This is not related to malware or scams, and using that is nothing but a PR smoke screen.

While Android is vulnerable, especially to user stupidity, people mostly get scammed by fake credit card charges or by giving access to their notifications and contacts allowing for spam.

And yes, while there are "infected" APK's for popular apps , this again isn't the case here.

The real case here is money.

Apple earns $27B from commision on apps, while Google earns about $3B. Why?

Because Android users are "less willing to pay", which includes pirated APK's and "unlocked" app versions. Eliminating the possibility of using these for 99% of the people will be enough to force them to pay for that app/service in the end, raising the Play store revenues.

Do not trust Google when it comes to "doing it for the user" - their mission is to establish as strong of a monopoly on the platforms and extract as much value as possible. They spent more money on lawyers & policy lobbyists in the last 10 years trying to keep Android closed than some S&P500 companies are worth.

Their incentive is even stronger: most users of ReVanced for example unlock YouTube, which belongs to Google. In that case we are talking about 100% revenue loss, not 30% app commission. This goes for NewPipe, etc.

I wonder if OsmAnd, Termux, F-Droid would survive this or will be casualties. Who will authenticate for a decentralized open source app that has 100 active contributors?

Exactly, especially when Google can revoke your account or keys at anytime.

Basically this give Google the way to blacklist any app you release now, in or out the play store for the sake of "security".

It's just about control and finally squashing the app that aren't to Google taste.

I can't image that ad blockers or ReVanced has any real impact on YouTube. I'm the only one I know using either. So that's 1 in about 300 maybe?

Locking down Chrome and killing ad blockers is not some huge effort, it's closer to the flick of a wrist. Neither is locking down android. They can just do it. And if they think there is nothing anybody can do about it, they will, to get that last 0.01%.

But no doubt they are under an enormous amount of pressure to do this from a variety of corporations and governments as well.

Well of course they are not "doing it for the user" but that would be a different discussion if scams and malware were out of the picture.

Doesn't this kill two birds with one stone?

Forcing users to pay for apps rather than install pirated APK's and unlocked apps both raises Google's revenue and reduces the risks of malware and scams.

The consequence is naturally, the savvy users who know how to avoid risks lose the ability to have more control over their phone.

This assumes that Google actually does reduce malware and scams within their garden, but they do not. They are just as prevalent (perhaps more so) within the apps that Google certifies.

So the only thing it kills is the risks to Google's revenue, not the risks to users' security.

My opinion on this changed as we helped elderly parents with declining capabilities. The internet is an extremely dangerous place for those less cognitively able.

It is extremely hard to live without the internet - it's almost impossible - everything from your bank to your doctor to restaurants to the barber that wants to be paid by Venmo. Taking away your parent's internet connection is even harder than taking away their driver license. (And also more isolating.)

There is no law enforcement; there's no consequence for scammers; there's no technology stack that is safe for the less able. It's a brutal Wild West where the weakest are attacked without recourse, flooded with misinformation and lies, and targeted by significant financial scams.

Okay and how does play protect and play integrity prevent this? Anyone?

Hint: it does not. Look around the play store, it's 80% malware and scams.

Why is this the case? Because it has to be or Google goes bankrupt. Google is an inherently parasidic company. They make their money off of advertisement, scams, and conjobs. The more shit the digital world is for you, the better for them. You will always have an adversarial relationship with Google.

They don't want ads that don't lie. They don't want apps that are honest. They don't want to limit notifications. They don't want to get rid of email spam.

The reason Apple devices are so much more pleasant for everyday use and there's so much less scams and adware isn't because Apple is a saint. Its because ultimately Apple doesn't give much of a fuck if they screw over con artist, because that's not the thing keeping them from bankruptcy.

Thank you! Apple is just as evil as the next company. The difference is in how they make their money and what their incentives are.

Google has chosen the path of duping their customers by selling them to the highest bidder. That's their business model across the board.

Apple has chosen to sell devices at a significant markup with the inherent agreement that they won't sell their customer to the highest bidder. After building trust in that arena for years, it wouldn't take much to destroy that credibility. So far, they know this. I'm getting concerned about them starting to plug ads into their core applications, so only time will tell if they get MBA'd to shit.

Yes, but this doesn't do absolutely anything to prevent this.

I've helped elderly family members and non-techie ones who barely know how to open a facebook account - none of them had "malware apps" installed. Their problems were mostly these:

- Websites asking for notification permission just to spam with unrelated malware or porn notifications

- Their calendars being filled with events that are nothing but links to porn or gambling sites, leading to constant notifications

- Apps that don't work yet are filled with ads - blood pressure meter on your phone, sugar level measurements, step trackers - filled with ads and trying to get 1000$ purchases

- An app actually being a launcher filling your screen with ads.

- Hell, even I, as someone who has deep intimate knowledge of Google Play Billing, got scammed by an app when upgrading from their weekly to their monthly offer, with them now charging both.

Google can intervene at any point here, they have reviewers, they control the store, they control the browser, hell, they basically control the device. And they have rules and policies for it, but it's convenient for them to ignore it. They have their cash cows and will fight tooth and nail to protect them as long as it makes them profit.

> Websites asking for notification permission just to spam with unrelated malware or porn notifications

People have been giving Apple shit forever for not supporting this "web standard" in Safari, but it's 99% used nefariously for this exact purpose. Websites should not be able to send push notifications.

I do not want websites to have equal capabilities to apps. Installing an app on my device is a very purposeful decision I make that I only do if I'm trusting it and willing to manage its permissions. Visiting a website is not.

I set my parents up with a computer and locked it down nice and good. A few months later they called me asking me about this full screen message they couldn't figure out how to make go away that was demanding they call Apple or Google for tech support.

I was able to remote in and close it. Then I noticed the message saying uBlock Origin had been disabled in Chrome (because Google broke ad blocking).

Thanks Google.

I actually filed a complaint with the WA Attorney General over that. My older parents got hit by that exact process. So there’s at least a public record complaint that Google is now actively blocking cybersecurity technology (because that’s what adblocking software ultimately is).

Driving is also extremely dangerous for the less congnitive able, that doesn't mean that we should let BMW decide where and when you are allowed to drive.

We also don't trust old people to live on their own, that doesn't mean we force every adult into dormitories.

Driving is licensed and regulated by the government. Are you suggested internet licenses that required semi-regular tests and strict enforcement by governments?

Is driving regulated because drivers can seriously harm themselves, or is is because drivers can easily harm others?

Yes aaand yes.

Interesting choice to cherrypick and then straw man one part of one example. They didn't say the government should get to decide where someone drives; it was the OEM, BMW in their example. That is basically what Google is doing here by locking down a previously open-ish platform.

Having a license doesn't mean you are restricted in where you can go unless we start considering the fringes like provisional (learners') permits complete with curfew. Therefore, your example doesn't fit. But OP's does, because it is equivalent to asking "do you think your refrigerator should refuse to cool items manufactured by an entity it doesn't like... to Keep You Safe(tm)?" Maybe you buy from non-verified cottage industry workers at the local farmers market. People who maybe didn't upload their PII and licenses to the refrigerator manufacturer, so it refuses to operate until you remove the offending item. Out of the utmost respect for your safety, of course.

Imagine if Charter Communications/Spectrum decided to block you from using their service and modem/routers from accessing any media created by Universal (owned by their rival, Comcast). It doesn't really have anything to do with safety, but they could pearl clutch and blame it on some risqué content that Universal releases via its imprints.

Then maybe it should be more opt-in. We're losing settings and configurability as time goes on. And like encryption it can be a one way street, requiring a full reset to turn it off. That's open security. This is a cash grab

you're describing the dangers of the open internet, but this is about the dangers of non-app-store apps. android already makes it quite difficult to side-load non-app-store apps; certainly not something a tech-illiterate user could do by accident.

> Tell that to all those assholes that are making malware and scamming society on billions.

So like Google?

Software that acts against the wishes of the user is malware, let's not forget that.

Completely agree. We seem to have forgotten the word "spyware", I don't see it used anymore because it became the norm. But let's call things by what they are.

Exactly this; the vast majority of people cannot be trusted with root access. And for those that can, the majority won't need or want it.

While I do believe root access should be possible, it shouldn't be easy. Because I'm confident my dad who wants to pirate F1 instead of pay for whichever overpriced premium streaming platform bought the rights this year would root his ipad and install a dodgy stream player if it was easy.

My 75 year old mother has root access, and she is perfectly fine.

> Tell that to all those assholes that are making malware and scamming society on billions.

And then? I don't know how many times I've downloaded APKs, including obviously malicious ones by accident. But not once has it ever been installed - not even when it was deliberate. The only way I ever 'sideloaded' anything is using 3rd party stores (just fdroid and aurora in my case), which themselves had to be installed via ADB after enabling developer mode. If you have that much skill, you're almost surely skilled enough to understand the security implications of sideloading and choose wisely.

And there are far worse malware available on play store than anything on fdroid repositories, if anything at all - anonymous or not. I hope you remember the SimpleMobileApps fiasco. People who installed it from fdroid were safe from the malicious update, but those who did it from play store were not, when the entire suite was turned into a spyware overnight. Not to mention the tea and boxscore apps scandal. Neither would have made it into fdroid. Google cares the least bit about security, if that isn't clear from the spyware tht each new android phone comes bundled with.

In all, Google's claim of security here is deceptive and farcical. The actual target is going to be the patched apps like revanced, root access software and anything else similar that allows the savvy user to escape the unfair and arbitrary limitations imposed by Google. The ultimate target is the users' pockets. This entire discussion is full of people reaffirming that conclusion. But scapegoats will be found and sacrificed regardless. Let's just not for once. Google deserves the atmost and undiluted contempt and condemnation for their greed and their willingness to erode consumer rights that underlie such dishonestly worded hostile and unilateral decisions.

To install 3rd party APKs on Android involves deliberately removing some guard rails. You need to allow it in settings, you need to enable developer mode, you need to agree to each individual source as a trusted source. If people are still blaming malware on this, when malware exists in the actual Play store, then they're delusional.

Right now, the average Joe can't click a link and install a 3rd party app. Meanwhile, you can install malware from the actual authorised sources, or even just come across a vulnerablity in chrome.

Keeping your devices up to date with security patches will save orders of magnitude more people from malicious software than stopping 3rd party app installation.

I occasionally develop Android apps for myself (mostly out of curiosity and experimentation, but sometimes out of a need for some particular functionality). I'm not going to apply for some developer permit and verification just to do this. I may as well buy a damn iPhone.

> You need to allow it in settings, you need to enable developer mode, you need to agree to each individual source as a trusted source. If people are still blaming malware on this, when malware exists in the actual Play store, then they're delusional.

To be fair to the security folks at Google, people will follow these steps like clockwork. The only thing they care about is getting the app on their device.

The root cause of all of this: banking/finance/payment apps figure they can trust your device, because no one has regulated a universal trust root into existence. Google encouraged this with SafetyNet/Play Integrity, and convincing Visa/MasterCard that devices can be trusted for contactless payments.

Now there's one gaping hole left: you can still install unverified software from anywhere, and said software will use all tricks possible to convince users to grant accessibility permissions and give up the keys to the kingdom. There have been many attempts over the years to make this harder, but malicious apps are getting even more sophisticated, to the point of installing shortcuts to entire fake versions of your banking app on the home screen.

So Google is being pressured by governments and markets to make it harder to produce installable malware, when a better way to prevent malware while protecting user freedom is already here: passkeys. You cannot steal passkeys with a third-party app, no matter what tricks you try, because they are tied to domains and APK signatures. Stop trusting stealable credentials and you stop needing to trust the entire hardware and software stack behind the app calling your backend.

I think we should actively make the web more hostile again.

Google themselves promotes malware - take a look at the play store. Adware, adware, adware, name meant to confuse people, more adware, probably has a keyloggers, adware adware, probably steals your data, adware adware.

For fucks sake, Meta is at the point they're pulling malware tactics to sell ads.

Circumventing permissions for app to browser talking? Really? FOR ADS? Thats where we're at?

I'm over it. Anyone who thinks this has even the faintest thing to do with malware is legitimately delusional. Not misinformed, delusional.

Malware is not a huge problem that requires restructuring the entire ecosystem to be closed and authoritarian. Nobody I know has ever had problems with malware or scams on Android.

This has nothing to do with malware, and has everything to do with locking down the Android ecosystem to keep out competitors to Google's services.

Take away all these freedoms and users will still get scammed. It doesn't help and it's not the real point.

I know literally 0, 0 people who have installed malwares or had their smartphones hacked in their life times.

The very few I know that have had this happen where all computer users, and virtually all victims of social hacking such as "hey, I'm from IT department, sending you an email, could you please...". A friend of mine exposed sensible data of thousands of customers of her bank like this.

well, as someone working in a department that also has Fraud detection responsibilities, the amount of users that lose tons of money because of scam apps, spoofed apps, identity stealing apps, is big. Like insanely big. I am all for it that these apps get significantly harder for the average joe to install or run on their phones.

It's a considerable number well into the 8 figures $/year that we have to cover (Granted this number is not specifically smartphones, also includes desktops, but I know smartphones is the bigger piece nowadays.)

(insuring this is near impossible, there is always a large part risk we have to pay ourselves and cannot cede to a reinsurer)

The problem isn't play protect or whatever the fuck, because 80% of the play store is malware, adware, and spyware anyway.

The problem is actually Google and other big tech.

Let's consider: why are users installing so many apps?

Because, on desktop, this doesn't happen. We don't ask people to download and run an EXE to look at their friends funny cat photos. No, we open the web browser.

The reason we have so many apps on mobile is because we require the malware. Google requires the malware. We need to be able to run privileged and unsandboxed code on users devices and this is the world that Apple and Google have created.

Users shouldn't be fucking downloading apps for 90% of the stuff they do anyway - including the non malicious apps! But they do, because they have no choice.

Think about it. Provide a web interface and miss out on juicy spyware? Or install executables on your customers systems? Apps are far too enticing for big tech.

it's very common in india

> scamming society on billions

so somehow my friends and family got hacked, lost money but don't know about it?

actually i know of one case where my mom got billed for airbnb even tho she didn't book the ticket but pretty sure I had her password in a text file so might've been me that got hacked on my PC.

Airbnb refunded her and then had no more issues. So 1 case in my entire life and it probably wasn't on a mobile device.

You can get hacked without losing money. If you devices gets used in a bot net, if your computer gets used to mine crypto, etc. Your work files gets stolen by hackers and sold to competitors in china, etc.

All those are things normal people wont notice.

> bot net

Fair enough, but besides mail spam which is filterable and DDos for which there are counter services, does it really impose that big of an issue to justify such a strict lockdown?

> mine crypto

Considering how little mining power mobile devices have and how anyone would figure out pretty fast there's a problem with heat / battery issues from it idk if that's really realistic these days. Hard to keep this one hidden while also profitable

> work files gets stolen

I think this has already been solved by corporations on PCs, there are already solutions for locking down a work issues laptop as for phone I think that's rarely an issue since people mostly use it for communications so probably rare for really sensitive info to be on there.

Overall those issues don't really hit me as that critical to impose such measures and there are ways to severely limit impact for people that care about security

In reality plenty of people access their work on a private computer too.

> Considering how little mining power mobile devices have and how anyone would figure out pretty fast there's a problem with heat / battery issues from it idk if that's really realistic these days. Hard to keep this one hidden while also profitable

I mean, check out HiddenMiner, ADB.Miner, HummingBad, WireX…

I agree that this is an overreaction, but the problem is real, and the fact you don’t know anyone who knows they’ve had a malware infection doesn’t mean that that is reality.

> "void warranties if you want "

Please don't push the Overton Window any further. Installing my own software on my own PC should never void the hardware vendor's warranty. That delegitimizes the core concept of a PC.

(A horrific possible dystopia just flashed through my mind: "I'd love to throw out Chrome and install Firefox so that I could block ads, but, the laptop is expensive, and I can't afford voiding the warranty". I bet Google would *love* that world. Or, a UK version: "I'd love to use a VPN, but, regulation banned them from the approved software markets, and anything else would permanently set the WARRANTY_VIOLATED flag in the TPM").

This is where it's heading, and I see this as the real driving force behind secure boot on x86_64.

It depends on what your software does; if it removes hardware protections then your warranty should be voided. Of course, those protections are either hardware or impossible to remove, like emergency cooling / lowering voltage when stuff overheats.

> You just have to inform user of the risks

Warnings aren't always enough, sometimes we have to lock people down and physically prevent them from harming themselves.

It's not always people being stupid. I recall reading an article by someone who got scammed who seemed generally quite knowledgeable about the type of scam he fell for. As he put it, he was tired, distracted, and caught at the right time.

Outside of that, a lot of the general public have a base assumption of "if the device lets me do it, it's not wrong," and just ignore the warnings. We get so many stupid pop-ups, seemingly silly warning signs (peanuts "may contain nuts") that it's easy to dismiss this as just one example of the nanny state gone mad.

Please read again the sentence you just typed.

> We have to lock people down and physically prevent them from harming themselves.

You can apply this argument to literally anything, and taken to its logical conclusion, this is exactly what will happen.

> sometimes we have to lock people down and physically prevent them from harming themselves

I highlighted the word you missed, deliberately in my opinion, as it completely changes the meaning to exclude your frankly idiotic assertion.

The idiotic statement is yours. If the "sometimes" is important to you, you can have it - you're not the first person on the internet to play word games.

But unless you can come up with a very detailed list of when it's acceptable "to lock people down and physically prevent them from harming themselves" and when it's not acceptable (it never is, it's a crazy statement), and I don't think you have such a list, your "sometimes" just means "whenever I, as the person writing the software judge", rendering it completely meaningless.

> sometimes we have to lock people down and physically prevent them from harming themselves

Seriously ill people as an exceptional last resort though, right? Or just everyone?

I’ll take a real world example where I watched someone start to climb over the side of a bridge. Luckily my words stopped him but I did consider whether I should pull him back and pin him to the ground for his own good.

Is your position that it would be better for his freedom for me to let him jump if I couldn’t dissuade him?

I would consider that an exceptional case for a person who is very unwell.

That said, I think suicide is a complicated case because some people want to be stopped, and some people will just try again the next night.

> sometimes we have to lock people down and physically prevent them from harming themselves

So where does my statement suggest we should make locking people up for their own good the norm?

I can come up with even more mundane examples of where we physically prevent people from harming themselves. High barriers to stop people getting into the tiger enclosure. If a member of staff saw someone dumb enough to try and climb in, rest assured they'd be physically dragged out for their own safety.

Or do you suggest we allow the general public to wander into the tiger exhibit to pet the animals? Personal freedom and all that.

Yes, I just want people to pet the tigers

Even if it's illegal? (like transmitting on forbidden frequencies)

It's not always the user who's installing software. Lots of people depend on other people to manage their devices. Manufacturers like the hardware they delivered to be trusted so users trust it regardless of who handled it.

I always hear as the excuse but it is ridiculous. If the user wants to transmit on "illegal" frequencies, all he has to do is to change the country setting in their Wi-Fi router, et voilà, illegal transmissions.

The entire Android OS has about as much access to radios than your average PC, if not less. In fact, even on recent android devices, wireless modems still tend to show up to the OS as serial devices speaking AT (hayes) (even if the underlying transport isn't, or even if the baseband is in the same chip). Getting them to transmit illegal frequencies is as much easy or hard as is getting a 4G USB adapter to do it.

At least in EU, transmitting is illegal, having hardware to transmit is not.

That's why people can buy TX/RX SDRs and Yaesu transceivers without a license.

AFAIK the radioamateur world, serious violations of frequency plans are rare and are usually quickly handled by regulators. OTOH, everyone is slightly illegal, e.g. transmitting encrypted texts or overpowering their rigs, but that's part of the fun.

And in some locations, quickly handled by the local amateur community, with foxhunts and community outreach to frequency violators - only getting regulators involved when just talking to the offenders fails.

> Even if it's illegal? (like transmitting on forbidden frequencies)

That's not relevant here. If frequencies are illegal, it should be impossible to program it in such a way. But even otherwise, it's the responsibility of the user to follow local laws. If I have a PTT phone, it's not legal for me to use forbidden frequencies just because it's possible. Why do these manufacturers care about what doesn't concern them when they violate even bigger laws all the time?

> It's not always the user who's installing software. Lots of people depend on other people to manage their devices.

That should be up to the user. Here we are talking about users who want to decide for themselves what their device does. You're talking as if giving the user that choice is the injustice. Nope. Taking away the choice is.

> Manufacturers like the hardware they delivered to be trusted so users trust it regardless of who handled it.

I see what you did here. But here is the thing. Securing a device is not antithetical to the user's freedom. That was what secure boot chain was originally supposed to accomplish until Microsoft managed to corrupt it into a tool for usurping control from the user.

Manufacturer trust is a farce. They should be deligating that trust to the user upon the sale of the device, through well proven concepts as explained above. They chose to distrust the user instead. Why? Greed!

> If frequencies are illegal, it should be impossible to program it in such a way.

You know there's a very fine line between hardware and software in this case so you're actually advocating for drm like control here.

> They should be deligating that trust to the user upon the sale of the device, through well proven concepts as explained above.

That same user who forgets passwords and recovery keys all the time and loses all access to documents when a device breaks? And you're presuming giving that kind of person who doesn't understand sh*t about backups, device security etc full access to their devices will not result in a lot of compromised devices?

I'm not sure manufacturers are the best party to trust but they have an interest in a secure reputation, which the majority of dumb users or eavesdropping governments do not have.

> They chose to distrust the user instead. Why? Greed!

There are more reasons to distrust the user. I don't buy greed is the only relevant one.

> so you're actually advocating for drm like control here.

Absolutely not. I'm saying that the hardware shouldn't have that capability at all in the first place. But whatever. Don't restrict it. Those functionalities are usually under the control of the kernel. If the user is smart enough to tinker with the subsystems at that level, they're also smart enough to deal with the consequences of its misuse. That isn't a good justification to just lock down devices like this. The harm that comes out of that is much worse than what anyone can do with an RF baseband chip.

> That same user who forgets passwords and recovery keys all the time and loses all access to documents when a device breaks? And you're presuming giving that kind of person who doesn't understand sh*t about backups, device security etc full access to their devices will not result in a lot of compromised devices?

Yeah, so? It's not like such a person is ever going to unlock a complex safety lock. Examples for that exist already. Who can sideload an app into a fresh Android device without enabling the developer mode and then installing the APK through ADB? Dumb users won't ever persist enough to reach there. To take it further, the user can be given the root key to the secure boot chain on a piece of paper with the explicit instruction to not share it with anyone or even use it if they don't know how to. Ordinary users can then go on about their day as if it is fully locked down. It's unfair to deny the control of the device to the smart user, when such a security is possible. The existence of a dumb user is not an excuse to lock out smart users.

> but they have an interest in a secure reputation, which the majority of dumb users or eavesdropping governments do not have.

I guess you haven't seen the spyware that OEMs ship with the android devices. Even Samsung is notorious for it - especially on their smart TVs. I'm not going to talk at all about the Chinese OEMs. For that matter, it's very hard for a normal user to even uninstall facebook - an app that's known to collect information from the device that it doesn't need. Manufacturers caring for their security reputation was some 20 years ago. Only Apple does it these days, just because it's their highlight feature. But even they tried once to ship off images on the phone to iCloud without the users' permission to 'check it for csam'. The rest treat it like a portable spying device on steroids.

> There are more reasons to distrust the user. I don't buy greed is the only relevant one.

Trusting the user isn't the manufacturer's prerogative. It's supposed to be the user's property once they pay for it. You are insisting on the manufacturer retaining control even afterwards - something I and many others vehemently oppose as unfair and scummy. Now if you are worried about the security reputation, proven methods exist that allow the smart users to take full control of the device while preventing regular users from shooting their own foot. But OEMs and their apologists pretend that the problem is entirely on the user side and the only solution is to lock it down in a block of glue. And there is one good reason for this ignorance, oversight and denial - greed. Retaining control over the end device forever allows them to squeeze users for their every last penny. I will need another epic post just to enumerate the ways in which the control over the end devices allows them to do so. But I'm not going to do that because HN has entire stories and discussions on each of those topics.

Especially if it's illegal (like speaking against the government, in some countries).

Maybe this is a bit of a hot take, but I think any government that has the ability to absolutely prevent people from breaking the law is a government with far too much power. I'm all in favor of law enforcement, but at some point it starts to cross over the line from enforcement to violation of people's free will.

Yes, very clear warnings; I could live with a small permanent icon in the status bar (via the GPU firmware) etc. But absolutely should not void warranties (overclocking might but never just root).

If you can't destroy your own hardware by rooting, do you have true root access?

Easy enough to have an efuse blow if you overvolt; then an dificult conversion on a warrenty claim. Whilst ideologically this is ceeding some control I can accept it.

The problem is Dunning Kruger effect.

The people who shouldn't disable these security features tend to be the first to do so. And then complain the loudest when the enter the "find out" phase.