• Frieren 11mo ago
  > there cannot exist an easy way for a typical non-technical user to install “unverified apps” (whatever that means), because the governments of countries where such scams are widespread will hold Google responsible. But it is perfectly fine to sell crypto and other complex financial assets to kids and other people that do not know they are from apps in the Play store. If "safety" takes control from you then it is implemented. If real safety puts profits in danger then it is fight against. Quite a dystopia.
• xzjis 11mo ago
  Why can't they just put up a big, red warning: "Never enable software installation if someone asks you to (over the phone or via message). If you're unsure, check out this article on scams."?
  • thw_9a83c 11mo ago
    > "Never enable software installation if someone asks you..." Imagine a situation in which a frightened, stressed user sees such a message on their screen. Meanwhile, a very convincing fake police officer or bank representative is telling them over the phone that they must ignore this message due to specific dangerous emergency situation to save the money in their bank account. Would the user realize at that moment that the message is right and the person on the phone is a thief? I'm not so sure.
    • 0xDEAFBEAD 11mo ago
      What if there is a 12-hour delay to unlock "power user mode", and during that entire 12-hour unlock period, the phone keeps displaying various scam education information to help even an unsophisticated user figure out what's going on? Surely Google can devote a few full-time employees to keeping such educational materials up to date, so they ideally contain detailed descriptions of the most common scams a user is going to be subject to at any given time.
      • thw_9a83c 11mo ago
        This would help for sure. Ideally, the phone should stay in "expert mode" for a limited time only, like 1 hour. However, there is still a danger that scammers will call after 12 hours, and they will be more convincing than educational material (or the user may not have read it).
        • ordu 11mo ago
          > However, there is still a danger that scammers will call after 12 hours It is unlikely it will work. Scammers are talking all the time and creating a sense of urgency, people have issues to think and listen at the same time, and they tend to drop thinking completely when in a haste. 12 hours of a break will give the victim time to think at least. Probably it will give time to talk about it with someone, or to google things.
• mschuster91 11mo ago
  > From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating- https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) In ye goode olde times, the US would have threatened invasion and that would have been the end of it. Half /s, because it actually used to be the case that the US government exercised its massive influence (and not just militarily) onto other countries for the benefit of its corporations and/or its citizens... these days, the geopolitical influence of the US has been reduced to shreds and the executive's priorities aren't set by doing what's (being perceived as being) right but by whomever pays the biggest bribes.
• shevy-java 11mo ago
  Aha - that is a much better explanation than I assumed, aka "the people forced Google to behave". So Google is scared of having to pay fines or having their CEOs end up in jail. I actually think there should be a new rule - easy-jail mode for CEOs globally. Does not have to be long but say, a few days in jail for ignoring the law, and right hold the CEOs responsible for that. You earn a lot of money, so you also gotta take the risk.
• dev1ycan 11mo ago
  This is just lies spread by the very own people that created this system in the first place, if PCs can have apps without "verification" then so can a phone.
• KurSix 11mo ago
  The tension here is classic: governments want accountability, Google wants plausible deniability, and users want control
  • sebastiennight 11mo ago
    ...and users want ̶c̶o̶n̶t̶r̶o̶l̶ convenience. Seems more appropriate.
• sharperguy 11mo ago
  Considering phone scammers often convince their victims to: - install remote desktop software - run commands in the windows terminal - withdraw cash from the bank - lie to the bank teller about their purpose - insert their cash into a bitcoin ATM at a gas station - ignore warnings about scams which appear on the screen of the ATM - insert the scammers bitcoin address into the machine It isn't a stretch to imagine they could convince the victim to install adb and sideload an app.
  • 0xDEAFBEAD 11mo ago
    It seems to me if you raise the difficulty enough, and lower the success rate enough, at some point a given scam stops being economical. https://news.ycombinator.com/item?id=45913529 https://news.ycombinator.com/item?id=45913529
  • extraduder_ire 11mo ago
    A change google made to android earlier this year prevents you from allowing unknown sources and installing apks while you are on a phone call. I'm surprised they didn't think of doing that sooner.
  • Ajedi32 11mo ago
    Notice though that we don't forbid people from withdrawing cash from the bank in order to prevent this. Warning about scams is fine, as is taking steps to make it harder, but once you start trying to completely remove the agency of mentally sound adults "for their own good" then we have a problem.
  • port11 11mo ago
    It's waaaay more complicated to download ADB and side load a random APK. This is either a move towards tighter control of the platform or a government request. And somewhat ironic, given that iOS is being pressured to be a bit more open.
• dns_snek 11mo ago
  > Google has hinted I beg to differ: > In early discussions about this initiative, we've been encouraged by the supportive initial feedback we've received. > the Brazilian Federation of Banks (FEBRABAN) sees it as a “significant advancement in protecting users and encouraging accountability.” This support extends to governments as well > We believe this is how an open system should work Google isn't "hinting" that they're doing this under pressure, that announcement makes it quite clear that this is Google's initiative which the governments are supportive of because it's another step on a ratcheting mechanism that centralizes power. > because the governments of countries where such scams are widespread will hold Google responsible Your comment is normalizing highly problematic behavior. Can we agree that vague "pressure from the government" shouldn't be how policies and laws are enacted? They should make and enforce laws in a constitutional manner. If you believe that it's normal for these companies and government officials to make shadow deals that bypass the rule of law, legal procedures, separation of powers and the entire constitutional system of governance that our countries have, then please drop the pretense that you stand for democracy and the rule of law (assuming that you haven't already). Otherwise we need to be treating it for what it is - a dangerous, corrupt, undemocratic shift in our system of governance.
• woliveirajr 11mo ago
  I'm pretty sure Brazil doesn't have a law saying that Google must forbid sideload. I'm sure that government (be it President, Central Bank etc) doesn't pressure Google about it. I'm sure some private actors (for example, banks) would love that smartphones are as tight as possible (reason: [0]). Perhaps the same reason applies to Google [1]. But no, "Brazil" isn't demanding that from Google. [0]: consider that some virus (insecure apps, for example) could somehow steal information from bank apps (even as simple as capture login information). The client might sue the bank and the bank might have to prove that their app is secure and the problem was in the client's smartphone. [1]: the client, the bank etc might complain to Google that their Android is insecure
• immibis 11mo ago
  Imagine if they tried to hold the entire world to the standards of Russia, China or North Korea. Yet they don't. This is just an excuse from them, or else they would only enable it in those countries. They don't hold the entire world to Chinese standards so why should they hold them to Brazilian standards? The only reasonable answer is: they also like those standards.
• like_any_other 11mo ago
  > because the governments of countries where such scams are widespread will hold Google responsible. How many virus infections and scams was Microsoft held responsible for? What about Red Hat, or Debian? And at least let Google plainly state this, instead of inventing legal theories based on vague hints from their press releases, to explain why their self-serving user-hostile actions are actually legally mandatory.