10 ms·

Android Developer Verification

328 points by ingve 7mo ago

bstsb 7mo ago
from https://9to5google.com/2026/03/30/android-developer-verifier-app https://9to5google.com/2026/03/30/android-developer-verifier... - > Starting in April, Android Developer Verifier will be installed on devices. so they're rolling out a system app that will call home to check whether any sideloaded apps have been "verified" with the developer's government ID? and this process will happen regardless of whether the user has enabled the "advanced flow" in Developer settings?
- birdsongs 7mo ago
  Good of a reason as any to go google-less on my Graphene pixel, I guess. But man it sucks, mostly for all the people who can't. I can manage my financials and 2FA from my laptop, that was my last real reason to have google play installed, but it's just a convenience. (I know it's mandatory for others.) I wonder how that sys app will be handled in GrapheneOS's google play sandbox?
  - subscribed 7mo ago
    It'll probably always confirm it's been verified. GOS have already said users won't be impacted by this clampdown.
    - kevin_thibedeau 7mo ago
      So F-Droid will be installable without sacrificing livestock?
- fc417fc802 7mo ago
  That essay about being licensed to use a debugger was supposed to be an absurdist over-extrapolation for the sake of making a deeper point about software freedoms ... right? Seems more like they're using it as an instruction manual.
stuaxo 7mo ago
Sorry, but absolutely not. I stuck with Android for years as a dev as I once did Android apps and occasionally do tinker. This is my last Android phone and Jolla is my next phone.
- birdsongs 7mo ago
  I really want to like the concept of Jolla / a European mobile alternative but I see no reason why they're closed source SW in 2026. Open source everything, let the community help develop, and sell your hardware (and support/deals for B2B). A single for-profit company owning the full HW and SW stack? My trust in companies lately is at a lifetime low. It just leaves a bad taste in my mouth.
- amarant 7mo ago
  Ooh, are you gonna go for their Ubuntu touch alternative, or their own OS?
56745742597 7mo ago
[dead]
andrepd 7mo ago
I don't see a way out of this except government regulation. The EU has the most motivation to do it, as a huge economic bloc with a lot of motivation right now to become as independent from the US as possible. I guess I can sort of manage to keep my head above water and keep buying secondhand phones which I unlock and install a supported version of LineageOS. But it's cumbersome, it gets more difficult and more restrictive every time. And I literally have a doctorate in computers for crying out loud! Is there any hope for Granny? For a kid? For >99% of people? Of course not. This is so clearly a matter for government oversight: prevent abuse, monopolies, protect the citizen's safety, rights, welfare, etc. It's not reasonable to expect consumers to figure out if the meat they buy is tainted, just as it's not to figure out if their phone spies on them, manipulates information, or sells their data (especially when there's a duopoly). That's why we have laws and food inspectors, paid for by the public, working for the public. Same thing with digital rights.
- pzo 7mo ago
  > I don't see a way out of this except government regulation. IMHO governments are partially behind those initiatives so they are unlikely to regulate themself- reason in last few years they intensified work on Digital ID, Age Verification, Chat control, KYC, etc.
  - zrm 7mo ago
    There are different governments and different subdivisions within any given government. The only thing you need to get a government that had been pushing Chat Control to do some trust busting is to get more votes.
  - lokar 7mo ago
    For the limits on side-loading in particular, there are a few southeast asian nations (I can't recall, Vietnam? Thailand?) where almost all internet access is via Android, including banking. And social engineering fraud, where they call someone up, pretend to be the bank, and get them to side-load malware, has become a major financial, and political problem. AIUI, they have told Google to find a fix, or else.
Fordec 7mo ago
Yeah, no, going back to web native. Keep your verification and your 20%.
parrellel 7mo ago
Yeah, no. No one needs your spyware.
ethagnawl 7mo ago
What % of Android users actually want this? Do they know or care? I've been using Android since 2010 because it was open in ways that the Apple ecosystem wasn't. I do not want this and imagine hardly any other power users (for lack of a better term) do. I'm already using a mostly deGoogled device but this really seals the deal. I have been longing for a true Linux phone for years and now seems like a good time to get serious about the search and migration plan.
- motbus3 7mo ago
  But but but it is for your security! You need to be protected! Android isn't open source for a while. They started by pushing device certification which crippled any abilities of OEMs to make a better framework. Then they took many of the opensource packages out of android and redistributed as applications that they controlled via play services. Then they made it harder to publish packages and created tons of rules that they can arbitrarily decide to cut ties with you or remove your remuneration. What they are effectively doing now is to remove any ability of individual developers to push applications. Some will say the costs ain't that high, but (1) maybe not in USD dollars for Americans and (2) both Google and Apple will push those numbers way up high soon. Even if that is not the case, if you don't agree with anything and you decide to have your own version of your family wiki, messenger or anything, they will be able to tell the authorities about it. This is insane....
- JLCarveth 7mo ago
  Being able to side load apps was why I switched to android 10 years ago
  - ux266478 7mo ago
    Yeah. Computing freedom to have a root shell and do as I please is the entire reason I put up with Android. Google is positioning Android to just be nothing more than a worse iOS. There's pretty much no point to it anymore.
  - matheusmoreira 7mo ago
    Same. If Google does this, my next phone will be an iPhone. Freedom is the only reason to put up with Android's shittiness. If they turn it into a walled garden, then we'll choose the better kept garden and it sure as hell isn't Google's.
nout 7mo ago
That's seriously horrible. There are 5+ open source android apps that I use and want to continue using that are not available on Play Store, but rather through alternative stores (like Zapstore, Obtainium). If I get a phone with preinstalled Graphene OS (like the upcoming Motorola phone), then does it avoid this stupidity? Or even with Graphene it prevents me from installing apks?
- ekianjo 7mo ago
  Graphene allows APKs
- ysnp 7mo ago
  Having GrapheneOS preinstalled is an option they may discuss with Motorola. It is not the current plan. The current plan is that Motorola release their devices as normal, but some of the flagship devices in 2027 will support manual installation of GrapheneOS.
hirako2000 7mo ago
The sad thing is only a tiny minority of android users side load apps. The rest will feel their phone is one step more secure.
- stavros 7mo ago
  How is it more secure for the people who don't sideload apps?
  - fc417fc802 7mo ago
    They'll feel it's more secure. It won't actually be but they'll feel that way and vibes are important. /s
rvnx 7mo ago
Hey boss: “40M users are running a cracked version of YouTube premium on mobile, what can we do ?”
- sporp 7mo ago
  I pay for YouTube Premium and I have an alt app on my phone because the user experience is just better. You're supposed to have background play in the regular YouTube app, but videos regularly pause until you return to the yt app to reload. It all worked perfectly fine back on my iPod touch, pre-premium bs. Tech is regressing. I'm on a family plan (cheap) and I use it for the music player for the inevitable question of why I'm doing this.
- londons_explore 7mo ago
  Exactly this. And that launch country list is most likely the countries where cracked YouTube Premium is most common. App piracy is huge by copying around modded APK's, and everyone's grandma is doing it.
- UncleMeat 7mo ago
  Google could already flag these apps as malware or whatever. What developer verification does is enable Google to detect polymorphic apps.
- einpoklum 7mo ago
  NewPipe is in no way cracked: https://newpipe.net/ https://newpipe.net/
kayson 7mo ago
> our recent analysis found over 90 times more malware from sideloaded sources than on Google Play So what's the solution then? At the same time, I'm curious how this ends up happening to end users. Enabling unknown sources is trivial in a way (it's just one check box and if you try to install an APK from, say, Firefox, it'll take you right there), but how are people even getting to that point??
- lmz 7mo ago
  Phone scammers guiding users to install apps.
bossyTeacher 7mo ago
"However, our recent analysis found over 90 times more malware from sideloaded sources than on Google Play." Has anyone seen the report for that analysis. I bet most people here would love to read it too.
- Macha 7mo ago
  I mean, I’m sure “Fortnite with infinite vbucks.apk” has a much worse malware rate than the play store, but I’m almost certain that fdroid has a lower malware rate than the play store and I honestly suspect even “random apks off github” might have a similar rate to the play store
- curt15 7mo ago
  Suppose for argument this statistic were true. It still does not fully capture people's risk. P(malware) = P(nalware | Google Play) * P(Google Play) + P(malware | non-Google Play) * P(non-Google Play) It's the combination of both factors that counts. Even if Google Play has a lower malware rate, a user is still far more likely to try to install apps through Google Play given the sheer size of its catalog and its prominent, default placement on people's devices.
TGower 7mo ago
It really seems like they are doing a lot to appease the tiny minority of us power users, adb load unaffected, one time toggle in settings to opt out, no change to alternative app stores as long as the apk was built by a verified developer. Crazy how harsh the sentiment is here, there are real people being harmed by scam apps intercepting sms one time codes and this will reduce the rate of that happening. It's not like we can't sideload anymore, though a lot of comments here seem to be implying otherwise.
- brnt 7mo ago
  Those scam apps largely are installed from the Play store. Let them fix that first.
  - TGower 7mo ago
    Really, there are apps that will intercept and exfiltrate your bank one time code sms that are just sitting on the play store? First I'm hearing of this, what's the name of one?
    - xigoi 7mo ago
      Many of the most popular apps on the Play Store will monitor all activity on your device and send it to a for-profit company.
      - microtonal 7mo ago
        The pre-installed privileged services will monitory all activity on your device and send it to a for-profit company.
  - selectively 7mo ago
    Your post is an outright lie.
- kcb 7mo ago
  Because the initial announcement included none of that... it wasn't addressed at all until the harsh sentiment.
mrtksn 7mo ago
The Android verification is such a broken experience. Recently I decided to purchase a dev account for my company, so far: 1) Provided my company DUNS number etc. once to create the payment profile. I did this some times ago, don’t remember the details but it was an involved verification process and it is marked as verified business payment profile. 2) Later on the payment step verified myself with a passport and bank statement to be able to actually pay with a proper HSBC bank card. Not shady pre-paid card or something, those are not accepted anyway. 3) After I paid I was told that now I need to verify my identity once more but this time with the passport and the incorporation certificate or some other company document. fingers crossed that in few days it will be verified. While waiting, it tells me that there are still website and email verification to do once the previous step is done. I already verified my e-mail a few times before paying. It’s painful, slow and annoying because if you fail at a step(i.e. needs verification that takes days and you are told about it at the payment step) you have to start again with the forms. I just remembered why I never use Android. It seems like no one owns the process and as a result you get unpolished shitty experience that fulfills the requirements of god knows how many people who work in the same company but don’t talk to each other.
- mcsniff 7mo ago
  What you're describing is not "broken", it's the process and it appears it hasn't even failed for you. My experience with getting a verified "business" developer account from Google mirrors the experience as getting one from Apple, except it's a one-time fee and much less than Apple. Yes there are hoops to jump through, identification usually requires some hoops, but pretty it's straightforward. I am not commenting on the requirements of these hoops, yes, it's BS that they exist but it's their platform so it's their rules. What type of "experience" are you expecting to have anyway?
  - mrtksn 7mo ago
    With Apple I filled the forms, accepted the agreements, entered the DUNS and paid with a card on my name and that was it. How does that mirror uploading my passport many times, entering company details many times, typing my e-mail and phone numbers many times both because I had to start over and because I was asked many times even if I provided these some steps back? Now I paid and waiting, hopefully I will later be verifying my e-mail address or something that I verified a few times prior. > What type of "experience" are you expecting to have anyway? The Apple experience. An experience that is well thought and streamlined, that doesn’t keep me entering the same information over and over again. I don’t mind paying a little more for well designed products. The $75 difference is nothing to justify this charade, I don’t think that that Google was short of $75 and designed this low quality experience, I think it’s engraver in their DNA.
deleted 7mo ago
[deleted]
hnburnsy 7mo ago
What Android versions is this applicable to?
- hnburnsy 7mo ago
  Found the answer... >What Android versions will the developer verification requirements be enforced on? It will apply to all certified Android devices running Android 7 or higher. These updates are delivered through Google Play services to help maintain consistent security across the ecosystem. Last updated: March 23, 2026
  - ncr100 7mo ago
    So, Google TVs too?
throwaway85825 7mo ago
A 'safe' app store would promote and prioritize open source apps compiled on public auditable runners.
- pxc 7mo ago
  F-Droid is in fact what an app store concerned about user safety looks like. Nobody gets hoodwinked into installing apps that track them or sell their data or otherwise abuse them on F-Droid.
  - throwaway85825 7mo ago
    It is yes. Their build system is somewhat arcane and difficult so some apps dont get updated from the git repo though. It could use some polish.
  - selectively 7mo ago
    This is non-technical. F-Droid is horrible. https://privsec.dev/posts/android/f-droid-security-issues/#5-general-lack-of-good-practices https://privsec.dev/posts/android/f-droid-security-issues/#5... F-Droid has not meaningfully improved since that piece was written, either. No one should use F-Droid.
    - rpdillon 7mo ago
      That article's premise is that the Android security model is something that I want. It really isn't. The F-Droid model of having multiple repositories in one app is absolutely perfect because it gives me control (rather than the operating system) over what repositories I decide to add. There is no scenario in which I wish Android to question me on whether I want to install an app from a particular F-Droid repository.
    - deleted 7mo ago
      [deleted]
    - yjftsjthsd-h 7mo ago
      Can you describe the threat model / specific attack under which... any of the supposed flaws on that page matter? (Most of the particular section you've linked appears to be about extra defenses that could be added, but which are unlikely to make a difference in the face of Android's TOFU signature verification on installed APKs.)
0xbadcafebee 7mo ago
tl;dr how to install an app from unverified developer ("advanced flow") 1. enable developer mode 2. confirm you aren't being coached 3. restart your phone and reauthenticate 4. come back after 24 hours and unlock device 5. install app from unverified developer, option of enabling for 7 days or indefinitely This is apparently a one-time process. Advanced flow for users launches globally August 2026. Verification requirement kicks in September 2026. Personally I am hopeful that people work toward a completely new, non-Android OS. 15 GB of space on my phone, and 1.5 GB of RAM, is dedicated to Android OS alone. This design, and the control this company (and the mobile providers, and device manufacturers) have over the mobile world, is ridiculous. Let's start over.
- robotnikman 7mo ago
  >15 GB of space on my phone, and 1.5 GB of RAM, is dedicated to Android OS alone The original Droid phone I used had only 256mb of memory, and could still multitask and run multiple apps at once with that limited memory. Its crazy how bloated things have become over the years.
- 0x1ceb00da 7mo ago
  Nah. This sucks. My banking app refuses to open if devtools are enabled. 24h window means I can't do dev work on my personal phone.
  - jlokier 7mo ago
    I have that problem too, and it's a banking app I use nearly every day. Needing to turn Developer mode off and on every time I open the app is really annoying. It was extra annoying when I needed to log all my phone's Bluetooth HCI protocol activity for a day for product development. I wouldn't be able to take that measurement using a separate dev-specific phone, because it wouldn't contain realistic usage.
- fsflover 7mo ago
  > I am hopeful that people work toward a completely new, non-Android OS Mobian, PureOS, postmarketOS already exist. Sent from my Librem 5.
__fst__ 7mo ago
Let everyone who wants it be safe using the Google App Store. But please let me do stupid/experimental things with my phone.
- sylos 7mo ago
  The google app store isn't even that safe. This is all just stupid
krick 7mo ago
So, anyway, how do we make sure that our phones don't turn into a pumpkin on a set date? I suppose it's all shit long term, but at the very least I don't want to be forced to look for a solution before I need a new phone. So, what do you do? Can you just disable android updates somehow and it will solve the issue? Or it is already a ticking bomb that will be activated on the set date no matter what?
- userbinator 7mo ago
  Root and kill everything that could be used to remotely install software without your consent.
thomasgeelens 7mo ago
oh so I'm not the only one, always believed Apple was the hard ass but I've been having a better experience with them.
glenstein 7mo ago
Don't love it but (1) it's addressing a serious problem and I'm not sure what the alternative is and (2) if you all remember the starting place, it was staggeringly, dramatically worse, practically a death sentence for F-Droid and seemingly testing the waters for if they could simply power through and do it despite objection. This is a major course correction that doesn't kill F-Droid. A one time 24 hour hoop to jump through and then never again is monumentally better than losing F-Droid forever.
- userbinator 7mo ago
  It's only a "serious problem" because they want you to think it is.
- snackbroken 7mo ago
  "Meet me in the middle" says the unjust man. You take a step forward. He takes a step back. "Meet me in the middle" says the unjust man.
- supern0va 7mo ago
  Is it a serious problem that you can run whatever software you want on your computer? Should we make it so that no one can do that without permission to protect them? I recommend Cory Doctorow's talk on why this is a serious problem for society: https://en.wikisource.org/wiki/The_Coming_War_on_General_Computation https://en.wikisource.org/wiki/The_Coming_War_on_General_Com... https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg
  - renewiltord 7mo ago
    Yes, lots of vulnerable users get harmed by modern tech. E.g. people have lost their minds using AI, their livelihoods using smartphones, their life savings using the Internet. In general, I prefer a solution where any mental health issue (age-related infirmity, ADHD, etc.) result in protection from modern exploitative tech like this. Every application use for such people should be supervised by a government official trained to ensure you are not hurting yourself. This way people who want to use AI, smartphones, or the Internet can do so if they’re healthy and the mentally disabled can be protected. We know that this need exists because even on this “Hacker” News forum everyone gets very upset when a mentally disabled person gets injured after AI use.
userbinator 7mo ago
Older Androids which are fully rootable and unbrickable are cheap (maybe even monetarily free) and will let you continue to have freedom despite what Google wants. "Those who give up freedom for security deserve neither."
- stavros 7mo ago
  Older Androids won't exist for long.
  - userbinator 7mo ago
    That's what Google wants, but they're not getting their way with mine.
    - fsflover 7mo ago
      How about security updates?
  - greentea23 7mo ago
    My pixel 1 is still going strong. Several phones released just last year are bootloader unlockable and rootable, and those should last at least a decade if cared for.
    - stavros 7mo ago
      You can always get some form of phone that will be rootable, but more and more of the ecosystem will depend on Play Integrity, and thus there will be more and more things you can't do with them.
m132 7mo ago
Is there any information about how the "advanced flow" will be implemented? According to keepandroidopen.org, this is going to be handled by Google Play Services. Does it mean it will be automatically installed via the silent, always-on GMS update mechanism and I should root my devices and remove GMS altogether if I don't want this?
ecshafer 7mo ago
> Android is for everyone. It’s built on a commitment to an open and safe platform. Users should feel confident installing apps, no matter where they get them from. This intro immediately tells me that whatever comes after will be horrible for users and developers. Surprise surprise, I was right. Software to "verify" side loaded apps is a bad, anti user idea.
- postsantum 7mo ago
  It's like a slimy HR telling you to come over for a chat. You immediately know it's not a chat
- Vinnl 7mo ago
  Whenever I find that I need to install something from the Play Store rather than from F-Droid, it fills me with dread, because I'm not confident about what those apps do behind the scenes.
- varispeed 7mo ago
  I am waiting for Google to require bodily fluid sample to verify identity.
- einpoklum 7mo ago
  "side loaded apps" is merely a pejorative Google and Apple use for "apps". What they call "apps" are "apps that we like and we distribute to you under our control of both yourself as a registered user and the developers". Well, I guess I'll need to install a non-Android distribution then. I hope one would be available for my phone by the end of the year :-(
shit_game 7mo ago
At this point, I think I would prefer to carry a dumb flip phone for SMS and phone calls, and a smartphone-shaped generic touchscreen linux computer for everything else. It's becoming disturbingly impossible to find the former, and practically impossible (IME) to find the former. Does anyone here have experience using Ubuntu Touch? That's the closest thing I've seen to "generic touchscreen linux" for mobile phone hardware. I'd love a device that works for multimedia, navigation, web browsing, and a handful of APKs like various chat apps (and really anything can can arbitrarily use the hardware), but it seems like tying a cellular modem to this ends up fucking up the whole dream because of carrier and manufacturer motivations/compensations.
marcprux 7mo ago
I am part of the team running keepandroidopen.org and corralling the signatures for the open letter opposing this program. We've been trying to get Google to reverse course on this program ever since it was announced. As it stands, Android Developer Verification (ADV) is a death sentence for F-Droid, Obtainium, and other competitors to the Google Play Store, both commercial and non-commercial. We are disappointed that they are still trying to steamroll this through in the face of overwhelming public opposition. There are numerous reasons to object to the program, but a few of the top ones are: 1. You own your computer, and you should be the sole decision-maker for what software you can install on it. 2. "Malware" means whatever Google says it means, and their terms and conditions change daily; today malware is banking scams, tomorrow it is … ad-blocking? VPNs? Their decisions are un-reviewable and opaque, and they have obvious commercial incentives to block certain kinds of (otherwise-legal) software. 3. Centralizing global developer registrations through a US corporation makes it subject to the rules (and whims) of the current regime. Citizens of sanctioned countries or members of sanctioned entities (like the International Criminal Court) will be legally barred from registering, blocking them from creating and distributing software _anywhere_ in the world (not just the US). 4. Scenarios that Google claims ADV will protect against — such as high-pressure phone calls manipulating vulnerable users into installing scam apps — have _already_ been addressed by incremental improvements to Android security over the years, such as "Enhanced Fraud Protection" introduced in Android 13 (and expanded in Android 15). Android has incrementally improved its security features over its near 20 years of existence. There is no evidence that anything has suddenly changed to justify such a disproportionate and extreme lockdown. 5. Being required to pay Google for the privilege of uploading your government identification so that you might be permitted to contribute to the Android software ecosystem is such an abominable insult to the developers that helped build the platform. It deserves all the utter contempt that has been heaped upon it thus far, and begs regulatory scrutiny from those few countries that still have the courage to stand up to these bullies. We emphatically recommend against developers signing up for this program or endorsing it in any way.
- fsflover 7mo ago
  > I am part of the team running keepandroidopen.org Perhaps your team should promote GNU/Linux phones instead, which do not depend on a megacorp. Sent from my Librem 5.
wisenet 7mo ago
Should we protest by graying out app icons and assets. https://news.ycombinator.com/item?id=47354917 https://news.ycombinator.com/item?id=47354917
creatonez 7mo ago
> However, our recent analysis found over 90 times more malware from sideloaded sources than on Google Play Google has seemingly never seen an elderly person's phone, where it is completely infected with crap including literal popup ads (that somehow overlay other apps), yet all of it was downloaded from GPlay.
- 1970-01-01 7mo ago
  100.00% this take. Google is redefining "malware" to fit their corporate narrative so ads-with-ads-with-tracking is labeled as fine wine. It simply cannot be malware because that truth would decimate their shareholders. Malware by any other definition remains software that disrupts the user's ability to operate the device: https://en.wikipedia.org/wiki/Malware https://en.wikipedia.org/wiki/Malware https://www.ibm.com/think/topics/malware https://www.ibm.com/think/topics/malware https://www.cloudflare.com/learning/ddos/glossary/malware/ https://www.cloudflare.com/learning/ddos/glossary/malware/ https://www.cisco.com/site/us/en/products/security/what-is-malware.html https://www.cisco.com/site/us/en/products/security/what-is-m... https://www.britannica.com/technology/malware https://www.britannica.com/technology/malware https://www.fortinet.com/resources/cyberglossary/malware https://www.fortinet.com/resources/cyberglossary/malware https://www.kaspersky.com/resource-center/threats/what-is-malware https://www.kaspersky.com/resource-center/threats/what-is-ma... https://www.mcafee.com/learn/malware/ https://www.mcafee.com/learn/malware/ https://www.trendmicro.com/en_us/what-is/malware.html https://www.trendmicro.com/en_us/what-is/malware.html https://www.t-mobile.com/home-internet/the-signal/internet-help/what-is-malware/ https://www.t-mobile.com/home-internet/the-signal/internet-h... https://www.merriam-webster.com/dictionary/malware https://www.merriam-webster.com/dictionary/malware
  - VHRanger 7mo ago
    Remember when we had the term "spyware" for a class of malware? I remember
- CobrastanJorji 7mo ago
  Both things might be true. Sideloaded apps are probably way more likely to be malicious, but also most installed malware/crapware is quite likely coming from Google Play.
jaimex2 7mo ago
The only malware I've had to clean off peoples devices has come from the Google Play Store.
jaimex2 7mo ago
It's kinda funny. I used to run custom roms all Android phones came with a shit OS. I stopped because Pixel AOSP phones were actually decent. Now I guess i'll be buying phones based on which I can flash with custom roms again.
- fensgrim 7mo ago
  good luck finding a phone with custom ROM support, when there will be no phones with bootloader unlock available :(
donatj 7mo ago
I would genuinely like to know more about these supposed users who are side loading things and getting hoodwinked. It seems high enough friction that you have to have something of an idea of what you're doing to begin with. Everyone I've known who is side loaded anything has been reasonably technical. My dad on the other hand, who worked for Control Data in the 1980s regularly installs some of the scummiest apps imaginable, and they're all from the Play Store proper. Launchers that don't actually launch things and serve ads. Apps that launch full screen ads while you're doing things saying your device is infected. Absolute trash. Like maybe just maybe put some energy into going after the stuff in the Play Store first. As the Play Store exists now, it is unsafe.
- bsimpson 7mo ago
  Have you seen those YouTube videos of people punking scammers? Scammers will convince people to drive to Target, buy gift cards, and read the credentials out over the phone. Those same people can surely talk you through tapping out a dialog flow. That's presumably why there's a lockout period - it keeps a scammer from reasonably holding the line until they can pressure you to finish it.
  - yjftsjthsd-h 7mo ago
    > Have you seen those YouTube videos of people punking scammers? Scammers will convince people to drive to Target, buy gift cards, and read the credentials out over the phone. Those same people can surely talk you through tapping out a dialog flow. ...if the scammer can get the victim to physically drive to Target a buy a bunch of gift cards, what makes you think they need to install anything on your phone? Having RCE on a human is more useful than RCE on a device.
    - TeMPOraL 7mo ago
      Having RCE on a human is like having RCE on a SOTA LLM webservice - tricky to get, and you'll probably lose it if the other side reloads.
    - jeroenhd 7mo ago
geokon 7mo ago
Does anyone know how this will work vis a vis China, where Android is everywhere, but Google is not? Will bypassing this bureaucracy be just a matter of buying a Chinese Android phone?
- RandyOrion 7mo ago
  Please no. If you want to install APKs directly on Android phones selling in China, you'll face even more draconian restrictions imposed by both Chinese OEMs and Chinese government, e.g., cannot install telegram [1], cannot install VPNs [2], called by local police station after installing VPNs [3], and so on. And you do not have the freedom to even talk about these restrictions freely without getting sued or censored. [1] https://xcancel.com/whyyoutouzhele/status/1689152388412616704 https://xcancel.com/whyyoutouzhele/status/168915238841261670... [2] https://xcancel.com/whyyoutouzhele/status/1978430665562689716 https://xcancel.com/whyyoutouzhele/status/197843066556268971... [3] https://xcancel.com/whyyoutouzhele/status/1702992057596276760 https://xcancel.com/whyyoutouzhele/status/170299205759627676...
ori_b 7mo ago
If they're taking on verification, are they also taking on liability? Do we get to sue them if grandma gets scammed through an app they allow onto their phone?
- eviks 7mo ago
  Nice try, but no, shit only flows down.
- RandyOrion 7mo ago
  Yeah, let's hold Google accountable. Is there a way to practice anti-trust laws?
myko 7mo ago
Google freaked out that Apple had a better reputation and went all in on fucking their Android store up. Everything about it is worse now than it was before. So tiring.
bitwize 7mo ago
I'd say Hackernews knows enough people at Google to raise a stink about this, but it's not going to do any good. Sometime at the last WEF or Bilderberg meeting it was decided that KYC level identity verification should be required to use a computer or the internet, with more stringent requirements to program one. This, and much worse, is going to happen whether we like it or not.
DeathArrow 7mo ago
If I do software for Windows, Linux or FreeBSD I don't need verification. And potential users aren't required to get software only from a certain app store. This is a case of companies forcing things on us "for our own good" and them knowing better than us what is good for us or not.
- mhitza 7mo ago
  It's a pathetic excuse of a reason. Google Ads is a mechanism for scam delivery, probably 90 times more effective than sideloaded scam apps.
BatteryMountain 7mo ago
Good job google. You just convinced our entire business to abandon our app (utilities company) and only target web. We are done with this shit. All our resources the next two weeks will be to fill in the gaps in our web clientzone so our thousands of customers can still buy electricity and pay water bill and have a similar experience than the app (it's 90% the same anyway). Oh and my three personal apps that I installed via adb (not released on playstore) - the moment they stop working on my phone or hassle me about verification, I will get in my car and go buy an iPhone. Next will be to degoogle the rest of my life, which is luckily only gmail. Guess how long it will take me to port out? Less than two days. I only let companies violate me once. Then I'm out. Play store is the biggest piece of trash malware system that exists today, but us normal businesses have to pull teeth and spend days jumping through hoops to get an app out, but the playstore is filled with infinite garbage that rot childrens brains. Wake up.
arcmutex 7mo ago
Great. This will make web apps popular again. Let's take back the web. HTML, JavaScript, CSS!
xihe-forge 7mo ago
[dead]
sgt 7mo ago
> It’s only when a user tries to install an unregistered app that they’ll require ADB or advanced flow, helping us keep the broader community safe while preserving the flexibility for our power users. So, we have a sideloaded app now. Which has been increasingly tricky for our users to install. The warning they get is hard to understand. Does this mean essentially the end of sideloading?
- takluyver 7mo ago
  If you get 'verified' by Google and sign your app, sideloading shouldn't change. That means money and ID checks, or a free 'hobbyist' carve out if you have <20 users. If you don't want to play their game, sideloading will get substantially harder.
Andebugulin 7mo ago
My experience was worse than just frustrating verification - it cost me money twice. I submitted my government-issued ID and bank statements multiple times. Each time rejected, no specific explanation why. After several rounds I gave up, assuming my developer account would at least stay dormant until I felt like trying again. It didn't. Google deleted the account entirely. No warning, no refund of the €25 registration fee or whatever it costed. When I eventually wanted to publish again, I had to create a new account and pay again. The second time around they accepted my driving license - the same type of document category they had rejected before. So the real cost of a bad verification experience isn't just time. If you give up and walk away, you lose your fee and start from zero. That's the part that stung, at least for me.
Steve16384 7mo ago
Even once you've managed to verify, Google love throwing more challenges at you if you want to keep your apps in the store. "You need to declare your blood type or we will remove your apps in 30 days". I removed my apps myself as it was turning from a hobby to an unpaid job just to keep the apps in the store.
fredgrott 7mo ago
Sounds like age verification exp in EU.... Maybe not expose potential internet users to such as high obstacle if your goal is to get their eyeballs to buy your advertised product???
tsoukase 7mo ago
In the last few years all apps I install in a phone come outside of Play Store, because either they are full of ads, throttle their usage or simply similar ones don't exist. Without them the phone loses half of it's functionality, which is pretty much. So, I am willing to wait a day in the "advanced flow" to keep a multi-year experience.
wg0 7mo ago
I'll probably ship PWAs but hope those are not killed by Google.
ChoGGi 7mo ago
> our recent analysis found over 90 times more malware from sideloaded sources than on Google Play. So, what I'm being told is; there's lots of malware on Google Play? Thank goodness for f droid (for now).
paprikanotfound 7mo ago
Does anyone know if Chinese developers will be forced into paying for a Google Dev account too?
einpoklum 7mo ago
> Android is for everyone. It’s built on a commitment to a... safe platform. These two statements contradict. When something is public, it is not entirely safe; and to make something safe, there is exclusion of practices, behaviors, and often people. > So as an extra layer of security, we are rolling out Android developer verification to help prevent malicious actors from hiding behind anonymity to repeatedly spread harm. 1. Well, then, surely Google can't be in charge of this process, because they are a malicious actor, known to manipulate social media search results and engage in mass surveillance of its users. And that's in addition to analyzing their personal data to try to manipulate them into buying things; which is called "targeted advertizing", but I would also characterize as harm. 2. To be slightly less tongue-in-cheek: Imagine that a two would prevent entry of unverified people - you know, to prevent malicious anonymous actors from bringing harm. That would be ridiculous - nobody should be able to restrict public space. Well, the space of computation and communications via our handheld phones/computers is enough of a public space to merit the same principle. Which means that it is not acceptable for it to be under Google/Alphabet's control. Government regulation could mitigate this problem, but then, governments collude with large corporations and often approve of such restrictions.
benrutter 7mo ago
The latest shift to lock down Google's android pushed me recently to install /e/OS. On paper it makes those kind of projects a lot harder, but its prompted me to be a bit more considered about what software projects I want to use/support. Really glad I have done that - I've been a 'boiled frog' of sorts on Android for a while now. Not happy with being continually more and more locked down, but not quite unhappy enough to shift. Feels like a breath of fresh air to have software that's built to serve me, rather than just to serve me ads.
trashb 7mo ago
Maybe it's just me but what happened to "don't send your government id to anyone". I am from the EU but this is what was indoctrinated to me. Just seems very strange to all off a sudden send all this information to any company you require a service from. Also the person is not the company, why is Google making the developer identify oneself while many apps are released under a company? My understanding is that Google has been mishandling this for a while but with the verification linked to a government id that just seems like another can of worms. A few scenarios to consider: - The developer is fired/resigns and the company does not want to be associated with the developer, for example if the developer is convicted for something. - The developer is fired/resigns and the developer does not want to be associated with the company, developer found out about certain practices of the company they don't condone. - The developer and the company part in good faith, however one of them is being exploited/pressured by a third party to abuse the relationship to the app. - The developer or the company is on legal hold due to legal issues, arrests, malpractice etc. - The developer passes away or the company ceases to exist. - How does this work if you are making an app as a developer for hire, when entering into a contract with a publisher for example. Who will verify and how will that work (especially on small scale apps).
solaire_oa 7mo ago
> However, our recent analysis found over 90 times more malware from sideloaded sources than on Google Play https://android-developers.googleblog.com/2025/08/elevating-android-security.html https://android-developers.googleblog.com/2025/08/elevating-... > The scale of this threat is significant: our recent analysis found over 50 times more malware from internet-sideloaded sources than on apps available through Google Play Bald face lies are getting baldier.
greatgib 7mo ago
This world is really dystopic. It amazes me that now anything restricting your rights and liberty can pass so easily. For students and hobbyists: To keep Android accessible to everyone, we're building a free, no government ID required, limited distribution account so you can share your work with up to 20 devices. You only need an email account to get started. Sign up for early access. We’ll send invites in June. Just imagine if in the computer world, Bigtech monopoly had managed to force everyone to submit is ID document to an american private gatekeeper to be able to distribute applications... But now it almost look normal most of us. Especially in countries like Thailand or Brazil were it is implemented now, just imagine that if Trump decide to go crazy any day, suddenly you would not be allowed to create or have user install your apps normally, just like that...

328 points by ingve 7mo ago

bstsb 7mo ago

from https://9to5google.com/2026/03/30/android-developer-verifier-app https://9to5google.com/2026/03/30/android-developer-verifier... - > Starting in April, Android Developer Verifier will be installed on devices. so they're rolling out a system app that will call home to check whether any sideloaded apps have been "verified" with the developer's government ID? and this process will happen regardless of whether the user has enabled the "advanced flow" in Developer settings?

birdsongs 7mo ago
Good of a reason as any to go google-less on my Graphene pixel, I guess. But man it sucks, mostly for all the people who can't. I can manage my financials and 2FA from my laptop, that was my last real reason to have google play installed, but it's just a convenience. (I know it's mandatory for others.) I wonder how that sys app will be handled in GrapheneOS's google play sandbox?
- subscribed 7mo ago
  It'll probably always confirm it's been verified. GOS have already said users won't be impacted by this clampdown.
  - kevin_thibedeau 7mo ago
    So F-Droid will be installable without sacrificing livestock?
fc417fc802 7mo ago
That essay about being licensed to use a debugger was supposed to be an absurdist over-extrapolation for the sake of making a deeper point about software freedoms ... right? Seems more like they're using it as an instruction manual.

stuaxo 7mo ago

Sorry, but absolutely not. I stuck with Android for years as a dev as I once did Android apps and occasionally do tinker. This is my last Android phone and Jolla is my next phone.

birdsongs 7mo ago
I really want to like the concept of Jolla / a European mobile alternative but I see no reason why they're closed source SW in 2026. Open source everything, let the community help develop, and sell your hardware (and support/deals for B2B). A single for-profit company owning the full HW and SW stack? My trust in companies lately is at a lifetime low. It just leaves a bad taste in my mouth.
amarant 7mo ago
Ooh, are you gonna go for their Ubuntu touch alternative, or their own OS?

56745742597 7mo ago

[dead]

andrepd 7mo ago

I don't see a way out of this except government regulation. The EU has the most motivation to do it, as a huge economic bloc with a lot of motivation right now to become as independent from the US as possible. I guess I can sort of manage to keep my head above water and keep buying secondhand phones which I unlock and install a supported version of LineageOS. But it's cumbersome, it gets more difficult and more restrictive every time. And I literally have a doctorate in computers for crying out loud! Is there any hope for Granny? For a kid? For >99% of people? Of course not. This is so clearly a matter for government oversight: prevent abuse, monopolies, protect the citizen's safety, rights, welfare, etc. It's not reasonable to expect consumers to figure out if the meat they buy is tainted, just as it's not to figure out if their phone spies on them, manipulates information, or sells their data (especially when there's a duopoly). That's why we have laws and food inspectors, paid for by the public, working for the public. Same thing with digital rights.

pzo 7mo ago
> I don't see a way out of this except government regulation. IMHO governments are partially behind those initiatives so they are unlikely to regulate themself- reason in last few years they intensified work on Digital ID, Age Verification, Chat control, KYC, etc.
- zrm 7mo ago
  There are different governments and different subdivisions within any given government. The only thing you need to get a government that had been pushing Chat Control to do some trust busting is to get more votes.
- lokar 7mo ago
  For the limits on side-loading in particular, there are a few southeast asian nations (I can't recall, Vietnam? Thailand?) where almost all internet access is via Android, including banking. And social engineering fraud, where they call someone up, pretend to be the bank, and get them to side-load malware, has become a major financial, and political problem. AIUI, they have told Google to find a fix, or else.

Fordec 7mo ago

Yeah, no, going back to web native. Keep your verification and your 20%.

parrellel 7mo ago

Yeah, no. No one needs your spyware.

ethagnawl 7mo ago

What % of Android users actually want this? Do they know or care? I've been using Android since 2010 because it was open in ways that the Apple ecosystem wasn't. I do not want this and imagine hardly any other power users (for lack of a better term) do. I'm already using a mostly deGoogled device but this really seals the deal. I have been longing for a true Linux phone for years and now seems like a good time to get serious about the search and migration plan.

motbus3 7mo ago
But but but it is for your security! You need to be protected! Android isn't open source for a while. They started by pushing device certification which crippled any abilities of OEMs to make a better framework. Then they took many of the opensource packages out of android and redistributed as applications that they controlled via play services. Then they made it harder to publish packages and created tons of rules that they can arbitrarily decide to cut ties with you or remove your remuneration. What they are effectively doing now is to remove any ability of individual developers to push applications. Some will say the costs ain't that high, but (1) maybe not in USD dollars for Americans and (2) both Google and Apple will push those numbers way up high soon. Even if that is not the case, if you don't agree with anything and you decide to have your own version of your family wiki, messenger or anything, they will be able to tell the authorities about it. This is insane....
JLCarveth 7mo ago
Being able to side load apps was why I switched to android 10 years ago
- ux266478 7mo ago
  Yeah. Computing freedom to have a root shell and do as I please is the entire reason I put up with Android. Google is positioning Android to just be nothing more than a worse iOS. There's pretty much no point to it anymore.
- matheusmoreira 7mo ago
  Same. If Google does this, my next phone will be an iPhone. Freedom is the only reason to put up with Android's shittiness. If they turn it into a walled garden, then we'll choose the better kept garden and it sure as hell isn't Google's.

nout 7mo ago

That's seriously horrible. There are 5+ open source android apps that I use and want to continue using that are not available on Play Store, but rather through alternative stores (like Zapstore, Obtainium). If I get a phone with preinstalled Graphene OS (like the upcoming Motorola phone), then does it avoid this stupidity? Or even with Graphene it prevents me from installing apks?

ekianjo 7mo ago
Graphene allows APKs
ysnp 7mo ago
Having GrapheneOS preinstalled is an option they may discuss with Motorola. It is not the current plan. The current plan is that Motorola release their devices as normal, but some of the flagship devices in 2027 will support manual installation of GrapheneOS.

hirako2000 7mo ago

The sad thing is only a tiny minority of android users side load apps. The rest will feel their phone is one step more secure.

stavros 7mo ago
How is it more secure for the people who don't sideload apps?
- fc417fc802 7mo ago
  They'll feel it's more secure. It won't actually be but they'll feel that way and vibes are important. /s

rvnx 7mo ago

Hey boss: “40M users are running a cracked version of YouTube premium on mobile, what can we do ?”

sporp 7mo ago
I pay for YouTube Premium and I have an alt app on my phone because the user experience is just better. You're supposed to have background play in the regular YouTube app, but videos regularly pause until you return to the yt app to reload. It all worked perfectly fine back on my iPod touch, pre-premium bs. Tech is regressing. I'm on a family plan (cheap) and I use it for the music player for the inevitable question of why I'm doing this.
londons_explore 7mo ago
Exactly this. And that launch country list is most likely the countries where cracked YouTube Premium is most common. App piracy is huge by copying around modded APK's, and everyone's grandma is doing it.
UncleMeat 7mo ago
Google could already flag these apps as malware or whatever. What developer verification does is enable Google to detect polymorphic apps.
einpoklum 7mo ago
NewPipe is in no way cracked: https://newpipe.net/ https://newpipe.net/

kayson 7mo ago

> our recent analysis found over 90 times more malware from sideloaded sources than on Google Play So what's the solution then? At the same time, I'm curious how this ends up happening to end users. Enabling unknown sources is trivial in a way (it's just one check box and if you try to install an APK from, say, Firefox, it'll take you right there), but how are people even getting to that point??

lmz 7mo ago
Phone scammers guiding users to install apps.

bossyTeacher 7mo ago

"However, our recent analysis found over 90 times more malware from sideloaded sources than on Google Play." Has anyone seen the report for that analysis. I bet most people here would love to read it too.

Macha 7mo ago
I mean, I’m sure “Fortnite with infinite vbucks.apk” has a much worse malware rate than the play store, but I’m almost certain that fdroid has a lower malware rate than the play store and I honestly suspect even “random apks off github” might have a similar rate to the play store
curt15 7mo ago
Suppose for argument this statistic were true. It still does not fully capture people's risk. P(malware) = P(nalware | Google Play) * P(Google Play) + P(malware | non-Google Play) * P(non-Google Play) It's the combination of both factors that counts. Even if Google Play has a lower malware rate, a user is still far more likely to try to install apps through Google Play given the sheer size of its catalog and its prominent, default placement on people's devices.

TGower 7mo ago

It really seems like they are doing a lot to appease the tiny minority of us power users, adb load unaffected, one time toggle in settings to opt out, no change to alternative app stores as long as the apk was built by a verified developer. Crazy how harsh the sentiment is here, there are real people being harmed by scam apps intercepting sms one time codes and this will reduce the rate of that happening. It's not like we can't sideload anymore, though a lot of comments here seem to be implying otherwise.

brnt 7mo ago
Those scam apps largely are installed from the Play store. Let them fix that first.
- TGower 7mo ago
  Really, there are apps that will intercept and exfiltrate your bank one time code sms that are just sitting on the play store? First I'm hearing of this, what's the name of one?
  - xigoi 7mo ago
    Many of the most popular apps on the Play Store will monitor all activity on your device and send it to a for-profit company.
    - microtonal 7mo ago
      The pre-installed privileged services will monitory all activity on your device and send it to a for-profit company.
- selectively 7mo ago
  Your post is an outright lie.
kcb 7mo ago
Because the initial announcement included none of that... it wasn't addressed at all until the harsh sentiment.

mrtksn 7mo ago

The Android verification is such a broken experience. Recently I decided to purchase a dev account for my company, so far: 1) Provided my company DUNS number etc. once to create the payment profile. I did this some times ago, don’t remember the details but it was an involved verification process and it is marked as verified business payment profile. 2) Later on the payment step verified myself with a passport and bank statement to be able to actually pay with a proper HSBC bank card. Not shady pre-paid card or something, those are not accepted anyway. 3) After I paid I was told that now I need to verify my identity once more but this time with the passport and the incorporation certificate or some other company document. fingers crossed that in few days it will be verified. While waiting, it tells me that there are still website and email verification to do once the previous step is done. I already verified my e-mail a few times before paying. It’s painful, slow and annoying because if you fail at a step(i.e. needs verification that takes days and you are told about it at the payment step) you have to start again with the forms. I just remembered why I never use Android. It seems like no one owns the process and as a result you get unpolished shitty experience that fulfills the requirements of god knows how many people who work in the same company but don’t talk to each other.

mcsniff 7mo ago
What you're describing is not "broken", it's the process and it appears it hasn't even failed for you. My experience with getting a verified "business" developer account from Google mirrors the experience as getting one from Apple, except it's a one-time fee and much less than Apple. Yes there are hoops to jump through, identification usually requires some hoops, but pretty it's straightforward. I am not commenting on the requirements of these hoops, yes, it's BS that they exist but it's their platform so it's their rules. What type of "experience" are you expecting to have anyway?
- mrtksn 7mo ago
  With Apple I filled the forms, accepted the agreements, entered the DUNS and paid with a card on my name and that was it. How does that mirror uploading my passport many times, entering company details many times, typing my e-mail and phone numbers many times both because I had to start over and because I was asked many times even if I provided these some steps back? Now I paid and waiting, hopefully I will later be verifying my e-mail address or something that I verified a few times prior. > What type of "experience" are you expecting to have anyway? The Apple experience. An experience that is well thought and streamlined, that doesn’t keep me entering the same information over and over again. I don’t mind paying a little more for well designed products. The $75 difference is nothing to justify this charade, I don’t think that that Google was short of $75 and designed this low quality experience, I think it’s engraver in their DNA.

deleted 7mo ago

[deleted]

hnburnsy 7mo ago

What Android versions is this applicable to?

hnburnsy 7mo ago
Found the answer... >What Android versions will the developer verification requirements be enforced on? It will apply to all certified Android devices running Android 7 or higher. These updates are delivered through Google Play services to help maintain consistent security across the ecosystem. Last updated: March 23, 2026
- ncr100 7mo ago
  So, Google TVs too?

throwaway85825 7mo ago

A 'safe' app store would promote and prioritize open source apps compiled on public auditable runners.

pxc 7mo ago
F-Droid is in fact what an app store concerned about user safety looks like. Nobody gets hoodwinked into installing apps that track them or sell their data or otherwise abuse them on F-Droid.
- throwaway85825 7mo ago
  It is yes. Their build system is somewhat arcane and difficult so some apps dont get updated from the git repo though. It could use some polish.
- selectively 7mo ago
  This is non-technical. F-Droid is horrible. https://privsec.dev/posts/android/f-droid-security-issues/#5-general-lack-of-good-practices https://privsec.dev/posts/android/f-droid-security-issues/#5... F-Droid has not meaningfully improved since that piece was written, either. No one should use F-Droid.
  - rpdillon 7mo ago
    That article's premise is that the Android security model is something that I want. It really isn't. The F-Droid model of having multiple repositories in one app is absolutely perfect because it gives me control (rather than the operating system) over what repositories I decide to add. There is no scenario in which I wish Android to question me on whether I want to install an app from a particular F-Droid repository.
  - deleted 7mo ago
    [deleted]
  - yjftsjthsd-h 7mo ago
    Can you describe the threat model / specific attack under which... any of the supposed flaws on that page matter? (Most of the particular section you've linked appears to be about extra defenses that could be added, but which are unlikely to make a difference in the face of Android's TOFU signature verification on installed APKs.)

0xbadcafebee 7mo ago

tl;dr how to install an app from unverified developer ("advanced flow") 1. enable developer mode 2. confirm you aren't being coached 3. restart your phone and reauthenticate 4. come back after 24 hours and unlock device 5. install app from unverified developer, option of enabling for 7 days or indefinitely This is apparently a one-time process. Advanced flow for users launches globally August 2026. Verification requirement kicks in September 2026. Personally I am hopeful that people work toward a completely new, non-Android OS. 15 GB of space on my phone, and 1.5 GB of RAM, is dedicated to Android OS alone. This design, and the control this company (and the mobile providers, and device manufacturers) have over the mobile world, is ridiculous. Let's start over.

robotnikman 7mo ago
>15 GB of space on my phone, and 1.5 GB of RAM, is dedicated to Android OS alone The original Droid phone I used had only 256mb of memory, and could still multitask and run multiple apps at once with that limited memory. Its crazy how bloated things have become over the years.
0x1ceb00da 7mo ago
Nah. This sucks. My banking app refuses to open if devtools are enabled. 24h window means I can't do dev work on my personal phone.
- jlokier 7mo ago
  I have that problem too, and it's a banking app I use nearly every day. Needing to turn Developer mode off and on every time I open the app is really annoying. It was extra annoying when I needed to log all my phone's Bluetooth HCI protocol activity for a day for product development. I wouldn't be able to take that measurement using a separate dev-specific phone, because it wouldn't contain realistic usage.
fsflover 7mo ago
> I am hopeful that people work toward a completely new, non-Android OS Mobian, PureOS, postmarketOS already exist. Sent from my Librem 5.

__fst__ 7mo ago

Let everyone who wants it be safe using the Google App Store. But please let me do stupid/experimental things with my phone.

sylos 7mo ago
The google app store isn't even that safe. This is all just stupid

krick 7mo ago

So, anyway, how do we make sure that our phones don't turn into a pumpkin on a set date? I suppose it's all shit long term, but at the very least I don't want to be forced to look for a solution before I need a new phone. So, what do you do? Can you just disable android updates somehow and it will solve the issue? Or it is already a ticking bomb that will be activated on the set date no matter what?

userbinator 7mo ago
Root and kill everything that could be used to remotely install software without your consent.

thomasgeelens 7mo ago

oh so I'm not the only one, always believed Apple was the hard ass but I've been having a better experience with them.

glenstein 7mo ago

Don't love it but (1) it's addressing a serious problem and I'm not sure what the alternative is and (2) if you all remember the starting place, it was staggeringly, dramatically worse, practically a death sentence for F-Droid and seemingly testing the waters for if they could simply power through and do it despite objection. This is a major course correction that doesn't kill F-Droid. A one time 24 hour hoop to jump through and then never again is monumentally better than losing F-Droid forever.

userbinator 7mo ago
It's only a "serious problem" because they want you to think it is.
snackbroken 7mo ago
"Meet me in the middle" says the unjust man. You take a step forward. He takes a step back. "Meet me in the middle" says the unjust man.
supern0va 7mo ago
Is it a serious problem that you can run whatever software you want on your computer? Should we make it so that no one can do that without permission to protect them? I recommend Cory Doctorow's talk on why this is a serious problem for society: https://en.wikisource.org/wiki/The_Coming_War_on_General_Computation https://en.wikisource.org/wiki/The_Coming_War_on_General_Com... https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg
- renewiltord 7mo ago
  Yes, lots of vulnerable users get harmed by modern tech. E.g. people have lost their minds using AI, their livelihoods using smartphones, their life savings using the Internet. In general, I prefer a solution where any mental health issue (age-related infirmity, ADHD, etc.) result in protection from modern exploitative tech like this. Every application use for such people should be supervised by a government official trained to ensure you are not hurting yourself. This way people who want to use AI, smartphones, or the Internet can do so if they’re healthy and the mentally disabled can be protected. We know that this need exists because even on this “Hacker” News forum everyone gets very upset when a mentally disabled person gets injured after AI use.

userbinator 7mo ago

Older Androids which are fully rootable and unbrickable are cheap (maybe even monetarily free) and will let you continue to have freedom despite what Google wants. "Those who give up freedom for security deserve neither."

stavros 7mo ago
Older Androids won't exist for long.
- userbinator 7mo ago
  That's what Google wants, but they're not getting their way with mine.
  - fsflover 7mo ago
    How about security updates?
- greentea23 7mo ago
  My pixel 1 is still going strong. Several phones released just last year are bootloader unlockable and rootable, and those should last at least a decade if cared for.
  - stavros 7mo ago
    You can always get some form of phone that will be rootable, but more and more of the ecosystem will depend on Play Integrity, and thus there will be more and more things you can't do with them.

m132 7mo ago

Is there any information about how the "advanced flow" will be implemented? According to keepandroidopen.org, this is going to be handled by Google Play Services. Does it mean it will be automatically installed via the silent, always-on GMS update mechanism and I should root my devices and remove GMS altogether if I don't want this?

ecshafer 7mo ago

> Android is for everyone. It’s built on a commitment to an open and safe platform. Users should feel confident installing apps, no matter where they get them from. This intro immediately tells me that whatever comes after will be horrible for users and developers. Surprise surprise, I was right. Software to "verify" side loaded apps is a bad, anti user idea.

postsantum 7mo ago
It's like a slimy HR telling you to come over for a chat. You immediately know it's not a chat
Vinnl 7mo ago
Whenever I find that I need to install something from the Play Store rather than from F-Droid, it fills me with dread, because I'm not confident about what those apps do behind the scenes.
varispeed 7mo ago
I am waiting for Google to require bodily fluid sample to verify identity.
einpoklum 7mo ago
"side loaded apps" is merely a pejorative Google and Apple use for "apps". What they call "apps" are "apps that we like and we distribute to you under our control of both yourself as a registered user and the developers". Well, I guess I'll need to install a non-Android distribution then. I hope one would be available for my phone by the end of the year :-(

shit_game 7mo ago

At this point, I think I would prefer to carry a dumb flip phone for SMS and phone calls, and a smartphone-shaped generic touchscreen linux computer for everything else. It's becoming disturbingly impossible to find the former, and practically impossible (IME) to find the former. Does anyone here have experience using Ubuntu Touch? That's the closest thing I've seen to "generic touchscreen linux" for mobile phone hardware. I'd love a device that works for multimedia, navigation, web browsing, and a handful of APKs like various chat apps (and really anything can can arbitrarily use the hardware), but it seems like tying a cellular modem to this ends up fucking up the whole dream because of carrier and manufacturer motivations/compensations.

marcprux 7mo ago

I am part of the team running keepandroidopen.org and corralling the signatures for the open letter opposing this program. We've been trying to get Google to reverse course on this program ever since it was announced. As it stands, Android Developer Verification (ADV) is a death sentence for F-Droid, Obtainium, and other competitors to the Google Play Store, both commercial and non-commercial. We are disappointed that they are still trying to steamroll this through in the face of overwhelming public opposition. There are numerous reasons to object to the program, but a few of the top ones are: 1. You own your computer, and you should be the sole decision-maker for what software you can install on it. 2. "Malware" means whatever Google says it means, and their terms and conditions change daily; today malware is banking scams, tomorrow it is … ad-blocking? VPNs? Their decisions are un-reviewable and opaque, and they have obvious commercial incentives to block certain kinds of (otherwise-legal) software. 3. Centralizing global developer registrations through a US corporation makes it subject to the rules (and whims) of the current regime. Citizens of sanctioned countries or members of sanctioned entities (like the International Criminal Court) will be legally barred from registering, blocking them from creating and distributing software _anywhere_ in the world (not just the US). 4. Scenarios that Google claims ADV will protect against — such as high-pressure phone calls manipulating vulnerable users into installing scam apps — have _already_ been addressed by incremental improvements to Android security over the years, such as "Enhanced Fraud Protection" introduced in Android 13 (and expanded in Android 15). Android has incrementally improved its security features over its near 20 years of existence. There is no evidence that anything has suddenly changed to justify such a disproportionate and extreme lockdown. 5. Being required to pay Google for the privilege of uploading your government identification so that you might be permitted to contribute to the Android software ecosystem is such an abominable insult to the developers that helped build the platform. It deserves all the utter contempt that has been heaped upon it thus far, and begs regulatory scrutiny from those few countries that still have the courage to stand up to these bullies. We emphatically recommend against developers signing up for this program or endorsing it in any way.

fsflover 7mo ago
> I am part of the team running keepandroidopen.org Perhaps your team should promote GNU/Linux phones instead, which do not depend on a megacorp. Sent from my Librem 5.

wisenet 7mo ago

Should we protest by graying out app icons and assets. https://news.ycombinator.com/item?id=47354917 https://news.ycombinator.com/item?id=47354917

creatonez 7mo ago

> However, our recent analysis found over 90 times more malware from sideloaded sources than on Google Play Google has seemingly never seen an elderly person's phone, where it is completely infected with crap including literal popup ads (that somehow overlay other apps), yet all of it was downloaded from GPlay.

1970-01-01 7mo ago
100.00% this take. Google is redefining "malware" to fit their corporate narrative so ads-with-ads-with-tracking is labeled as fine wine. It simply cannot be malware because that truth would decimate their shareholders. Malware by any other definition remains software that disrupts the user's ability to operate the device: https://en.wikipedia.org/wiki/Malware https://en.wikipedia.org/wiki/Malware https://www.ibm.com/think/topics/malware https://www.ibm.com/think/topics/malware https://www.cloudflare.com/learning/ddos/glossary/malware/ https://www.cloudflare.com/learning/ddos/glossary/malware/ https://www.cisco.com/site/us/en/products/security/what-is-malware.html https://www.cisco.com/site/us/en/products/security/what-is-m... https://www.britannica.com/technology/malware https://www.britannica.com/technology/malware https://www.fortinet.com/resources/cyberglossary/malware https://www.fortinet.com/resources/cyberglossary/malware https://www.kaspersky.com/resource-center/threats/what-is-malware https://www.kaspersky.com/resource-center/threats/what-is-ma... https://www.mcafee.com/learn/malware/ https://www.mcafee.com/learn/malware/ https://www.trendmicro.com/en_us/what-is/malware.html https://www.trendmicro.com/en_us/what-is/malware.html https://www.t-mobile.com/home-internet/the-signal/internet-help/what-is-malware/ https://www.t-mobile.com/home-internet/the-signal/internet-h... https://www.merriam-webster.com/dictionary/malware https://www.merriam-webster.com/dictionary/malware
- VHRanger 7mo ago
  Remember when we had the term "spyware" for a class of malware? I remember
CobrastanJorji 7mo ago
Both things might be true. Sideloaded apps are probably way more likely to be malicious, but also most installed malware/crapware is quite likely coming from Google Play.

jaimex2 7mo ago

The only malware I've had to clean off peoples devices has come from the Google Play Store.

jaimex2 7mo ago

It's kinda funny. I used to run custom roms all Android phones came with a shit OS. I stopped because Pixel AOSP phones were actually decent. Now I guess i'll be buying phones based on which I can flash with custom roms again.

fensgrim 7mo ago
good luck finding a phone with custom ROM support, when there will be no phones with bootloader unlock available :(

donatj 7mo ago

I would genuinely like to know more about these supposed users who are side loading things and getting hoodwinked. It seems high enough friction that you have to have something of an idea of what you're doing to begin with. Everyone I've known who is side loaded anything has been reasonably technical. My dad on the other hand, who worked for Control Data in the 1980s regularly installs some of the scummiest apps imaginable, and they're all from the Play Store proper. Launchers that don't actually launch things and serve ads. Apps that launch full screen ads while you're doing things saying your device is infected. Absolute trash. Like maybe just maybe put some energy into going after the stuff in the Play Store first. As the Play Store exists now, it is unsafe.

bsimpson 7mo ago
Have you seen those YouTube videos of people punking scammers? Scammers will convince people to drive to Target, buy gift cards, and read the credentials out over the phone. Those same people can surely talk you through tapping out a dialog flow. That's presumably why there's a lockout period - it keeps a scammer from reasonably holding the line until they can pressure you to finish it.
- yjftsjthsd-h 7mo ago
  > Have you seen those YouTube videos of people punking scammers? Scammers will convince people to drive to Target, buy gift cards, and read the credentials out over the phone. Those same people can surely talk you through tapping out a dialog flow. ...if the scammer can get the victim to physically drive to Target a buy a bunch of gift cards, what makes you think they need to install anything on your phone? Having RCE on a human is more useful than RCE on a device.
  - TeMPOraL 7mo ago
    Having RCE on a human is like having RCE on a SOTA LLM webservice - tricky to get, and you'll probably lose it if the other side reloads.
  - jeroenhd 7mo ago

geokon 7mo ago

Does anyone know how this will work vis a vis China, where Android is everywhere, but Google is not? Will bypassing this bureaucracy be just a matter of buying a Chinese Android phone?

RandyOrion 7mo ago
Please no. If you want to install APKs directly on Android phones selling in China, you'll face even more draconian restrictions imposed by both Chinese OEMs and Chinese government, e.g., cannot install telegram [1], cannot install VPNs [2], called by local police station after installing VPNs [3], and so on. And you do not have the freedom to even talk about these restrictions freely without getting sued or censored. [1] https://xcancel.com/whyyoutouzhele/status/1689152388412616704 https://xcancel.com/whyyoutouzhele/status/168915238841261670... [2] https://xcancel.com/whyyoutouzhele/status/1978430665562689716 https://xcancel.com/whyyoutouzhele/status/197843066556268971... [3] https://xcancel.com/whyyoutouzhele/status/1702992057596276760 https://xcancel.com/whyyoutouzhele/status/170299205759627676...

ori_b 7mo ago

If they're taking on verification, are they also taking on liability? Do we get to sue them if grandma gets scammed through an app they allow onto their phone?

eviks 7mo ago
Nice try, but no, shit only flows down.
RandyOrion 7mo ago
Yeah, let's hold Google accountable. Is there a way to practice anti-trust laws?

myko 7mo ago

Google freaked out that Apple had a better reputation and went all in on fucking their Android store up. Everything about it is worse now than it was before. So tiring.

bitwize 7mo ago

I'd say Hackernews knows enough people at Google to raise a stink about this, but it's not going to do any good. Sometime at the last WEF or Bilderberg meeting it was decided that KYC level identity verification should be required to use a computer or the internet, with more stringent requirements to program one. This, and much worse, is going to happen whether we like it or not.

DeathArrow 7mo ago

If I do software for Windows, Linux or FreeBSD I don't need verification. And potential users aren't required to get software only from a certain app store. This is a case of companies forcing things on us "for our own good" and them knowing better than us what is good for us or not.

mhitza 7mo ago
It's a pathetic excuse of a reason. Google Ads is a mechanism for scam delivery, probably 90 times more effective than sideloaded scam apps.

BatteryMountain 7mo ago

Good job google. You just convinced our entire business to abandon our app (utilities company) and only target web. We are done with this shit. All our resources the next two weeks will be to fill in the gaps in our web clientzone so our thousands of customers can still buy electricity and pay water bill and have a similar experience than the app (it's 90% the same anyway). Oh and my three personal apps that I installed via adb (not released on playstore) - the moment they stop working on my phone or hassle me about verification, I will get in my car and go buy an iPhone. Next will be to degoogle the rest of my life, which is luckily only gmail. Guess how long it will take me to port out? Less than two days. I only let companies violate me once. Then I'm out. Play store is the biggest piece of trash malware system that exists today, but us normal businesses have to pull teeth and spend days jumping through hoops to get an app out, but the playstore is filled with infinite garbage that rot childrens brains. Wake up.

arcmutex 7mo ago

Great. This will make web apps popular again. Let's take back the web. HTML, JavaScript, CSS!

xihe-forge 7mo ago

[dead]

sgt 7mo ago

> It’s only when a user tries to install an unregistered app that they’ll require ADB or advanced flow, helping us keep the broader community safe while preserving the flexibility for our power users. So, we have a sideloaded app now. Which has been increasingly tricky for our users to install. The warning they get is hard to understand. Does this mean essentially the end of sideloading?

takluyver 7mo ago
If you get 'verified' by Google and sign your app, sideloading shouldn't change. That means money and ID checks, or a free 'hobbyist' carve out if you have <20 users. If you don't want to play their game, sideloading will get substantially harder.

Andebugulin 7mo ago

My experience was worse than just frustrating verification - it cost me money twice. I submitted my government-issued ID and bank statements multiple times. Each time rejected, no specific explanation why. After several rounds I gave up, assuming my developer account would at least stay dormant until I felt like trying again. It didn't. Google deleted the account entirely. No warning, no refund of the €25 registration fee or whatever it costed. When I eventually wanted to publish again, I had to create a new account and pay again. The second time around they accepted my driving license - the same type of document category they had rejected before. So the real cost of a bad verification experience isn't just time. If you give up and walk away, you lose your fee and start from zero. That's the part that stung, at least for me.

Steve16384 7mo ago

Even once you've managed to verify, Google love throwing more challenges at you if you want to keep your apps in the store. "You need to declare your blood type or we will remove your apps in 30 days". I removed my apps myself as it was turning from a hobby to an unpaid job just to keep the apps in the store.

fredgrott 7mo ago

Sounds like age verification exp in EU.... Maybe not expose potential internet users to such as high obstacle if your goal is to get their eyeballs to buy your advertised product???

tsoukase 7mo ago

In the last few years all apps I install in a phone come outside of Play Store, because either they are full of ads, throttle their usage or simply similar ones don't exist. Without them the phone loses half of it's functionality, which is pretty much. So, I am willing to wait a day in the "advanced flow" to keep a multi-year experience.

wg0 7mo ago

I'll probably ship PWAs but hope those are not killed by Google.

ChoGGi 7mo ago

> our recent analysis found over 90 times more malware from sideloaded sources than on Google Play. So, what I'm being told is; there's lots of malware on Google Play? Thank goodness for f droid (for now).

paprikanotfound 7mo ago

Does anyone know if Chinese developers will be forced into paying for a Google Dev account too?

einpoklum 7mo ago

> Android is for everyone. It’s built on a commitment to a... safe platform. These two statements contradict. When something is public, it is not entirely safe; and to make something safe, there is exclusion of practices, behaviors, and often people. > So as an extra layer of security, we are rolling out Android developer verification to help prevent malicious actors from hiding behind anonymity to repeatedly spread harm. 1. Well, then, surely Google can't be in charge of this process, because they are a malicious actor, known to manipulate social media search results and engage in mass surveillance of its users. And that's in addition to analyzing their personal data to try to manipulate them into buying things; which is called "targeted advertizing", but I would also characterize as harm. 2. To be slightly less tongue-in-cheek: Imagine that a two would prevent entry of unverified people - you know, to prevent malicious anonymous actors from bringing harm. That would be ridiculous - nobody should be able to restrict public space. Well, the space of computation and communications via our handheld phones/computers is enough of a public space to merit the same principle. Which means that it is not acceptable for it to be under Google/Alphabet's control. Government regulation could mitigate this problem, but then, governments collude with large corporations and often approve of such restrictions.

benrutter 7mo ago

The latest shift to lock down Google's android pushed me recently to install /e/OS. On paper it makes those kind of projects a lot harder, but its prompted me to be a bit more considered about what software projects I want to use/support. Really glad I have done that - I've been a 'boiled frog' of sorts on Android for a while now. Not happy with being continually more and more locked down, but not quite unhappy enough to shift. Feels like a breath of fresh air to have software that's built to serve me, rather than just to serve me ads.

trashb 7mo ago

Maybe it's just me but what happened to "don't send your government id to anyone". I am from the EU but this is what was indoctrinated to me. Just seems very strange to all off a sudden send all this information to any company you require a service from. Also the person is not the company, why is Google making the developer identify oneself while many apps are released under a company? My understanding is that Google has been mishandling this for a while but with the verification linked to a government id that just seems like another can of worms. A few scenarios to consider: - The developer is fired/resigns and the company does not want to be associated with the developer, for example if the developer is convicted for something. - The developer is fired/resigns and the developer does not want to be associated with the company, developer found out about certain practices of the company they don't condone. - The developer and the company part in good faith, however one of them is being exploited/pressured by a third party to abuse the relationship to the app. - The developer or the company is on legal hold due to legal issues, arrests, malpractice etc. - The developer passes away or the company ceases to exist. - How does this work if you are making an app as a developer for hire, when entering into a contract with a publisher for example. Who will verify and how will that work (especially on small scale apps).

solaire_oa 7mo ago

> However, our recent analysis found over 90 times more malware from sideloaded sources than on Google Play https://android-developers.googleblog.com/2025/08/elevating-android-security.html https://android-developers.googleblog.com/2025/08/elevating-... > The scale of this threat is significant: our recent analysis found over 50 times more malware from internet-sideloaded sources than on apps available through Google Play Bald face lies are getting baldier.

greatgib 7mo ago

This world is really dystopic. It amazes me that now anything restricting your rights and liberty can pass so easily. For students and hobbyists: To keep Android accessible to everyone, we're building a free, no government ID required, limited distribution account so you can share your work with up to 20 devices. You only need an email account to get started. Sign up for early access. We’ll send invites in June. Just imagine if in the computer world, Bigtech monopoly had managed to force everyone to submit is ID document to an american private gatekeeper to be able to distribute applications... But now it almost look normal most of us. Especially in countries like Thailand or Brazil were it is implemented now, just imagine that if Trump decide to go crazy any day, suddenly you would not be allowed to create or have user install your apps normally, just like that...