12 ms·

Open Letter to Google on Mandatory Developer Registration for App Distribution

462 points by kaplun 7mo ago

kelp6063 7mo ago
why anyone thinks "open letters" and petitions to a trillion-dollar company will get them to change their mind is beyond me
- gleenn 7mo ago
  It matters to me because I'm reading it now and feel more informed about this problem. Throwing the towel in and saying it's all pointless isn't helpful.
  - shimman 7mo ago
    It's not throwing in the towel, it's about doing things that we the people can actually do. One thing, we the people can do, is pressure our politicians to break up Google along with the rest of big tech. There are many primary challengers this cycle that are running anti-monopoly platforms. Help their cause, signing pointless petitions is just West Wing style fantasy that is extremely childish.
    - jhasse 7mo ago
      We can also do both, right? :)
- jeroenhd 7mo ago
  It's something apps that will soon break can point their users to so they know to blame Google and a bunch of incompetent governments. Google will not change their minds, they're too busy buying goodwill from governments by playing along. There aren't any real alternatives to Android that are less closed off and they know it.
- Retr0id 7mo ago
  Because the company either has to address it, or stop pretending it's "listening to concerns" or whatever. Even if it doesn't change the outcome, it makes it clearer that the company is engaging in bad faith.
pmdr 7mo ago
The undersigned are basically a list of entities Google would like to see disappear.
- OutOfHere 7mo ago
  Precisely! Google doesn't care one bit about civil society; it cares about power to itself even if this means punching freedom and liberty in the face. Personally I think it'll be a good thing if this restriction finally wakes up people to seek alternatives to Google.
dfabulich 7mo ago
The most controversial claim in this letter is in the section that "Existing Measures Are Sufficient." In Google's announcement in Nov 2025, they articulated a pretty clear attack vector. https://android-developers.googleblog.com/2025/11/android-developer-verification-early.html https://android-developers.googleblog.com/2025/11/android-de... > For example, a common attack we track in Southeast Asia illustrates this threat clearly. A scammer calls a victim claiming their bank account is compromised and uses fear and urgency to direct them to sideload a "verification app" to secure their funds, often coaching them to ignore standard security warnings. Once installed, this app — actually malware — intercepts the victim's notifications. When the user logs into their real banking app, the malware captures their two-factor authentication codes, giving the scammer everything they need to drain the account. > While we have advanced safeguards and protections to detect and take down bad apps, without verification, bad actors can spin up new harmful apps instantly. It becomes an endless game of whack-a-mole. Verification changes the math by forcing them to use a real identity to distribute malware, making attacks significantly harder and more costly to scale. I agree that mandatory developer registration feels too heavy handed, but I think the community needs a better response to this problem than "nuh uh, everything's fine as it is." A related approach might be mandatory developer registration for certain extremely sensitive permissions, like intercepting notifications/SMSes...? Or requiring an expensive "extended validation" certificate for developers who choose not to register...?
- verdverm 7mo ago
  Agree with this middle path you point out. On one hand, I do not want some apps to be distributed anonymously, I need to know who is behind it in order to trust the app. On the other hand, many apps are benign. Permissions are a great way to distinguish.
  - amiga386 7mo ago
    Do you need Google to compel the author to start a business relationship with them, which they can cut off at any time? Or would you be OK knowing that Thunderbird you downloaded from https://thunderbird.net/ https://thunderbird.net/ is signed by the thunderbird.net certificate owner?
jonathanstrange 7mo ago
For me this change is a problem not just because of the ID upload to Google but mainly because it's another nail in the coffin of native software solutions. It increases friction and anything that increases friction is bad. Concretely, my original plan was to provide an .apk for manual installation first and tackle all this app store madness later. I already have enough on my plate dealing with macOS, Windows, and Linux distribution. With the change, delaying this is no longer viable, so Android is not only one among five platforms with their own requirements, signing, uploading, rules, reviews, and what not, it is one more platform I need to deal with right from the start because users expect software to be multiplatform nowadays. Quite frankly, it appears to me as if dealing with app stores and arbitrary and ever changing corporate requirements takes away more time than developing the actual software, to the detriment of the end users. It's sad to watch the decline of personal computing.
- verdverm 7mo ago
  I personally see an unmoderated app store as more detrimental to the end users. The harm happens at scale.
  - jonathanstrange 7mo ago
    When there were many different app stores to choose from, nobody would be forced to use an unmoderated app store. What happened to individual freedom and responsibility?
    - verdverm 7mo ago
      I would need to see a widely used and trusted 3rd party store before leaving Google Play became a consideration. I'm interested, but not an early adopter. It's also unclear if any store that reaches this point doesn't institute similar moderation techniques. Scale incentivizes bad actors, which in turn requires good moderation.
  - InsideOutSanta 7mo ago
    That's the status quo, though. Apple's App Store and Google's Play Store are essentially unmoderated. The sheer scale of them and both platforms' technical architectures prohibits either company from properly validating their stores' contents - they can't even catch the easy cases, like all the apps that impersonate ChatGPT. The main thing they manage to do is inconvenience innocent indie devs once in a while. The result is unwarranted trust from users in stores that are full of scams. Apple and Google effectively built malware pipelines under the guise of security.
boje 7mo ago
Uh, is having Aurora Store as a signatory a good idea? It's literally a Google Play Store bypassing tool.
drnick1 7mo ago
Isn't the obvious solution to use an AOSP fork that does not have to comply with the registration requirements? Distributions like Graphene and Lineage are completely unaffected.
- turblety 7mo ago
  Google are also destroying that path by delaying the releases more and more.
  - jhasse 7mo ago
    Even more reason to use these forks (and support them), right?
- wackget 7mo ago
  No, because many apps refuse to run on third-party distros due to misguided notions of them being insecure. It's easy to say "just don't use those apps" but in reality, people are rightly unwilling to put up with any friction and so will simply continue to use Google's version of the OS.
  - microtonal 7mo ago
    Many banking apps work as long as you relock the bootloader. E.g. on GrapheneOS: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/ https://privsec.dev/posts/android/banking-applications-compa...
- jamesnorden 7mo ago
  No bank in my country has an app that works with those, so it's not an option for me anymore.
  - arjie 7mo ago
    Does the web app for the bank actually selectively block mobile phones? I just checked and Chase here in the US lets me log in on Brave Mobile on iOS. Perhaps your bank lets you log on in the browser.
dvh 7mo ago
Wrong approach. Vote with your wallet instead. My next mobile phone will not have OS from Google (not from Apple).
- hollandheese 7mo ago
  Good luck with that.
  - fsflover 7mo ago
    Works for me.
  - yndoendo 7mo ago
    No luck needed. Linux based phones are starting to become viable as daily drivers. [0] They are even coming with VM Android in case an application is needed that does not have a Linux equivalent. I am interested in how Google's gatekeeper tactics are going to affect Android like platforms such as /e/os and GrapheneOS. [1] [0] http://furilabs.com/ http://furilabs.com/ [1] https://murena.com/america/products/smartphones/ https://murena.com/america/products/smartphones/
    - cesarb 7mo ago
      > > Good luck with that. > No luck needed. Linux based phones are starting to become viable as daily drivers. Then please tell me, which non-Android Linux-based phone can I buy here in Brazil (one of the first places where Android would have these new restrictions)? I'd love to know (not sarcasm, I'm being sincere). Keep in mind that only phones with ANATEL certification can be imported, non-certified phones will be stopped by customs and sent back.
      - iamnothere 7mo ago
        My condolences, that sucks that you’re stuck in such an authoritarian country. If you look at the PostmarketOS site, you may be able to find a legal phone (weird to type that phrase) that can be reflashed. Or you could buy one while on vacation, my guess is they don’t check models at the border if it looks like a personal device.
octoclaw 7mo ago
The real issue is that mandatory registration doesn't actually stop scammers. It stops hobbyist developers and small open source projects. Scammers will use stolen identities or shell companies. They already do this on the Play Store itself. The $25 fee and passport upload haven't prevented the flood of scam apps there. Meanwhile F-Droid's model (build from source, scan for trackers/malware) actually provides stronger guarantees about what the app does. No identity check needed because the code speaks for itself. The permission-based approach someone mentioned above makes way more sense. If your app wants to read SMS or intercept notifications, sure, require extra scrutiny. But a simple calculator app or a notes tool? That's just adding friction for no security benefit.
- jeroenhd 7mo ago
  The permission problem also affects normal apps. Things like KDE Connect quickly become useless without advanced permissions, for instance. No permission system can work as well as a proper solution (such as banks and governments getting their shit together and investing in basic digital skills for their citizens).
rm30 7mo ago
Registration just creates friction for legitimate developers (thousands) while bad actors simply rotate shell companies and fake/stolen IDs. This conflates identity verification with criminal deterrence, they're not the same thing.
- nickorlow 7mo ago
  Yeah, Google is terrible at validating developers are non-malicious on google play. plenty of fake/malicious/garbage apps make it through the filter.
- UncleMeat 7mo ago
  Friction does matter. Yes, criminals will create fake accounts with stolen IDs and stolen credit cards. But creating 1,000s of these is hard. Creating polymorphic banking trojans is simple. I don't know if this trade off is worth it, but the idea that it won't affect this abuse at all is false.
  - array_key_first 7mo ago
    If you can convince someone over the phone to install malware thru a million "don't do this" screens, you can convince them to just give you their login credentials. Which is both easier, cheaper, and, I imagine, more effective.
    - UncleMeat 7mo ago
      And yet, criminals create banking trojans at scale. They wouldn't do this if it was more effective to always do traditional phishing.
      - array_key_first 7mo ago
        Well they do both, and as I said I imagine most phishing is traditional, through the phone or email. Casting a wide net is just good business, but simply eradicating malware won't make phishing no longer possible. And I'm being extremely generous here, because this won't erradicate malware. It will make a specific subset of malware harder to distribute. I imagine most malware is distributed through the play store, and naturally that will be unaffected.
EmbarrassedHelp 7mo ago
The problem with mandatory developer registration, is that it gives Google and Governments the ability to veto apps. It would not be unsurprising for a government to tell Google they must block any VPN apps from being installed on devices, and Google using the developer requirements to carry out the ban.
- criddell 7mo ago
  > The problem with mandatory developer registration, is that it gives Google and Governments the ability to veto apps. Don't they already have that power?
  - nickorlow 7mo ago
    You can download any APK you like on the internet and run it without google/gov getting in the way
    - scoofy 7mo ago
      Yes, but the already have the power to ban apps if they wanted to. They just don't. That's the point.
      - nickorlow 7mo ago
        No they don't?
  - mhitza 7mo ago
    No, that is one reason why they are pushing for these changes.
  - aftergibson 7mo ago
    No judgement whatsoever, but for almost everyone they too will think, no big deal you only install software through stores right? Nothing changes for them, in fact they can't conceive of an alternative anymore.
dsl 7mo ago
Dear Undersigned, I have an APK I would like you to install on your personal phones. No, I won't tell you who I am. Please let me know when you are comfortable with this.
- bigstrat2003 7mo ago
  Nice strawman. People want the ability to decide for themselves whether or not to install some APK, they are not saying every APK under the sun is trustworthy.
  - dsl 7mo ago
    It is a simplification, not a strawman. If you want to make the decision to install Hay Day, the user should be able to know that it is the Hay Day from Supercell or from Sketchy McMalwareson. 99.9% of apps should have no issue with their name being associated with their work. If you genuinely need to use an anonymously published app, you will still be able to do that as a user.
    - nickorlow 7mo ago
      > If you genuinely need to use an anonymously published app, you will still be able to do that as a user. I'm pretty sure the goal of Google's changes is to make it so you can't
    - NicuCalcea 7mo ago
      Android already tells users when they're installing software from outside the Play Store and shows big scary warnings if Play Protect is turned off. What else do you want? If I want to install something from Sketchy McMalwareson after all that, that's my phone and my business.
- nickorlow 7mo ago
  If I want to run a piece of software on my phone, I shouldn't need to go ask google whether they're cool with it
rprend 7mo ago
[flagged]
- TJTorola 7mo ago
  Ideological is carrying a lot of weight there. Perhaps you can be more specific about the ideological arguments you are hearing that are not worth it?
  - rprend 7mo ago
    Walled gardens have less fraud and malware because it's less open. But developers prefer open source decentralized software. Of course, we are technologically literate enough to avoid the fraud. It's similar to drug decriminalization or the legalization of sports gambling.
- mhitza 7mo ago
  Who says that Google is the one to decide what open source software I can install on my mobile Android computing device?
  - rprend 7mo ago
    Wym? Google says it’s the one to decide. They are doing this because side loading causes fraud. There is pressure and lobbying (like this open letter) to stop them from locking it down.
    - mhitza 7mo ago
      It was a catchy rethorical question. Desired emphasis on the fact that a smartphone is a computing device. If you like to not be able to run whatever software you want on your computer, and the one your family owns, that's your thing. Its another pretense, like disabling full disk encryption, where people came with these ideas (instead of other options), because its convenient to them to pretend its the right thing.
      - 7mo ago
exe34 7mo ago
Does anyone know if this will affect Lineage OS with root?
- jech 7mo ago
  As far as I know, it's implemented in the proprietary part of Android (Google Mobile Services, GMS), so it won't affect LineageOS users as long as they don't install the GMS.
iamnothere 7mo ago
Just here to register my disapproval of this, and to remind everyone that you should support Linux phones if you’re against it. Or Graphene OS, at the very least, even though this still supports Google due to the requirement for a Pixel phone. Also, I’m going to coin a new term for the recurring names that I see promoting this kind of thing here: “safety fascists.” Safety fascists won’t sleep until there is a camera watching every home, a government bug in every phone, a 24/7 minder for every citizen. For your safety, of course. I think I may hate safety fascists more than I hate garden variety fascists. That’s an accomplishment!
btreesOfSpring 7mo ago
Would rather a more robust and distributed app store system that figures out how to police these edge cases of fraud rather than one vendor (Apple or Google) whose monopolies push developers into subscriptionware across the board. Something more akin to how internic moved from one domain name registrar to what we have today, chock full of competition and new top level domains. It feels like independent development on devices has slowed in recent years. More stores appealing to different developer models/tools and monetization strategies please.
pserwylo 7mo ago
Many people online and in person telling me "Google backed down" or "Google has an advanced flow" are typically referring to these two statements from Google staff: > Based on this feedback and our ongoing conversations with the community, we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. [0] > Advanced users will be able to"Install without verifying," but expect a high-friction flow designed to help users understand the risks. [1] Firstly - I am yet to see "ongoing conversations with the community" from Google. Either before this blog post or in the substantial time since this blog post. "The community" has no insight into whether any such "advanced flow" is fit for purpose. Secondly - I as an experienced engineer may be able to work around a "high-friction flow". But I am not fighting this fight for me, I am fighting it for the billions of humans for whom smart phones are an integral part of their daily lives. They deserve the right to be able to install software using free, open, transparent app stores that don't require signing up with Google/Samsung/Amazon for the privilege of: Installing software on a device they own. One example of a "high friction flow" which I would find unacceptable if implemented for app installation on Android is the way in which browsers treat invalid SSL certificates. If I as a web developer setup a valid cert, and then the client receives an invalid cert, this means that the browser (which is - typically - working on behalf of the customer) is unable to guarantee that it is talking to the right server. This is a specific and real threat model which the browser addresses by showing [2]: * "Your connection is not private" * "Attackers might be trying to steal your information (for example, passwords, messages or credit cards)" * "Advanced" button (not "Back to safety") * "Proceed (unsafe)" link * "Not secure" shown in address bar forever In this threat model, the web dev asked the browser to ensure communication is encrypted, and it is encrypted with their private key. The browser cannot confirm this to be the case, so there is a risk that a MITM attack is taking place. This is proportionate to the threat, and very "high friction". I don't know of many non-tech people who will click through these warnings. When the developer uses HSTS, it is even more "high friction". The user is presented all the warnings above, but no advanced button. Instead, on Chromium based browsers they need to type "thisisunsafe" - not into a text box, just randomly type it while viewing the page. On Firefox, there is no recourse. I know of very few software engineers who know how to bypass HSTS certificate issues when presented with them, e.g. in a non-prod environment with corporate certs where they still want to bypass it to test something. If these "high friction" flows were applied to certified Android devices each time a user wanted to install an app from F-Droid - it would kill F-Droid and similar projects for almost all non-tech users. All users, not just tech users, deserve the right to install software on their smart phone without having to sign up for an "app store" experience that games your attention and tries to get you to install scammy attention seeking games that harvest your personal information and flood you with advertisements Hence, I don't want to tell people "Just install [insert non-certified AOSP based project here]". I want Android to remain a viable alternative for billions of people. [0] - https://android-developers.googleblog.com/2025/11/android-developer-verification-early.html https://android-developers.googleblog.com/2025/11/android-de... [1] - https://x.com/matt_w_forsythe/status/2012293577854930948 https://x.com/matt_w_forsythe/status/2012293577854930948 [2] - https://wrong.host.badssl.com/ https://wrong.host.badssl.com/
cyanydeez 7mo ago
When do we think PWA and WebRTC will be attacked and degraded as insecure?
tsoukase 7mo ago
Banning apps installation outside PlayStore will be a disaster for power-ish users and will start a fight between Google and community. I abandoned rooting my devices because I could achieve all I wanted through apps (mostly ad- and nag-freedom, it's impossible to be online without ad blocking). But all these were downloaded as APKs. I cannot imagine how the first day without these will be.
WarmWash 7mo ago
The judge told Google that Apple is not anti-competitive because Apple has no competitors on it's platform (this all stemming from the Epic lawsuits). Google listened. Blame the judge for one of the worst legal calls in recent history. Google is a monopoly and Apple is not. Simple fix for Google... Same comment I made a few days ago, I feel it bears repeating as much as possible until it's really driven home how detrimental and uninformed that decision was.
- pas 7mo ago
  Sorry, which exact ruling are you referring to? How did the court arrived at this finding (that seems irrelevant, false)?
  - kodebach 7mo ago
    It is a non-sensical ruling. But IIRC the reason was basically that while Apple and Google did basically the same shit, only Google kept a written record of their monopolistic behaviour, so only Google was found guilty. However, there is a relevant court case here. The one about Samsung's "Auto Blocker" (https://arstechnica.com/gadgets/2025/07/samsung-and-epic-games-call-a-truce-in-app-store-lawsuit/ https://arstechnica.com/gadgets/2025/07/samsung-and-epic-gam...). Epic Games sued because Samsung made it too hard to install apps from "untrusted" sources. This may be a reason why Google is now trying to make the process more difficult on the developer side instead.
    - pas 7mo ago
      thanks for replying! the Samsung case is very interesting, haven't bumped into that one before. ... as far as I understand the really nasty part of "contemporary" jurisprudence of antitrust enforcement is that the standard is to show that things would be cheaper for the consumers (though I don't know why developers are not considered consumers of the app marketplace services, after all for them bringing their own payments and whatnot would be much more cost effective... well, anyway, unfortunately the courts are mostly locked to this very inefficient path-dependent way of regulating anything through super expensive arguments, which is an obvious (?) dysfunction of legislation)
arjie 7mo ago
If I'm being honest, I suspect this > Disproportionate impact on marginalized communities and controversial but legal applications applies more to the elderly in third-world countries who are constantly scammed through fraudulent side-loaded apps than it does to hackers who want to install whatever software they want but do not want to use a non-Google AOSP distribution.
jdlyga 7mo ago
To be honest, if both Android and iOS were walled gardens, I'd choose iOS every time. I choose Android specifically because of its openness. But if that weren't the case, I'd prefer the smoother UX and stronger Apple ecosystem.
- singpolyma3 7mo ago
  You're welcome to it I suppose. As someone forced to use iOS for the past year I'm still waiting to find any smooth UX or strong ecosystem...
asim 7mo ago
I think we're about to see an explosion in "mini apps". It's taken 10+ years for us to catch up to WeChat and China but this regulation and other issues are going to block a lot of innovation and we're better off surfacing tiny PWA or SPA like apps that get loaded in native apps or we just do away with that entirely. The time has come.
- TheJoeMan 7mo ago
  Elon's vision for the X "everything" app. It's great for them, now every single thing you do has the full gamut of privacy permissions. Playing a "mini-game"? Full accurate GPS coordinates available to it because you also have the ride-hailing "mini-app".
umairnadeem123 7mo ago
[dead]
- AlotOfReading 7mo ago
  Why is that an acceptable middle ground for you? I trust f-droid apps a lot more than anything installed from the Play store. The same restrictions should apply to Google's store as others.
- hbn 7mo ago
  > periodic re-confirmation This just trains everyone to blindly click "accept" thus adding zero security while making the UX terrible for people who know what they're doing
TZubiri 7mo ago
If I may advocate for the non HN partisan position here. Let's consider that Google's Android was and is a huge improvement in security in terms of OS design (even if inspired by iOS) over the previous incumbent (let's call Windows that). That difference in security still exists today (probably due to Window's Backwards Compatibility prioritization, and its later positioning in the market as a cheap powertool (cheap compared to iOS, powertool compared to android). That security advantage, by the way, was not just the result of initial design, but it required a lot of maintenance, in the form of the 'Play Store' App Store equivalent (at no cost to the user no less). All this to say that let's consider this context, and consider what alternatives are proposed. 1- The windows 'install whatever you want model' (Now with OS approved certificates): As mentioned, worse, with almost no sandboxing. 2- Linux package managers + install whatever you want: Valid model for powerusers and programmers, not really relevant for massive personal computing. 3- Keeping the old Android system: This would imply simply ignoring the problem of growing professional and untouchable malicious actors that seem to be growing in power with the advent of anonymous financial tech. Is this the actual proposal? Do nothing about the problem? Pretend there is no problem? I don't think the problem is necessarily malware, but to take a specific example, suppose a Casino from Isle of Man is allowing underaged and users from jurisdictions where it is illegal. Regardless of whether you think this is ok, or debatable or it depends on the circumstances. Isn't the ask to identify the developer rather trivial? Just a little bit of paperwork, you want to be a developer? Install code that someone else will use? Put your name in it, have skin in the game. I think there's also a contradiction between the need for developer privacy and user privacy. Most HN users are privacy-sensitive. Well I propose there's a tradeoff between the privacy of the consumer and the producer. In order to provide privacy and rights to the user, the producer needs to come forward. There's no way to have the cake and eat it too, if both producer and consumer are shy, they will never find each other, if both producer and consumer stay anonymous, they won't trust each other, if both producer and consumer stay anonymous, they don't give any guarantees to the other party that they won't go rogue. You know this if you've tried to start a business, you can either put your face, your name, register with the state, put your actual address. Or you can use an anonymous brand, a Registered Agent Address, etc... The latter is a harder sell than the former, and you only don't notice it if you are completely absorbed in your own world and cannot put yourself in the shoes of your customer. tl;dr: Google has an impeccable data security track record. And User/Developer privacy is a tradeoff. Google is right to protect user privacy and not developer privacy.
atlgator 7mo ago
"Don't be evil" → "Don't be evil without registering first and uploading your government ID." The most telling detail is the sequencing. Google spent years in court arguing Android is open to fend off antitrust regulators, won key battles on that basis, and is now quietly closing the door they swore under oath was permanently propped open. The antitrust defense was the product roadmap's cover story. And framing this as security is particularly rich from the company whose own Play Store routinely hosts malware that passes their review. The problem they're solving isn't "unverified developers distribute harmful apps" — it's "unverified developers distribute apps we can't monetize or control."
ChoGGi 7mo ago
Hey Google, how about you clear all the malware from the play store then work on sideloading?
eqvinox 7mo ago
Can someone explain to me why Google's plans don't collide with the EU DMA? They're locking down the platform, that's what the DMA is supposed to prevent, I thought.
schmorptron 7mo ago
Before this LLM age the solution would've been to make the user solve a leetcode problem to access a developer mode.
wernsey 7mo ago
Google's concerns about security rings hollow to me. I believe it is strictly to exercise more control over the platform. The appeals to people in Southeast Asia being scammed reminds me of a blog by Cory Doctorow last year: Every complex ecosystem has parasites [1] The gist of it is that technology can be useful, but that usefulness comes with a price: sometimes bad actors are going to commit fraud or other undesirable actions. As an example, you can reduce the amount of banking app scams to 0% by simply denying any banking apps on phones. But because of banking apps' usefulness we're not going to do that, so there will be some non-zero risk that you will get scammed. As a technical user I chose Android for its usefulness, accepting that there may be a (minute) chance that I get scammed, but it is a risk I am willing to take, and Google will unilaterally take this choice away from me. Still, I don't believe Google's security concerns are sincere, so I think I just wasted my time typing all of this [1] https://pluralistic.net/2025/04/24/hermit-kingdom/ https://pluralistic.net/2025/04/24/hermit-kingdom/
pbnjeh 7mo ago
1) As I saw Rossman recommend the other day, once Android phones are locked down, just get an iPhone. I’ve had a Pixel 8 Pro and was considering the upcoming 11. If this lockdown goes through, I guess not. 2) I hope the lockdowns don’t strangle tethering. My other consideration is to use whatever phone for calls, texts, and “secure” apps. The rest I’ll do on an unrestricted device that just uses the phone as a data connection. More crap to carry, but crap that does what I want and need and not what “they” insist upon. P.S. And that may mean spending less on future phones. Especially if I also switch my higher quality camera image needs to a real camera. Sigh, yet more physical crap, but I’m pissed enough to do it, and then each individual device would be less of a feature compromise than what a phone provides — other than size and portability, which are indeed quite significant.

462 points by kaplun 7mo ago

why anyone thinks "open letters" and petitions to a trillion-dollar company will get them to change their mind is beyond me

gleenn 7mo ago
It matters to me because I'm reading it now and feel more informed about this problem. Throwing the towel in and saying it's all pointless isn't helpful.
- shimman 7mo ago
  It's not throwing in the towel, it's about doing things that we the people can actually do. One thing, we the people can do, is pressure our politicians to break up Google along with the rest of big tech. There are many primary challengers this cycle that are running anti-monopoly platforms. Help their cause, signing pointless petitions is just West Wing style fantasy that is extremely childish.
  - jhasse 7mo ago
    We can also do both, right? :)
jeroenhd 7mo ago
It's something apps that will soon break can point their users to so they know to blame Google and a bunch of incompetent governments. Google will not change their minds, they're too busy buying goodwill from governments by playing along. There aren't any real alternatives to Android that are less closed off and they know it.
Retr0id 7mo ago
Because the company either has to address it, or stop pretending it's "listening to concerns" or whatever. Even if it doesn't change the outcome, it makes it clearer that the company is engaging in bad faith.

pmdr 7mo ago

The undersigned are basically a list of entities Google would like to see disappear.

OutOfHere 7mo ago
Precisely! Google doesn't care one bit about civil society; it cares about power to itself even if this means punching freedom and liberty in the face. Personally I think it'll be a good thing if this restriction finally wakes up people to seek alternatives to Google.

dfabulich 7mo ago

The most controversial claim in this letter is in the section that "Existing Measures Are Sufficient." In Google's announcement in Nov 2025, they articulated a pretty clear attack vector. https://android-developers.googleblog.com/2025/11/android-developer-verification-early.html https://android-developers.googleblog.com/2025/11/android-de... > For example, a common attack we track in Southeast Asia illustrates this threat clearly. A scammer calls a victim claiming their bank account is compromised and uses fear and urgency to direct them to sideload a "verification app" to secure their funds, often coaching them to ignore standard security warnings. Once installed, this app — actually malware — intercepts the victim's notifications. When the user logs into their real banking app, the malware captures their two-factor authentication codes, giving the scammer everything they need to drain the account. > While we have advanced safeguards and protections to detect and take down bad apps, without verification, bad actors can spin up new harmful apps instantly. It becomes an endless game of whack-a-mole. Verification changes the math by forcing them to use a real identity to distribute malware, making attacks significantly harder and more costly to scale. I agree that mandatory developer registration feels too heavy handed, but I think the community needs a better response to this problem than "nuh uh, everything's fine as it is." A related approach might be mandatory developer registration for certain extremely sensitive permissions, like intercepting notifications/SMSes...? Or requiring an expensive "extended validation" certificate for developers who choose not to register...?

verdverm 7mo ago
Agree with this middle path you point out. On one hand, I do not want some apps to be distributed anonymously, I need to know who is behind it in order to trust the app. On the other hand, many apps are benign. Permissions are a great way to distinguish.
- amiga386 7mo ago
  Do you need Google to compel the author to start a business relationship with them, which they can cut off at any time? Or would you be OK knowing that Thunderbird you downloaded from https://thunderbird.net/ https://thunderbird.net/ is signed by the thunderbird.net certificate owner?

jonathanstrange 7mo ago

For me this change is a problem not just because of the ID upload to Google but mainly because it's another nail in the coffin of native software solutions. It increases friction and anything that increases friction is bad. Concretely, my original plan was to provide an .apk for manual installation first and tackle all this app store madness later. I already have enough on my plate dealing with macOS, Windows, and Linux distribution. With the change, delaying this is no longer viable, so Android is not only one among five platforms with their own requirements, signing, uploading, rules, reviews, and what not, it is one more platform I need to deal with right from the start because users expect software to be multiplatform nowadays. Quite frankly, it appears to me as if dealing with app stores and arbitrary and ever changing corporate requirements takes away more time than developing the actual software, to the detriment of the end users. It's sad to watch the decline of personal computing.

verdverm 7mo ago
I personally see an unmoderated app store as more detrimental to the end users. The harm happens at scale.
- jonathanstrange 7mo ago
  When there were many different app stores to choose from, nobody would be forced to use an unmoderated app store. What happened to individual freedom and responsibility?
  - verdverm 7mo ago
    I would need to see a widely used and trusted 3rd party store before leaving Google Play became a consideration. I'm interested, but not an early adopter. It's also unclear if any store that reaches this point doesn't institute similar moderation techniques. Scale incentivizes bad actors, which in turn requires good moderation.
- InsideOutSanta 7mo ago
  That's the status quo, though. Apple's App Store and Google's Play Store are essentially unmoderated. The sheer scale of them and both platforms' technical architectures prohibits either company from properly validating their stores' contents - they can't even catch the easy cases, like all the apps that impersonate ChatGPT. The main thing they manage to do is inconvenience innocent indie devs once in a while. The result is unwarranted trust from users in stores that are full of scams. Apple and Google effectively built malware pipelines under the guise of security.

boje 7mo ago

Uh, is having Aurora Store as a signatory a good idea? It's literally a Google Play Store bypassing tool.

drnick1 7mo ago

Isn't the obvious solution to use an AOSP fork that does not have to comply with the registration requirements? Distributions like Graphene and Lineage are completely unaffected.

turblety 7mo ago
Google are also destroying that path by delaying the releases more and more.
- jhasse 7mo ago
  Even more reason to use these forks (and support them), right?
wackget 7mo ago
No, because many apps refuse to run on third-party distros due to misguided notions of them being insecure. It's easy to say "just don't use those apps" but in reality, people are rightly unwilling to put up with any friction and so will simply continue to use Google's version of the OS.
- microtonal 7mo ago
  Many banking apps work as long as you relock the bootloader. E.g. on GrapheneOS: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/ https://privsec.dev/posts/android/banking-applications-compa...
jamesnorden 7mo ago
No bank in my country has an app that works with those, so it's not an option for me anymore.
- arjie 7mo ago
  Does the web app for the bank actually selectively block mobile phones? I just checked and Chase here in the US lets me log in on Brave Mobile on iOS. Perhaps your bank lets you log on in the browser.

dvh 7mo ago

Wrong approach. Vote with your wallet instead. My next mobile phone will not have OS from Google (not from Apple).

hollandheese 7mo ago
Good luck with that.
- fsflover 7mo ago
  Works for me.
- yndoendo 7mo ago
  No luck needed. Linux based phones are starting to become viable as daily drivers. [0] They are even coming with VM Android in case an application is needed that does not have a Linux equivalent. I am interested in how Google's gatekeeper tactics are going to affect Android like platforms such as /e/os and GrapheneOS. [1] [0] http://furilabs.com/ http://furilabs.com/ [1] https://murena.com/america/products/smartphones/ https://murena.com/america/products/smartphones/
  - cesarb 7mo ago
    > > Good luck with that. > No luck needed. Linux based phones are starting to become viable as daily drivers. Then please tell me, which non-Android Linux-based phone can I buy here in Brazil (one of the first places where Android would have these new restrictions)? I'd love to know (not sarcasm, I'm being sincere). Keep in mind that only phones with ANATEL certification can be imported, non-certified phones will be stopped by customs and sent back.
    - iamnothere 7mo ago
      My condolences, that sucks that you’re stuck in such an authoritarian country. If you look at the PostmarketOS site, you may be able to find a legal phone (weird to type that phrase) that can be reflashed. Or you could buy one while on vacation, my guess is they don’t check models at the border if it looks like a personal device.

octoclaw 7mo ago

The real issue is that mandatory registration doesn't actually stop scammers. It stops hobbyist developers and small open source projects. Scammers will use stolen identities or shell companies. They already do this on the Play Store itself. The $25 fee and passport upload haven't prevented the flood of scam apps there. Meanwhile F-Droid's model (build from source, scan for trackers/malware) actually provides stronger guarantees about what the app does. No identity check needed because the code speaks for itself. The permission-based approach someone mentioned above makes way more sense. If your app wants to read SMS or intercept notifications, sure, require extra scrutiny. But a simple calculator app or a notes tool? That's just adding friction for no security benefit.

jeroenhd 7mo ago
The permission problem also affects normal apps. Things like KDE Connect quickly become useless without advanced permissions, for instance. No permission system can work as well as a proper solution (such as banks and governments getting their shit together and investing in basic digital skills for their citizens).

rm30 7mo ago

Registration just creates friction for legitimate developers (thousands) while bad actors simply rotate shell companies and fake/stolen IDs. This conflates identity verification with criminal deterrence, they're not the same thing.

nickorlow 7mo ago
Yeah, Google is terrible at validating developers are non-malicious on google play. plenty of fake/malicious/garbage apps make it through the filter.
UncleMeat 7mo ago
Friction does matter. Yes, criminals will create fake accounts with stolen IDs and stolen credit cards. But creating 1,000s of these is hard. Creating polymorphic banking trojans is simple. I don't know if this trade off is worth it, but the idea that it won't affect this abuse at all is false.
- array_key_first 7mo ago
  If you can convince someone over the phone to install malware thru a million "don't do this" screens, you can convince them to just give you their login credentials. Which is both easier, cheaper, and, I imagine, more effective.
  - UncleMeat 7mo ago
    And yet, criminals create banking trojans at scale. They wouldn't do this if it was more effective to always do traditional phishing.
    - array_key_first 7mo ago
      Well they do both, and as I said I imagine most phishing is traditional, through the phone or email. Casting a wide net is just good business, but simply eradicating malware won't make phishing no longer possible. And I'm being extremely generous here, because this won't erradicate malware. It will make a specific subset of malware harder to distribute. I imagine most malware is distributed through the play store, and naturally that will be unaffected.

EmbarrassedHelp 7mo ago

The problem with mandatory developer registration, is that it gives Google and Governments the ability to veto apps. It would not be unsurprising for a government to tell Google they must block any VPN apps from being installed on devices, and Google using the developer requirements to carry out the ban.

criddell 7mo ago
> The problem with mandatory developer registration, is that it gives Google and Governments the ability to veto apps. Don't they already have that power?
- nickorlow 7mo ago
  You can download any APK you like on the internet and run it without google/gov getting in the way
  - scoofy 7mo ago
    Yes, but the already have the power to ban apps if they wanted to. They just don't. That's the point.
    - nickorlow 7mo ago
      No they don't?
- mhitza 7mo ago
  No, that is one reason why they are pushing for these changes.
- aftergibson 7mo ago
  No judgement whatsoever, but for almost everyone they too will think, no big deal you only install software through stores right? Nothing changes for them, in fact they can't conceive of an alternative anymore.

dsl 7mo ago

Dear Undersigned, I have an APK I would like you to install on your personal phones. No, I won't tell you who I am. Please let me know when you are comfortable with this.

bigstrat2003 7mo ago
Nice strawman. People want the ability to decide for themselves whether or not to install some APK, they are not saying every APK under the sun is trustworthy.
- dsl 7mo ago
  It is a simplification, not a strawman. If you want to make the decision to install Hay Day, the user should be able to know that it is the Hay Day from Supercell or from Sketchy McMalwareson. 99.9% of apps should have no issue with their name being associated with their work. If you genuinely need to use an anonymously published app, you will still be able to do that as a user.
  - nickorlow 7mo ago
    > If you genuinely need to use an anonymously published app, you will still be able to do that as a user. I'm pretty sure the goal of Google's changes is to make it so you can't
  - NicuCalcea 7mo ago
    Android already tells users when they're installing software from outside the Play Store and shows big scary warnings if Play Protect is turned off. What else do you want? If I want to install something from Sketchy McMalwareson after all that, that's my phone and my business.
nickorlow 7mo ago
If I want to run a piece of software on my phone, I shouldn't need to go ask google whether they're cool with it

rprend 7mo ago

[flagged]

TJTorola 7mo ago
Ideological is carrying a lot of weight there. Perhaps you can be more specific about the ideological arguments you are hearing that are not worth it?
- rprend 7mo ago
  Walled gardens have less fraud and malware because it's less open. But developers prefer open source decentralized software. Of course, we are technologically literate enough to avoid the fraud. It's similar to drug decriminalization or the legalization of sports gambling.
mhitza 7mo ago
Who says that Google is the one to decide what open source software I can install on my mobile Android computing device?
- rprend 7mo ago
  Wym? Google says it’s the one to decide. They are doing this because side loading causes fraud. There is pressure and lobbying (like this open letter) to stop them from locking it down.
  - mhitza 7mo ago
    It was a catchy rethorical question. Desired emphasis on the fact that a smartphone is a computing device. If you like to not be able to run whatever software you want on your computer, and the one your family owns, that's your thing. Its another pretense, like disabling full disk encryption, where people came with these ideas (instead of other options), because its convenient to them to pretend its the right thing.
    - 7mo ago

exe34 7mo ago

Does anyone know if this will affect Lineage OS with root?

jech 7mo ago
As far as I know, it's implemented in the proprietary part of Android (Google Mobile Services, GMS), so it won't affect LineageOS users as long as they don't install the GMS.

iamnothere 7mo ago

Just here to register my disapproval of this, and to remind everyone that you should support Linux phones if you’re against it. Or Graphene OS, at the very least, even though this still supports Google due to the requirement for a Pixel phone. Also, I’m going to coin a new term for the recurring names that I see promoting this kind of thing here: “safety fascists.” Safety fascists won’t sleep until there is a camera watching every home, a government bug in every phone, a 24/7 minder for every citizen. For your safety, of course. I think I may hate safety fascists more than I hate garden variety fascists. That’s an accomplishment!

btreesOfSpring 7mo ago

Would rather a more robust and distributed app store system that figures out how to police these edge cases of fraud rather than one vendor (Apple or Google) whose monopolies push developers into subscriptionware across the board. Something more akin to how internic moved from one domain name registrar to what we have today, chock full of competition and new top level domains. It feels like independent development on devices has slowed in recent years. More stores appealing to different developer models/tools and monetization strategies please.

pserwylo 7mo ago

Many people online and in person telling me "Google backed down" or "Google has an advanced flow" are typically referring to these two statements from Google staff: > Based on this feedback and our ongoing conversations with the community, we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. [0] > Advanced users will be able to"Install without verifying," but expect a high-friction flow designed to help users understand the risks. [1] Firstly - I am yet to see "ongoing conversations with the community" from Google. Either before this blog post or in the substantial time since this blog post. "The community" has no insight into whether any such "advanced flow" is fit for purpose. Secondly - I as an experienced engineer may be able to work around a "high-friction flow". But I am not fighting this fight for me, I am fighting it for the billions of humans for whom smart phones are an integral part of their daily lives. They deserve the right to be able to install software using free, open, transparent app stores that don't require signing up with Google/Samsung/Amazon for the privilege of: Installing software on a device they own. One example of a "high friction flow" which I would find unacceptable if implemented for app installation on Android is the way in which browsers treat invalid SSL certificates. If I as a web developer setup a valid cert, and then the client receives an invalid cert, this means that the browser (which is - typically - working on behalf of the customer) is unable to guarantee that it is talking to the right server. This is a specific and real threat model which the browser addresses by showing [2]: * "Your connection is not private" * "Attackers might be trying to steal your information (for example, passwords, messages or credit cards)" * "Advanced" button (not "Back to safety") * "Proceed (unsafe)" link * "Not secure" shown in address bar forever In this threat model, the web dev asked the browser to ensure communication is encrypted, and it is encrypted with their private key. The browser cannot confirm this to be the case, so there is a risk that a MITM attack is taking place. This is proportionate to the threat, and very "high friction". I don't know of many non-tech people who will click through these warnings. When the developer uses HSTS, it is even more "high friction". The user is presented all the warnings above, but no advanced button. Instead, on Chromium based browsers they need to type "thisisunsafe" - not into a text box, just randomly type it while viewing the page. On Firefox, there is no recourse. I know of very few software engineers who know how to bypass HSTS certificate issues when presented with them, e.g. in a non-prod environment with corporate certs where they still want to bypass it to test something. If these "high friction" flows were applied to certified Android devices each time a user wanted to install an app from F-Droid - it would kill F-Droid and similar projects for almost all non-tech users. All users, not just tech users, deserve the right to install software on their smart phone without having to sign up for an "app store" experience that games your attention and tries to get you to install scammy attention seeking games that harvest your personal information and flood you with advertisements Hence, I don't want to tell people "Just install [insert non-certified AOSP based project here]". I want Android to remain a viable alternative for billions of people. [0] - https://android-developers.googleblog.com/2025/11/android-developer-verification-early.html https://android-developers.googleblog.com/2025/11/android-de... [1] - https://x.com/matt_w_forsythe/status/2012293577854930948 https://x.com/matt_w_forsythe/status/2012293577854930948 [2] - https://wrong.host.badssl.com/ https://wrong.host.badssl.com/

cyanydeez 7mo ago

When do we think PWA and WebRTC will be attacked and degraded as insecure?

tsoukase 7mo ago

Banning apps installation outside PlayStore will be a disaster for power-ish users and will start a fight between Google and community. I abandoned rooting my devices because I could achieve all I wanted through apps (mostly ad- and nag-freedom, it's impossible to be online without ad blocking). But all these were downloaded as APKs. I cannot imagine how the first day without these will be.

WarmWash 7mo ago

The judge told Google that Apple is not anti-competitive because Apple has no competitors on it's platform (this all stemming from the Epic lawsuits). Google listened. Blame the judge for one of the worst legal calls in recent history. Google is a monopoly and Apple is not. Simple fix for Google... Same comment I made a few days ago, I feel it bears repeating as much as possible until it's really driven home how detrimental and uninformed that decision was.

pas 7mo ago
Sorry, which exact ruling are you referring to? How did the court arrived at this finding (that seems irrelevant, false)?
- kodebach 7mo ago
  It is a non-sensical ruling. But IIRC the reason was basically that while Apple and Google did basically the same shit, only Google kept a written record of their monopolistic behaviour, so only Google was found guilty. However, there is a relevant court case here. The one about Samsung's "Auto Blocker" (https://arstechnica.com/gadgets/2025/07/samsung-and-epic-games-call-a-truce-in-app-store-lawsuit/ https://arstechnica.com/gadgets/2025/07/samsung-and-epic-gam...). Epic Games sued because Samsung made it too hard to install apps from "untrusted" sources. This may be a reason why Google is now trying to make the process more difficult on the developer side instead.
  - pas 7mo ago
    thanks for replying! the Samsung case is very interesting, haven't bumped into that one before. ... as far as I understand the really nasty part of "contemporary" jurisprudence of antitrust enforcement is that the standard is to show that things would be cheaper for the consumers (though I don't know why developers are not considered consumers of the app marketplace services, after all for them bringing their own payments and whatnot would be much more cost effective... well, anyway, unfortunately the courts are mostly locked to this very inefficient path-dependent way of regulating anything through super expensive arguments, which is an obvious (?) dysfunction of legislation)

arjie 7mo ago

If I'm being honest, I suspect this > Disproportionate impact on marginalized communities and controversial but legal applications applies more to the elderly in third-world countries who are constantly scammed through fraudulent side-loaded apps than it does to hackers who want to install whatever software they want but do not want to use a non-Google AOSP distribution.

jdlyga 7mo ago

To be honest, if both Android and iOS were walled gardens, I'd choose iOS every time. I choose Android specifically because of its openness. But if that weren't the case, I'd prefer the smoother UX and stronger Apple ecosystem.

singpolyma3 7mo ago
You're welcome to it I suppose. As someone forced to use iOS for the past year I'm still waiting to find any smooth UX or strong ecosystem...

asim 7mo ago

I think we're about to see an explosion in "mini apps". It's taken 10+ years for us to catch up to WeChat and China but this regulation and other issues are going to block a lot of innovation and we're better off surfacing tiny PWA or SPA like apps that get loaded in native apps or we just do away with that entirely. The time has come.

TheJoeMan 7mo ago
Elon's vision for the X "everything" app. It's great for them, now every single thing you do has the full gamut of privacy permissions. Playing a "mini-game"? Full accurate GPS coordinates available to it because you also have the ride-hailing "mini-app".

umairnadeem123 7mo ago

[dead]

AlotOfReading 7mo ago
Why is that an acceptable middle ground for you? I trust f-droid apps a lot more than anything installed from the Play store. The same restrictions should apply to Google's store as others.
hbn 7mo ago
> periodic re-confirmation This just trains everyone to blindly click "accept" thus adding zero security while making the UX terrible for people who know what they're doing

TZubiri 7mo ago

If I may advocate for the non HN partisan position here. Let's consider that Google's Android was and is a huge improvement in security in terms of OS design (even if inspired by iOS) over the previous incumbent (let's call Windows that). That difference in security still exists today (probably due to Window's Backwards Compatibility prioritization, and its later positioning in the market as a cheap powertool (cheap compared to iOS, powertool compared to android). That security advantage, by the way, was not just the result of initial design, but it required a lot of maintenance, in the form of the 'Play Store' App Store equivalent (at no cost to the user no less). All this to say that let's consider this context, and consider what alternatives are proposed. 1- The windows 'install whatever you want model' (Now with OS approved certificates): As mentioned, worse, with almost no sandboxing. 2- Linux package managers + install whatever you want: Valid model for powerusers and programmers, not really relevant for massive personal computing. 3- Keeping the old Android system: This would imply simply ignoring the problem of growing professional and untouchable malicious actors that seem to be growing in power with the advent of anonymous financial tech. Is this the actual proposal? Do nothing about the problem? Pretend there is no problem? I don't think the problem is necessarily malware, but to take a specific example, suppose a Casino from Isle of Man is allowing underaged and users from jurisdictions where it is illegal. Regardless of whether you think this is ok, or debatable or it depends on the circumstances. Isn't the ask to identify the developer rather trivial? Just a little bit of paperwork, you want to be a developer? Install code that someone else will use? Put your name in it, have skin in the game. I think there's also a contradiction between the need for developer privacy and user privacy. Most HN users are privacy-sensitive. Well I propose there's a tradeoff between the privacy of the consumer and the producer. In order to provide privacy and rights to the user, the producer needs to come forward. There's no way to have the cake and eat it too, if both producer and consumer are shy, they will never find each other, if both producer and consumer stay anonymous, they won't trust each other, if both producer and consumer stay anonymous, they don't give any guarantees to the other party that they won't go rogue. You know this if you've tried to start a business, you can either put your face, your name, register with the state, put your actual address. Or you can use an anonymous brand, a Registered Agent Address, etc... The latter is a harder sell than the former, and you only don't notice it if you are completely absorbed in your own world and cannot put yourself in the shoes of your customer. tl;dr: Google has an impeccable data security track record. And User/Developer privacy is a tradeoff. Google is right to protect user privacy and not developer privacy.

atlgator 7mo ago

"Don't be evil" → "Don't be evil without registering first and uploading your government ID." The most telling detail is the sequencing. Google spent years in court arguing Android is open to fend off antitrust regulators, won key battles on that basis, and is now quietly closing the door they swore under oath was permanently propped open. The antitrust defense was the product roadmap's cover story. And framing this as security is particularly rich from the company whose own Play Store routinely hosts malware that passes their review. The problem they're solving isn't "unverified developers distribute harmful apps" — it's "unverified developers distribute apps we can't monetize or control."

ChoGGi 7mo ago

Hey Google, how about you clear all the malware from the play store then work on sideloading?

eqvinox 7mo ago

Can someone explain to me why Google's plans don't collide with the EU DMA? They're locking down the platform, that's what the DMA is supposed to prevent, I thought.

schmorptron 7mo ago

Before this LLM age the solution would've been to make the user solve a leetcode problem to access a developer mode.

wernsey 7mo ago

Google's concerns about security rings hollow to me. I believe it is strictly to exercise more control over the platform. The appeals to people in Southeast Asia being scammed reminds me of a blog by Cory Doctorow last year: Every complex ecosystem has parasites [1] The gist of it is that technology can be useful, but that usefulness comes with a price: sometimes bad actors are going to commit fraud or other undesirable actions. As an example, you can reduce the amount of banking app scams to 0% by simply denying any banking apps on phones. But because of banking apps' usefulness we're not going to do that, so there will be some non-zero risk that you will get scammed. As a technical user I chose Android for its usefulness, accepting that there may be a (minute) chance that I get scammed, but it is a risk I am willing to take, and Google will unilaterally take this choice away from me. Still, I don't believe Google's security concerns are sincere, so I think I just wasted my time typing all of this [1] https://pluralistic.net/2025/04/24/hermit-kingdom/ https://pluralistic.net/2025/04/24/hermit-kingdom/

pbnjeh 7mo ago

1) As I saw Rossman recommend the other day, once Android phones are locked down, just get an iPhone. I’ve had a Pixel 8 Pro and was considering the upcoming 11. If this lockdown goes through, I guess not. 2) I hope the lockdowns don’t strangle tethering. My other consideration is to use whatever phone for calls, texts, and “secure” apps. The rest I’ll do on an unrestricted device that just uses the phone as a data connection. More crap to carry, but crap that does what I want and need and not what “they” insist upon. P.S. And that may mean spending less on future phones. Especially if I also switch my higher quality camera image needs to a real camera. Sigh, yet more physical crap, but I’m pissed enough to do it, and then each individual device would be less of a feature compromise than what a phone provides — other than size and portability, which are indeed quite significant.