Then just don't use an android phone, that's a choice isn't it????

It is a toggle. they just locked said toggle behind a 24 hour time lock. It's ridiculous. I think if they kept it the way it was without said time lock it wouldn't be anywhere near as controversial.

That is why I linked sources. I don't say trust me bro.

That is no longer true!

I k ow that the Playstore is also full of crap, I don't deny this.

But, just because our back window does not close correctly, do you leave the front entrance open?

Not the best analogy maybe, but a visual one

Technically, you can always use the library and the post office, so yeah, it's a choice. I guess.

Not denying that there could be better ways, and also, that was never the question .

If their IA was so great, they would use it to curate the mess that is their app store...

What? "Will install" not "have installed". Maybe "would" is a better word, English is not my first language and I have a bad day, but there is no moving goal post.

You do, actually.

I have over 2 decades of background in hardcore IT-Sec, i know my stuff. And you? What is your qualification, where are your sources?

This translates to anyone who isn't you to:

I know a lot, you know very little. Trust me, not you.

And again if you're going to make this 80% claim and then say you sourced it, don't link shit that's sort of related but in no way backing up that claim. No one here is saying malware isn't a problem. You're getting downvoted for making specific claims which are absurd.

How about an apple phone?

Or how about that: projects like Linux and Ubuntu phones died because there was no interest in it, because there was Google. And now, everybody wants an alternative.

They are out there, you can use opensource Android forks, you don't have to use Google

Except you have it backwards. The play store is the primary vector. The play store is also pre-installed on Android devices, and even without the whole verification nonsense, you still need to allow a different app repository to install.

Not cleaning their own play store up first means it has nothing to do with what they are claiming. And lets be candid - they have absolutely not.

The analogy is bad specifically because its not reflecting the issues anywhere near accurately. This is closing a window on the second floor while the front door is wide open with a sign that says "Come on in!".

typo

That is a general issue of online debates.

I can not squash 20 years of daily learning into a comment.

I can point you to sources where you can verify it our self. Social engineering studies, blog post about campaigns from other researchers.

Placing m credentials there is my kind of saying "I have insight, ask", but how do you think should something like this communicated.

We have a highly sensitive topic, with a lot of obsolete or just misinformation.

It is a highly complex topic that can not be simply understood by most persons, but social media opens a place for debate anyways.

There are many other examples for this happening and it is bad. Very bad.

Another example Google wants to get rid of third party cookies. Instead they want to to adspace action on your local system. In our browser, protected. But bad, because Google. Firefox could implement the same API on better, but no, bad because Google.

Google is not the good guy. But just throwing out every fucking Idea because Google Had it (or was forced into it, allowing sideloading again was because of pressure) is just not what we need

That assumes that Google does not do anything about the appstore and that is objectively not true.

Is it enough? No ideas, but still, it does not change the need for better endpoint security.

I firmly disagree. The issue has nothing to do with the endpoint. They have done very little with the play store relative to this massively impactful change to installation practices in creating a walled garden - precisely the reason many, myself included, chose not to go with iOS in the first place.

So the very idea that this is an endpoint security issue rather than an app store issue is, to me, laughable at best.

Then we agree to disagree.

I think we are manly on the same page, but different opinions on priority and that's fine.

I declare both as a risk.

From my perspective, with this change, we could make Google directly reliable for malware in the appstore.

While this started as a very anti consumer change, as long as sideloading stays possible, this is a good measure.

we'll see in the next months

we could make Google directly reliable for malware in the appstore.

There is no reason they shouldn't be now. Developer verification for the play store is one thing. Developer verification for installing an application on your own device is wholly separate.

I declare both as a risk.

And one is substantially higher risk than the other. Namely, the play store. As we recently saw with tens of millions of downloads from just a handful of apps in the play store. Does requiring this developer verification on a device resolve that problem? No. Not even remotely, does it?

While this started as a very anti consumer change

As long as it impacts the device use (it does), it still is.

I'm leaving Android over this. I doubt I'll be the only one.

Android forks

Soon to be locked out from participating in society because of play integrity, digital IDs and age verification. The EU is very likely to use strictly Apple/Google, the very monopolists they "despise". Don't give me the "just go to the post office by foot".. I could also "technically" live in a cave, I guess. Man stfu, your bullshit doesn't stick here.

With any luck there will be pushback somewhere that Google can't ignore.

Ah another myth "the EU App", I will not go I to detail, but each member state must implement its own app. Yes, the reference implementation uses Google services currently, but there is not a single , working , published app! Not one.

This is so much beating around the bush. Somehow you've managed to ignore the 15 times I've pointed it out: most users do not install apks. That's all. You claimed they did and I said that was dumb. So anything else is just a distraction from the point I was trying to make. Google is pretty shitty but you might have a point that not everything they do is shitty... But that's not what the conversation started as. And I don't really care to change the subject at this point.

English is not my first language and I have a bad day

Uh, so then why confidently correct others who do speak English as a first language? You haven't made much of an attempt to do anything here other than say "I'm right everyone else is wrong"

I'm leaving Android over this. I doubt I'll be the only one.

Good! I hope alternative mobile operating systems get traction out of this!

And again, there is no verification need anymore! That is exactly why I am so pissed about this debate in general.

Is the workflow simple? No. Is the 24hour period comfortable? No. Do I understand why? Yes, but one or two hours would be enough

1. Google being a private american company that claims the authority of what is okay and not okay on most devices over the world is problematic, especially in the context of ICE tracking apps, VPN apps, private messaging apps etc. They take this power but don't take responsibility and would not be put into court if this measure would be proven useless if not harmful. I still remember how they complied with deleting Navalny's app from russian app store and nothing stops them from revoking said IDs as well if they don't like what dev does for a reason they'd not care to explain.
2. The side-benefit of that is a manifest v3-style hunt for those who still use their computing devices without watching ads. Alternative apps for social networks and google's own resources is probably the only category I know half-savvy people still intentionally install, sometimes going out of their way for that. While this seems small, adblocking was too, and piracy was never anyone's problem, but by totally crumbling it once again some CEO can get a bonus.
3. We are talking about Google's Android, they had around 15 years to fix the swiss cheese their OS is, to clean obvious garbage from their app store, with modern phones you need to jump through the hoops to enable apk installation and even more hoops to root it, and it still isn't perceived as safe, but does feel like a closed garden iPhone without benefits of having an iPhone - quality basic apps, curated store and need of israeli hack tools to reliably break in. Small scammers still get their bread and butter by sending links to infected files, big scammers vacuum everything you ever have with no explicit user's agreement, and I don't see how that would change with ID requerement they are no bank or government to ask for, but they'd, soon.

I think you should invite people to join you on not one, but two Christmasses to compare before and after. I'm sure they won't magically fix things this time, at best it would be a little setback not changing much in the end. What it would do is directly giving Google even more power while hurting open source community, alternative appstores and OSes.

Maybe look at other threads here where I debate the actual issue. An actual debate.

They've been continually removing things from that and making actual Google stuff more required. To be fair, they had a good reason because it let them get around the carriers never updating anything.

How do you now that?

Again, the ability to install a completely unverified APK is used in real, successful, attacks.

The user DOES NOT KNOW WHAT HE IS DOING! That is the entire point!

If users would know what this is and understand, maybe it would be less if a risk.

Lol still with the "I'm right" stance. Very helpful. If I'm being generous here you accidentally introduced a misunderstanding, did nothing to clear it up, and then blamed others for it. If I'm not, you're just a troll.

Good! I hope alternative mobile operating systems get traction out of this!

We'll see. The plan for now is a tcl flip with hotspot and a clamshell linux box in my pocket.

And again, there is no verification need anymore!

Please read the very first sentence in that slide. Then read through those steps again (and look at the steps inside of those steps).

Yes, there is a need still, or there are a series of annoying, anti-consumer steps involved, in an effort to have a walled garden.

Android and Google are not worth supporting over this. Again, not dealing with the play store first and thoroughly tells me this has nothing to do with security. If it did, they wouldn't be going this route.

Final try, this is the official new workflow from Google.

Did you know this existed? Are you aware while not very convenient or restores the full sideloading functionality once you went through this process?

What the fuck are we even debating about if facts, provable fucking facts, are ignored

I know because most people won't even install an ad blocker. Let alone will they research apks, change system settings, and then install them. It being possible to be tricked into it is an entirely different topic. What are you high on man? I'm done here. What a waste of time.

You are debating literally anything that comes to mind. I was debating a ridiculous bullshit stat you puked up. Bye

I had a good look at the process. And yes it is not very convenient and or course it is not just to protect users, that is a secondary marketing effect.

I completely lost this view after all those heated debates, thanks.

As long as people claim that F-Droid will stop working and other stuff, based on the initial plans, I classify most of the debate as fear mongering .

And good luck and fun with your new setup. I still have an original OpenMoko, to bad GSM is dead here.

And, thanks for the debate.

"Google shouldn't have restricted Android, that's their (anti-user) choice, isn't it????"

The other party shouldn't be able to unilaterally chance the terms. It is my phone, after all, and I strongly believe I should be able to do whatever I can with the devices I own.

Even then, what other choice for an usable but actually of property of the user phone do you suggest? iPhone?

It's also extremely convenient for Google, a company lobbying ID laws, to add ID harvesting; or for Google, a company pushing for anti-user behaviour to add anti-user behaviour. If this was about security, they would stop shipping spyware, and take security seriously, something they do not.

Yeah I'm not debating that there is fear mongering about this at all, just - as you noted - this is not about protecting users. Thats a farce.

This is about Google trying to close up their ecosystem, device first. That is the issue I take with this whole situation, its a clear step in that direction being marketed as something it decidedly is not.

And I think Android users should recognize what it actually is, and try to find a different option than Apple or Google going forward.

So I'll be back at the end of the year, be proven right and you got your pay and your karma anyway.

Proven right with what? To be clear; I can not see in the future and if member states copy the EU implementation 1:1, then at least we can fight against it in that level. Because, an implementation relying ok US Google would violate multiple European regulations.

But as it seems, misinformation and propaganda won, facts are now subjective and we just give up and bow to big corpo, because those shit hats profit from exactly this kind of bullshit.

Member states are null, they can develop their reskins.

They're already developing with google/apple. What more do you need to know... They shouldn't even be developing anything, but now the point is about trying hard so they rise to "sanctity" and give us an alternative.

There's no propaganda, the propaganda is theirs using children yet again as customary. Serious people merely read the room, because when they resort to games to try repeatedly pass obvious mass surveillance, that tells us what they're coming for. It's obvious.

Why would you want to pleasure them?

It is what I would call "functionally true". You have to enable developer mode to install unverified apps. A very, very small subset of users are going to do that.

https://android-developers.googleblog.com/2026/03/android-developer-verification.html?m=1

If you have more information on this, please share.

If I were a mobile dev I'd make GTK apps for Linux phones and use Pixiewood to create Android builds:

https://github.com/sp1ritCS/gtk-android-builder

You have to enable it. And I would love a dedicated switch.

Currently, you need to enable third party install sources.

And one could argue that the fact that most people will not enable developer mode is a clear sign that this is a protection.

In my very very personal opinion: people that do not want to enable developer mode should maybe not install apps from third parties. Developer mode itself unlocks a few switches, and none of them is enabled per default. This is a pretty safe action IMHO.

There is a way to avoid this, but this is the device owner mode. You need an app that takes full control over device ownership, and those apps are allowed to do anything including installing any app.

One example is OwnDroid.

An opensource app that is signed by a dev and allows to manage install sources would be a working solution with better security.

If someone builds it

I use the German digital id since years. Without enforced Google.

Because the German (older) app does not depend on it.

So no, that's not true. It is an assumption and pessimism

I don't want Google to control how many and often I install apps or update them. Imagine having this 24 hour time lock on your PC. Do you know how many people get scammed or malware on PC? Should this be adopted everywhere, because its a good solution? Off course its ridiculous. 24 hour time lock is not acceptable solution. The is literally the worst toggle I have seen in my life.

That's not even the only issue. Developers have to give their identity / pass to Google. That alone is a multi-worm-level of issue. Google doesn't care about its users, they only care about controlling the market and everyone.

IMO the answer from a security perspective is that the Linux distro "official repo" model is about as good as it gets. However somehow we still have Fedora COPR, openSUSE OBS, Arch AUR, etc. Those are essentially like FDroid. If someone can solve the problem of why apps can't be easily just added and controlled in the official repos, maybe we'd be getting somewhere. Seems to be an industry issue.

100% Agreement

Any apps that were on play store already get automatically added to the verified list without them even asking you.

Is there any way to build Android apps for Linux if you have the source code? I know Waydroid is a thing but that's basically just a VM of Android. I was told Jetpack compose is supposed to be cross platform so there should be a way migrate it right?