What they want is to get rid of apps like YouTube Vanced that are making them lose money (and other Play Store apps)
Security and Intellectual Property (IP) protection could both be true. Google has a big enough reason to make it happen now.
In a perverse way it's not that protecting Google's IP is making us safer. Yet it, strangely is.
> What they want is to get rid of apps like YouTube Vanced
It felt weird that the official press release was quoting entities from these countries, as if it should give confidence to the rest of the world. I can't imagine what these countries would want with apps that can be traced back to a government id...
Vanced and such is more of a First World/Western issue. I don't think you're wrong but I got a strong gut feeling there's other pressures in the works. Just something doesn't smell right...
what about us losing control over our own devices? do you like losing control over devices you paid for?
I'd greatly appreciate it if you can share the relevant link/repo for it?
By allowing people to shoot themselves in the foot after ignoring a unmistakable warning, you are helping teach the foolish to be more careful in the future. Making mistakes is the best way to learn something.
If they even notice, that is. It's just as possible that they play open relay for a year before they move to a new phone because their battery is always dying so fast for some unknown reason.
To be fair though, this strategic duplicity is a technique Apple has used since Jobs; so it's not as if Google used the approach first.
Back in the early days of the Internet there was the Joel Spolsky article on why users will always do anything to see the dancing bunnies.
The user can’t make an informed choice because it’s literally impossible to audit the safety of the app or the author. So they will click passed any warnings, follow any number of steps to install the app that gives them something desirable for free.
> users aren't being 'trained' to ignore warnings
Of course they are. Every time they click "continue anyway" and it actually isn't malware (which is 99% of the time) they are being trained that the warning is nonsense.
And they're right! What use is a warning that an app might be malware, if a) it actually isn't almost every time you see the warning, and b) you have no way of telling if it is or isn't anyway?
I hate this move too and I don't think they should have done "just make the warning even bigger!" is obviously dumb.
c.f. the Windows “it could be malware” blurb. You basically can’t use any software from a small publisher without clicking through it, even if they pay for the code signing certificate.
What reason do you have to believe that this goal wasn't achieved?
Plus, you are not required to do that, you can just stick to Google Play and trust what Google approves there. But no need to lock down others because of your recklessness.
Why the hell can't I use my rooted device for payments? It's my goddamn money at risk.
You are inadvertently reaching the true core of the question. The ones who have "control" over a device, are those who control the software running on it. Be it the bad guys (in the case of a malware-infested device), a giant corporation (in the case of a locked-down device), or yourself (when you can install and replace any software you want on the device).
Plus the whole "banks need to protect you by ensuring your device" is stupid when cards are protected only by a PIN, and the app also requires some form of biometry to unlock it, which is to encrypt the underlying tokens. Banks should protect your money on their end, with clients having their responsibility to keep safe their stuff, whether that's their card or phone. It's a stupid premise itself, and it's lazy engineering.
Those same users can now install facebook, and facebook does this: https://medium.com/@ak123aryan/facebooks-hidden-android-trac...
And facebook is and will be verified in the future too.
I think this is what commenters here are missing. I agree politically with the notion that people should own their devices (having full control), but the reality is not and will never be that the majority have anything but the illusion of control. Meanwhile, as these devices become increasingly necessary for people to exist at all, and the data they store becomes increasingly sensitive, the ability to theoretically install your own software is completely irrelevant compared to the risk of anything bad happening.
Things that would be compromised if my phone is compromised: All private communication, bank accounts, stock portfolio, medical history, driver's license, criminal record, sexual history, grocery habits, all communication between my government and me, real estate deeds and mortgages, two-factor authentication keys, and I suppose my Steam library.
Like, that's a lot. People can lose their homes. The stakes are unfathomably high here.
Saying "this will steal your data" is probably correct.
So what were actually asking users is to install some malware, if it's provided by a big enough tech company, but not other malware. Of course users get confused.
Just stop downloading apps altogether and run the web views in the original web view - the web browser.
Will Google, Meta et al. do that and abandon their apps? Of course not, they need to install malware.
Why and how is this protecting against a malicious actors? You can't skip that part.
What about malicious actors that are entrenched, like Meta and even Google? Does this not strengthen them?
"Free" devices exist. Linux computers. Linux phones. No codesigning, minimal sandboxing, none of that "malevolent" stuff from macOS/Windows/Android. Knock your socks off. You have a choice. Ideologically wanting everyone's devices to be like this is not sensible.
This isn't like anticompetitive behavior (bundling, lock-in, fees) where "you have a choice" is irrelevant because corporate power should be minimized and competition and consumer surplus should be maximized. Tradeoffs between security and nerd-fantasy "freedom" are valid.
I still remember that piece about the tween girl getting her nudes exposed because of a RAT. True "freedom" with technology, for non-nerds, means being able to use technology to pursue your passions, learn singing, fashion, dancing, without having to be terrified that this computer might destroy your life. That's "freedom" for 99% of folks. But the high-empathy folks here will respond "user error", "personal responsibility", "you should have known not to click that". You aren't entitled to be care-free, to have a life, to pay no attention to boring nerd stuff. Become a dead-inside geek like us, you bottom-quintile person, or else.
I can't say whether the specific implementation will be an improvement, but that is clearly the intent.
Meta and Google have not shown themselves to be "malicious" in sense that is relevant to this discussions. Whatever shady practices they may or may not have is very likely entirely within the law, and they are strongly motivated to protect people's personal data, because they will not have users (i.e., their product) if their platforms are insecure.
Anyway, Apple already does this with unknown apps downloaded from the internet, you need to go to security settings and hit a button there.
The only reason, and it is the only reason, you do not view Meta as a malicious actor is because they've told you many times they are not.
Most Meta and Google products could be described as keyloggers or spyware. Many break permissions expectations - for example, Google apps have special privileges that allow them to circumvent some permissions on Android.
In addition, both Meta and Google products are primarily ad driven, with the majority of ads being scams. Again, virtually identical to other malicious apps.
Is any of this legal? Maybe, maybe not, you signed a EULA. But if all it takes is a EULA, then most android malware is not malware, and we're back at square one: play protect will not do anything.
And, to be clear, this is intentional. It is not Googles intention to squander malware because they rely on malware. No malware on Android and they go bankrupt.
It is their intention to further extract value out of the Google play store by leveraging their mandatory 30% cut. As well as making Android a more locked down platform and thereby more attractive to advertisers and DRM distributors.
Firefox for instance does not allow you to install unsigned extensions. You don't need to list them on their storefront, but they want to perform automated tests and have the ability to block extensions through this signing requirement.
So in principle I can see them wanting to address a legitimate issue, but the way they are going about this is way to centralized. IMO they should do something like we have for web certificates, where vendors can add more root authorities than just the one from Google, and users should be able to add their own root certificates if they want to side load apps.
What? I'm from Brazil and Vanced is as big, if not bigger here. In fact, most of my 'first world' friends just pay for YouTube Premium (or whatever it is called), and these kinds of workarounds are mostly used in countries with less purchasing power.
> I could see that this is also an issue for scam apps.
> Firefox for instance does not allow you to install unsigned extensions.
[0] https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
For other people to use your extension, you need ***to package it and submit it to Mozilla*** for signing.https://extensionworkshop.com/documentation/publish/signing-...
You can temporarily install extensions in about:debugging, but everything permanent needs to be signed.
> Add-ons need to be signed before they can be installed into release and beta versions of Firefox. This signing process takes place through addons.mozilla.org (AMO), whether you choose to distribute your add-on through AMO or to do it yourself.
I mean test it out. Write that short example extension in Firefox. Doesn't matter if you need to open up about:debugging (just as you need to do extra things on your android). It'll stay.
The signing is for distribution.
[0] >>45033035
[1] >>45035699
The only difference between a malicious app exfilitrating your cookies through an exploit and Meta exfilitrating your cookies through an exploit is you trust Meta won't use your cookies to impersonate you, steal your browser sessions, drain your bank account, etc.
But that's just pure trust. Meta could easily have a leak - Experian had a leak and people lost millions of dollars.