Google To Allow 'Experienced Users' To Install Unverified Android Apps
(Thursday November 13, 2025 @11:51AM (msmash)
from the some-relief dept.)
- Reference: 0180063536
- News link: https://tech.slashdot.org/story/25/11/13/146214/google-to-allow-experienced-users-to-install-unverified-android-apps
- Source link:
Google says it will build a new "advanced flow" to allow experienced users to [1]install Android apps from unverified developers , easing up on [2]restrictions it proposed in late August . The company said earlier that Android would block such installations starting next year. The new flow will include clear warnings about security risks but will give users final control over the decision.
Google said it is designing the system to resist coercion and prevent users from being tricked into bypassing safety checks. The company is currently gathering early feedback on the feature's design. Google also announced that developers who distribute apps exclusively outside the Play Store can now join an early access program for developer verification.
[1] https://www.androidauthority.com/android-power-users-install-unverified-apps-3615310/
[2] https://tech.slashdot.org/story/25/08/25/1716213/google-to-require-identity-verification-for-all-android-app-developers-by-2027
Google said it is designing the system to resist coercion and prevent users from being tricked into bypassing safety checks. The company is currently gathering early feedback on the feature's design. Google also announced that developers who distribute apps exclusively outside the Play Store can now join an early access program for developer verification.
[1] https://www.androidauthority.com/android-power-users-install-unverified-apps-3615310/
[2] https://tech.slashdot.org/story/25/08/25/1716213/google-to-require-identity-verification-for-all-android-app-developers-by-2027
Unpossible (Score:2)
by AmiMoJo ( 196126 )
How can this be? I was told that Mr. Google was evilly rubbing his hands in glee at the thought of take even more control of your phone, cackling away as lightning flashed outside an arched window behind his throne.
He gave up on the much hated Privacy Sandbox too, which was going to send all your data to Google. That said he also decided to keep third party cookies, which kinda sucks.
Are you sure? (Score:2)
by Tomahawk ( 1343 )
Are you really really sure?
Are you sure-to-the-power-infinity?
Ok then, go ahead.
They're asking for shit! (Score:2)
by sentiblue ( 3535839 )
I have nearly 30 years of technical experience but I won't claim that I have the "experience" to detect/avoid ALL malicious attempts by way of installing unverified apps. Even the Google cannot read the compiled code, how the hell do you expect end-users to be "advanced" on this?
Already an option for 'advanced users' (Score:2)
It's called ADB.
Re:Already an option for 'advanced users' (Score:4, Interesting)
The point was that that was going to go away as a route for unsigned apps to be replaced with a requirement for signatures even when using ADB or other alternative installation methods. Google is backing off that change for now. This should mean that things like [1]Obtainium [imranr.dev] keep working in future.
[1] https://obtainium.imranr.dev/
Re: (Score:3)
Obtainium is such a useful tool. As well as open source apps, it can update apps that you aren't allowed to install in your region via Google Play. Very handy if you travel a lot, as developers often put regional restrictions on things like transport and loyalty apps.
Re: (Score:2)
It needs to be inconvenient and convoluted enough that clueless users can't be tricked into doing it via phishing.
Re: (Score:2)
> It needs to be inconvenient and convoluted enough that clueless users can't be tricked into doing it via phishing.
False. It's the [1]Dancing Pigs [wikipedia.org] problem.
As long as there's a method, someone will write instructions that people will follow. And malware actors will hijack whatever method to install ransomware. You can bet one step will have people running command line commands and there was that ransomware installed via the command line.
The urge to get pirated apps will drive people to whatever the method is. Th
[1] https://en.wikipedia.org/wiki/Dancing_pigs
Re: (Score:3)
It has to be at least a little inconvenient, though. The end users DO NOT READ. No matter how scary the warnings are, whatever told them to do it is scarier and they ignore these warnings. We're at the point now where we don't even need malware to steal someone's bank account information. Just fake virus warnings on a web page with a toll-free number. And this is across the board, at all education levels. Critical thinking skills work against this but even those with the skills forget to put them to u
Re: (Score:2)
> It has to be at least a little inconvenient, though. The end users DO NOT READ. No matter how scary the warnings are, whatever told them to do it is scarier and they ignore these warnings.
They read, they just don't have infinite attention to dedicate to vendor nonsense. The source of software isn't relevant. What software is allowed to do is what matters. Misplaced focus especially given the fact Google app store itself is full of malware only contributes to fatigue swaying attention away from what is important to what is not.
If an OS vendor really cared about what was in the best interest of the user they would never place the user in a situation where they face take it or leave it deman
Re: (Score:2)
> 'advanced' doesn't and shouldn't have to be a synonym for 'incredibly inconvenient'
DOS ain't done til Lotus won't run
Re:Already an option for 'advanced users' (Score:4, Interesting)
The problem is that alternate app stores would have had to verify all their apps with Google which defeats the purpose of being alternate. This move would allow them to actually exist again as they currently do, but it does raise the question of how this will be different from the current method of allowing alternate app stores to install apps, which has already existed in android for quite some time.
Re: (Score:2)
Whatever method it is, it will probably defeat the purpose of ending unsigned side loading. Whatever the hoops are, users will be trained to jump through them.