You might sideload an Android app, or manually install its APK package, if you’re using a custom version of Android that doesn’t include Google’s Play Store. Alternately, the app might be experimental, under development, or perhaps no longer maintained and offered by its developer. Until now, the existence of sideload-ready APKs on the web was something that seemed to be tolerated, if warned against, by Google.
This quiet standstill is being shaken up by a new feature in Google’s Play Integrity API. As reported by Android Authority, developer tools to push “remediation” dialogs during sideloading debuted at Google’s I/O conference in May, have begun showing up on users’ phones. Sideloaders of apps from the British shop Tesco, fandom app BeyBlade X, and ChatGPT have reported “Get this app from Play” prompts, which cannot be worked around. An Android gaming handheld user encountered a similarly worded prompt from Diablo Immortal on their device three months ago.
Google’s Play Integrity API is how apps have previously blocked access when loaded onto phones that are in some way modified from a stock OS with all Google Play integrations intact. Recently, a popular two-factor authentication app blocked access on rooted phones, including the security-minded GrapheneOS. Apps can call the Play Integrity API and get back an “integrity verdict,” relaying if the phone has a “trustworthy” software environment, has Google Play Protect enabled, and passes other software checks.
Graphene has questioned the veracity of Google’s Integrity API and SafetyNet Attestation systems, recommending instead standard Android hardware attestation. Rahman notes that apps do not have to take an all-or-nothing approach to integrity checking. Rather than block installation entirely, apps could call on the API only during sensitive actions, issuing a warning there. But not having a Play Store connection can also deprive developers of metrics, allow for installation on incompatible devices (and resulting bad reviews), and, of course, open the door to paid app piracy.
i JUST started enjoying adfree YouTube via revanced, now it could go away?! fuck lol
App developers need ways to know the app has not been modified in unsanctioned manner, glad to see Android finally catching up on security with integrity checks.
Yup, this is important for certain apps with a high security bar. Surprised at all the downvotes.
This is Lemmy. If you’re not advocating for FOSS, or piracy to spite the corporations, you’re gonna get downvoted. I don’t care. We need better security standards whether these kids like it or not.
Security by default is fine, but not if its being forced.
If I go out of my way to root my phone or sideload an app, I have a reason for that. I’m fine with an app going “Hey! This phone is rooted / this app is not from an official source! Wait 10s before you can click ‘I understand and take full responsibikity in case of a security breach’”.
I’m not OK with an app going “I will not work on this device because yiur environment is non-standard, period”.
certain apps with a high security bar
like the McDonalds app, which already requires workarounds to work on rooted devices?
No, this will only lead people without access to Google Play to be forced to get it from somebody who has modified the app to fake the check.
If they don’t have access to Play, then the developer of that app specifically does not want to service them as a user. Developers have to enable this feature in their own apps for it to do anything. If that developer wanted to support de-Googled users, they wouldn’t enable this in the first place.
Personally, it’s not Google’s place to dictate how an app verification ecosystem works. If a company has developed an app, they need to be the ones to make sure it’s secure in the first place, not trusting a monopolist tech company that has almost all control with how someone uses their phone.
Google has rules yes, but Android is open-source and should be open with a free & open market for apps. After all, we paid for the device.
Why do you think apps should verify their integrity in the first place? In the case of banking apps or other online apps, the APIs they use should be secure in the first place so a user can’t achieve anything meaningful by modifying API calls. In the case of offline games with monetization, a hacker who makes a pirated APK will also remove the restriction so legitimate players on non standart ROMs will get screwed. In the case of messaging apps with a “delete messages” or “one time view” function ie. Whatsapp, the sender shouldn’t take that their actions will be respected by other clients because modded apps exist and Whatsapp doesn’t care if you install it on a rooted device.
API are secure only if you can secure the authentication details. A modified app (be it as something modified and distributed on a unsanctioned channel, or custom injected by another malicious actor/app) can easily siphon out your authentication tokens to a third party unbeknownst to you the user. However, if the app verifies it came from the approved source and have not been tempered with, then it is much easier to lean on ASLR and other OS level security to make it harder to extract the authentication info.
Multiplayer game operators have obligation to curb modified clients so their actual paying clients have a levelled playing field. By ensuring their apps are only distributed via approved channels and unmodified by malicious players, this improves their odds at warding off cheaters creating a bad time for those that actually pay them to play fairly.
These are just simple cases where this kind of security is beneficial. I am glad Android is finally catching up in this regard.
be it as something modified and distributed on a unsanctioned channel
Downloading APKs from reputable sources and signature checking can help with this one. Android will refuse to upgrade an app if APK has a different signature anyways.
custom injected by another malicious actor/app
If this is possible there are bigger problems.
Multiplayer game operators have obligation to curb modified clients so their actual paying clients have a levelled playing field.
There isn’t much I can say for that.
This!
APK signatures exist and they’re enough for making sure the file you got isn’t modified. Warning people when they use apks for stuff like banking, I get, but if they wanna take the risk, it’s on them.
Blocking root makes no sense because I’d argue that if the person knows enough to root their phone and got past all those bricked phone/thermonuclear war warnings, the onus is on them to not get their keychain compromised by giving root to some random app. Again, a warning is fine.
Aside from that, people need to understand: THE CLIENT IS NEVER SECURE. NO EXCEPTIONS.
Any self respecting secure API is made under the assumption that all the calls are coming from some malicious state actor using curl until proven beyond doubt that it’s an actual user.
Google Pain Services. Google Pisses Itself API.
I just won’t use any apps that do this. Simple.
Yeah until the cops pull you over and take your cash under civil asset forfeiture because it’s “suspicious that you have so much cash on hand”.
personally, i wouldn’t trust a third-party created app with my banking details. what’s more, i’ve removed all banking apps from my phone.
i don’t need to allow access to my finances on the device which is most likely to get pinched out of everything i own. plus google and apple don’t need to know which banks have accounts of mine.
imo that additional inconvenience to conduct all banking transactions from a browser is worth the candle.
I’ll be real, I wouldn’t trust a banking app from any third-party storefront to begin with. That’s the sort of app I’d really want to be properly vetted and secured.
But, there’s no difference in security between using a different storefront? The difference in security depends on the app itself, not where it was downloaded from.
The features you miss out on would be direct deposit from checks and app notifications (usually there are a few that you want enabled but are only available through the app).
There’s an app to make web apps icons. Or just use Firefox to add the bookmark to your homepage
What’s the point of having an android phone then? I fucking hate android so much, but I only use it, not iOS, because of sideloading. Of If they take that away from us then why not just get an iPhone then? Our only hope is Linux phones picking up a little.
One reason would be that with an iPhone, you’re paying two to five times the price of an Android phone with comparable hardware.
Hardware isn’t everything. Apple has a couple of advantages over iPhone that let them do more with less:
- iOS needs to support a MUCH fewer devices than Android. Even before they switched to their own silicon, they’ve been optimizing the OS to the hardware really well giving you devices that go toe to toe with Android flagships of the same generation with SIGNIFICANTLY better hardware and like double the RAM. Also why Apple doesn’t really care to increase RAM as much as the android side of things.
- Apple silicon is actually really good and making their own hardware allows them to optimize on both sides of the equation and lets them do more with less.
The selling points for Android (at least the way I’ve seen it over the years) have always been full control (talking about non-root, I’d rather not go down the root rabbit hole here) and (since iPhone 11 started doing firmware blocks on parts) reparability…but both seem to be going out the window lately.
Prices are crap though, but then again Android phones on the top end don’t seem much better. 1-2 gen old iPhones are usually a bit more reasonable though tbh.
F-Droid
Most of the apps I have and use are installed via Droidify. The ones that aren’t are company apps, like banking or airline. I could just used the web sites for those; they’re only conveniences.
My phone isn’t rooted, and I didn’t read the article so I don’t know how this will affect me. If push comes to shove, I’ll simply bite the bullet and get a phone I can install Linux on next time, regardless of how polished for daily driving it is.
Right on. I do use F-Droid and droidify. I also use Obtanium. Linux phone has never sounded better, godammit. Like you, I really don’t give a shit about those banking apps and other shit, web browsers are more than enough in this day and age.
I would most likely be using a phone with Ubuntu Touch on it as my daily driver if it wasn’t for the fact that the cellular carriers force me to have VoLTE support for calls, which is kind of the point for a phone! And guess the one thing Ubuntu Touch doesn’t have support for!
This is just Google’s clever way of not removing the sideloading feature from their OS.
They let app developers to prevent users from using sideloaded app.
This way they can avoid antitrust lawsuits.
It’s the apps that prevent themselves being sideloaded. Presumably, their devs will enact similar policy on EU iOS too.
