Making users wait 24 hours doesn't improve security; it's an anti-competitive change designed to make the Google Play store seem like less of a hassle in comparison.
I can actually see where it can improve security against scammers trying to scam elderly and non-tech savvy people.
Scammer tries to get someone to install malware from their site
Victim isn't familiar with sideloading, but scammer instructs them
Victim hits the first time 24 hour block and has to restart and wait
The restart alone breaks contact with the scammer, scam thwarted
For the rest of us that know our way around Android, it's just a one time annoyance, after completing all the steps to enable sideloading, you won't have to wait 24 hours anymore.
It's sad, but this is the world we live in. It's constantly disappointing.
But I do want to push back a bit, the people getting scammed are not incredibly stupid, they're incredibly vulnerable. They're often people who are generally less tech savvy, but also they're people who don't have a lot to lose, it's a bit counterintuitive, but it's easier to scam people who take money very seriously.
Fair enough, you have a point. Although, I do think the developer verification thing will make it easier for Google to weed out bad actor developers altogether from the Play Store.
Sure there's no perfect solution, but at least they're trying to make it a lot more difficult for the scammers out there, while still leaving power users a path to keep using Android the way we want.
I think it is absolutely delusional to assume any of this actually has anything to do with security or safety of users. Google just wants more power and control over, well, everything they can get.
Lets be real though, currently they already have to blow through 4 other warnings about installing unsigned APK and enabled the browser or file manager to be able to install applications. It's almost certain if they are that far deep/commited, they are going to call the scammer back if the scammer left a number.
Yes this might allow for a time delay where the scammers number could be disabled if reported by enough people, or someone else to be like "yo this is a scam" if they mentioned it but, I don't think this is as secure as they are saying it will be. The target audience for this is very unlikely to be thwarted by a time delay. Plus, the scammer will make some excuse about how the warning is just a safety percaucion and doesn't need to be followed as this is a normal usage of the toggle, and then have them call back after the delay is done.
For clarification: the target audience doesn't know about the scam, and all they care about is that someone is seemingly willing to assist with an issue or problem they have. Said person knows the solution and they just have to wait for the timer to be done to be able to do said solution. They have no reason of telling others about it (unless they were complaining about googles time delay) as they already got someone who is seemingly able to assist.
Honestly, having to have the user type "I agree that I have verified the application i am trying to install is genuine and not a fraudulent app" or a listbox of checkmarks to toggle in order to enable it would be far more efficient for this case.
Hell take the example image the article on the dev page has and make it into toggles instead and it would work far better than a timer does.
Honestly, having to have the user type "I agree that I have verified the application i am trying to install is genuine and not a fraudulent app"
Yeah, this would be the most promising approach IMO. Whenever I was forced to write something, I did pay more attention to what that said than if I ticked a box next to it.
Maybe even have them write "I am not instructed to install this app by someone else. I am aware that following instructions to install an app this way often have fraudulent intentions".
(Also if the language was changed recently, it should ask to write it in all languages that were set within the last 14 days or so. Otherwise the scammer will have them switch the language so they don't understand what they're writing)
Sadly, there's truth in everything you say. Scammers are gonna be scammers, and they'll just find a new technique plus the long standing social engineering to continue their efforts to rip people off of whatever they can.
Still, it's something in the middleground, to help grandma be less likely to get scammed, while also giving power users an out and way to keep using their devices the way they want.
Honestly, having to have the user type “I agree that I have verified the application i am trying to install is genuine and not a fraudulent app”
Ask Other Linus how well that sort of thing ("Yes, do as I say!") works, LOL!
I agree with you that Google's anti-competitive time delay BS is likely to be ineffective for its claimed purpose, but frankly, I don't think any other reasonable (i.e. non-rights-infringing) strategies would be effective either. Honestly, there's a limit to how much effort you should go through to save idiots from themselves -- and how much annoyance you impose on everyone else in the process! -- and I think we've already hit it.
I have never seen that page before, but that's hilarious. I somewhat hope that he did that as a demonstration of, hey, someone may do this because it's hard for me to wrap my head around someone who uses a computer for a living, doing something like that.
Being said, I think that prompt went above and beyond what was needed. At some point you just need to let the user touch the hot stove top... It stated what it was going to do, stated that it was going to be potentially dangerous and unlikely what the user wanted, and then reiterated that it was core essential packages needed for it to run... I don't know what else they could do there. I would definitely be against adding further restrictions though. If he was willing to type that in, I don't know what would stop him from doing that, to be honest, Maybe a..." I acknowledge this would break my system..." instead of it being yes-do as I say. But I don't know.
Being said hard agree there is zero reason that a package like steam should be able to uninstall your desktop., That was definitely a bug or a misconfiguration with the steam package. That was unexcusable. I just think they gave more than enough information of what that would do and he did it anyway.
I firmly agree at some point the ends don't justify the means and Android has definitely got to that point with unsigned packages prior to making this change., And I don't think the ends justify the means to implement such a system. And I definitely think there is ulterior motives for implementing it.
I somewhat hope that he did that as a demonstration of, hey, someone may do this because it’s hard for me to wrap my head around someone who uses a computer for a living, doing something like that.
Nope, he genuinely didn't bother to understand the warning before typing it. He may use computers for a living, but that just means he has a lot of very ingrained Windows bad habits to un-learn.
It was some pretty big Internet drama when it happened and he's still trying to defend himself from the near-universal lambasting he got for it. Although I included the link just in case, I'm kinda surprised you (being a person tech-savvy enough to be posting on Lemmy) didn't already hear of it.
He's actually making a second attempt to switch to Linux right now (four years later), initially picked Pop!_OS again, and had some more problems with it. 🤦 He has a second channel where he posts clips from his podcast, and he keeps whining about how the other people doing it with him are having little to no trouble and he's just cursed, LOL.
Yeah, I had never heard of it, I generally stray away from video based mediums, but I am a little surprised I didn't come across articles for it, I can only assume that none of the creators I followed covered it.
Although it was kind of funny to see the beginning of that second video, him still trying to do damage control, it looked for a second like he was going to agree that he had screwed up that install because he said it was 100% his fault and then he Backtracked and said that it wasn't his fault and I'm like so close lol.
This is only the first step, they will keep adding more bullshit like this in the name of security till you end up with a device that's nothing more than a advertisement and user serveilence terminal for google
The problem with this is that most of the apps used in scams are already on the play store. I haven't ever seen a scam which requests the user to download a third party app, although I'm sure it's happened on occasion.
My point is that this won't stop most scams, and primarily cause annoyance for actual power users.
So, we will have to enable developer mode for that? How long before banking and government apps refuse to run if you have "sideloaded" apps installed? This will be the same as not allowing the majority of people to sideload. No win in here, just an advanced strategy from google to make us conform
This is already the case if the developer mode toggle is enabled for some. I have to turn it off any time I'm traveling for work because the app we have to use to file expense reports refuses to run with developer mode enabled.
At that point you should tell your work to get a work only device for you... I always refuse to use my phone for work shit. I used to explain to them why, now I just lie and say my device is too old to have anything installed on it.
lmao, no arguments here. My boss's phone got bit by the construction site so I think we might finally be getting some movement on that front, at least for anyone who finds themselves in the field doing shit.
For what it's worth, I don't generally mind using my phone for work shit because it's convenient to do so. MDM on android works in a container, so I don't even care about that if they want to implement it.
My dad was complaining out loud to his boss, not requesting anything, just complaining about having to bring two phones with him when he was out and about. So his boss got him a dual-sim work phone lol. The convenience can work out that way as well :)
And to be completely honest... Its a bit funny to see people complain about having to carry two phones. I mean I get it, its annoying. Buuuuut, back in the day we used to carry a camera, a cd or cassette walkman and of course the trusty old nokia 3210. And everyone thought it was the height of convenience :D Oh how times have changed lol
Aaaand now I sound like a old man yelling at clouds. I'm gonna go have a nap, I'm exhausted.
I mentioned to the other guy how my dad got a dual-sim phone (not a shitty one) just by sort of mentioning having to carry two phones. I guess some employers are nicer than others :D
Or if you're rooted, or run something other than your OEM image. I use grapheneos and I'm lucky that my bank doesn't enforce that like some do. I still can't use cards to tap with Google wallet because it's not certified by Google.
Yeah, if that process wouldn't need developer mode (or stayed active after disabling it again) that wouldn't be that bad (still annoying). But having to choose between the ability to install apps or use those apps that only work without developer mode certainly isn't a win.
Riddle me this, why do people use banking apps on mobile devices in the first place? Why put all your financial data in an eggshell just waiting to get dropped or stolen?
Bank cards have had the whole tap to pay thing for quite a while now. I drop my phone, busted. I drop my bank card, it's fine, I just pick it right back up, and it stays in my wallet unless in use, not in my hand where it's infinitely more likely to get lost or stolen.
You want a banking app, do so from your home computer, not a fragile mobile device literally designed to fail if it so much as falls out of your hands.
Because they incentivize it. Some banks are better at incentivizing it than others. My bank for example, allows the highest daily limit (by a factor of 5x) if you use the app. Online banking has a lower limit, and cards lower still. I don't appreciate them holding my own money hostage, but the sad reality we live in precludes me from having enough remaining mental bandwidth and effort reserve to commit it to fighting against it in such an empty and unwinnable battle. Money is a scam anyway.
The only thing I use my bank app for is to deposit checks. It can't be done from the desktop because it needs the phone camera to take photos of the check.
I don't know how online banking access is around the world, but here in brazil, they made it completely impractical to use from computers by applying artificial restrictions. Some payment institutions doesn't even support access from computers anymore. Meanwhile, accessing from the phones has been made easier and less restrictive, so basically everyone has to do banking from the phone. It has even become a popular thing to have a separate "banking phone" to use at home, but many people can't affort that.
In the US, I largely agree with you. Or use a website from a mobile browser. Different story in different countries where a smartphone might be the only compute the average person has, or where state services are tied to a mobile ID or bank app.
Not saying that should be the case, but if the choice is between running niche FOSS apps and removing yourself from societal benefits structures, I know what most people will pick. That's the real danger of allowing one company to own an entire ecosystem and have enough power that they have conversations directly with governments about their people instead of with their people.
We got a large gift card as an incentive to renew our lease at our current apartment vs moving. The format they sent it in had no physical card and would only work on either online stores or through a service like Google Wallet AKA a banking app on a mobile device as you mentioned.
So to get groceries while waiting on a tax refund (thanks crappy American economy and taxation methods) we had no choice but to connect and use it that way.
Oh, I have a choice alright, I chose to withdraw all my money and cancel my bank account like 11 years ago, because my bank refused to accept my tax return as a direct deposit. TurboTax had to reprocess it and send my return as a paper check after the bank refused a fucking direct deposit!
Besides, when the electricity goes out for two weeks after a hurricane or other natural or manmade disaster, how you gonna get groceries or gasoline with electronic money anyways? Give me a paper check to exchange for paper money, paper money still spends even when the electricity goes out.
If it's a service that only deals with electronic transfers, well I ain't signing up, and you can just keep that gift card if it requires an app to even use.
Every single day I assume that tomorrow there might not be electricity, it's amazing to me that people have come to rely on it so much and assume it'll always be there.
Oh I have lived outside the USA at one point and I'm well aware electricity isn't magic. There were other places too but Guyana most definitely doesn't have a stable power grid.
I'm not going to starve my kids over that kind of stance on cash only either though.
I can't understand why banks are as stupid as they often are. Why would you refuse money from the federal government. What do you think we successfully stole money from the IRS through a direct deposit?
Yeah corpos don't respect consumers or norms of human dignity, they'll just do what they want more quietly if you complain. The only real solution is to break up monopolies (ideally for the last several decades).
Counterpoint: my software allows you to access your banking needs. I’m financially on the hook if fraud occurs. Fraud occurs because your favorite “slap the monkey” game also installs a keylogger and network monitor. So I don’t allow my software to work if you have that installed.
I think you’re right that companies should not be able to tell you what software you can run, but users also can’t be trusted to keep their devices safe.
A lot of network, banking, and telephony protocols historically rely on trusting that there are no bad actors in the chain. Technology has added more links to the chain increasing the opportunities for bad actors to tap into it.
It’s a situation that needs better fixes. Maybe we just need to hand the current internet over to the bots and start a new one with security and privacy built in from the ground up.
Yea the argument stated works better for rooted environments than rootless environments or sideloading.
In a non-root scenario, you would need to specify a few permissions to give a keylogger that amount of access. I think that a big issue is people not understanding that there is a difference between a rooted device or root installed app, and a sideloaded application.
Just because you have a non-google device or a rooted device != you have a compromised device. Applications aren't going to magically install running as root, every rom worth their salt keeps it a clear isolation between the layers, and some roms don't even allow you to use the root environment after installing it.
In your standard google phone install? A keylogger wouldn't be able to be installed without enabling an accessibility permission. It's not like you can just "oops I just sideloaded a keylogger haha silly me" like described. Both google installed and side loaded applications would require prompting a warning page that very clearly states it allows logging of the screen for the logging part of it to work.
That one isn't an issue with the sandboxing but with the networking system. Secure browsers have that in consideration and are not vulnerable to meta's tracking.
Maybe banks could use a way to authenticate the user a second way, that doesn't involve a password. If only. (Sidenote: why do banks still insist on sms 2FA?)
A lot of network, banking, and telephony protocols historically rely on trusting that there are no bad actors in the chain. Technology has added more links to the chain increasing the opportunities for bad actors to tap into it.
Their wish to break the first rule of network security (you can't trust the client) shouldn't be everyone else's problem.
Can someone please come out with a phone that's an actual computer and help stop this nonsense?
Phones cost a lot of money at this point and I'm completely sick of them being some locked down, surveillance ridden pile of crap. A reasonably built one would be able to replace a laptop at this point if it weren't for these artificial constraints imposed by the stupid fucking suits running things.
Battery life is limited by cell modem drivers being closed source and having to be reverse engineered.
I have been looking into an alternate hybrid radio device using Reticulum. Though with that comes a new less convenient user experience for a lot of apps.
Pretty sure they meant a smartphone with a desktop OS installed on it (eg Linux phones), not just "phone that looks kinda like a laptop but still uses Android"
That's why I recommended this, their devices dual boot Android or Linux. One of their older devices quad boots by default
This isn't a fly by night operation, it's got a loyal fanbase, and good hardware and software support. They've been manufacturing for a decade, before that this guys were doing PDAs.
GPD has been making "mini laptops" for a long while, now they try to make similar gaming handheld.
I'm not sponoered nor I've bought this for myself. (yet)
As long as your phone model is supported by any custom mod. I have checked compatibility for almost all smartphones I owned, some 7 or 8 through the years.
Not a single one of them was ever supported by a custom mod.
I consider price and technical specifications. I don't have 200€ to spend on a phone. Most phones I bought were less than 100€ new. What I care about a phone is that it supports two SIM cards.
With such constraints, choice is quite limited unfortunately.
Is it worth having a free device? Indeed. Is it worth spending 4 times the price just for that? Not to me.
Intentionally non-standard hardware does not get a real custom rom. It’s just a mod of Android which Google can render intentionally incompatible any time they want
Lol same, I spent $250 on a used pixel 8, threw grapheneos on it the day I got it. Honestly my dream scenario right now is that sailfish let's me just purchase a sailfish X license for a community port
A classic case of making a ridiculously restrictive change, then "walking it back" to a merely semi-ridiculous change and having everyone sigh in relief.
I'm writing an app that I will distribute only through f-droid. The people I would like to share it with are typical, non-technical android users. Before those changes I could just send them a link to f-droid apk and explain it's just another app store or send a link to the apk directly and probably most of them would be able to install it. Now I would have to tell them to do all those weird things first, things that look suspicious and that they would not understand the purpose of. I don't think anyone will be wiling to do it. This is not a win. The effect will be exactly the same - serious limits on distributing apps though alternative channels.
I don't know if adb sideload will fallback to a regular install, maybe it does as a convenience for people who don't read the docs? In any case, you said:
That’s the name of the command, though.
And I demonstrated that you're wrong by linking to the official man page (aka the docs) directly from the master branch of the public git repo. Here's the relevant part which describes the sideload command:
sideload OTAPACKAGE Sideload the given full OTA package OTAPACKAGE.
If antitrust was being enforced, Google execs wouldn't even dream of attempting this bullshit.
Antitrust regulation is probably the easiest way to fix the biggest problems in our society, it is 100% bipartisan, and it is easy to explain to the average US voter. The only group that is against it is the billionaires/ultra wealthy. Instead, politicians are all hyperfocused on culture war mudslinging and bullshit that makes no difference.
Break up Apple, Google, Microsoft, Amazon, and Meta (just to start), and watch how the tech industry explodes with innovation again, and the tech billionaire becomes an endangered species. The AI bubble will burst as companies actually need to compete to survive, and thus won't be burning as much resources on crap that clearly doesn't work.
I, as the owner of my device, don't want to wait 24h.
I hope this will popularize the ROM community again. It gradually faded out due to mainstream ROMs having every perk of the custom ROMs but now the custom ROMs can start offering freedom, which no official ROM will offer.
Is there a tap to pay system that works on custom ROMs? I thought those really required SafetyNet/PlayIntegrity/Whatever-it-is-now.
I would rather not give up tap to pay but I will if I have to. It seems like trying to Magisk my way into getting Google Wallet to work would be a PITA.
Pardon my ignorance, but physical cards are tap-to-pay since it exists, no smartphone needed, and as a bonus, you don't need to think about your battery dying before you need to buy something. It's a problem of extreme convenience, not something you depend on in any way.
An alternative could also be a smartwatch, which you can set up tap-to-pay on, so you can have a custom ROM on your smartphone and pay with your wrist.
Because google is so productive about eliminating malware from the play store and all of its scam advertising.
This is not about protecting the vulnerable, this is about control and forcing people into their ecosystem.
Of course we didn't win. the more hoops you have to jump through, the fewer people who will install their own apps and then you lose all of the community support. And Google didn't promise not to change their plans in the future. So you know that they'll promise this now. Maybe they'll backtrack a little if they have to and they will try to ratchet things up six months later anyway.
Real solutions involve either breaking up monopolies or breaking up monopolies, which is why some of the other cell phone vendors' actions recently look positive. If there are two versions of Android that are popularly used, then the banks will have to support both of them and then everyone can run away from Google whenever they feel like it. But if there's only one popular version and Android itself gets more and more locked down then that is Google seizing the entire market and they will cut out all of the other cell phone manufacturers as soon as they can. that will be just as bad as Apple.
The square app will not run on a phone that has developer mode enabled. I turned developer mode on to disable annoying animations, so now I can't take card payments unless I carry around a second phone.
If Google goes through with this, my payment phone won't be able to run any third party apps.
As someone who occasionally goes to markets and pays someone using Square, I think I'm happy with that.
Now that you mention it I'm surprised single purpose phone isn't required like needing dedicated Internet for registers. Or did they finally fix that to allow VLANs?
So fucking glad that GrapheneOS will probably be available for the new Motorola phones next year. I've been on pixels since they were Nexus, and if not for GrapheneOS, I would have jumped ship after the Pixel 4 and moved to Crapple.
I feel the same way. As a matter of fact, the moment I heard about the partnership, I started researching the possibility for either the current signature or the razr ultra (I think that's the name), but it's confirmed the hardware is not up to GOS standards. We're basically stuck until next year.
still just not gonna update my phone for a while until they've for sure have allowed side loading.
Got my pixel because it's just a nice phone, and i can put graphene on it when it's paid off. Half of my apps are all from f-droid, too.
Would you be able to change the IMEI as I would have thought those were encoded on the hardware chip. If you could it means they couldn’t blacklist the phone if you stopped paying.
I mean it's been around the longest and has the most subscribers. Most people only look at that, and I feel like arbitrarily splitting communities is actively harmful to the fediverse. Competing communities confuse and drive away new users.
lol one of the first things I read here, after making my account, was that everyone should block .ml apparently because communism? I dunno, its all very confusing and new for me.
I haven't read the article yet, but I'm about to. But no matter what, I'm still looking a lot more seriously into Linux on mobile, such as PostmarketOS than I was before.
the win in this is that many people realise how locked google has made android and how blatantly and arbitrarily google exerts their control over it. hopefully that will be input to some consumer decision (when sailfish becomes an alternative) and a tiny bit more people will consider their choice when getting a new phone. and maybe it also helps some regulation to be agreed (in europe, obviously).
Not if it's implemented in the Google Play Services, then every device will refuse to install unverified apps after the deadline, even if it's not on the newest Android versions.
If the process doesn't include any phone home stuff, and is just a one-time cool off period to prevent scammers, this is acceptable to me. That should be enough to get potential victims to self-question, ask more knowledgeable people of what's going on to avoid being unknowingly hacked, without being naggy every time for users that want to do what they want.
Making a software "foolproof" will probably invent a bigger better fool, hoping for some sort of free crypto app jumping through these hoops, but this should weed out most of the basic scams.
It still sets your phone in a state that marks it as security compromised. This could lead i.e. to banking apps not working. I'm not so sure about the "acceptable" state of things here.
I tend to favour privacy over big tech control, but I recognize we have to at least consider the cost-benefit of these tradeoffs, to live in a society. Of course I'd prefer a phone with no warnings, no nagging, if you get scammed that's my fault and I will keep my phone that way if it means I will stay off Android 15 and de-Google my next phone. But Google's plan is within the realm of an acceptable compromise to me because sideloading is still available to everyone without registration with Google. Each person will feel differently about it.
Taking your position to the extreme, if trading liberty for comfort is "always" a bad idea with no exceptions, you can turn off your phone and do without the comfort of it. (Only saying this because always is the word you chose to use.) To accept cellular and home internet services to communicate in the public realm requires you to give up some level of privacy, though of course it can be possible to stop a lot of the unnecessary surveillance that happens along with the necessary tradeoff.
No the scammer will simply point out that the warning is about scammers and not him, your friendly MS tech that called to help solve a problem you didn't have.
What do they mean reauthenticate after 24h? I can't authenticate as I don't have a Google account. Although I do unfortunately have Google play installed, my phones can't have it removed.
Nah, American companies cannot be relied upon by definition. Even if the people running one are fine (and many are), they are still based in what is essentially a pro-crime, pro-corruption jurisdiction.
Its seems fine, other than the whole "coaching" thing. Like, nobody knows how to do this today, so someone will have to "coach" them through it, even if it's Google themselves.
But I would wait and see exactly how it's implemented before calling off the resistance. And I wouldn't call it a "win", that would be then backing down entirely back to what they were already doing.
I think the 24 hour wait is at least a sensible alternative. Anybody who's going to be seriously installing apps on their devices like this is probably going to be using Lineage OS or Graphene OS or /e/OS or something like that anyway. And in that case, they will be using AOSP and not be subject to this because they're not running a Google certified device.
While I'm not particularly happy about this change, I think it could be way worse.
Something tells me that Google drastically underestimated the amount of pushback they were going to get when they announced this. I mean, very drastically underestimated.
I don't know. For one in don't noble how bad the problem is and the that the big thing. We who install apps are not the target for this issue. But the 99% of other people who can fall for these scams is who this is for. And I can handle a little in convince if it stops some scammers from cleaning out peoples life savings.
183 Comments
Zedstrian@sopuli.xyz · 382 pts · 168d
Making users wait 24 hours doesn't improve security; it's an anti-competitive change designed to make the Google Play store seem like less of a hassle in comparison.
over_clox@lemmy.world · 103 pts · 168d
I can actually see where it can improve security against scammers trying to scam elderly and non-tech savvy people.
For the rest of us that know our way around Android, it's just a one time annoyance, after completing all the steps to enable sideloading, you won't have to wait 24 hours anymore.
pennomi@lemmy.world · 72 pts · 168d
PseudorandomNoise@lemmy.dbzer0.com · 37 pts · 168d
Is it still a subset when it's the majority?
And to be honest, the level of effort scammers are willing to go through is shocking, and AI's just making it easier for them.
ParlimentOfDoom@piefed.zip · 35 pts · 168d
Anything less than the whole is a subset, yes.
zzffyfajzkzhnsweqm@sh.itjust.works · 10 pts · 168d
Strictly mathematically even the whole world is a subset of the whole world.
Anivia@feddit.org · 3 pts · 168d
Is it? If you live in a country like India, then a single successful scam will be able to pay for years of living expenses
freeman@sh.itjust.works · 3 pts · 168d
Evidence that any significant percentage of people, never mind the majority, is getting scammed? Then how many of them via app installs?
CainTheLongshot@lemmy.world · 1 pts · 168d
Something about the smartest bears vs the dumbest humans.
Cocodapuf@lemmy.world · 4 pts · 167d
It's sad, but this is the world we live in. It's constantly disappointing.
But I do want to push back a bit, the people getting scammed are not incredibly stupid, they're incredibly vulnerable. They're often people who are generally less tech savvy, but also they're people who don't have a lot to lose, it's a bit counterintuitive, but it's easier to scam people who take money very seriously.
Crozekiel@lemmy.zip · 54 pts · 168d
I'd believe that if most Pig Butchering scams weren't using apps from Google Play already.
over_clox@lemmy.world · -11 pts · 168d
Fair enough, you have a point. Although, I do think the developer verification thing will make it easier for Google to weed out bad actor developers altogether from the Play Store.
Sure there's no perfect solution, but at least they're trying to make it a lot more difficult for the scammers out there, while still leaving power users a path to keep using Android the way we want.
Crozekiel@lemmy.zip · 30 pts · 168d
I think it is absolutely delusional to assume any of this actually has anything to do with security or safety of users. Google just wants more power and control over, well, everything they can get.
Pika@sh.itjust.works · 35 pts · 168d
Lets be real though, currently they already have to blow through 4 other warnings about installing unsigned APK and enabled the browser or file manager to be able to install applications. It's almost certain if they are that far deep/commited, they are going to call the scammer back if the scammer left a number.
Yes this might allow for a time delay where the scammers number could be disabled if reported by enough people, or someone else to be like "yo this is a scam" if they mentioned it but, I don't think this is as secure as they are saying it will be. The target audience for this is very unlikely to be thwarted by a time delay. Plus, the scammer will make some excuse about how the warning is just a safety percaucion and doesn't need to be followed as this is a normal usage of the toggle, and then have them call back after the delay is done.
For clarification: the target audience doesn't know about the scam, and all they care about is that someone is seemingly willing to assist with an issue or problem they have. Said person knows the solution and they just have to wait for the timer to be done to be able to do said solution. They have no reason of telling others about it (unless they were complaining about googles time delay) as they already got someone who is seemingly able to assist.
Honestly, having to have the user type "I agree that I have verified the application i am trying to install is genuine and not a fraudulent app" or a listbox of checkmarks to toggle in order to enable it would be far more efficient for this case.
Hell take the example image the article on the dev page has and make it into toggles instead and it would work far better than a timer does.
cageythree@lemmy.ml · 6 pts · 168d
Yeah, this would be the most promising approach IMO. Whenever I was forced to write something, I did pay more attention to what that said than if I ticked a box next to it.
Maybe even have them write "I am not instructed to install this app by someone else. I am aware that following instructions to install an app this way often have fraudulent intentions".
(Also if the language was changed recently, it should ask to write it in all languages that were set within the last 14 days or so. Otherwise the scammer will have them switch the language so they don't understand what they're writing)
over_clox@lemmy.world · 6 pts · 168d
Sadly, there's truth in everything you say. Scammers are gonna be scammers, and they'll just find a new technique plus the long standing social engineering to continue their efforts to rip people off of whatever they can.
Still, it's something in the middleground, to help grandma be less likely to get scammed, while also giving power users an out and way to keep using their devices the way they want.
grandma@sh.itjust.works · 1 pts · 167d
I bet they will end up having granny use adb over WebUSB a la GrapheneOS
grue@lemmy.world · 5 pts · 167d
Ask Other Linus how well that sort of thing ("Yes, do as I say!") works, LOL!
I agree with you that Google's anti-competitive time delay BS is likely to be ineffective for its claimed purpose, but frankly, I don't think any other reasonable (i.e. non-rights-infringing) strategies would be effective either. Honestly, there's a limit to how much effort you should go through to save idiots from themselves -- and how much annoyance you impose on everyone else in the process! -- and I think we've already hit it.
Pika@sh.itjust.works · 3 pts · 167d
I have never seen that page before, but that's hilarious. I somewhat hope that he did that as a demonstration of, hey, someone may do this because it's hard for me to wrap my head around someone who uses a computer for a living, doing something like that.
Being said, I think that prompt went above and beyond what was needed. At some point you just need to let the user touch the hot stove top... It stated what it was going to do, stated that it was going to be potentially dangerous and unlikely what the user wanted, and then reiterated that it was core essential packages needed for it to run... I don't know what else they could do there. I would definitely be against adding further restrictions though. If he was willing to type that in, I don't know what would stop him from doing that, to be honest, Maybe a..." I acknowledge this would break my system..." instead of it being yes-do as I say. But I don't know.
Being said hard agree there is zero reason that a package like steam should be able to uninstall your desktop., That was definitely a bug or a misconfiguration with the steam package. That was unexcusable. I just think they gave more than enough information of what that would do and he did it anyway.
I firmly agree at some point the ends don't justify the means and Android has definitely got to that point with unsigned packages prior to making this change., And I don't think the ends justify the means to implement such a system. And I definitely think there is ulterior motives for implementing it.
grue@lemmy.world · 3 pts · 167d
Nope, he genuinely didn't bother to understand the warning before typing it. He may use computers for a living, but that just means he has a lot of very ingrained Windows bad habits to un-learn.
It was some pretty big Internet drama when it happened and he's still trying to defend himself from the near-universal lambasting he got for it. Although I included the link just in case, I'm kinda surprised you (being a person tech-savvy enough to be posting on Lemmy) didn't already hear of it.
He's actually making a second attempt to switch to Linux right now (four years later), initially picked Pop!_OS again, and had some more problems with it. 🤦 He has a second channel where he posts clips from his podcast, and he keeps whining about how the other people doing it with him are having little to no trouble and he's just cursed, LOL.
Pika@sh.itjust.works · 2 pts · 167d
Yeah, I had never heard of it, I generally stray away from video based mediums, but I am a little surprised I didn't come across articles for it, I can only assume that none of the creators I followed covered it.
Although it was kind of funny to see the beginning of that second video, him still trying to do damage control, it looked for a second like he was going to agree that he had screwed up that install because he said it was 100% his fault and then he Backtracked and said that it wasn't his fault and I'm like so close lol.
3abas@lemmy.world · 14 pts · 168d
Solution in search of a problem?
I have never seen a scam call involving sideloading an app on a phone... Why would they whenTeamViwer is in the Google app store?
over_clox@lemmy.world · 2 pts · 168d
Fuck I dunno, I haven't used the Play Store since Covid lockdown. I rather prefer to sideload most apps and avoid Google for the most part anyways.
zzffyfajzkzhnsweqm@sh.itjust.works · 13 pts · 168d
Scammers almost always install remote desktop app from play store. This is just anti competitiveness....
DoucheBagMcSwag@lemmy.dbzer0.com · 2 pts · 167d
Do not redeem
BackgrndNoize@lemmy.world · 7 pts · 167d
This is only the first step, they will keep adding more bullshit like this in the name of security till you end up with a device that's nothing more than a advertisement and user serveilence terminal for google
CorrectAlias@piefed.blahaj.zone · 3 pts · 167d
The problem with this is that most of the apps used in scams are already on the play store. I haven't ever seen a scam which requests the user to download a third party app, although I'm sure it's happened on occasion.
My point is that this won't stop most scams, and primarily cause annoyance for actual power users.
RamRabbit@lemmy.world · 183 pts · 168d
No we didn't win. This is Google making it harder to install the programs you want, rather than the programs Google wants you to have.
morto@piefed.social · 135 pts · 168d
So, we will have to enable developer mode for that? How long before banking and government apps refuse to run if you have "sideloaded" apps installed? This will be the same as not allowing the majority of people to sideload. No win in here, just an advanced strategy from google to make us conform
osaerisxero@kbin.melroy.org · 42 pts · 168d
This is already the case if the developer mode toggle is enabled for some. I have to turn it off any time I'm traveling for work because the app we have to use to file expense reports refuses to run with developer mode enabled.
HuudaHarkiten@piefed.social · 45 pts · 168d
At that point you should tell your work to get a work only device for you... I always refuse to use my phone for work shit. I used to explain to them why, now I just lie and say my device is too old to have anything installed on it.
osaerisxero@kbin.melroy.org · 7 pts · 168d
lmao, no arguments here. My boss's phone got bit by the construction site so I think we might finally be getting some movement on that front, at least for anyone who finds themselves in the field doing shit.
For what it's worth, I don't generally mind using my phone for work shit because it's convenient to do so. MDM on android works in a container, so I don't even care about that if they want to implement it.
HuudaHarkiten@piefed.social · 4 pts · 168d
Yeah I get the convenience of it.
My dad was complaining out loud to his boss, not requesting anything, just complaining about having to bring two phones with him when he was out and about. So his boss got him a dual-sim work phone lol. The convenience can work out that way as well :)
zzffyfajzkzhnsweqm@sh.itjust.works · 2 pts · 168d
But then you have to use their shitty non privacy friendly phone or still use two phones.
HuudaHarkiten@piefed.social · 3 pts · 167d
Yup. I would opt for the use of two phones.
And to be completely honest... Its a bit funny to see people complain about having to carry two phones. I mean I get it, its annoying. Buuuuut, back in the day we used to carry a camera, a cd or cassette walkman and of course the trusty old nokia 3210. And everyone thought it was the height of convenience :D Oh how times have changed lol
Aaaand now I sound like a old man yelling at clouds. I'm gonna go have a nap, I'm exhausted.
picnic@lemmy.dbzer0.com · 0 pts · 168d
Yeah, but I travel for work. I dont want to carry two phones, as the one colpany offers is a shitty samsung a-series and I use graphene on my Pixel
HuudaHarkiten@piefed.social · 1 pts · 168d
Yeah, totally understandable.
I mentioned to the other guy how my dad got a dual-sim phone (not a shitty one) just by sort of mentioning having to carry two phones. I guess some employers are nicer than others :D
RoddyStiggs@lemmy.blahaj.zone · 11 pts · 168d
You should NEVER be using work apps on a personal device. EVER.
morto@piefed.social · 6 pts · 168d
But what if they starting requiring that you remove the sideloaded apps? We're getting trapped
frongt@lemmy.zip · 5 pts · 168d
Or if you're rooted, or run something other than your OEM image. I use grapheneos and I'm lucky that my bank doesn't enforce that like some do. I still can't use cards to tap with Google wallet because it's not certified by Google.
LedgeDrop@lemmy.zip · 8 pts · 168d
I totally agree.
I am so tired of this "slow boil", bs.
SkavarSharraddas@gehirneimer.de · 5 pts · 168d
Yeah, if that process wouldn't need developer mode (or stayed active after disabling it again) that wouldn't be that bad (still annoying). But having to choose between the ability to install apps or use those apps that only work without developer mode certainly isn't a win.
Mynameisallen@lemmy.zip · 2 pts · 168d
Huh I'm unfamiliar with this, but I've been running graphene for years and before that lineage
ThomasWilliams@lemmy.world · 1 pts · 168d
over_clox@lemmy.world · -2 pts · 168d
Riddle me this, why do people use banking apps on mobile devices in the first place? Why put all your financial data in an eggshell just waiting to get dropped or stolen?
Bank cards have had the whole tap to pay thing for quite a while now. I drop my phone, busted. I drop my bank card, it's fine, I just pick it right back up, and it stays in my wallet unless in use, not in my hand where it's infinitely more likely to get lost or stolen.
You want a banking app, do so from your home computer, not a fragile mobile device literally designed to fail if it so much as falls out of your hands.
Anyways, riddle me that...
cecilkorik@piefed.ca · 4 pts · 168d
Because they incentivize it. Some banks are better at incentivizing it than others. My bank for example, allows the highest daily limit (by a factor of 5x) if you use the app. Online banking has a lower limit, and cards lower still. I don't appreciate them holding my own money hostage, but the sad reality we live in precludes me from having enough remaining mental bandwidth and effort reserve to commit it to fighting against it in such an empty and unwinnable battle. Money is a scam anyway.
over_clox@lemmy.world · 1 pts · 168d
I couldn't agree more 👍
grue@lemmy.world · 3 pts · 167d
The only thing I use my bank app for is to deposit checks. It can't be done from the desktop because it needs the phone camera to take photos of the check.
morto@piefed.social · 3 pts · 168d
I don't know how online banking access is around the world, but here in brazil, they made it completely impractical to use from computers by applying artificial restrictions. Some payment institutions doesn't even support access from computers anymore. Meanwhile, accessing from the phones has been made easier and less restrictive, so basically everyone has to do banking from the phone. It has even become a popular thing to have a separate "banking phone" to use at home, but many people can't affort that.
jabberwock@lemmy.dbzer0.com · 2 pts · 168d
In the US, I largely agree with you. Or use a website from a mobile browser. Different story in different countries where a smartphone might be the only compute the average person has, or where state services are tied to a mobile ID or bank app.
Not saying that should be the case, but if the choice is between running niche FOSS apps and removing yourself from societal benefits structures, I know what most people will pick. That's the real danger of allowing one company to own an entire ecosystem and have enough power that they have conversations directly with governments about their people instead of with their people.
Thrawn@lemmy.dbzer0.com · 1 pts · 168d
I have a concrete and very stupid example.
We got a large gift card as an incentive to renew our lease at our current apartment vs moving. The format they sent it in had no physical card and would only work on either online stores or through a service like Google Wallet AKA a banking app on a mobile device as you mentioned.
So to get groceries while waiting on a tax refund (thanks crappy American economy and taxation methods) we had no choice but to connect and use it that way.
over_clox@lemmy.world · 2 pts · 168d
Oh, I have a choice alright, I chose to withdraw all my money and cancel my bank account like 11 years ago, because my bank refused to accept my tax return as a direct deposit. TurboTax had to reprocess it and send my return as a paper check after the bank refused a fucking direct deposit!
Besides, when the electricity goes out for two weeks after a hurricane or other natural or manmade disaster, how you gonna get groceries or gasoline with electronic money anyways? Give me a paper check to exchange for paper money, paper money still spends even when the electricity goes out.
If it's a service that only deals with electronic transfers, well I ain't signing up, and you can just keep that gift card if it requires an app to even use.
Every single day I assume that tomorrow there might not be electricity, it's amazing to me that people have come to rely on it so much and assume it'll always be there.
Ask anyone in Cuba how that's going right now...
Thrawn@lemmy.dbzer0.com · 2 pts · 168d
Oh I have lived outside the USA at one point and I'm well aware electricity isn't magic. There were other places too but Guyana most definitely doesn't have a stable power grid.
I'm not going to starve my kids over that kind of stance on cash only either though.
I can't understand why banks are as stupid as they often are. Why would you refuse money from the federal government. What do you think we successfully stole money from the IRS through a direct deposit?
pirate2377@lemmy.zip · 97 pts · 168d
Microsoft appeared to walk back Recall until they suddenly brought it back unannounced and doubled down. So I'll believe it when I see it
yakko@feddit.uk · 16 pts · 168d
Yeah corpos don't respect consumers or norms of human dignity, they'll just do what they want more quietly if you complain. The only real solution is to break up monopolies (ideally for the last several decades).
SomeDudeFromSpace@lemmy.ml · 87 pts · 168d
We will win when nobody can tell you what you can or can’t put in your own fucking device.
invertedspear@lemmy.zip · -9 pts · 168d
Counterpoint: my software allows you to access your banking needs. I’m financially on the hook if fraud occurs. Fraud occurs because your favorite “slap the monkey” game also installs a keylogger and network monitor. So I don’t allow my software to work if you have that installed.
I think you’re right that companies should not be able to tell you what software you can run, but users also can’t be trusted to keep their devices safe.
A lot of network, banking, and telephony protocols historically rely on trusting that there are no bad actors in the chain. Technology has added more links to the chain increasing the opportunities for bad actors to tap into it.
It’s a situation that needs better fixes. Maybe we just need to hand the current internet over to the bots and start a new one with security and privacy built in from the ground up.
OrganicMustard@lemmy.world · 19 pts · 168d
Android runs apps sandboxed, so no app can access what you write in another like your banking app, or the unencrypted packages it sends.
Pika@sh.itjust.works · 8 pts · 168d
Yea the argument stated works better for rooted environments than rootless environments or sideloading.
In a non-root scenario, you would need to specify a few permissions to give a keylogger that amount of access. I think that a big issue is people not understanding that there is a difference between a rooted device or root installed app, and a sideloaded application.
Just because you have a non-google device or a rooted device != you have a compromised device. Applications aren't going to magically install running as root, every rom worth their salt keeps it a clear isolation between the layers, and some roms don't even allow you to use the root environment after installing it.
In your standard google phone install? A keylogger wouldn't be able to be installed without enabling an accessibility permission. It's not like you can just "oops I just sideloaded a keylogger haha silly me" like described. Both google installed and side loaded applications would require prompting a warning page that very clearly states it allows logging of the screen for the logging part of it to work.
Anivia@feddit.org · 2 pts · 168d
Androids sandboxing is far from bulletproof
https://www.ru.nl/en/research/research-news/new-research-highlights-privacy-abuse-involving-meta-and-yandex
OrganicMustard@lemmy.world · 5 pts · 168d
That one isn't an issue with the sandboxing but with the networking system. Secure browsers have that in consideration and are not vulnerable to meta's tracking.
kkj@lemmy.dbzer0.com · 8 pts · 168d
You're liable if someone shares their credentials? Even if they did it accidentally by installing a keylogger, that seems like user error.
feannag@sh.itjust.works · 8 pts · 168d
Maybe banks could use a way to authenticate the user a second way, that doesn't involve a password. If only. (Sidenote: why do banks still insist on sms 2FA?)
Zak@lemmy.world · 2 pts · 167d
Their wish to break the first rule of network security (you can't trust the client) shouldn't be everyone else's problem.
MisterFrog@lemmy.world · 1 pts · 165d
If your software runs on windows or MacOS, this point is such bull, sorry.
Do you monitor what software people have installed accessing their banking needs on those platforms?
aesthelete@lemmy.world · 82 pts · 167d
Can someone please come out with a phone that's an actual computer and help stop this nonsense?
Phones cost a lot of money at this point and I'm completely sick of them being some locked down, surveillance ridden pile of crap. A reasonably built one would be able to replace a laptop at this point if it weren't for these artificial constraints imposed by the stupid fucking suits running things.
prole@lemmy.blahaj.zone · 27 pts · 167d
Valve should make a Linux phone. Smaller Steam Deck with a modem
Martyy@lemmy.world · 2 pts · 166d
j0ester@lemmy.world · 1 pts · 166d
There was an Ubuntu phone. It failed.
TrippinMallard@lemmy.ml · 8 pts · 167d
Battery life is limited by cell modem drivers being closed source and having to be reverse engineered.
I have been looking into an alternate hybrid radio device using Reticulum. Though with that comes a new less convenient user experience for a lot of apps.
muusemuuse@sh.itjust.works · 2 pts · 167d
I like the idea of a continuum capable module desktop like canonical and Microsoft promised years ago.
HexaBack@lemmy.blahaj.zone · 7 pts · 167d
furilabs flx1s. I'm using one
Fontasia@feddit.nl · 4 pts · 167d
https://www.www3.planetcom.co.uk/astro-slide-5g
This sounds up your ally
communism@lemmy.ml · 3 pts · 167d
Pretty sure they meant a smartphone with a desktop OS installed on it (eg Linux phones), not just "phone that looks kinda like a laptop but still uses Android"
Fontasia@feddit.nl · 4 pts · 167d
https://www.www3.planetcom.co.uk/devices-specification
That's why I recommended this, their devices dual boot Android or Linux. One of their older devices quad boots by default
This isn't a fly by night operation, it's got a loyal fanbase, and good hardware and software support. They've been manufacturing for a decade, before that this guys were doing PDAs.
Kailn@lemmy.myserv.one · 3 pts · 167d
There, exacly what you want.
Here's a more budget one.
GPD has been making "mini laptops" for a long while, now they try to make similar gaming handheld.
I'm not sponoered nor I've bought this for myself. (yet)
kepix@lemmy.world · 1 pts · 167d
dude. you can just install a custom rom.
ranzispa@mander.xyz · 4 pts · 167d
As long as your phone model is supported by any custom mod. I have checked compatibility for almost all smartphones I owned, some 7 or 8 through the years.
Not a single one of them was ever supported by a custom mod.
kepix@lemmy.world · 1 pts · 166d
but you did not check custom rom aupport before you bought tgem, cause did not want freedom and moddability. its on you.
ranzispa@mander.xyz · 2 pts · 165d
I consider price and technical specifications. I don't have 200€ to spend on a phone. Most phones I bought were less than 100€ new. What I care about a phone is that it supports two SIM cards.
With such constraints, choice is quite limited unfortunately.
Is it worth having a free device? Indeed. Is it worth spending 4 times the price just for that? Not to me.
muusemuuse@sh.itjust.works · 2 pts · 167d
Intentionally non-standard hardware does not get a real custom rom. It’s just a mod of Android which Google can render intentionally incompatible any time they want
kepix@lemmy.world · 1 pts · 166d
not like linux phones are super compatible
osanna@lemmy.vg · 77 pts · 168d
It’s not side loading. It’s installing software on the device you probably paid multiple thousands for that you no longer own.
Zoomboingding@lemmy.world · 3 pts · 167d
Multiple thousands!? My phone was like $250
signup@sh.itjust.works · 9 pts · 167d
not all people are americans
jeffep@lemmy.world · 7 pts · 167d
That's multiple thousands in some countries
Mynameisallen@lemmy.zip · 4 pts · 167d
Lol same, I spent $250 on a used pixel 8, threw grapheneos on it the day I got it. Honestly my dream scenario right now is that sailfish let's me just purchase a sailfish X license for a community port
paultimate14@lemmy.world · 2 pts · 167d
Congratulations!
Shellofbiomatter@lemmus.org · 1 pts · 167d
Multiple thousands!? No phone isn't worth that much. Bloody marketing brainwashing people into accepting exorbitant prices for everything.
zod000@lemmy.dbzer0.com · 75 pts · 168d
This isn't a win, this is Google making things shitty for the benefit of no one but themselves.
smeg@infosec.pub · 72 pts · 168d
FaceDeer@fedia.io · 37 pts · 168d
A classic case of making a ridiculously restrictive change, then "walking it back" to a merely semi-ridiculous change and having everyone sigh in relief.
XLE@piefed.social · 10 pts · 168d
Just like Anthropic and OpenAI's willingness to kill people en masse, then walking it back to a nonexistent standard.
freeman@sh.itjust.works · 1 pts · 168d
And creepily walk it forth step by step.
SuspciousCarrot78@lemmy.world · 4 pts · 168d
puppycat@lemmy.blahaj.zone · 1 pts · 167d
SuspciousCarrot78@lemmy.world · 1 pts · 167d
commander@lemmy.world · 66 pts · 168d
Still worse than it was before. There's no win in that
ExLisper@lemmy.curiana.net · 55 pts · 168d
I'm writing an app that I will distribute only through f-droid. The people I would like to share it with are typical, non-technical android users. Before those changes I could just send them a link to f-droid apk and explain it's just another app store or send a link to the apk directly and probably most of them would be able to install it. Now I would have to tell them to do all those weird things first, things that look suspicious and that they would not understand the purpose of. I don't think anyone will be wiling to do it. This is not a win. The effect will be exactly the same - serious limits on distributing apps though alternative channels.
kilgore_trout@feddit.it · 55 pts · 168d
To call the install of apps of your choice as «sideloading», means that they have won.
zarkanian@sh.itjust.works · -6 pts · 167d
That's the name of the command, though. It's
adb sideload. Anything else is installing.entwine@programming.dev · 19 pts · 167d
That's not even true. If you install an app through adb, the command is
adb install <path/to/app.apk>adb sideload is for installing OTA packages
Source: https://android.googlesource.com/platform/packages/modules/adb/+/refs/heads/master/docs/user/adb.1.md
signup@sh.itjust.works · -4 pts · 167d
bs, i did install apks before using
adb sideloadit worksentwine@programming.dev · 7 pts · 167d
I don't know if adb sideload will fallback to a regular install, maybe it does as a convenience for people who don't read the docs? In any case, you said:
And I demonstrated that you're wrong by linking to the official man page (aka the docs) directly from the master branch of the public git repo. Here's the relevant part which describes the sideload command:
signup@sh.itjust.works · -5 pts · 167d
idc what those stupid docs say. i know i installed apps with that command before
communism@lemmy.ml · 3 pts · 167d
And I've installed apps with
adb install file.apk, your point?signup@sh.itjust.works · -3 pts · 167d
the docs about
adb sideloadis wrong. thats my point bec they dont say you can install apps with itdogs0n@sh.itjust.works · 4 pts · 167d
Exactly?.......
kilgore_trout@feddit.it · 0 pts · 166d
As someone else explained, it is not. The command is
adb install.zarkanian@sh.itjust.works · 1 pts · 166d
Why did you feel the need to say it, too? You aren't adding anything.
kilgore_trout@feddit.it · 0 pts · 165d
What is this comment of yours doing, then?
sonofearth@lemmy.world · 43 pts · 168d
Zoomboingding@lemmy.world · -5 pts · 167d
Reading the article it looks like they found a decent middle ground. It lays out how the steps help prevent people from getting scammed.
communism@lemmy.ml · 5 pts · 167d
The middle ground is the middle ground between user freedom and corporate control. Which is not a spectrum you want to be in the middle of.
This is like getting a pay rise that's below inflation. That's a pay cut. And this is a loss.
xcjs@programming.dev · 43 pts · 167d
I do not consider this a win, and I will continue applying pressure where I can.
Appoxo@lemmy.dbzer0.com · 1 pts · 166d
Please share how
xcjs@programming.dev · 1 pts · 162d
CubitOom@infosec.pub · 39 pts · 168d
"side loading" == installing
icedaemon0@lemmy.world · 6 pts · 168d
icedaemon0@lemmy.world · 1 pts · 168d
entwine@programming.dev · 39 pts · 167d
If antitrust was being enforced, Google execs wouldn't even dream of attempting this bullshit.
Antitrust regulation is probably the easiest way to fix the biggest problems in our society, it is 100% bipartisan, and it is easy to explain to the average US voter. The only group that is against it is the billionaires/ultra wealthy. Instead, politicians are all hyperfocused on culture war mudslinging and bullshit that makes no difference.
Break up Apple, Google, Microsoft, Amazon, and Meta (just to start), and watch how the tech industry explodes with innovation again, and the tech billionaire becomes an endangered species. The AI bubble will burst as companies actually need to compete to survive, and thus won't be burning as much resources on crap that clearly doesn't work.
Fedditor385@lemmy.world · 38 pts · 167d
I, as the owner of my device, don't want to wait 24h.
I hope this will popularize the ROM community again. It gradually faded out due to mainstream ROMs having every perk of the custom ROMs but now the custom ROMs can start offering freedom, which no official ROM will offer.
aquovie@lemmy.cafe · 3 pts · 167d
Is there a tap to pay system that works on custom ROMs? I thought those really required SafetyNet/PlayIntegrity/Whatever-it-is-now.
I would rather not give up tap to pay but I will if I have to. It seems like trying to Magisk my way into getting Google Wallet to work would be a PITA.
Fedditor385@lemmy.world · 1 pts · 159d
Pardon my ignorance, but physical cards are tap-to-pay since it exists, no smartphone needed, and as a bonus, you don't need to think about your battery dying before you need to buy something. It's a problem of extreme convenience, not something you depend on in any way. An alternative could also be a smartwatch, which you can set up tap-to-pay on, so you can have a custom ROM on your smartphone and pay with your wrist.
signup@sh.itjust.works · -5 pts · 167d
then dont. adb is instant
Scrollone@feddit.it · 10 pts · 167d
Why would I need a computer to do something that the computer that I already have in my hand can and should do?
signup@sh.itjust.works · -6 pts · 167d
bec malware. people get hacked on android and make google look bad.
KillerWhale@orcas.enjoying.yachts · 4 pts · 167d
Because google is so productive about eliminating malware from the play store and all of its scam advertising. This is not about protecting the vulnerable, this is about control and forcing people into their ecosystem.
Tiger_Man_@szmer.info · 33 pts · 167d
""""sideloading"""", oh look who cant say installing software
techt@lemmy.world · 16 pts · 167d
"Sideloading" is the "jaywalking" of the mobile space
fodor@lemmy.zip · 31 pts · 168d
Of course we didn't win. the more hoops you have to jump through, the fewer people who will install their own apps and then you lose all of the community support. And Google didn't promise not to change their plans in the future. So you know that they'll promise this now. Maybe they'll backtrack a little if they have to and they will try to ratchet things up six months later anyway.
Real solutions involve either breaking up monopolies or breaking up monopolies, which is why some of the other cell phone vendors' actions recently look positive. If there are two versions of Android that are popularly used, then the banks will have to support both of them and then everyone can run away from Google whenever they feel like it. But if there's only one popular version and Android itself gets more and more locked down then that is Google seizing the entire market and they will cut out all of the other cell phone manufacturers as soon as they can. that will be just as bad as Apple.
org@lemmy.org · 31 pts · 168d
Time for another OS. Android is over.
BennyTheExplorer@lemmy.world · 6 pts · 168d
Postmarketos is looking pretty promising right now.
mannycalavera@feddit.uk · 4 pts · 168d
The year of the Linux phone is upon us brethren!
ThomasWilliams@lemmy.world · 2 pts · 168d
You can't sideload on Linux...
org@lemmy.org · 1 pts · 168d
Almost got me..
18107@aussie.zone · 27 pts · 168d
The square app will not run on a phone that has developer mode enabled. I turned developer mode on to disable annoying animations, so now I can't take card payments unless I carry around a second phone.
If Google goes through with this, my payment phone won't be able to run any third party apps.
Giloron@programming.dev · -3 pts · 168d
As someone who occasionally goes to markets and pays someone using Square, I think I'm happy with that.
Now that you mention it I'm surprised single purpose phone isn't required like needing dedicated Internet for registers. Or did they finally fix that to allow VLANs?
Jorn@sh.itjust.works · 26 pts · 168d
My galaxy will let me install but then I get this when I try to run the app:
Scrollone@feddit.it · 27 pts · 168d
Disable Google Play Protect. It's a scam that doesn't protect you at all, it just gives more control to Google.
entwine@programming.dev · 15 pts · 167d
Google Play Protect is designed to protect Google Play from competitors
yakko@feddit.uk · 10 pts · 168d
Christ
darkmogool@feddit.org · 4 pts · 168d
I had this too. I installed it from playstore but maintain the software now via aurora. So far it works…
jjlinux@lemmy.zip · 25 pts · 168d
So fucking glad that GrapheneOS will probably be available for the new Motorola phones next year. I've been on pixels since they were Nexus, and if not for GrapheneOS, I would have jumped ship after the Pixel 4 and moved to Crapple.
maplesaga@lemmy.world · 5 pts · 168d
I too am excited. I wish they'd just put it on a flagship Motorola now so I could buy it.
jjlinux@lemmy.zip · 3 pts · 167d
I feel the same way. As a matter of fact, the moment I heard about the partnership, I started researching the possibility for either the current signature or the razr ultra (I think that's the name), but it's confirmed the hardware is not up to GOS standards. We're basically stuck until next year.
SuspciousCarrot78@lemmy.world · 22 pts · 168d
h4arts@lemmy.blahaj.zone · 22 pts · 167d
still just not gonna update my phone for a while until they've for sure have allowed side loading. Got my pixel because it's just a nice phone, and i can put graphene on it when it's paid off. Half of my apps are all from f-droid, too.
freddo@lemmy.zip · 7 pts · 167d
You cannot install graphene until it is paid off?
mememuseum@lemmy.world · 16 pts · 167d
Some carriers lock the bootloader until you've paid off the phone.
Phones produced for sale through Verizon have a permanently locked bootloader.
Archr@lemmy.world · 7 pts · 167d
Fuck Verizon for this exact reason. Never buy from them direct if you can help it.
mememuseum@lemmy.world · 4 pts · 167d
Didn't realize this when switching. Went through a whole kerfuffle to cancel the trade in deal.
Phone agent sounded perplexed when I wanted to keep my old Pixel 7 Pro lol.
dependencyinjection@discuss.tchncs.de · 2 pts · 167d
Why is that?
Would you be able to change the IMEI as I would have thought those were encoded on the hardware chip. If you could it means they couldn’t blacklist the phone if you stopped paying.
Paying you can spoof it
h4arts@lemmy.blahaj.zone · 4 pts · 167d
xfinity locks the bootloader until you get your phone paid off and you call them to get it unlocked
umbrella@lemmy.ml · 22 pts · 168d
JoMiran@lemmy.ml · 19 pts · 168d
db2@lemmy.world · 18 pts · 168d
I don't care if it's android or anything else, the moment my phone does that is the moment I switch to something else.
hark@sh.itjust.works · 16 pts · 168d
Yup, I got a pixel 10a that I will be putting graphene on as soon as it releases.
Lost_My_Mind@lemmy.world · 6 pts · 168d
What if both android and iOS do this?
bdonvr@thelemmy.club · 7 pts · 168d
!linuxphones@lemmy.ml
Lost_My_Mind@lemmy.world · 3 pts · 168d
Is there a non-lemmy.ml variant?
bdonvr@thelemmy.club · 2 pts · 168d
I mean it's been around the longest and has the most subscribers. Most people only look at that, and I feel like arbitrarily splitting communities is actively harmful to the fediverse. Competing communities confuse and drive away new users.
HuudaHarkiten@piefed.social · 3 pts · 168d
lol one of the first things I read here, after making my account, was that everyone should block .ml apparently because communism? I dunno, its all very confusing and new for me.
frongt@lemmy.zip · 3 pts · 168d
No, because the people there are generally obnoxious, trolls, tankies, or all three. Nothing to do with their views on government economic policy.
HuudaHarkiten@piefed.social · 1 pts · 168d
Yeah I wasn't being completely serious with the "communism" bit.
bdonvr@thelemmy.club · 2 pts · 168d
Yeah people are weird about it. I've never had any systematic issue from .ml
HuudaHarkiten@piefed.social · 2 pts · 168d
Usually takes a few decades after a world war for systematic issues to arise from that stuff.
Huehuehue.
protogen420@lemmy.blahaj.zone · 1 pts · 168d
iOS is malware why are you even suggeating it
Goodlucksil@lemmy.dbzer0.com · 17 pts · 168d
"Scammers" also exist on the Play Store. Google should start by cleaning it up.
favoredponcho@lemmy.zip · 15 pts · 168d
Itdidnttrickledown@lemmy.world · 14 pts · 168d
with a 24 hour delay guarunteed to punish anyone who wants to have their device their way.
shortwavesurfer@lemmy.zip · 13 pts · 168d
I haven't read the article yet, but I'm about to. But no matter what, I'm still looking a lot more seriously into Linux on mobile, such as PostmarketOS than I was before.
gergolippai@lemmy.world · 11 pts · 168d
the win in this is that many people realise how locked google has made android and how blatantly and arbitrarily google exerts their control over it. hopefully that will be input to some consumer decision (when sailfish becomes an alternative) and a tiny bit more people will consider their choice when getting a new phone. and maybe it also helps some regulation to be agreed (in europe, obviously).
XLE@piefed.social · 10 pts · 168d
I want an extra day added to the warranty of any device I purchase, as it will be useless during that time
tabular@lemmy.world · 9 pts · 168d
Software freedom or demise. While Google is capable of imposing anything then Android is already dead to me.
webkitten@piefed.social · 8 pts · 168d
SkavarSharraddas@gehirneimer.de · 8 pts · 168d
Not if it's implemented in the Google Play Services, then every device will refuse to install unverified apps after the deadline, even if it's not on the newest Android versions.
Rentlar@lemmy.ca · 8 pts · 168d
If the process doesn't include any phone home stuff, and is just a one-time cool off period to prevent scammers, this is acceptable to me. That should be enough to get potential victims to self-question, ask more knowledgeable people of what's going on to avoid being unknowingly hacked, without being naggy every time for users that want to do what they want.
Making a software "foolproof" will probably invent a bigger better fool, hoping for some sort of free crypto app jumping through these hoops, but this should weed out most of the basic scams.
Wildmimic@anarchist.nexus · 18 pts · 168d
It still sets your phone in a state that marks it as security compromised. This could lead i.e. to banking apps not working. I'm not so sure about the "acceptable" state of things here.
Rentlar@lemmy.ca · 1 pts · 168d
Yeah, I take issue with that, but I don't think it would be used if people complain to banks that reading the flag bricks the app.
gwl@lemmy.blahaj.zone · 4 pts · 168d
Sounds to me like you're willing to give up liberties in exchange for comforts, that's always a bad idea
Rentlar@lemmy.ca · 2 pts · 168d
I tend to favour privacy over big tech control, but I recognize we have to at least consider the cost-benefit of these tradeoffs, to live in a society. Of course I'd prefer a phone with no warnings, no nagging, if you get scammed that's my fault and I will keep my phone that way if it means I will stay off Android 15 and de-Google my next phone. But Google's plan is within the realm of an acceptable compromise to me because sideloading is still available to everyone without registration with Google. Each person will feel differently about it.
Taking your position to the extreme, if trading liberty for comfort is "always" a bad idea with no exceptions, you can turn off your phone and do without the comfort of it. (Only saying this because always is the word you chose to use.) To accept cellular and home internet services to communicate in the public realm requires you to give up some level of privacy, though of course it can be possible to stop a lot of the unnecessary surveillance that happens along with the necessary tradeoff.
freeman@sh.itjust.works · 1 pts · 168d
No the scammer will simply point out that the warning is about scammers and not him, your friendly MS tech that called to help solve a problem you didn't have.
Scams don't rely on tech.
Rentlar@lemmy.ca · 1 pts · 168d
The scammer is not going to be on the phone with the victim for 24 hours continuously.
freeman@sh.itjust.works · 2 pts · 168d
He doesn't need to.
freeman@sh.itjust.works · 7 pts · 168d
Then make the wait period a week, a month. Have this privilege expire every so often etc.
Try to pull warranty shenanigans if you ever went through the process.
Bloefz@lemmy.world · 6 pts · 168d
What do they mean reauthenticate after 24h? I can't authenticate as I don't have a Google account. Although I do unfortunately have Google play installed, my phones can't have it removed.
SkavarSharraddas@gehirneimer.de · 5 pts · 168d
Whatever you use to login, password / pin / pattern / body part.
Rekall_Incorporated@piefed.social · 4 pts · 168d
Nah, American companies cannot be relied upon by definition. Even if the people running one are fine (and many are), they are still based in what is essentially a pro-crime, pro-corruption jurisdiction.
artyom@piefed.social · 4 pts · 168d
Its seems fine, other than the whole "coaching" thing. Like, nobody knows how to do this today, so someone will have to "coach" them through it, even if it's Google themselves.
But I would wait and see exactly how it's implemented before calling off the resistance. And I wouldn't call it a "win", that would be then backing down entirely back to what they were already doing.
mrgoosmoos@lemmy.ca · 4 pts · 168d
at best this is not losing at this very moment
shortwavesurfer@lemmy.zip · 4 pts · 168d
I think the 24 hour wait is at least a sensible alternative. Anybody who's going to be seriously installing apps on their devices like this is probably going to be using Lineage OS or Graphene OS or /e/OS or something like that anyway. And in that case, they will be using AOSP and not be subject to this because they're not running a Google certified device.
While I'm not particularly happy about this change, I think it could be way worse.
Something tells me that Google drastically underestimated the amount of pushback they were going to get when they announced this. I mean, very drastically underestimated.
DonPiano@lemmy.ca · 1 pts · 168d
This is a premature April Fool's joke, right?
nutsack@lemmy.dbzer0.com · -4 pts · 167d
nobody here read the part where side loading was never going to be disabled
Auli@lemmy.ca · -6 pts · 167d
I don't know. For one in don't noble how bad the problem is and the that the big thing. We who install apps are not the target for this issue. But the 99% of other people who can fall for these scams is who this is for. And I can handle a little in convince if it stops some scammers from cleaning out peoples life savings.