Comment on Google gives Android users a way to install unverified apps if they prove they really, really want to

smeg@infosec.pub ⁨12⁩ ⁨hours⁩ ago

• Squizzy@lemmy.world ⁨10⁩ ⁨hours⁩ ago

  Is this for all android systems because it is a huge rug pull if so

  source

  • AHemlocksLie@lemmy.zip ⁨9⁩ ⁨hours⁩ ago

    Pretty sure it’s a change to AOSP, the basis for every single Android ROM in existence.

    source
• FauxLiving@lemmy.world ⁨11⁩ ⁨hours⁩ ago

  I can understand this workflow being created to protect the legions of people who are tricked into installing spyware.

  It doesn’t remotely affect me because I use GrapheneOS and if this is an issue for you then you’re probably someone who should look at installing GOS or Lineage.

  I don’t think Google should be able to do this and it is likely part of a longer-term strategy to strangle any competition. At the same time, I can understand how this change will save a lot of grandparents from clicking a link in a text from their ‘grandchildren’ and installing spyware that’ll steal all of their bank information.

  source

  • AHemlocksLie@lemmy.zip ⁨9⁩ ⁨hours⁩ ago

    GrapheneOS is built on AOSP, which is where the change is being made. Graphene and other custom ROMs will need to maintain a fork that cuts out the feature if they want to avoid. Google is also starting to close off Android to make that more difficult, so it’ll become a genuine project to maintain the fork well.

    source

    • nomadpxl@programming.dev ⁨5⁩ ⁨hours⁩ ago

      As far as I understand the enforcement depends on privileged play services. xcancel.com/Metr0pl3x/status/1960329785277571420#…

      source
  • ThirdConsul@lemmy.zip ⁨11⁩ ⁨hours⁩ ago

    I can understand this workflow being created to protect the legions of people who are tricked into installing spyware.

    Then you’re stupid, as most people install third party spyware through the Google Play store.

    source

    • FauxLiving@lemmy.world ⁨11⁩ ⁨hours⁩ ago

      Yes, how stupid of me for not explicitly explaining the context that everyone with basic reading comprehension can understand.

      I’ll add the obvious context for everyone else who is new to the world and has issues parsing regular English sentences:

      • The link and description of the post is the part at the top of the page.
      • If you click the Title link it will take you to a web page (a collection of HTML documents and javascript) which contains a story.
      • The story in the OP is about installing unverified apps.
      • Unverified apps are installed directly from apks and not from the Play Store
      • Scams often target elderly people with text messages or phone calls.
      • Part of these scams involves getting access to the victim’s devices so that the scammer can leverage that access to obtain bank information and account control.
      • Creating a system which prevents a scam victim from easily installing unverified apps will mitigate this attack vector.

      source