10 ms·

From TFA: Delve into System Settings, find Developer Options Tap the build number seven times to enable Developer Mode Dismiss scare screens about

by jjgreen 6mo ago

From TFA: Delve into System Settings, find Developer Options Tap the build number seven times to enable Developer Mode Dismiss scare screens about coercion Enter your PIN Restart the device Wait 24 hours Come back, dismiss more scare screens Pick "allow temporarily" (7 days) or "allow indefinitely" Confirm, again, that you understand "the risks" Nine steps. A mandatory 24-hour cooling-off period. For installing software on a device you own.

0x3f 6mo ago
Sounds a bit like trying to transfer my own money to myself at the bank. I.e. it seems designed to prevent old people getting scammed.
- hungryhobbit 6mo ago
  That's exactly what this is: Google is trying to prevent tech illiterate users from installing malware. (Or at least, that's their take on this. You can choose to read between the lines, or not, as to whether they have other motivations also.)
  - raverbashing 6mo ago
    Of course they have other motivations But for 1 person wanting to run their own software there are hundreds of people with the potential to install malware/crapware/etc
    - lucb1e 6mo ago
      Had to read that sentence twice. You really think that there's more people getting scammed via "please tap the build number seven times and then go to extra settings and enable untrusted installs and then go to this website that I will dictate the URL of and you should ignore that install warning" etc etc etc. to install an apk to run software that can barely access more than a simple webpage could, than there are people (like HN'ers) who install apk files from github and f-droid?! (Also note that "crapware" describes basically every app you find in google's store. I try on occasion, when nobody made an open source this-or-that, and it's such a minefield. If that's the thing you're trying to avoid, I don't know how you could possibly feel positive about a requirement to only use the Play Store for the tech-illiterate)
      - raverbashing 6mo ago
        > You really think that there's more people getting scammed via "please tap the build number seven times Yes, because this whole procedure is new > Also note that "crapware" describes basically every app you find in google's store Go back to emacs then I guess
        lucb1e 6mo ago
        Installing apks has required going into settings for years now. 'Scary' steps aren't new > Go back to emacs then I guess way to have a conversation
      - 0x3f 6mo ago
        > more people getting scammed via "please tap the build number seven times and then go to extra settings and enable untrusted installs and then go to this website that I will dictate the URL of and you should ignore that install warning" etc etc etc. I don't really understand. You seem to be against the 'annoyance' of the protections, but that annoyance is precisely why the scammed count is lower, no? I certainly believe _more generally_ that the market for scam victims is much bigger than the market for sideloaders, for example.
        lucb1e 6mo ago
        What I'm against is the mandatory registration to get a key signed by a party we don't elect, who controls all (soft-mandatory^1) devices that aren't controlled by the other party we didn't elect, and both are controlled by a government that we have no say in and is acting increasingly hostile towards everyone but fellow belligerents (Israel, Russia.. seeing a pattern here). Your "it's just a bit annoying" argument seems irrelevant compared to that, even if it would reduce scams, which I have seen no evidence for or against. Did you find or come across any evidence for it? ^1 https://news.ycombinator.com/item?id=47940687 https://news.ycombinator.com/item?id=47940687 > the market for scam victims is much bigger than the market for sideloaders That makes no sense. Of course the market for "scam victims" is current-earth-population.com minus one (the person doing the scamming); this is a universal constant you're comparing against If you mean the number of people who would potentially get scammed by being told to do a dozen steps to install some app which can barely do more to aid the scam than a webpage could, then I'm interested in how you end up with those figures! Given that maybe every 20th person is decently tech-literate and that I have yet to come across a scam where installing software on your phone is a component of it (including via google's; just any kind of mobile software installation), the way I figure the "market sizes" are about 400 million to somewhere around nil
  - mulmen 6mo ago
    Define malware.
    - kube-system 6mo ago
      The scams this directly targets are well known and common. Someone gets a phishing message, they have someone install some sort of malware on the device, then their bank accounts are drained into some offshore account never to be seen again. That's why there's a requirement for restarting the phone and waiting 24 hours. The restart ends the connection for any remote-access software or phone call that might be driving the operation -- and the 24 hour wait period breaks the "urgency" part of the scam that prevents other people who know better from stopping the vicim from continuing.
      - mulmen 6mo ago
        Malware is whatever Google says it is.
- selectively 6mo ago
  Yes! That is because banking malware is specifically what is being targeted here: https://android-developers.googleblog.com/2026/03/android-developer-verification.html https://android-developers.googleblog.com/2026/03/android-de...
nine_k 6mo ago
I see zero trouble as long as it requires no additional identification, no additional payment, and no mandatory time limit for the sideloaded apps. That is, fine by me. I can wait for 24 hours once in a few years when I acquire a new mobile phone.
- moralestapia 6mo ago
  Why would you do all that to install an app in a device that you own? It's bollocks.
  - nine_k 6mo ago
    Because grandmas all over the world are getting swindled by scam apps. Look, I can't locally install a web extension I wrote on an open-source Firefox browser, because security. I have to install a Developer Edition, or get the extension reviewed and signed by Mozilla, for the very same reasons of thwarting scammers. Is this stifling, or is it making my browser not mine? Is anybody making a big deal out of that? The world we inhabit is not always friendly. It has a ton of determined and sophisticated bad actors, and a lot of people with less technical savvy than you and me. We have to deal with that, instead of being cantankerous.
    - rcxdude 6mo ago
      It's not obvious to me that this will help much with scamming. Especially when it affects safer app repositories like F-droid more than the cesspit that is the official Play store.
      - gruez 6mo ago
        >It's not obvious to me that this will help much with scamming. Because as a reader to this forum, you're probably more tech savvy that the average person. Moreover this type of scam seems to be more common in Asia than the West, see: https://cdn.economistdatateam.com/videos/cyber-scams/fake-vietnamese-app_700.webm https://cdn.economistdatateam.com/videos/cyber-scams/fake-vi... https://www.economist.com/interactive/asia/2026/04/10/scam-inc-has-a-new-weapon https://www.economist.com/interactive/asia/2026/04/10/scam-i... They convince users to download a "government app", grant it accessibility permissions, then use that to take over their phone and drain their bank accounts. >Especially when it affects safer app repositories like F-droid more than the cesspit that is the official Play store. Where do you draw the line? If you whitelist f-droid, do you have to whitelist third party f-droid repos too? What about other app "stores" like obtanium? Moreover f-droid being less of a "cesspool" is likely because its reach is smaller, not because it has better moderation.
moralestapia 6mo ago
>Wait 24 hours Somehow bank vaults and heroin storage boxes don’t take this long.
- kube-system 6mo ago
  The 24 hour wait period is so the scammer can't use the element of urgency to keep the victim on the phone where they don't have the opportunity to speak with trusted friends/family who would stop the scam.
  - sowbug 6mo ago
    See also https://en.wikipedia.org/wiki/Cooling-off_period_(consumer_rights) https://en.wikipedia.org/wiki/Cooling-off_period_(consumer_r.... It's an old solution to an old problem: give the potential victim a chance to think clearly while the damage can still be undone.
tromp 6mo ago
You left out the crucial bit: Worse: this flow runs entirely through Google Play Services, not the Android OS. Google can change it, tighten it, or kill it at any time, with no OS update required and no consent needed. And as of today, it hasn't shipped in any beta, preview, or canary build. It exists only as a blog post and some mockups.
- Markoff 6mo ago
  that seems better, not worse, that they don't implement this on OS level, so no gapps users are not affected at all
wstrange 6mo ago
To be fair, that's a one time process. You do not need to do that for every app you want to sideload. The malware issue that the flow is designed to mitigate is a very real problem. Perhaps there is a better way, but it's not immediately clear what that is.

by jjgreen 6mo ago

0x3f 6mo ago

Sounds a bit like trying to transfer my own money to myself at the bank. I.e. it seems designed to prevent old people getting scammed.

hungryhobbit 6mo ago
That's exactly what this is: Google is trying to prevent tech illiterate users from installing malware. (Or at least, that's their take on this. You can choose to read between the lines, or not, as to whether they have other motivations also.)
- raverbashing 6mo ago
  Of course they have other motivations But for 1 person wanting to run their own software there are hundreds of people with the potential to install malware/crapware/etc
  - lucb1e 6mo ago
    Had to read that sentence twice. You really think that there's more people getting scammed via "please tap the build number seven times and then go to extra settings and enable untrusted installs and then go to this website that I will dictate the URL of and you should ignore that install warning" etc etc etc. to install an apk to run software that can barely access more than a simple webpage could, than there are people (like HN'ers) who install apk files from github and f-droid?! (Also note that "crapware" describes basically every app you find in google's store. I try on occasion, when nobody made an open source this-or-that, and it's such a minefield. If that's the thing you're trying to avoid, I don't know how you could possibly feel positive about a requirement to only use the Play Store for the tech-illiterate)
    - raverbashing 6mo ago
      > You really think that there's more people getting scammed via "please tap the build number seven times Yes, because this whole procedure is new > Also note that "crapware" describes basically every app you find in google's store Go back to emacs then I guess
      - lucb1e 6mo ago
        Installing apks has required going into settings for years now. 'Scary' steps aren't new > Go back to emacs then I guess way to have a conversation
    - 0x3f 6mo ago
      > more people getting scammed via "please tap the build number seven times and then go to extra settings and enable untrusted installs and then go to this website that I will dictate the URL of and you should ignore that install warning" etc etc etc. I don't really understand. You seem to be against the 'annoyance' of the protections, but that annoyance is precisely why the scammed count is lower, no? I certainly believe _more generally_ that the market for scam victims is much bigger than the market for sideloaders, for example.
      - lucb1e 6mo ago
        What I'm against is the mandatory registration to get a key signed by a party we don't elect, who controls all (soft-mandatory^1) devices that aren't controlled by the other party we didn't elect, and both are controlled by a government that we have no say in and is acting increasingly hostile towards everyone but fellow belligerents (Israel, Russia.. seeing a pattern here). Your "it's just a bit annoying" argument seems irrelevant compared to that, even if it would reduce scams, which I have seen no evidence for or against. Did you find or come across any evidence for it? ^1 https://news.ycombinator.com/item?id=47940687 https://news.ycombinator.com/item?id=47940687 > the market for scam victims is much bigger than the market for sideloaders That makes no sense. Of course the market for "scam victims" is current-earth-population.com minus one (the person doing the scamming); this is a universal constant you're comparing against If you mean the number of people who would potentially get scammed by being told to do a dozen steps to install some app which can barely do more to aid the scam than a webpage could, then I'm interested in how you end up with those figures! Given that maybe every 20th person is decently tech-literate and that I have yet to come across a scam where installing software on your phone is a component of it (including via google's; just any kind of mobile software installation), the way I figure the "market sizes" are about 400 million to somewhere around nil
- mulmen 6mo ago
  Define malware.
  - kube-system 6mo ago
    The scams this directly targets are well known and common. Someone gets a phishing message, they have someone install some sort of malware on the device, then their bank accounts are drained into some offshore account never to be seen again. That's why there's a requirement for restarting the phone and waiting 24 hours. The restart ends the connection for any remote-access software or phone call that might be driving the operation -- and the 24 hour wait period breaks the "urgency" part of the scam that prevents other people who know better from stopping the vicim from continuing.
    - mulmen 6mo ago
      Malware is whatever Google says it is.
selectively 6mo ago
Yes! That is because banking malware is specifically what is being targeted here: https://android-developers.googleblog.com/2026/03/android-developer-verification.html https://android-developers.googleblog.com/2026/03/android-de...

nine_k 6mo ago

I see zero trouble as long as it requires no additional identification, no additional payment, and no mandatory time limit for the sideloaded apps. That is, fine by me. I can wait for 24 hours once in a few years when I acquire a new mobile phone.

moralestapia 6mo ago
Why would you do all that to install an app in a device that you own? It's bollocks.
- nine_k 6mo ago
  Because grandmas all over the world are getting swindled by scam apps. Look, I can't locally install a web extension I wrote on an open-source Firefox browser, because security. I have to install a Developer Edition, or get the extension reviewed and signed by Mozilla, for the very same reasons of thwarting scammers. Is this stifling, or is it making my browser not mine? Is anybody making a big deal out of that? The world we inhabit is not always friendly. It has a ton of determined and sophisticated bad actors, and a lot of people with less technical savvy than you and me. We have to deal with that, instead of being cantankerous.
  - rcxdude 6mo ago
    It's not obvious to me that this will help much with scamming. Especially when it affects safer app repositories like F-droid more than the cesspit that is the official Play store.
    - gruez 6mo ago
      >It's not obvious to me that this will help much with scamming. Because as a reader to this forum, you're probably more tech savvy that the average person. Moreover this type of scam seems to be more common in Asia than the West, see: https://cdn.economistdatateam.com/videos/cyber-scams/fake-vietnamese-app_700.webm https://cdn.economistdatateam.com/videos/cyber-scams/fake-vi... https://www.economist.com/interactive/asia/2026/04/10/scam-inc-has-a-new-weapon https://www.economist.com/interactive/asia/2026/04/10/scam-i... They convince users to download a "government app", grant it accessibility permissions, then use that to take over their phone and drain their bank accounts. >Especially when it affects safer app repositories like F-droid more than the cesspit that is the official Play store. Where do you draw the line? If you whitelist f-droid, do you have to whitelist third party f-droid repos too? What about other app "stores" like obtanium? Moreover f-droid being less of a "cesspool" is likely because its reach is smaller, not because it has better moderation.

moralestapia 6mo ago

>Wait 24 hours Somehow bank vaults and heroin storage boxes don’t take this long.

kube-system 6mo ago
The 24 hour wait period is so the scammer can't use the element of urgency to keep the victim on the phone where they don't have the opportunity to speak with trusted friends/family who would stop the scam.
- sowbug 6mo ago
  See also https://en.wikipedia.org/wiki/Cooling-off_period_(consumer_rights) https://en.wikipedia.org/wiki/Cooling-off_period_(consumer_r.... It's an old solution to an old problem: give the potential victim a chance to think clearly while the damage can still be undone.

tromp 6mo ago

You left out the crucial bit: Worse: this flow runs entirely through Google Play Services, not the Android OS. Google can change it, tighten it, or kill it at any time, with no OS update required and no consent needed. And as of today, it hasn't shipped in any beta, preview, or canary build. It exists only as a blog post and some mockups.

Markoff 6mo ago
that seems better, not worse, that they don't implement this on OS level, so no gapps users are not affected at all

wstrange 6mo ago

To be fair, that's a one time process. You do not need to do that for every app you want to sideload. The malware issue that the flow is designed to mitigate is a very real problem. Perhaps there is a better way, but it's not immediately clear what that is.