• pe1uca@lemmy.pe1uca.dev
      link
      fedilink
      English
      arrow-up
      65
      ·
      2 months ago

      Well, the issue will be developers of other apps would force us to re-google since any build of the app would be useless unless installed from the play store…

        • doctortran@lemm.ee
          link
          fedilink
          English
          arrow-up
          11
          ·
          edit-2
          2 months ago

          Are they? Other comments in different PRs seem to indicate they have no intention of trying to subvert play integrity. Is there something more recent than this that indicates they’re trying?

        • doctortran@lemm.ee
          link
          fedilink
          English
          arrow-up
          17
          ·
          edit-2
          2 months ago

          For every single app where the developer tries this?

          Yeah right. That’s unsustainable.

          They’ll also just increase ways for the integrity to verify it hasn’t been patched. This announcement already says they’re checking the app’s binary for tampering.

    • helenslunch@feddit.nl
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      13
      ·
      2 months ago

      And…move to iOS? The even more locked down platform? What solution are you proposing here?

        • stebo@lemmy.dbzer0.com
          link
          fedilink
          English
          arrow-up
          5
          arrow-down
          1
          ·
          2 months ago

          You can degoogle on Android you know.

          only if your device is supported. Most aren’t…

          • sunzu2@thebrainbin.org
            link
            fedilink
            arrow-up
            4
            arrow-down
            2
            ·
            2 months ago

            LineageOS with microg works for most devices

            Issue is that it is no secure. People should be buying pixels flashing calyx or graphene going forward for their next upgrade IMHO

            • doctortran@lemm.ee
              link
              fedilink
              English
              arrow-up
              5
              ·
              edit-2
              2 months ago

              Issue is that it is no secure.

              Explain. I’m tired of hearing this boogeyman, tell me exactly how Lineage is “not secure” but Graphene is?

              Then maybe give me some examples of cases where that difference has actually been a problem.

              Because it feels like a lot of these “unsecure” things people hand-wring over are really just user freedoms they may use to hurt themselves, not actual vulnerabilities that can’t be avoided with common sense.

              • sunzu2@thebrainbin.org
                link
                fedilink
                arrow-up
                2
                arrow-down
                3
                ·
                2 months ago

                Primarily because bootloader is not lockable, plus delayed updates.

                Also, they do some weird thing with how it is developed. I think it is always in some weird “developer” state but I don’t remember details.

        • helenslunch@feddit.nl
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          4
          ·
          2 months ago

          You can degoogle on Android you know.

          Not if the app doesn’t work outside of Google’s app store, you can’t…?

          • sunzu2@thebrainbin.org
            link
            fedilink
            arrow-up
            4
            arrow-down
            2
            ·
            2 months ago

            Apps that don’t work are usually the worst privacy offenders lol

            People will need to make a choice, corpos won’t make it easier for the slave

            • doctortran@lemm.ee
              link
              fedilink
              English
              arrow-up
              1
              ·
              2 months ago

              I mean, you can be as snotty about this as you like, but it doesn’t change the fact this “choice” is basically between participate in the same digital world as most people do with the most popular, most supported, and highest value apps, vs only what you can use in F Droid or something?

              You’re calling them slaves but can you give them anything more appealing outside the walled garden than “privacy”? It’s not like everything on the play store has an F-Droid corollary. You’re basically telling them to dramatically reduce their own use case. Does that make them a slave?

    • KomfortablesKissen@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      54
      ·
      2 months ago

      So no banking apps for you? I agree that this is shit, but pretending we are not hit by this is not helping.

      Also, I don’t really use banking apps anyway because they already pull similar shit and I can get around it. For now.

      • Ghoelian@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        20
        ·
        2 months ago

        Fortunately so far I haven’t come across a bank here in the Netherlands that wouldn’t work because my phone was rooted or because I’m running grapheneos. Hope it stays that way too.

      • themachine@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        1
        ·
        2 months ago

        Correct. I’ve never used banking apps in the first place anyway. If my bank doesnt have a functional website then I would change banks.

        And i say this not to be difficult or contrarian. I just really hate using apps for every business in existence and simply refuse to do so. Yes I have absolutely sacrificed convenience on many occasions due to this principal.

        • KomfortablesKissen@discuss.tchncs.de
          link
          fedilink
          English
          arrow-up
          1
          ·
          2 months ago

          Very good. I don’t like using apps for every little shitty website like discord or WebEx either.

          Just know that this is a step forward in the direction of making it technically possible to force people to usw the app. Ask yourself if you trust them to not try and profit from this.

          • themachine@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            2 months ago

            Just know that this is a step forward in the direction of making it technically possible to force people to usw the app.

            I disagree. There is nothing stopping that as it is. What this really does is remove one more level of control from the end user on their device.

            Ask yourself if you trust them to not try and profit from this.

            Im not sure what you are getting at here. Of course i don’t trust “them”. Nor do i trust any corp. It’s those reasons among others why i have completely removed google from my computing life and almost exclusively use open source software as well as self host functionally all network services.

            • KomfortablesKissen@discuss.tchncs.de
              link
              fedilink
              English
              arrow-up
              1
              ·
              2 months ago

              I disagree. There is nothing stopping that as it is. What this really does is remove one more level of control from the end user on their device.

              That is exactly what I meant with that. Less control for you means more control for the banks/app creators.

              I myself also want to let go of the likes of Google. It’s a pretty bumpy ride, but better than a future where the Tech Bros are in control.

      • Mr_Blott@feddit.uk
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        1
        ·
        2 months ago

        Is there any reason anyone would want to use an out of date banking app?

      • helenslunch@feddit.nl
        link
        fedilink
        English
        arrow-up
        8
        arrow-down
        5
        ·
        2 months ago

        Honest question though: what are you using banking apps for?

        On the rare occasion I need to actually interact with my bank, I log in using the browser.

      • henfredemars@infosec.pub
        link
        fedilink
        English
        arrow-up
        2
        ·
        2 months ago

        With banking apps in particular this lock down is ultra-stupid.

        Like, I have to use your super secure app, or I can just… visit your page in a web browser running on god-knows-what with whatever extensions in any computing environment or OS of my choosing? But not using Google Play is where they draw the line.

  • cleverusername@lemm.ee
    link
    fedilink
    English
    arrow-up
    69
    ·
    2 months ago

    What if I sideload purely to downgrade a bugged app? Just seems like yet another kick in the teeth by Google.

      • ReversalHatchery@beehaw.org
        link
        fedilink
        English
        arrow-up
        2
        ·
        2 months ago

        without uninstalling. that had a reason, safety, as apps are often not prepared to handle their “future” (relatively) config files and data formats

    • Chozo@fedia.io
      link
      fedilink
      arrow-up
      11
      arrow-down
      37
      ·
      2 months ago

      Google’s only providing the option, it’s up to individual devs to enable it on their app. If the app developer has chosen to block sideloading, then they probably have a reason for going out of their way to do so. Whatever you find that reason to be should inform your decision whether or not to continue using their app.

      • doctortran@lemm.ee
        link
        fedilink
        English
        arrow-up
        60
        arrow-down
        3
        ·
        edit-2
        2 months ago

        Their reasons mean nothing. It’s my device. I shouldn’t have to worry about an application installed on my device being policed because the developer got a hair up their ass about people downgrading.

        The phrase “more secure” is becoming meaningless as it keeps being used as a blanket excuse for literally every user hostile change.

        • Chozo@fedia.io
          link
          fedilink
          arrow-up
          13
          arrow-down
          37
          ·
          2 months ago

          Sure, it’s your device. But it’s their app. Ultimately, it’s the developer’s call to make. You don’t have to use their app.

                • Chozo@fedia.io
                  link
                  fedilink
                  arrow-up
                  3
                  arrow-down
                  2
                  ·
                  2 months ago

                  Sounds like the app developer does not want to support you as a user. You should take it up with devs that do this if that’s a concern.

                • lolcatnip@reddthat.com
                  link
                  fedilink
                  English
                  arrow-up
                  3
                  arrow-down
                  2
                  ·
                  2 months ago

                  Sounds like you’re using a phone that doesn’t meet the requirements specified by your employer. Might I suggest asking them for a company phone?

          • woodgen@lemm.ee
            link
            fedilink
            English
            arrow-up
            7
            ·
            2 months ago

            We can still use their app with a little help from my reverse engineering tools.

      • Virkkunen@fedia.io
        link
        fedilink
        arrow-up
        25
        ·
        2 months ago

        Explain to me what would be the good reasons McDonald’s has to block their app from running on a rooted device because it doesn’t pass SafetyNet or whatever Google is calling it now

        • Chozo@fedia.io
          link
          fedilink
          arrow-up
          3
          arrow-down
          14
          ·
          2 months ago

          Why would I explain something that has nothing to do with this discussion? This has nothing to do with rooted devices.

          • Ghoelian@lemmy.dbzer0.com
            link
            fedilink
            English
            arrow-up
            22
            arrow-down
            1
            ·
            2 months ago

            It’s the same system, it’s all part of play integrity. And that also applies to this bullshit, why does McDonald’s care if I didn’t install their app from the play store?

            • limerod@reddthat.comM
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              6
              ·
              2 months ago

              Can’t you use the website instead? Is the MCDonalds app necessary for orders? I use hermit to sandbox webapps for services which do not require a app.

              • Ghoelian@lemmy.dbzer0.com
                link
                fedilink
                English
                arrow-up
                7
                ·
                2 months ago

                Oh I don’t know if mcdonald’s specifically does this, I’ve never used the app, I just used it as an example because that’s what the guy above was talking about as well.

              • ℍ𝕂-𝟞𝟝@sopuli.xyz
                link
                fedilink
                English
                arrow-up
                2
                ·
                2 months ago

                IIRC they did coupons exclusively in their app a few years ago where I lived (haven’t checked since), and they hiked the price of everything, so if you don’t install the app, you get a 20% surcharge in effect.

                That goes for every single shitty chain store as well.

            • Chozo@fedia.io
              link
              fedilink
              arrow-up
              1
              arrow-down
              7
              ·
              2 months ago

              Why should I know? I’m not a McDeveloper.

              If I had to guess, I’d assume it’s because there’s a payment system in their app and they don’t want people monkeying around with it and stealing food.

              • Ghoelian@lemmy.dbzer0.com
                link
                fedilink
                English
                arrow-up
                10
                ·
                2 months ago

                McDonald’s was just an example, the point is most apps don’t need to do that at all.

                I do happen to know how payment systems like that work, and thankfully those are all cloud-based, the only thing the app does is start transactions and check with the server if they’re paid. If they implemented it well, as I suspect a big corpo like McDonald’s probably would, their own order screen also checks server-side if orders are paid. Not much you can do from the app side to mess with that.

                • ℍ𝕂-𝟞𝟝@sopuli.xyz
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  edit-2
                  2 months ago

                  the only thing the app does is start transactions and check with the server if they’re paid

                  Yeah, but the whole PCI DSS thing means that the app must still be secured. That doesn’t necessarily mean that it has to be tied to Google Play, but explain it to them.

              • sunzu2@thebrainbin.org
                link
                fedilink
                arrow-up
                1
                arrow-down
                4
                ·
                2 months ago

                🤡

                If apps like fidelity will run on aurora store withithout safety net and other bullshit, then shiti McDonalds app can take the risk too.

                You are poorly educated on the iseue or a bootlicker

  • Ghoelian@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    70
    arrow-down
    1
    ·
    2 months ago

    Not a single app on my phone was installed through Google Play, it’s all Aurora. Guess if apps really do this i’ll just have to stop using them, cause I’m not installing the play store.

    • Mwa@lemm.ee
      link
      fedilink
      English
      arrow-up
      12
      ·
      2 months ago

      I wish i can degoogle my phone but its a few months old so no rom support and its a samsung :<

      • ReversalHatchery@beehaw.org
        link
        fedilink
        English
        arrow-up
        10
        ·
        2 months ago

        this is the reason phone selection for me is based on what it supports.

        but samsungs are ruled out anyway. their service centers desttoys your phone if you have asserted your ownership of it, their software is way too unnecessarily complicated (not the part you see, but the low level part that complicates the flashing process), and they are generally a garbage company.

        • Mwa@lemm.ee
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          2 months ago

          oh yeah you have to use their own software to flash but i never had samsung destroyed by them and they killed samsung dex pc app for mac but i think in a few years rom support for my phone will improve and there is also gsi roms you can use

      • Raptorox@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        How is it being a samsung making things worse? I’ve never flashed a samsung phone before so I may be very wrong, but isn’t unlocking the bootloader easy?

        And now that I think about, does samsung have their own system file format or something? Is that the issue?

        • Mwa@lemm.ee
          link
          fedilink
          English
          arrow-up
          2
          ·
          2 months ago

          its bcs they use their own flashing method which got leaked

          • Raptorox@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            2 months ago

            Omg I completely forgot they had a proprietary flasher, yeah that makes it much worse.

            E: wasn’t there an open source implementation called Heimdall?

            • Mwa@lemm.ee
              link
              fedilink
              English
              arrow-up
              1
              ·
              2 months ago

              E: wasn’t there an open source implementation called Heimdall?

              I Would rather use Heimdall then the leaked odin flasher honestly

    • cordlesslamp@lemmy.today
      link
      fedilink
      English
      arrow-up
      3
      ·
      2 months ago

      Quick question: what is the advantage of using Aurora to get apps instead of the Play Store?

      I have Aurora but i don’t understand that, afaik both use the same APKs and can update interchangeably?

      At first I thought Aurora remove some of the app’s tracking beacons but that’s not the case.

      • OutsiderInside@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        At least for me, Play Store impulsively updates itself. I would even say that some apps got updated even though I’d disabled auto updates.

        I installed Aurora and disabled Play Store altogether. So I update apps manually whenever I want to.

  • Nawor3565@lemmy.blahaj.zone
    link
    fedilink
    English
    arrow-up
    55
    ·
    2 months ago

    Aw shit, it says this is supposed to detect when an app’s binary has been tampered with… That means it’s probably gonna be used to block stuff like ReVanced. I hope they can find a way around this that doesn’t require root.

    • Vakbrain@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      17
      ·
      edit-2
      2 months ago

      I guess Revanced would eventually have a patch to skip this check. It can already spoof the client and such, why not this as well. I hope so

  • Zak@lemmy.world
    link
    fedilink
    English
    arrow-up
    45
    ·
    2 months ago

    The whole tech world saw Microsoft Palladium as a nightmare scenario, but was quiet ten years later when Apple and Google did the same thing to our phones. That was a mistake.

    • jbk@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      1
      ·
      2 months ago

      Maybe everyone was just OK with mobile devices being locked down heavily from the start, and now it’s more or less the same level for most

      • Zak@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        2 months ago

        We had several years of Android that mostly wasn’t. Now it’s hard work to get Android that isn’t.

    • lud@lemm.ee
      link
      fedilink
      English
      arrow-up
      19
      arrow-down
      2
      ·
      2 months ago

      This is the individual app’s fault and not Googles. It’s like getting mad at Steam for allowing apps with DRM. Is feature is entirely optional and requires extra effort to implement.

      Also didn’t Google already get sued in the USA for Android not being open enough or something like that.

    • Clent@lemmy.world
      link
      fedilink
      English
      arrow-up
      9
      ·
      2 months ago

      Are you suggesting such an app can be purchased outside Google play but not used?

      Having an app check a license server isn’t exactly new. Google play is simply a third party license server.

      • accideath@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        2 months ago

        No, but you can download the APKs anyways. Which is most likely exactly why this is being implemented. I doubt many developers of free apps are going to turn this feature on.

        • doctortran@lemm.ee
          link
          fedilink
          English
          arrow-up
          1
          ·
          2 months ago

          Yes they will. This tool would force users to always use the Play Store which would increase the download count on their app, which would help its ranking in the Play Store. Every last single developer is incentivized to use this.

          • accideath@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            2 months ago

            On the other hand though, the amount of people who sideload free apps is very small because that’s only really interesting for people with degoogled smartphones.

    • jbk@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      2
      ·
      2 months ago

      Kinda makes sense. A paid app on Google Play is a license to download the .apk file(s). Then a user could make copies, and without DRM, it’d be the same situation as with copyrighted movies and whatnot.

      I’m not saying I support them, it’s just that they are like this for a reason

  • Xenny@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    1
    ·
    2 months ago

    That’s fine I rarely download apps that want to be on the Play store anyway