A theoretical way to circumvent Android developer verification
enaix.github.io
enaix.github.io
Do not accept the premise of assholes.
I hope we can get the EU to fund a truly open Android Fork. Maybe under some organisation similar to NL Labs.
--- edit ---
Furthermore, the need for a trustworthy binary to be auditable to a certain hash or something would make banning this a simple task if Google would want to go that route.
This is actually the advantage of doing it. You make the thing (call it a "personal app loader" or something rather than a "circumvention tool"), they ban it, now you campaign against them or make antitrust arguments presenting the ban as an anti-competitive practice or use the ban to refute claims that they're not inhibiting third party app distribution.
Even if you know they're going to be the villains, you still want to make them actually do it so that everyone can see them doing it.
I do think having a technical bypass is good - it isn't mutually exclusive with also having a legal bypass. I just hope that the gov'ts are smart enough, and agile enough, to make this happen before it becomes too late (aka, once the gates close, it will never open again, like apple's ecosystem).
If politicians are not all power-hungry caricatures, is it possible that the same is true for businesses?
Android has millions of users worldwide, many of whom are far less computer-literate than HN users. I think it's very reasonable for Google to put speed bumps in front of malware developers trying to distribute through the Play Store. If you're a half-decent dev, $25 is nothing compared to the opportunity cost of your time in developing your app.
This whole thing seems to be a fairly recent announcement on Google's part, so it's unsurprising they're still hammering out details for hobbyist devs? How about making constructive suggestions for ways that Google can protect ordinary people without stopping power users?
I struggle to see any good-faith need to erect additional barriers to protect users from running the programs they want on devices they own, when you already have to be fairly expert to enable developer mode, install via adb, etc.
Recall that the premise of this thread is that the EU should sponsor an alternative to Android. The EU vs US question isn't really topical, since no one suggested that the US government should sponsor an alternative to Android instead.
The DMA is an attempt to reclassify what “market” means in the modern age where we have a global tech oligopoly. This is because a simple “test” for monopolism doesn’t work in this world of multinational megacorps.
Again, your complaint is a double standard. You are doing similar in the USA - albeit without an actual structured act - as per the recent rulings on the Google Play store.
The EU has simply codified the rules for their vision of the future where people aren’t beholden to a handful of tech overlords, whereas the USA is making similar incremental “changes” through case-law. I’m not saying either way is correct, but it seems like they are both headed in the same direction.
Were you offered to vote for Von Der Layen by the way?
The chancellor in Germany is also not directly elected by majority vote but by parliament.
Its a reasonable criticism that the EU structures make democratic legitimisation very indirect, but that is at least partly a result of the EU being a club of sovereign democracies. The central tension was extremely evident during the Greek debt crisis, you have a change in government in Greece, but due to EU level constraints they can't enact a change in policy. More independent power ininstitutions less dependent on the member state, means the sovereign democratic national governments can't act on their local democratic mandates.
Except the are a couple degrees of separation between the democracy part and in the running the EU institutions.
The EU parliament is also a very superficial imitation of a real parliament in a democratic state. It has very limited say in forming the “government” or decision making.
> result of the EU being a club of sovereign democracies
So either revert to it just being a trade union or implement fully democratic federal institutions. The in between isn’t really working that well.
That's what parliamentary democracy means, yes.
In parliamentary democracies the parliament is elected directly and is generally sovereign (optionally constrained by a constitution or some set of basic laws and powers delegated to regional governments and such).
In no way does that describe the EU. It has no equivalent body. Its imitation “parliament” is extremely weak and barely has a say in who forms the closest EU has to a “government”.
"The Parliament also has the power to censure the Commission by a two-thirds majority which will force the resignation of the entire Commission from office. As with approval, this power has never been explicitly used, but when faced with such a vote, the Santer Commission then resigned of their own accord."
The fact that the whole democratic setup is highly complex is in itself a problem. But the concrete deficits people mention are never true or don't apply to other democracies either...
In practice the EU Parliament has been a lot more trouble for the executive than is typical in national bodies. The one valid point is that the parliament does not have the right to initiate legislation itself. That is unusual, but in practice many people who are actually close to political processes seem to say this is mostly symbolic, as national bodies can't really draft effective legislation without cooperation from the executive either... Stil definitely something I would love to see addressed.
In the last cycles the candidate who led the party who won the parliamentary elections became head of commission.
So this is just wrong. The EU parliament has more power than US Congress or the UK parliament in this respect.
The parliament would have picked Weber, but nobody cared since its just there to rubber stamp predetermined decisions.
He was the leader of the party which won the plurality in the elections and had its support. EU had a real chance to move towards becoming a real parliamentary democracy if it went that way.
That’s the new Spitzenkandidate system. The council is supposed to pick the candidate put forward by the main political force in the parliament.
The EU is a real democracy anyway. All the members of the council are themselves democratically elected. It has a weird three parts political system but everyone in it is elected or appointed by people elected.
Bad legislation gets written everywhere, the difference is, in the EU it doesn't pass.
Before it was unclear so it was better to allow installation of apps without any verification to appear as more open.
Remember any regulation/law has unintended consequences. At one point Apple decided that PWAs would no longer be supported in EU so they don't have to provide equal capabilities to implement them in alternative web browsers, fortunatelly they changed their mind by obtaining an exception. PWAs is the only alternative choice for making "proper" apps on iOS (no hacky sideloading methods).
I think overally DMA is more a loss than a win (good on paper, terrible in practice). It codified worse things. The EU app stores are still fully controlled by Apple (harder to install, they can just decline or drag notarization of any apps or revoke your license to dev tools, you need to still pay them, etc.).
For various apps the EU market is too small (esp. for things that need to be global) to invest into the development so while you can for example theoretically develop a real alternative web browser to Safari/WebKit (forbidden by App Store rules) nobody is willing to do it.
Edit: Google could ultimately use that as a lever in licensing deals with manufacturers. It'd marginalize everything.
https://images.squarespace-cdn.com/content/v1/60f1421e1afcf4...
Several of those are the opposite of security features, like SafetyNet support, which might be a convenience in some cases but it mostly makes it so you can't upgrade certain parts of the system to newer versions even when the old versions have security vulnerabilities.
Here's the up-to-date comparison: https://eylenburg.github.io/android_comparison.htm
As far as I know, there is no significant features other distros have that increase their privacy or security over what GOS has. I'm not entirely sure about the SafetyNet thing, but GOS is by far the most up-to-date to the AOSP out of these distros.
Moreover, some of the stuff with green boxes is still kind of a privacy fail. For example, with GNSS (i.e. GPS) your device calculates its location from the timing of radio broadcasts emitted by a network of satellites. It has extremely good privacy properties because your device is a passive radio receiver and neither the satellites nor anyone else know you're there when you use it. "Network-based location" can sometimes work when you're somewhere you can't hear the satellites, but now you have Google or someone else building a database of nearby wireless APs etc. in order to make it work, and in the process you're effectively uploading your location to them.
Their objections in general seem to be fairly pedantic, e.g. objecting to a connectivity check which could be improved in a theoretical sense but in practice that shouldn't be leaking anything you're not already giving up by having a phone which is turned on and connected to a cellular network.
No one else even bothered to make a list.
>Several of those are the opposite of security features, like SafetyNet support, which might be a convenience in some cases but it mostly makes it so you can't upgrade certain parts of the system to newer versions even when the old versions have security vulnerabilities.
Citation needed
That doesn't make the biased list good.
> Citation needed
Are you not aware of what SafetyNet is? It's the thing where Google certifies that the phone is running the software produced for it by the OEM. The problem, of course, being that the OEM stops issuing updates and then the certified version has known vulnerabilities. Which is a lot of the point of wanting to install a newer ROM on such a device, except that then it won't pass SafetyNet because you replaced the vulnerable but certified code with third party code that has the patch but not the certification.
The same EU that keeps pushing for breaking encryption and chatcontrol? No thank you
The two are not equivalent issues; the first one is ill-formed as stated.
Cryptography is a tool of control. It's "dual-use", in the same sense like a knife or nuclear fission is - its moral valence depends on who is wielding it, and to what end.
In the context we're discussing, encryption is being used against the people. Working encryption is in fact needed to make chat control work - it's fundamental to it, the same way it is to Developer Verification and Safetynet/Remote Attestation. It would be great if EU decided to break that set of encryption applications. Alas, chat control only wants to break E2EE on messages, and uses encryption elsewhere to guarantee E2EE stays broken.
A more general comment about this thread, and related ones in the past: people really need to stop thinking about "encryption" and "security" as inherently good. They're not. Most of the social problems with computing, the attempts at user disempowerment and disenfranchisement, persist because they apply cybersecurity solutions.
The core question of security is always: who exactly is being secured, and from who.
How are things in the EU on whether it's legal to buy a SIM card without showing ID?
The task, therefore, is to convince enough politicians to establish an independent unit that can address this issue without direct political influence.
Fund the unit with enough money so that it can take care of the cybersecurity and sovereignty of all citizens.
A side effect of this would hopefully be that these politicians would then be digitally literate enough to recognize nonsense such as chat control as such and reject it outright. I hope that most politicians would not really want such omnipotent surveillance tools if they could truly grasp their scope.
Secure for who, and from whom?
Remote Attestation and Developer Verification both make Android OS and platform more secure against malicious actors that would want to defeat the guarantees the platform gives, guarantees that enable secure digital services.
Yes, this includes protecting the banking services and DRM media services and advertising platforms from malicious actors like you and me, who pose a real threat to the revenues of the aforementioned players, by:
- Expecting banking to do security right on their own side, instead of outsourcing it to mobile platform and society at large (like with "identity theft" trick);
- Enjoying entertainment and education in ways the vendor or IP owner does not like or can't be arsed to support, and thus not spending extra on the inferior ways that are supported;
- Not looking at the ads.
Same is with Chat Control. Chat Control improves security of the society against threats such as sexual predators who want to hurt children, or citizens who disapprove of how the current ruling class is governing the people. To effectively provide that security, Chat Control in turn relies on a secure OS and platform providing secure digital services - in particular, secure against those malicious actors that would want to circumvent Chat Control protections.
Is the larger picture clear now? Security technologies are not inherently good, they're morally ambivalent. They're "dual-use". It's important to consider their deployment on a case-by-case basis, always asking who is being secured, and what are the actual threats they're being secured from.
no it doesn't. Chat Control is single-use.
Also, I'm not saying Chat Control is dual-use, I'm saying crypto is. Chat Control actually needs working crypto to be properly implemented.
In some EU member states this might be fine, but definitely not all.
> Your local drunkard will be happy to get $10 to buy a SIM card for you.
Buying a SIM card was always the easy bit. Getting it activated may not be, it depends on which country you're in.
https://www.telekom.de/prepaid-aktivierung/en/start
"For the Selfie-Ident you identify yourself with your identity card, passport or residence permit. (Selfie-Ident is currently possible worldwide with the German ID card, residence permit and passport. Alternatively, you can use Video-Ident and identify yourself in a video call with an employee.)
Important: Temporary identification documents are not supported due to internal check. You need a tablet or smartphone with a camera and an internet connection."
Q: Who's paying the bills for that SIM?
> > The ID presented at time of purchase does not have to be the ID of the actual user of the card
>In some EU member states this might be fine, but definitely not all
It seems hard if not impossible to prevent or stop?
Thought experiement: you can buy and register a car, and then lend it to someone else to use.
That's certainly "hard if not impossible to prevent or stop" and might seem fine ... right until the point when it isn't fine any more.
At which point the police will come to knock on your door (first).
You can anonymously buy top-up vouchers in supermarkets for pay-as-you-go SIMs.
As a result, sites where I could rent a number for verification, now don't offer local numbers anymore.
And even in that case, doing this for a long period of time violates most roaming policies
https://en.wikipedia.org/wiki/European_Union_roaming_regulat...
In some places your plan will be cancelled for roaming beyond a certain number of days or quantity of usage. Telecom laws and polices vary widely.
It varies per country. In some you can just buy one (or more) SIM cards at a supermarket without any ID.
I was confused bexause anonymity against the state is hardly the only, or even a main point of android forks.
Privacy usually is, but against big tech typically.
I believe devices I own should let me do whatever I want with them and I agree that the verification is BS, but I'll work around it in the ways I can which means building more for the web.
If that ever drops the open pretense (since both traffic and trust authority are largely centralized and thus easily controllable) then I'll only write for self hosted linux boxes.
We as individuals can only do so much. We'd need actual organization and some measure of political power to do anything more since normal people do not care about this.
The tl;dr is that a PWA implies an app which is based in the cloud. So suddenly you need a server, and you need to store user data, which means costs and dealing with privacy and security.
If something could be built as a native app without depending on a central server, it could also be built as a PWA without a central server. You don't need to store user data centrally at all, just because it's a webapp. You can just have the clients use localStorage or IndexedDB or whatever.
You still have to host the static files for the webapp itself, but that can be made very cheap.
Of course, API feature parity between native and web apps is a separate issue. But the argument about server costs doesn't seem like a good one.
There are other APIs that allow you to store binary data directly (which you'll probably want if you're storing large files) and also to use/request larger quotas.
It seems to me that, ironically, PWAs are uniquely ill-suited for the type of non-corporate software where distribution outside mainstream channels makes the most sense.
To me, the attention to these verification changes seems misplaced. We need to defend the ability to unlock the bootloader, pressure Google to revive AOSP and then encourage people to switch to a more user-friendly OS.
You're already unable to install what you want on a stock OS due to Android permission model treating you as a third-class citizen, after Google and OEMs.
Despite that, there are some things that should not be for profit in my opinion. A good OS platform is one such thing.
If Google decides to pull this off, then I guess reflashing to a custom ROM with this crap patched out will be a very first step I'll be recommending to anyone who cares.
They don't do it out of goodness of their hearts, which is why it's more solid than relying on goodwill - Microsoft simply has an offering that depends on that for certain high profile clients.
Frankly they should still be getting sued for the way Edge and Cortana are bundled.
People should be free to use other browsers and accept higher power usage, or "privacy risk" without Apple forcing their own browser engine, which limits functionality of all web browsers on iOS.
What Microsoft did by bundling IE with windows was far less egregious. Could you imagine if Microsoft forced all browsers on Windows to use IE as a webview? Holly shit people would be rightly pissed.
Apple does this specifically to prevent competition from web applications so that developers have to use Apple's app store, where Apple can charge the developer/customer money. It's spelled out in the DOJ lawsuit against Apple.
https://www.justice.gov/archives/opa/media/1344546/dl?inline
Which makes a lot of sense, because you couldn't run Windows on a Mac nor MacOS on PCs from the likes of Dell or IBM, and you couldn't run third party software for Macs on Windows or vice versa. By contrast, you could run various types of Unix on a Dell, and run Windows software on OS/2 or DOS software on DOS competitors other than MS-DOS.
That distinction seems like it might be relevant to the current situation.
It remains objectively inarguable that Apple does not have a platform monopoly on (ARM-compatible) smartphones the way Microsoft did on ("Intel-compatible") PCs.
If you have a car that runs on diesel fuel and there is only one company that sells diesel fuel, it seems like you want to claim that it's irrelevant and isn't a monopoly because there is another company of the same size that sells gasoline. Is it not relevant that you can't actually use that in your car?
Whether their behavior is otherwise anticompetitive is a different issue. You are intentionally conflating them and it is morally repugnant for you to continue doing so.
And a day after you release, Google will say "Oh no you don't" and unverify your app, preventing it from being installed or run. Which is you know, kind of the point of this maneuver.
Google's not going to let you keep your signing key if you do this with it.
It's going to be the same as Play Protect using the PackageVerifier API. Even if won't trust that Play Protect will continue to allow adb installs, if you go to the developer options you can disable package verifiers for adb installs.
>the concept
This would not really work considering you can't do a lot of things at runtime. You can't create activities, you can't create services, you can't declare permissions, you can't use permissions, etc. Pretty much everything in your manifest can't be done properly. You can't really do a job faking it. You would have to declare a ton of dummy activities with all different permutations of things like launch mode, document launch mode, intent filters, etc.
What you can do are things like game engines like how the android godot editor works where you aren't loading full android apps, but projects into the editor.
Google will simply revoke the keys for the "loader" APK. But that's fine for malware, its authors will just use the next stolen credit card to register a new account.
That's also why this has nothing to do with security.
Giving google control over what code runs on $device regardless of how that code got onto the device.
A revoked key doesn't care about how the APK got there...
I'd imagine Google would plug any major holes in their soon to be closed garden, assuming that is their intention. So this and any other fix to the problem of 'install app through not-Google Play' that goes via technical means that Google can just cover up after a month or two doesn't actually move the needle any meaningful amount.
In the same vein, using adb isn't a real solution to that same problem for most people, since having to use adb is a massive jump in required effort that's going to leave all the normies behind, with only the super-dedicated willing to go through the hassle, and an equivalent amount of developer effort is going to be left behind as well, since their audience just got decimated, and they themselves might not even bother to develop something that even their dad or sister is going to bother/be able to install. Anything that's much more complicated than 'go to website, download thing, run thing, click your way through' doesn't solve for this.
The actual problem is to have Google not be knobheads about it, and the only way that's realistically going to happen is through the law, but that's not looking all that likely in my view.
Android may ultimately win the arms race, but if they want to be evil, we should make their task as tedious as possible.
Wasn't this kind of solution considered and sort of dismissed (because of too much centralization iirc) by F-Droid (can't find the reference now)? It seems like something that's worth trying, but in the end it's just a band-aid. If it gets any traction Google will shut it down. The real disease is dependence on a duopoly of (quasi)-proprietary OS for the dominant computing platform of our time.
1. The loader will just get banned.
2. The application ID and permissions are that of the loader. To have different applications with separate data and permissions you would need multiple copies of the loader.
3. You miss out on other android security features such as application signing validation for updates.
And as others mention, using adb (or Shizuku) might also be a workaround for tech-savvy users (for the time being). We list some other potential temporary workarounds at https://keepandroidopen.org. But none of it is viable for the other 99%.
There's really no solution to the dilemma other than stopping Google from implementing it altogether. And for that, we need regulatory action — which means we need to advocate and educate consumers and lawmakers about the threat that this poses.
You don't have to distribute via the app store, you dont have to get Googles permission to publish the app or have them sign it.
This looks like purely app validation, we only run apps we can prove originate from the author.
Having the file signed by a relatively centralized authority makes it much easier for Google to gain control outside of their realm.
Wouldn't this break all kinds of things, like app sandboxing, the permission system, app intents, …?
So interesting as a fun exercise, but not really useful for probably quite a few apps.
Right back to Symbian signed AppTRK and rolling back hardware clocks. Great.
Is that app immutable? I seem to recall it being changed with new versions of android.