There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

Android apps are blocking sideloading and forcing Google Play versions instead

You might sideload an Android app, or manually install its APK package, if you’re using a custom version of Android that doesn’t include Google’s Play Store. Alternately, the app might be experimental, under development, or perhaps no longer maintained and offered by its developer. Until now, the existence of sideload-ready APKs on the web was something that seemed to be tolerated, if warned against, by Google.

This quiet standstill is being shaken up by a new feature in Google’s Play Integrity API. As reported by Android Authority, developer tools to push “remediation” dialogs during sideloading debuted at Google’s I/O conference in May, have begun showing up on users’ phones. Sideloaders of apps from the British shop Tesco, fandom app BeyBlade X, and ChatGPT have reported “Get this app from Play” prompts, which cannot be worked around. An Android gaming handheld user encountered a similarly worded prompt from Diablo Immortal on their device three months ago.

Google’s Play Integrity API is how apps have previously blocked access when loaded onto phones that are in some way modified from a stock OS with all Google Play integrations intact. Recently, a popular two-factor authentication app blocked access on rooted phones, including the security-minded GrapheneOS. Apps can call the Play Integrity API and get back an “integrity verdict,” relaying if the phone has a “trustworthy” software environment, has Google Play Protect enabled, and passes other software checks.

Graphene has questioned the veracity of Google’s Integrity API and SafetyNet Attestation systems, recommending instead standard Android hardware attestation. Rahman notes that apps do not have to take an all-or-nothing approach to integrity checking. Rather than block installation entirely, apps could call on the API only during sensitive actions, issuing a warning there. But not having a Play Store connection can also deprive developers of metrics, allow for installation on incompatible devices (and resulting bad reviews), and, of course, open the door to paid app piracy.

cheers_queers ,

i JUST started enjoying adfree YouTube via revanced, now it could go away?! fuck lol

Peruvian_Skies , (edited )

This has absolutely nothing to do with ReVanced.

cheers_queers ,

oh okay, thanks

bad_alloc ,

Just the term “side loading” instantly frames installing software on a device you own as something shady.

chiisana ,
@chiisana@lemmy.chiisana.net avatar

App developers need ways to know the app has not been modified in unsanctioned manner, glad to see Android finally catching up on security with integrity checks.

Natanael ,

No, this will only lead people without access to Google Play to be forced to get it from somebody who has modified the app to fake the check.

praise_idleness ,

Which obviously sucks but also is exactly what developers want or just don’t care

Chozo ,

If they don't have access to Play, then the developer of that app specifically does not want to service them as a user. Developers have to enable this feature in their own apps for it to do anything. If that developer wanted to support de-Googled users, they wouldn't enable this in the first place.

surge_1 ,

Yup, this is important for certain apps with a high security bar. Surprised at all the downvotes.

DoucheBagMcSwag , (edited )

Slippery slope. Soon it wil be for all fucking mundane apps because they don’t want you running a modded version…which is my fucking choice to do

chiisana ,
@chiisana@lemmy.chiisana.net avatar

This is Lemmy. If you’re not advocating for FOSS, or piracy to spite the corporations, you’re gonna get downvoted. I don’t care. We need better security standards whether these kids like it or not.

smiletolerantly ,

Security by default is fine, but not if its being forced.

If I go out of my way to root my phone or sideload an app, I have a reason for that. I’m fine with an app going “Hey! This phone is rooted / this app is not from an official source! Wait 10s before you can click ‘I understand and take full responsibikity in case of a security breach’”.

I’m not OK with an app going “I will not work on this device because yiur environment is non-standard, period”.

0x0 ,

This does jack-all for security, it’s just monopolization in disguise and you’re buying into it.

x00za ,

They can check their own integrity without Play services. And even then, ME AS A USER, doesn’t want the app to decide this for me.

noodlejetski ,

certain apps with a high security bar

like the McDonalds app, which already requires workarounds to work on rooted devices?

surge_1 ,

Of course not, sometimes it really is just corpo bs, don’t use their app if it’s such an issue for you.

brbposting ,

You want affordable food, you WILL pay them with your data. Always on location please! Oh and precise as well, thank you.

Cheems ,
@Cheems@lemmy.world avatar

It’s my phone. If I’m specifically going out of my way to do that, they have no right to force me to do it their way.

mrvictory1 ,

Why do you think apps should verify their integrity in the first place? In the case of banking apps or other online apps, the APIs they use should be secure in the first place so a user can’t achieve anything meaningful by modifying API calls. In the case of offline games with monetization, a hacker who makes a pirated APK will also remove the restriction so legitimate players on non standart ROMs will get screwed. In the case of messaging apps with a “delete messages” or “one time view” function ie. Whatsapp, the sender shouldn’t take that their actions will be respected by other clients because modded apps exist and Whatsapp doesn’t care if you install it on a rooted device.

whats_all_this_then , (edited )

This!

APK signatures exist and they’re enough for making sure the file you got isn’t modified. Warning people when they use apks for stuff like banking, I get, but if they wanna take the risk, it’s on them.

Blocking root makes no sense because I’d argue that if the person knows enough to root their phone and got past all those bricked phone/thermonuclear war warnings, the onus is on them to not get their keychain compromised by giving root to some random app. Again, a warning is fine.

Aside from that, people need to understand: THE CLIENT IS NEVER SECURE. NO EXCEPTIONS.

Any self respecting secure API is made under the assumption that all the calls are coming from some malicious state actor using curl until proven beyond doubt that it’s an actual user.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •