4 ms·

Nothing is perfect, but by what percentage would you think scams that leverage sideloading would drop? 1%? 10%? 50%? 90%? 99%?

anonym29 7mo ago
Compared the current paradigm, where you already need to enable developer options, allow installation from untrusted sources, and tap through a warning screen for each apk to be installed? Maybe 10-20%, generously. The people who are falling for it under current protections clearly are not reading anything they're looking at or thinking about security at all, they've fallen for social engineering scams and sincerely believe they're at imminent risk of being arrested by the FBI or that their adult child is about to be killed. They're in fight or flight mode already, not critical thinking and careful deliberation mode. If you were to rank everyone by gullibility, these people would largely be clustered in the top 1-2% of most gullible people. There is very little you can do to protect these people, realistically.
- dataflow 7mo ago
  I guess I just don't believe your estimate. I think you're grossly underestimating how far we can get through these kinds of approaches.
  - anonym29 7mo ago
    That's fair, reasonable minds can disagree on the numbers and even magnitude here. What I would challenge you to consider is this: where do we draw the "good enough" line, where we finally stop sacrificing freedom over the devices we purchased under terms that originally included freedom, control, and ownership at the altar of protecting the vulnerable? Do scam victims need to be 0.1% of all Android users? 0.01%? 0.0001%? Should this extend to computers too - should local admin become completely unavailable to all Windows users? Should root become unavailable to all Mac users? To all Linux users? Should you be allowed to own technology at all, or merely rent it as a managed service, to protect those who cannot be trusted to own devices without getting scammed?
    - dataflow 7mo ago
      It really feels like you're replying to a completely different comment than mine? Absolutely nothing you're responding to here is consistent with what I wrote (except your very first sentence)... > What I would challenge you to consider is this: where do we draw the "good enough" line, where we finally stop sacrificing freedom over the devices we purchased under terms that originally included freedom, control, and ownership at the altar of protecting the vulnerable? There's nothing to challenge here. The method I proposed keeps you fully in control and owning your device. Anybody can follow that process if they want. It's not like I said each person has to get approval from Google before enabling developer mode on their phone. > Do scam victims need to be 0.1% of all Android users? 0.01%? 0.0001%? This is not some kind of paradox like you're making it out to be. A very reasonable starting point would be "get this scam rate down to match {that of another less-common scam}". Iterate until/unless new data comes along suggesting otherwise. > Should this extend to computers too - should local admin become completely unavailable to all Windows users? Should root become unavailable to all Mac users? To all Linux users? "Too"?! Where did I ever suggest root should be "completely unavailable" to all Android users? > Should you be allowed to own technology at all, or merely rent it as a managed service, to protect those who cannot be trusted to own devices without getting scammed? Where did I suggest any of this?
      - anonym29 7mo ago
        I think there has been a fundamental misunderstanding. I am not accusing you of having suggested any of this - these are escalating hypotheticals about what lengths it is appropriate to go to in the name of protecting vulnerable users. When you say "Iterate until/unless new data comes along suggesting otherwise", does that mean you will want to continue adding more friction and more restrictions as long as a number or percentage of people (that exceeds some threshold) continue to get scammed? What I am asking you to do, as a thought exercise, is to define that threshold, and then to consider that if we never meet that threshold, how far are you willing to go with iterating and adding more friction, stripping user control in pursuit of it? It seems to me that you have a mental model where some small, reasonable changes will dramatically reduce the number of scam victims to near zero. All I'm asking you to do is sincerely consider what your preferred course of action looks like if you are wrong about how effective each additional layer of controls are.
  - duskdozer 7mo ago
    Are scam apps really a significant portion of scams? Is it not people calling and telling you to buy gift cards and give them codes anymore?
- Dylan16807 7mo ago
  > They're in fight or flight mode already, not critical thinking and careful deliberation mode. That actually sounds like an argument is favor of this restriction. If someone is in a position of deep trust with the scammer then waiting a day is nothing. But if they're in a panic, not thinking things through or calling anyone for advice, that state probably won't last 24 hours.

anonym29 7mo ago

Compared the current paradigm, where you already need to enable developer options, allow installation from untrusted sources, and tap through a warning screen for each apk to be installed? Maybe 10-20%, generously. The people who are falling for it under current protections clearly are not reading anything they're looking at or thinking about security at all, they've fallen for social engineering scams and sincerely believe they're at imminent risk of being arrested by the FBI or that their adult child is about to be killed. They're in fight or flight mode already, not critical thinking and careful deliberation mode. If you were to rank everyone by gullibility, these people would largely be clustered in the top 1-2% of most gullible people. There is very little you can do to protect these people, realistically.

dataflow 7mo ago
I guess I just don't believe your estimate. I think you're grossly underestimating how far we can get through these kinds of approaches.
- anonym29 7mo ago
  That's fair, reasonable minds can disagree on the numbers and even magnitude here. What I would challenge you to consider is this: where do we draw the "good enough" line, where we finally stop sacrificing freedom over the devices we purchased under terms that originally included freedom, control, and ownership at the altar of protecting the vulnerable? Do scam victims need to be 0.1% of all Android users? 0.01%? 0.0001%? Should this extend to computers too - should local admin become completely unavailable to all Windows users? Should root become unavailable to all Mac users? To all Linux users? Should you be allowed to own technology at all, or merely rent it as a managed service, to protect those who cannot be trusted to own devices without getting scammed?
  - dataflow 7mo ago
    It really feels like you're replying to a completely different comment than mine? Absolutely nothing you're responding to here is consistent with what I wrote (except your very first sentence)... > What I would challenge you to consider is this: where do we draw the "good enough" line, where we finally stop sacrificing freedom over the devices we purchased under terms that originally included freedom, control, and ownership at the altar of protecting the vulnerable? There's nothing to challenge here. The method I proposed keeps you fully in control and owning your device. Anybody can follow that process if they want. It's not like I said each person has to get approval from Google before enabling developer mode on their phone. > Do scam victims need to be 0.1% of all Android users? 0.01%? 0.0001%? This is not some kind of paradox like you're making it out to be. A very reasonable starting point would be "get this scam rate down to match {that of another less-common scam}". Iterate until/unless new data comes along suggesting otherwise. > Should this extend to computers too - should local admin become completely unavailable to all Windows users? Should root become unavailable to all Mac users? To all Linux users? "Too"?! Where did I ever suggest root should be "completely unavailable" to all Android users? > Should you be allowed to own technology at all, or merely rent it as a managed service, to protect those who cannot be trusted to own devices without getting scammed? Where did I suggest any of this?
    - anonym29 7mo ago
      I think there has been a fundamental misunderstanding. I am not accusing you of having suggested any of this - these are escalating hypotheticals about what lengths it is appropriate to go to in the name of protecting vulnerable users. When you say "Iterate until/unless new data comes along suggesting otherwise", does that mean you will want to continue adding more friction and more restrictions as long as a number or percentage of people (that exceeds some threshold) continue to get scammed? What I am asking you to do, as a thought exercise, is to define that threshold, and then to consider that if we never meet that threshold, how far are you willing to go with iterating and adding more friction, stripping user control in pursuit of it? It seems to me that you have a mental model where some small, reasonable changes will dramatically reduce the number of scam victims to near zero. All I'm asking you to do is sincerely consider what your preferred course of action looks like if you are wrong about how effective each additional layer of controls are.
- duskdozer 7mo ago
  Are scam apps really a significant portion of scams? Is it not people calling and telling you to buy gift cards and give them codes anymore?
Dylan16807 7mo ago
> They're in fight or flight mode already, not critical thinking and careful deliberation mode. That actually sounds like an argument is favor of this restriction. If someone is in a position of deep trust with the scammer then waiting a day is nothing. But if they're in a panic, not thinking things through or calling anyone for advice, that state probably won't last 24 hours.