8 ms·

This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) w

This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? - One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably not be willing to wait a day, and will thus just not sideload unless they really have no choice for what they need. This kills the pathway for new users to sideload apps that have similar functionality to those on the Play Store. The rest -- restarting, confirming you aren't being coached, and per-install warnings -- would be just as effective alone to "protect users," but with those prior two points, it's clear that this is just simply intended to make sideloading so inconvenient that many won't bother or can't (dev mode req.).

pmontra 7mo ago
You have to wait one day only once, when enabling the feature. I agree that enabling developer mode could be a problem but mostly because it's buried below screens and multiple touches. As a data point, I enabled developer mode on all my devices since 2011 and no banking app complained about it. But it could depend by the different banking systems of our countries.
- frays 7mo ago
  You don't use the HSBC or Citibank app then I assume?
  - pmontra 7mo ago
    They don't operate in my county AFAIK. However that reinforces my idea that the endgame will be a pristine Android phone in a drawer at home with the banking apps required for accessing their sites with 2FA and another phone in my pocket for daily use.
    - brewdad 7mo ago
      I’m not sure that Google/Android selling everyone two phones instead of one is the deterrent to this behavior that you envision.
      - pmontra 7mo ago
        It's not a deterrent, far from that, but it's probably what I'll have to do to be able to carry with me a sane device.
curt15 7mo ago
The one-day waiting period is so arbitrary. Have they demonstrated any supporting data? We know google loves to flaunt data. Something like Github's approach of forcing users to type the name of the repo they wish to delete would seem to be more than sufficient to protect technically disinclined users while still allowing technically aware users to do what they please with their own device.
- xnx 7mo ago
  > The one-day waiting period is so arbitrary. Scammers aren't going to wait on the phone for a day with your elderly parent.
  - cogman10 7mo ago
    Sure, but what about a 30 minute delay? 1 hour? 2 hour? 24 is just so long. But also, my expectation is that a scammer is going to just automate the flow here anyways. Cool, you hit the "24 hour" wait period, I'll call you back tomorrow, the next day, or the next day and continue the scam process. It might stop some less sophisticated spammers for a little bit, but I expect that it'll just be a few tweaks to make it work again.
    - fwip 7mo ago
      24 hours is long enough to get them off the phone, and potentially talking to other people who might recognize the scam. There will be some proportion of people who mention to their spouse/child/friend about how Google called them to fix their phone, and are saved by that waiting period.
      - MishaalRahman 7mo ago
        Exactly - the idea is to make it harder for scammers to create a false sense of urgency.
        ncr100 7mo ago
xnx 7mo ago
> some apps (e.g., banking apps) will refuse to operate and such when developer mode is on JFC. Why would an app be allowed to know this? Just another datapoint for fingerprinting.
- tadfisher 7mo ago
  Yes, it is really dumb that some of these settings are exposed to all apps with no permission gating [0]. But it will likely always be possible to fingerprint based on enabled developer options because there are preferences which can only be enabled via the developer options UI and (arguably) need to be visible to apps. 0: https://developer.android.com/reference/android/provider/Settings.Global#DEVELOPMENT_SETTINGS_ENABLED https://developer.android.com/reference/android/provider/Set...
  - zzo38computer 7mo ago
    What might help better is having permissions that you can set separate settings that can be read for different apps (including the possibility to return errors instead of the actual values), even if they can be read by default you can also change them per apps. (This has other benefits as well, including possibility of some settings not working properly due to a bug, you can then work around it.)
- ninininino 7mo ago
  Because estimates suggest Americans lose about $119 billion annually to financial scams, which is a not insignificant fraction of our entire military budget, or more than 5% of annual social security expenditures.
  - wolvoleo 7mo ago
    [flagged]
    - int0x29 7mo ago
      Most of the victims were last in school in the 1960s when all this stuff didn't exist. Also from experience teaching people with dementia or memory issues is kinda challenging as they just forget.
inyorgroove 7mo ago
As described developer mode is only required at install time. Remains to be seen in the actual implementation, but as described in the post developer mode can be switched off after apps have been side loaded.
tadfisher 7mo ago
We'll see when this rolls out, but I don't foresee the package manager checking for developer mode when launching "unverified" apps, just when installing them. AFAICT the verification service is only queried on install currently.
- MishaalRahman 7mo ago
  Googler here (community engagement for Android) - I looked into the developer options question, and it's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you turn off developer options, then to turn off the advanced flow, you would first have to turn developer options back on.
  - kuschku 7mo ago
    If I understand correctly, the F-Droid store itself would be possible to install without waiting period, as it's an app from a verified developer. Would apps installed from F-Droid be subject to this process, or would they also be exempt? Could that be a solution that makes everyone happy? Android already tracks which app store an app originates from re: autoupdating. Also: Can I skip the 24h by changing the my phone's clock?
    - dzaima 7mo ago
      > as it's an app from a verified developer. Well that's if they go through the verification process, which does not seem like a thing they'd want to do - https://f-droid.org/en/2026/02/24/open-letter-opposing-developer-verification.html https://f-droid.org/en/2026/02/24/open-letter-opposing-devel...
      - kuschku 7mo ago
        If one verified app can install many unverified apps, either aurora droid or fdroid basic or one of the many other frontends would end up offering that feature quickly. But there's been some comments that even that wouldn't be possible, every app would have to be verified individually, or be signed by a developer with less than 20 installs. (Which of course then begs the question: Why not build a version of Fdroid that generates its own signing key and resigns every app on device?)
rtkwe 7mo ago
> - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? What apps are those? I've yet to run into any of my banking apps that refuse to run with developer mode enabled. I've seen a few that do that for rooted phones but that's a different story. I've been running android for a decade and a half now with developer mode turned on basically the whole time and never had an app refuse to load because of it.
- jcelerier 7mo ago
  RBC in Canada for instance, just having developer mode enabled blocks it here
- wolvoleo 7mo ago
  Wero in Europe. It's really insane. They make wero to make us less dependent on US tech and then hamstring it in this way.
  - looperhacks 7mo ago
    I can use Wero just fine in my banking app. Can't try the app that's called Wero in the Play store because it just directs me to my banking app. But I can open it at least ...
- adzm 7mo ago
  I enable developer mode on every android phone to at least change the animation durations to twice the speed. I also have never run into an issue fwiw
- andrewaylett 7mo ago
  SumUp won't let you use your phone to accept contactless payments while developer mode is enabled. You can still use an external card reader though.
- flykespice 7mo ago
  Brazil government app refuses to operate with developer mode on
MishaalRahman 7mo ago
>- Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? Hi, I'm the community engagement manager @ Android. It's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you turn off developer options, then to turn off the advanced flow, you would first have to turn developer options back on. >- One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably not be willing to wait a day, and will thus just not sideload unless they really have no choice for what they need. ADB installs are not impacted by the waiting period, so that is an option if you need to install certain unregistered applications immediately.
- kotaKat 7mo ago
  So... we're just going to move the scam into convincing the end user to run an application on their PC to ADB sideload the Scam App. Got it, simple enough. It's not hard to coach a user into clicking the "no, I'm not being coached" button, too, to guide them towards the ADB enable flow.
  - ufmace 7mo ago
    I think this is a "don't let the perfect be the enemy of the good thing". It's technically possible to get around, but adding more speed bumps in the way of scammers tends to drastically reduce the number of people who get scammed.
    - johnnyanmac 7mo ago
      It's adding more speedbumps because one drunk person a few years ago ran into a tree. it still won't stop that, but now everyone suffers.
    - ottah 7mo ago
      What good?
deleted 7mo ago
[deleted]
Dwedit 7mo ago
Medical apps (such as those that talk to insulin pumps) also refuse to run when developer mode is turned on.
andyjohnson0 7mo ago
> some apps (e.g., banking apps) will refuse to operate and such when developer mode is on Enable dev mode, sideload the apk, then disable dev mode. I'd argue that it is poor security practice to keep developer mode enabled long-term on a phone that is used for everyday activities, such as banking.
lvales 7mo ago
> This is going to hurt legitimate sideloading way more than actually necessary to reduce scams Isn't that the objective? "Reducing scams" is the same kind of argument as "what about the children"; it's supposed to make you stop thinking about what it means, because the intentions are so good.
girvo 7mo ago
That is working as intended. Google wants to kill side loading.
- prmoustache 7mo ago
  Google wants to kill installing apps outside of playstore. Installing apps manually or through another store app is not "sideloading". Sideloading is the new jaywalking, a newish word to pretend that a pretty normal action would be in any way illegal, dangerous or harmful.
prism56 7mo ago
>the vast majority of people who need to sideload something will probably not be willing to wait a day I disagree with this. Won't somebody who need to sideload something will just try again the next day...
jcul 7mo ago
I don't know. I've been silently outraged and disappointed by this whole forbidding of unverified apps, but also hopeful it wouldn't affect me much as a user of grapheneos. But this process seems pretty reasonable to me. I'd like to think it is due in part to the efforts of F-Droid and others. Waiting a day, once, to disable this protection doesn't seem like a big deal to me. I'd probably do it once when I got a phone and then forget about it. I happen to have developer mode enabled right now, for no good reason other than I never disabled last time I needed it. Haven't had any issues with any apps. I actually think these protections could help mitigate scammers.
- jraph 7mo ago
  It's not directly a big issue for us technical people and our own individual usage. Telling people about F-Droid, NewPipe (& forks) or secuso apps will be a pain. People will find free software / software not approved by Google complicated or suspicious. It is a huge issue, and even for us in the end because it hurts the software we love.
nacozarina 7mo ago
their goal is to make software installation as painful as possible without being outright impossible : ‘sideloading’ is only ever a euphemism for ‘illegitimate’.
johnnyanmac 7mo ago
Didn't Google already lose a case over making it hard to install alternative app stores? How is this not going to get them hit again? This is way worse than what Epic sued over.
raincole 7mo ago
> some apps (e.g., banking apps) will refuse to operate and such when developer mode is on And you blame Google for this? First of all, banks chose to make apps work this way, not Google. Moreover, they chose this likely due to scams. That proves scamming on android IS an issue that needs some technical solution.
- 5d41402abc4b 7mo ago
  >And you blame Google for this Why does google allow apps to access this info?
riedel 7mo ago
This is clearly anticompetitive. Hope regulators will figure out, then we won't have it eg not in the EU. However, Google is also abusing their power to e.g. deinstall apps without any option to decide using 'play protect' and blocks whole alternative stores through 'safe browsing' flags. I posted this play protect incident about IzzyOnDroid a few days ago, because I was so outraged: https://news.ycombinator.com/item?id=47409344 https://news.ycombinator.com/item?id=47409344
sharpshadow 7mo ago
I wouldn’t be fully optimistic about the one-day waiting period. Almost certain there will be a pop up showing up with: Process failed try again in 23:59:59.
BatteryMountain 7mo ago
Another take: People are not getting scammed because of side-loading (or not knowing your demographics/biometrics). People are getting scammed because of ignorance & stupidity & lack of common sense. In a way, its just nature running its course. If I'm able to scam you successfully, don't you deserve it at that point? Doesn't matter what we do, if you are scammable, you will get scammed. Have these companies sent out their people to old age homes to teach old people how to use their tech and how avoid scams? If you lock the system down at max level, scams will just move offline again or find another way. Same if they build backdoors into encryption or make chats data available to gov agents: all illicit comms will just move off the network or find another smarter way. Its just how nature works, we are seeing tech-evolution in realtime.
fortyseven 7mo ago
One of the first things I do when I buy a new Android phone, like day one, is to enable developer mode. I usually use that simply for the ability to speed up animations so the phone feels a bit more snappy. In all the years I've engaged in this behavior, I've never had an application refuse to work. A rooted phone? Yes. Definitely. But just having developer mode enabled, no. That said, it may be that I've simply been lucky and have an encountered that yet. So I'll be keeping an eye out for it.

pmontra 7mo ago

You have to wait one day only once, when enabling the feature. I agree that enabling developer mode could be a problem but mostly because it's buried below screens and multiple touches. As a data point, I enabled developer mode on all my devices since 2011 and no banking app complained about it. But it could depend by the different banking systems of our countries.

frays 7mo ago
You don't use the HSBC or Citibank app then I assume?
- pmontra 7mo ago
  They don't operate in my county AFAIK. However that reinforces my idea that the endgame will be a pristine Android phone in a drawer at home with the banking apps required for accessing their sites with 2FA and another phone in my pocket for daily use.
  - brewdad 7mo ago
    I’m not sure that Google/Android selling everyone two phones instead of one is the deterrent to this behavior that you envision.
    - pmontra 7mo ago
      It's not a deterrent, far from that, but it's probably what I'll have to do to be able to carry with me a sane device.

curt15 7mo ago

The one-day waiting period is so arbitrary. Have they demonstrated any supporting data? We know google loves to flaunt data. Something like Github's approach of forcing users to type the name of the repo they wish to delete would seem to be more than sufficient to protect technically disinclined users while still allowing technically aware users to do what they please with their own device.

xnx 7mo ago
> The one-day waiting period is so arbitrary. Scammers aren't going to wait on the phone for a day with your elderly parent.
- cogman10 7mo ago
  Sure, but what about a 30 minute delay? 1 hour? 2 hour? 24 is just so long. But also, my expectation is that a scammer is going to just automate the flow here anyways. Cool, you hit the "24 hour" wait period, I'll call you back tomorrow, the next day, or the next day and continue the scam process. It might stop some less sophisticated spammers for a little bit, but I expect that it'll just be a few tweaks to make it work again.
  - fwip 7mo ago
    24 hours is long enough to get them off the phone, and potentially talking to other people who might recognize the scam. There will be some proportion of people who mention to their spouse/child/friend about how Google called them to fix their phone, and are saved by that waiting period.
    - MishaalRahman 7mo ago
      Exactly - the idea is to make it harder for scammers to create a false sense of urgency.
      - ncr100 7mo ago

xnx 7mo ago

> some apps (e.g., banking apps) will refuse to operate and such when developer mode is on JFC. Why would an app be allowed to know this? Just another datapoint for fingerprinting.

tadfisher 7mo ago
Yes, it is really dumb that some of these settings are exposed to all apps with no permission gating [0]. But it will likely always be possible to fingerprint based on enabled developer options because there are preferences which can only be enabled via the developer options UI and (arguably) need to be visible to apps. 0: https://developer.android.com/reference/android/provider/Settings.Global#DEVELOPMENT_SETTINGS_ENABLED https://developer.android.com/reference/android/provider/Set...
- zzo38computer 7mo ago
  What might help better is having permissions that you can set separate settings that can be read for different apps (including the possibility to return errors instead of the actual values), even if they can be read by default you can also change them per apps. (This has other benefits as well, including possibility of some settings not working properly due to a bug, you can then work around it.)
ninininino 7mo ago
Because estimates suggest Americans lose about $119 billion annually to financial scams, which is a not insignificant fraction of our entire military budget, or more than 5% of annual social security expenditures.
- wolvoleo 7mo ago
  [flagged]
  - int0x29 7mo ago
    Most of the victims were last in school in the 1960s when all this stuff didn't exist. Also from experience teaching people with dementia or memory issues is kinda challenging as they just forget.

inyorgroove 7mo ago

As described developer mode is only required at install time. Remains to be seen in the actual implementation, but as described in the post developer mode can be switched off after apps have been side loaded.

tadfisher 7mo ago

We'll see when this rolls out, but I don't foresee the package manager checking for developer mode when launching "unverified" apps, just when installing them. AFAICT the verification service is only queried on install currently.

MishaalRahman 7mo ago
Googler here (community engagement for Android) - I looked into the developer options question, and it's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you turn off developer options, then to turn off the advanced flow, you would first have to turn developer options back on.
- kuschku 7mo ago
  If I understand correctly, the F-Droid store itself would be possible to install without waiting period, as it's an app from a verified developer. Would apps installed from F-Droid be subject to this process, or would they also be exempt? Could that be a solution that makes everyone happy? Android already tracks which app store an app originates from re: autoupdating. Also: Can I skip the 24h by changing the my phone's clock?
  - dzaima 7mo ago
    > as it's an app from a verified developer. Well that's if they go through the verification process, which does not seem like a thing they'd want to do - https://f-droid.org/en/2026/02/24/open-letter-opposing-developer-verification.html https://f-droid.org/en/2026/02/24/open-letter-opposing-devel...
    - kuschku 7mo ago
      If one verified app can install many unverified apps, either aurora droid or fdroid basic or one of the many other frontends would end up offering that feature quickly. But there's been some comments that even that wouldn't be possible, every app would have to be verified individually, or be signed by a developer with less than 20 installs. (Which of course then begs the question: Why not build a version of Fdroid that generates its own signing key and resigns every app on device?)

rtkwe 7mo ago

> - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? What apps are those? I've yet to run into any of my banking apps that refuse to run with developer mode enabled. I've seen a few that do that for rooted phones but that's a different story. I've been running android for a decade and a half now with developer mode turned on basically the whole time and never had an app refuse to load because of it.

jcelerier 7mo ago
RBC in Canada for instance, just having developer mode enabled blocks it here
wolvoleo 7mo ago
Wero in Europe. It's really insane. They make wero to make us less dependent on US tech and then hamstring it in this way.
- looperhacks 7mo ago
  I can use Wero just fine in my banking app. Can't try the app that's called Wero in the Play store because it just directs me to my banking app. But I can open it at least ...
adzm 7mo ago
I enable developer mode on every android phone to at least change the animation durations to twice the speed. I also have never run into an issue fwiw
andrewaylett 7mo ago
SumUp won't let you use your phone to accept contactless payments while developer mode is enabled. You can still use an external card reader though.
flykespice 7mo ago
Brazil government app refuses to operate with developer mode on

MishaalRahman 7mo ago

>- Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? Hi, I'm the community engagement manager @ Android. It's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you turn off developer options, then to turn off the advanced flow, you would first have to turn developer options back on. >- One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably not be willing to wait a day, and will thus just not sideload unless they really have no choice for what they need. ADB installs are not impacted by the waiting period, so that is an option if you need to install certain unregistered applications immediately.

kotaKat 7mo ago
So... we're just going to move the scam into convincing the end user to run an application on their PC to ADB sideload the Scam App. Got it, simple enough. It's not hard to coach a user into clicking the "no, I'm not being coached" button, too, to guide them towards the ADB enable flow.
- ufmace 7mo ago
  I think this is a "don't let the perfect be the enemy of the good thing". It's technically possible to get around, but adding more speed bumps in the way of scammers tends to drastically reduce the number of people who get scammed.
  - johnnyanmac 7mo ago
    It's adding more speedbumps because one drunk person a few years ago ran into a tree. it still won't stop that, but now everyone suffers.
  - ottah 7mo ago
    What good?

deleted 7mo ago

[deleted]

Dwedit 7mo ago

Medical apps (such as those that talk to insulin pumps) also refuse to run when developer mode is turned on.

andyjohnson0 7mo ago

> some apps (e.g., banking apps) will refuse to operate and such when developer mode is on Enable dev mode, sideload the apk, then disable dev mode. I'd argue that it is poor security practice to keep developer mode enabled long-term on a phone that is used for everyday activities, such as banking.

lvales 7mo ago

> This is going to hurt legitimate sideloading way more than actually necessary to reduce scams Isn't that the objective? "Reducing scams" is the same kind of argument as "what about the children"; it's supposed to make you stop thinking about what it means, because the intentions are so good.

girvo 7mo ago

That is working as intended. Google wants to kill side loading.

prmoustache 7mo ago
Google wants to kill installing apps outside of playstore. Installing apps manually or through another store app is not "sideloading". Sideloading is the new jaywalking, a newish word to pretend that a pretty normal action would be in any way illegal, dangerous or harmful.

prism56 7mo ago

>the vast majority of people who need to sideload something will probably not be willing to wait a day I disagree with this. Won't somebody who need to sideload something will just try again the next day...

jcul 7mo ago

I don't know. I've been silently outraged and disappointed by this whole forbidding of unverified apps, but also hopeful it wouldn't affect me much as a user of grapheneos. But this process seems pretty reasonable to me. I'd like to think it is due in part to the efforts of F-Droid and others. Waiting a day, once, to disable this protection doesn't seem like a big deal to me. I'd probably do it once when I got a phone and then forget about it. I happen to have developer mode enabled right now, for no good reason other than I never disabled last time I needed it. Haven't had any issues with any apps. I actually think these protections could help mitigate scammers.

jraph 7mo ago
It's not directly a big issue for us technical people and our own individual usage. Telling people about F-Droid, NewPipe (& forks) or secuso apps will be a pain. People will find free software / software not approved by Google complicated or suspicious. It is a huge issue, and even for us in the end because it hurts the software we love.

nacozarina 7mo ago

their goal is to make software installation as painful as possible without being outright impossible : ‘sideloading’ is only ever a euphemism for ‘illegitimate’.

johnnyanmac 7mo ago

Didn't Google already lose a case over making it hard to install alternative app stores? How is this not going to get them hit again? This is way worse than what Epic sued over.

raincole 7mo ago

> some apps (e.g., banking apps) will refuse to operate and such when developer mode is on And you blame Google for this? First of all, banks chose to make apps work this way, not Google. Moreover, they chose this likely due to scams. That proves scamming on android IS an issue that needs some technical solution.

5d41402abc4b 7mo ago
>And you blame Google for this Why does google allow apps to access this info?

riedel 7mo ago

This is clearly anticompetitive. Hope regulators will figure out, then we won't have it eg not in the EU. However, Google is also abusing their power to e.g. deinstall apps without any option to decide using 'play protect' and blocks whole alternative stores through 'safe browsing' flags. I posted this play protect incident about IzzyOnDroid a few days ago, because I was so outraged: https://news.ycombinator.com/item?id=47409344 https://news.ycombinator.com/item?id=47409344

sharpshadow 7mo ago

I wouldn’t be fully optimistic about the one-day waiting period. Almost certain there will be a pop up showing up with: Process failed try again in 23:59:59.

BatteryMountain 7mo ago

Another take: People are not getting scammed because of side-loading (or not knowing your demographics/biometrics). People are getting scammed because of ignorance & stupidity & lack of common sense. In a way, its just nature running its course. If I'm able to scam you successfully, don't you deserve it at that point? Doesn't matter what we do, if you are scammable, you will get scammed. Have these companies sent out their people to old age homes to teach old people how to use their tech and how avoid scams? If you lock the system down at max level, scams will just move offline again or find another way. Same if they build backdoors into encryption or make chats data available to gov agents: all illicit comms will just move off the network or find another smarter way. Its just how nature works, we are seeing tech-evolution in realtime.

fortyseven 7mo ago

One of the first things I do when I buy a new Android phone, like day one, is to enable developer mode. I usually use that simply for the ability to speed up animations so the phone feels a bit more snappy. In all the years I've engaged in this behavior, I've never had an application refuse to work. A rooted phone? Yes. Definitely. But just having developer mode enabled, no. That said, it may be that I've simply been lucky and have an encountered that yet. So I'll be keeping an eye out for it.