32 ms·
Android may soon restrict on-device ADB
- satvikpendem 2mo agoOf course this was bound to happen, next you're telling me people will be surprised that the 24 hour limit for side loading will turn into some indefinite time period.
- devsda 2mo agoIt can and will most probably turn to indefinite time depending on the answer to the question "will we have a viable alternative to jump ship before that happens ?". We don't need anything to completely capture the market, it has to be just enough to make Google hesitate or make it hard for Google to do it for legal reasons. Like how Firefox is ideally supposed to be for Chrome.
- microtonal 2mo agoMany alternative AOSP-based systems work fine today and do not have the new Android Developer Verifier (wow, already rolled out to 500M+ devices [1], though still dormant). To be honest, it is quite scary that Google is able to remotely roll out an app like that to all GMS Android phones. Of course, we all knew that, but it highlights again that Google can remotely take away functionality that you had before, brick your phone, etc. [1] https://play.google.com/store/apps/details?id=com.google.android.verifier https://play.google.com/store/apps/details?id=com.google.and...
- izacus 2mo agoWait till you hear that your OEM can remotely rollout full OS updates with full access to all your data and drivers... carrying Google software and most of it Google code.
- microtonal 2mo agoSnarks do not lead to productive discussions. You also know that there is has always been an implicit social contract between users and vendors. The vendor rolls out updates as part of the service attached to the device (typically included in the purchase price) and that the vendor does not abuse the update mechanism to make things worse for the user. If vendors use updates to restrict functionality that the user had before, puts existing features behind paywalls, etc. people are rightfully outraged, because it breaks the social contract. It's just that the repeated offenses have made us insensitive. Imagine Debian rolling out some mechanism that only allows you to install software outside their repos with a 24 hour delay. It would destroy Debian.
- 59percentmore 2mo ago>implicit social contract Sounds worthless (in court).
- sunaookami 2mo agoAnd that's how you get a low-trust society.
- 59percentmore 2mo agoWell, no. The low-trust society comes (partly) from corporations betraying the trust of consumers, not consumers recognizing that the corporations saying, "Trust us," are probably bullshitting them. The initial assertion that there has "always" been a social contract is inaccurate.
- RobotToaster 2mo agoWe used to call programs like this, that allow someone to remotely break your system, a Trojan horse...
- bpavuk 2mo agoand now people install Remote Access Trojans just to let GPT and Claude think and work for them, granting them shell and a11y access. really? after seeing that, nothing surprises me
- TeMPOraL 2mo agoYes, really. The obvious answer that security maximallists deny even exists is, who is doing it and why. In LLM case, users are doing it themselves to allow a way of computing they want and find useful, in spite of platform locks designed to deny users just that.
- bpavuk 2mo agoI mean, go tell Anthropic to prompt Claude to make it adopt Landlock in Claude Code instead of regex-based filtering. actually adopt it, not how Codex did, but with controls on the level of some third-party harnesses and Pi plugins.
- classified 2mo ago> brick your phone, etc. Apple can do the same for iPhones. In terms of dark shit they can do there's no difference anymore.
- ajross 2mo ago> To be honest, it is quite scary that Google is able to remotely roll out an app like that to all GMS Android phones. Are any commercial mobile phone vendors not able to do such a thing? Do remember that this giant kerfuffle is all over the seeming preparation for the apparent removal of a developer feature that iPhones have never had at all.
- atif089 2mo agoGoogle is working on a new recaptcha strategy to counter that. Essentially any non Google flavor of Android OS will fail recaptcha validation
- stein1946 2mo ago> will we have a viable alternative to jump ship before that happens ? Here is a better question: "Is the EU going to stop this?"
- sunaookami 2mo agoNo because the EUDI Wallet needs Google Play Services. People need to come to the realization that the EU has no interest in regulating the freedom of devices because the EU itself is benefitting from the closed-down ecosystem.
- ChocolateGod 2mo agoWhy would the EU stop it?
- birdsongs 2mo agoI get the analogy but it's a false one. Google covers about 90% of Mozilla's funding. Firefox only survives because of Google, and that's so they don't hit antitrust problems. https://en.wikipedia.org/wiki/Mozilla_Foundation#Financing https://en.wikipedia.org/wiki/Mozilla_Foundation#Financing
- devsda 2mo ago> Firefox only survives because of Google, and that's so they don't hit antitrust problems. Yes, that is what I meant. They should be hesitant to lockdown completely and (grudgingly even) allow alternative options and/or workarounds due to legal concerns like anti-trust. Firefox was existing before Chrome, but in this case we either need a different OS or need an android based option like Graphene/3rd party stores gain enough marketshare to trigger anti-competitive laws.
- fsflover 2mo ago> "will we have a viable alternative to jump ship before that happens ?" GNU/Linux phones already exist. Sent from my Librem 5.
- smolder 2mo ago[flagged]
- charcircuit 2mo agoadb connecting a device to itself is just bad design and a hack. Either the capabilities should just be granted directly to the app or it should all be blocked.
- qrobit 2mo agoSame can be said about loopback device in general. Why do you need to use networking when you are literally on the same device and can use binder/dbus and friends with native apps? Shizuku uses Binder AFAICS[^1]. Looking deeper it seems that Shizuku does not connect to the device itself per se, but rather it has a privileged server launched manually through adb. Never used Shizuku, so can't say for sure. [1]: https://github.com/rikkaapps/shizuku#how-does-shizuku-work https://github.com/rikkaapps/shizuku#how-does-shizuku-work
- charcircuit 2mo agoShizuku essentially implements an API that your OS creator should have implemented via using adb access to have more privileges than a regular app could have access to. If your OS creator implemented these APIs they could properly implement them without this hack or requiring adb to be used.
- smolder 2mo agoRIP phones
- luciana1u 2mo ago[flagged]
- luqtas 2mo agofinally my children will be secure and my bank account impenetrable!
- mdp2021 2mo ago/s
- 3form 2mo agoWhat I find most annoying aspect of all software from 2010s onwards is this stupid discourse and associated results: - some people want A, or A might even be already in use - A is problematic for $MODERATE_OR_MILD_REASON - B is introduced and made default - a config switch between A and B is never considered So, so tiring. If I want to bind ADB to localhost, _let me_. It's my device and my problem, ffs.
- Arbortheus 2mo agoToxic max security. Not everyone has the same threat model as you, $BIGTECHCORP.
- rightbyte 2mo agoIsn't security just an excuse to push user hostile features? Like, if security was a concern we would have simpler systems and still use 2fa devices for banks etc.
- SXX 2mo agoSometimes it's truly useful featutes, but having no toggle in settings making it terrible. Like iPhone idle auto-reboot every 3 days. After a while they added "Allow Idle Reboot" flag but it only accessible via MDM and require device wipe and for switching it to be a managed device.
- TeMPOraL 2mo agoWhat would that be useful for anyway? Sounds like something aimed to prevent people from reusing their old/secondary devices for IoT.
- RobotToaster 2mo agoHides memory leaks
- coffee33go 2mo agohttps://archive.ph/gla4i https://archive.ph/gla4i In case it is made private.
- throawayonthe 2mo agothat seems pretty reasonable actually
- amelius 2mo agoTo iPhone users, perhaps.
- kasabali 2mo agoI'm afraid in a few years iOS will actually (not as a joke) be the more open and customizable option
- hagbard_c 2mo agoThat seems rather unlikely given the the ways of the fruit factory. They don't stand to gain anything from loosening their stranglehold on their flock while they could lose substantially if someone were to open the gate and let the sheep escape. Nope, keeping them penned in is the best way to reliably fleece them.
- throawayonthe 2mo agoi'm running graphene
- mdp2021 2mo agoTo only use ADB through a WLAN? No, it is not that reasonable
- throawayonthe 2mo agoor over USB, from another device? this is about maybe restricting the wireless variant to only work on wlan0
- shalom1112 2mo ago[dead]
- lardosaurusrex 2mo ago[dead]
- throw9394999 2mo agoThis assumes user is the only person with physical access to unlocked phone. All sorts of goverment agencies, airport security, even teachers now have access. And such attacks can be trivially automated, so even low paid worker can do it.
- SXX 2mo agoThis is solvable by adding big huge warning that ADB is running. Not by removing feature.
- throw9394999 2mo agoJust use opensource phone os!
- tonyhart7 2mo agoandroid is open source
- xg15 2mo agoThat huge warning would also be permanently shown for everyone using Shinzuku apps. I think that UX would neither be desirable nor increase security.
- _flux 2mo ago..for the very little number of people who use them? Arguably it would be highly preferable compared to the option of not being able to use them at all.
- eviks 2mo ago> Spamming the thread will only cause Google developers to lock the issue, ignore valuable community feedback, or stop sharing public updates about this change entirely. So nothing would change (they can also lock away your "valuable community feedback" because what bothers them is the criticism itself), thus feel free to express your approval
- AussieWog93 2mo ago> because what bothers them is the criticism itself I think there's a difference between criticism of a policy and being brigaded by a reddit mob.
- zetanor 2mo agoGoogle pushes a new feature to Android where phones wake up at 2:22 AM every night to play a blood-curdling scream at maximum volume, regardless of settings. An issue is created and gets assigned, into which Google employees regularly butt in to explain the feature exists to keep users safe from night break-ins. Nothing changes. People have to start modifying their lives around this problem—most have to shut off their phones during the night, many had to buy a separate alarm clock—and masses of disappointed customers eventually make their way to the bug tracker to voice their concern. The issue gets locked as "too heated". Apple has had this feature for three years on iOS. What else should they have done?
- gruez 2mo ago>What else should they have done? Use an AOSP fork like grapheneos or lineageos. Barring that, voting with their wallets and buying a HarmonyOS phone. If for whatever reason they're doing that too, there's probably more powerful forces behind this change (eg. government mandates) that won't be helped by spamming an issue tracker.
- NotPractical 2mo agoI have bad news for you if you think GrapheneOS isn't going to accept this patch from upstream if it lands.
- mdp2021 2mo agoStep back to the other issue (referenced in the page*), that Google would pushing on devices something that blocks applications that do not come from play.google.com . Was it not established that Google can only push that update on devices with a google account? * https://keepandroidopen.org/ https://keepandroidopen.org/
- microtonal 2mo agoI am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing. The other proposed change (to restrict access to certain interfaces or IP addresses) seems good, but why not allow developers to restrict access localhost? It reeks of trying to block Shizuku, Canta, etc. using a way that only makes it look like a side-effect.
- pigggg 2mo agoIsn't this because of the kimwolf (and now 6+ other botnets) that are taking advantage of people running residential proxyware unknowingly on the device which permits outbound connections to 127.0.0.1 on tcp/5555 to auth in and exec wgets or drops a loader that grabs the ddos malware APKs and install it?
- xg15 2mo agoHadn't thought about that additional attack vector those proxies are enabling. In addition to "internet access from residental connection" privileges, the attacker also gets access to loopback on the device that does the proxying... But even then, shouldn't this show the same permission prompt for the user that anything else trying to connect to port 5555 would?
- londons_explore 2mo agoYes, but users are told to allow it if they want to get free coins etc.
- xg15 2mo agoTold by whom though? If it's through proxyware, then there are three parties who mostly don't know each other: - the app embedding the proxyware SDK for money - the proxy operators - the attackers/botnets using the proxy to access ADB. The botnet has no access to the app, so it can't show any messages. The app can show messages, but probably has no connection to the botnet. (I hope) The proxy operators could show a message by abusing the SDK even more, but that would mean they actively colluded with the botnet. Is that likely? Then they could just give the botnet direct access to the app, no need to do the whole proxy thing.
- sehw 2mo ago[dead]
- magic_hamster 2mo agoThis is about control, not security. As in, Google's control over your device, your experience, your features and choices. This and Google just isn't interested in supporting an open OS anymore. Maybe they think it makes them liable. Either way the writing is on the wall, and has been for a while.
- returnInfinity 2mo agobullish on google stock revenue must go up
- IvanK_net 2mo agoI am worried that this might happen to websites soon. If you want your website to be openable on Apple devices, you would have to pay Apple a fee each month. If you want your website to be openable on Android devices, you would have to pay Google a fee ecah month, etc.
- tonyhart7 2mo agowe can just fork android edit: I not realizing that I been replying to wrong comment
- rcMgD2BwE72F 2mo agoAh yes, Android without the Play Store. So you won't be able to use your banking apps, your local transport app, public services apps, health services apps, etc. But sure, you can do SMS (no RCS though), use the device calculator, and maybe browse the Web… until websites kick you out because your non Chrome/Safari browser isn't supported anymore. Even Signal won't work well due to the lack of FCM. And I'm a GrapheneOS user happy with Obtainium and without Play Services installed in main user space.
- tonyhart7 2mo agothe situation is not ideal but this is the best we can do
- BoxwoodSeed 2mo agoI always disable everything Google that comes preinstalled other than maps, including the App store. You can download stuff that you can only get there through Aurora, but really most of what I use comes from F-Droid. Not that I trust a device running Android enough to do banking, mind you.
- avian 2mo agoI am thinking how this would split the web. You would have the "new web" consisting of the top n major websites paying this fee. And then you would have the "old web", accessible only to people still owning their own PCs with unrestricted browsers. And probably heavily scrapped by AI companies to reguritate to the masses through the new web.
- peheje 2mo agoWe need Linux on phones. Bank apps not needed as long as I can use browser. But do need some things like wireless cards, popular apps like Sonos and Spotify working.
- mnahkies 2mo agoUnfortunately many banks in the UK no longer offer a web portal or physical branches. I'd love to see legislation that mandated a functioning web experience for critical services like this (banking, utilities, etc) - otherwise it will continue to further entrench the current duopoly. (I suppose this is also an instance where I should do a better job of voting with my feet and supporting services that do offer this)
- ninalanyon 2mo ago> many banks in the UK no longer offer a web portal Same in Norway.
- cynicalsecurity 2mo agoPoland, all banks I know offer web portal. Linux, Firefox - works perfectly.
- TeMPOraL 2mo agoFollow up question: how many of those still let you log in and authorize transfers without relying on their mobile app as required second factor?
- juleiie 2mo agoThis is all inevitable direction over long period of time What’s worrying is that noone protests about it It doesn’t suprise me that corporations and governments want the laziest, most „protective” laws passed that extend their power. But why noone, absolutely noone puts some kind of resistance to it? Government and citizens are at eternal conflict of interests. It has been this way and it will be this way forever. Your job as a citizen is to make sure you have greatest amount of liberties Noone will do it for you.
- NSPG911 2mo agogoodbye shizuku i guess, and maybe termux
- oblio 2mo agoShizuku has a big banner on the PlayStore telling me it can't be installed on Samsung S26, it's not old enough.
- GenericDev 2mo ago[dead]
- ignoramous 2mo agoThe article overlooks security implications from spyware, which is a huge problem not only for financial applications, but personal safety, too [0]. Per FTC, a stalkerware will: geo locate, read call list & record calls, read notifications, texts, & possibly emails, access gallery, camera, & files, and monitor network activity. [1] You could do all of those with "on-device adb" (in some cases, with just the appropriate permissions), without root access. Stalkerware & financial fraud enabled merely due to the scale & reach of Android (half of humanity uses it!) and lack of basic security literacy warrants such protective measures, as (Thaler & Sunstein would like to remind us) defaults matter. With conspiracies abound, we must not lose sight of tech safety and related issues, which almost exclusively affect the most vulnerable & the most disadvantaged. [0] https://www.techsafety.org/spyware-and-stalkerware-phone-surveillance https://www.techsafety.org/spyware-and-stalkerware-phone-sur... [1] https://consumer.ftc.gov/articles/stalkerware-what-know https://consumer.ftc.gov/articles/stalkerware-what-know
- zb3 2mo ago> Per FTC, a stalkerware will: geo locate, read call list & record calls, read notifications, texts, & possibly emails, access gallery, camera, & files, and monitor network activity. Like Google Mobile Services on stock Android?
- ignoramous 2mo agoNo.
- kitsumed 2mo agoSpyware using ADB could be a thing (assuming someone has full access to your phone, including the password). However, it is impractical, as a reboot, system update, or Wi-Fi change would likely break everything. It is much easier for spyware to be installed as a device administrator, granted accessibility privileges, and then given every possible Android permission via AppOps as a one-time setup. At that point, ADB no longer matters. The spyware is already configured and ready to run. Even if on-device ADB were patched, anyone with physical access to the phone would still be able to install and configure their spyware via a USB cable. As for attacks without physical access, as explained in the article with the 3 scenario, this is neither practical nor realistic. It only affects a very small subset of users (primarily Android developers) under very specific circumstances and during limited time windows.
- OsrsNeedsf2P 2mo agoI'm so done with Android and iOS. I already carry around 2 phones because neither will give me exactly what I want, maybe it's time for a 3rd running Linux..?
- BoxwoodSeed 2mo agoLinux phone is already a thing that exists and is at a point where it can be used by tech illiterate people within the confines of what is possible normally. It's just that few people bother using it. But that number might increase if Android continues it's war against its users.
- gitowiec 2mo agoThank you for telling me about Shizuku! Android world is so vast and full of resources
- chii 2mo ago> Android world is so vast and full of resources and google is doing all they can to try shut it down, because they saw how profitable a walled garden like iOS really is.
- hypendev 2mo agoAndroid had a tradeoff - less vertical integration and more annoyances, a bit worse software quality, for a more open, customisable and utility-like experience. I loved that. Now, the tradeoff is - less vertical integration, double the integration layer trash (Google & OEM) and a much more locked down experience. But the quality of it hasn't improved, it just got worse. Doesn't make sense anymore. They can now do 99% of the same things, but iOS has a better quality OS, better apps and better vertical integration. Not even vertical integration, actually just any kind. FFS it's 2026 and the recommended android way to send a photo to your mac/PC is "upload to google photos and hope it decides to sync".
- chii 2mo ago> send a photo to your mac/PC is "upload to google photos and hope it decides to sync". and conveniently, google now has access to your photo, the meta data, and potentially able to scan it for advertising purposes.
- NopIdoN 2mo agoand hopefully the other scans won't trip a false positive that leads to your inconvenience/death
- userbinator 2mo agoIt's frankly amazing how many Google developers will associate their real identities and contact info with such hostility, believing they're invincible. Perhaps they should be subjected to the full force of the First Amendment.
- Razengan 2mo agoDoes anyone have any doubt left that we're headed for a future where you need a government ID to use any computing device, and only allowed to do government-approved tasks and view government-approved content? Not a rhetorical tinfoil question: Does anyone still believe there's some hope for personal freedoms?
- chii 2mo ago> Does anyone still believe there's some hope for personal freedoms? as long as such personal freedoms gives users the ability to skirt the profit motives of companies making these devices, there will always be a force to try restrict it. The internet, as it has been, is quite an anomaly, but inevitably, power that the people have gets usurped one way or another. It's just a matter of time.
- Razengan 2mo agoWhat's ironic is that these news are something you'd expect to hear from China or former Soviet countries. But frogs still believe that "putting America in the same sentence as Russia" is stupid
- wartywhoa23 2mo ago> The internet, as it has been, is quite an anomaly It's not an anomaly, it was the data grabbing infrastructure, and now that enough data is vacuumed in from it to train AI, it is now time to turn this dangerously conductive communication network into a control-only one, by all logic of the process and those who funded it all the way.
- xg15 2mo ago> Scenario 3: A Developer Using ADB over TCP/IP - You install a malicious application. - You enable USB debugging, starting ADBD. - You connect via USB ADB to enable TCP/IP, then disconnect the USB cable. - ADBD continues running and listens on all network interfaces. - The application initiates a connection, causing an authorization prompt to appear on the screen. If the user selects No, the connection is rejected. No silent exploitation attempts are possible. I understand the author's rationale and think the reasons why that whole ecosystem is accessing ADB are legitimate - but I have some questions here. The above flow is basically what apps that use Shizuku have to do as well, right? Only that in that case, the user would deliberately install the app and have the knowledge it uses ADB features and therefore would also confirm the permission prompt. However, ADBD in this situation only sees a connection attempt, not which app made the attempt, right? So it also cannot remember that a particular app was already authorized by the user and has to display the prompt again on each connection attempt? Does that mean that a Shizuku-enabled app would prompt the user again for ADB access any time it's started? This seems honestly like Shizuku itself would increase the risk of a user granting ADB access to a bad actor (i.e. a second app or external connection that is different from the app the user wanted to authorize). Thinking of "scenario 3" if a Shizuku-enabled app is already running on the device and something else wants to connect to ADB: - I'm assuming a malicious app was already installed (without privileges) or something tries to connect to port 5555 from outside or via proxyware. - ADBD is already running and listening for TCP to serve the Shizuku app, so those steps can be taken for granted. - The malicious app or connection triggers a permission prompt from ADBD. However, by that time, the user has grown used to those prompts, because the Shizuku triggers them frequently, so they are more likely to select "yes". If ADBD has no information about who is connecting, it also can't show any meaningful information in the prompt. So it cannot really help the user distinguish prompts from the legitimate Shizuku app from malicious prompts. A user still has the timing and context to distinguish prompts, i.e. prompts that appear out of the blue when they aren't using the app are suspicious.
- kitsumed 2mo ago> However, ADBD in this situation only sees a connection attempt, not which app made the attempt, right? Every ADB connection has some kind of certificate / key that is saved locally. This means that a new application would have a different certificate. That certificate is shown in the yes/no prompt. > Does that mean that a Shizuku-enabled app would prompt the user again for ADB access any time it's started? You can tell android to remember that certificate and allow the connection next time. There is a bug that make it not work on certains specific version of Android 12 I think, but outside of that, it always works.
- Superblazer 2mo agoThis is huge, Android getting locked down to such levels should be sounding alarm bells. They are slowly removing everything that makes Android good.
- SwellJoe 2mo agoThere's only one reason for anyone, or for me, at least, to choose Android, and it's the only reason I've consistently chosen Android from the very first Google Developer Phone: It's more open. So, they don't want me to even have that one reason to keep choosing Android, I guess.
- chii 2mo agothe question isn't whether you still have a reason to choose android - the question is what alternative do you have but android (or iOS).
- akersten 2mo agoIf my phone is going to be locked down anyway, I'm choosing the platform that at least pairs with my AirPods properly and doesn't get me weird looks at social events. Google is really stretching their goodwill with this one. The ability to sideload and debug my phone is the only marginal benefit to these janky Java relics. If that's gone, no reason not to switch to a wholely better platform.
- Brian_K_White 2mo agoIf I don't get weird looks at the kinds of social events where everyone else has an iphone, then I have failed at life. I can think of no greater horror than to be seen as uninteresting.
- shevy-java 2mo agoThese are not accidents. Google declared total war against open source. You only need to remember how it declared war against ublock origin. In the long run this will also fail, but until then Google causes a lot of damage. Legislation needs to control this tyrant but unfortunately the oligarchs run the country of the mad orange king right now. Louis Rossman will have a field day with Google here. I think it is time to end Evil - that is, to end Google. This company serves no more useful purpose on this planet anymore.
- 0x_rs 2mo agoLimiting ADB is the obvious next step. Even if this one specific feature request does not come to pass, Google has cornered everyone into relying on a developer interface for any normal personal computing tasks, whether running on-device or through USB/wireless. It's quite clear at some point in the future you will either be required to surrender your identity to them and pay a yearly fee or be severely limited to continue using it in any meaningful capacity, because Google does not want you to develop applications on Android outside their controlled channels -- and it's a developer bridge, the battle was already lost when they did not back down from the changes forbidding normal, legitimate ̶s̶i̶d̶e̶l̶o̶a̶d̶i̶n̶g̶ installation. >Don’t even get me started on OEMs that force an audio warning such as “This call is being recorded,” when it’s in places where it’s not legally required. This is also Google's fault. Their dialer--that OEMs increasingly pick over their own, despite their always being much better, see old MIUI one for example--just blanket applies the rule almost everywhere. Especially annoying on all MediaTek SoCs that do not support the feature on an hardware level at all through proper, reliable third-party applications. As if you didn't need any more proof you don't own "your" devices. But maybe in a couple years Gemini will be able to listen to the calls and summarize them for you, just need to go through the approved surveillance channel.
- kllrnohj 2mo ago> As if you didn't need any more proof you don't own "your" devices. Can you install your own OS? If yes, you own it. And Google consistently lets you do that. It other OEMs don't then direct your outrage at them.
- 0x_rs 2mo ago>Can you install your own OS? If yes, you own it. Not before connecting it to the internet, even Pixels will go through hundreds of megabytes of data before allowing you to unlock them (see 0). Also, will Google let me browse the web with "my own OS" without their proprietary services installed on it? (see 1) And without developers pouring tens of thousands of work hours into making projects such as GrapheneOS viable despite Google, you wouldn't even be able to do much that requires anything to do with SafetyNet and all successors delivered through Google Play Services, which is functionally the core component of any Android device for the near entirety of typical use-cases. And I'm not excusing OEMs, but they did not build their market share off of being "open" then start to close every door and trap you in it. 0. https://www.fitzsim.org/blog/?p=545 https://www.fitzsim.org/blog/?p=545 1. https://www.eff.org/deeplinks/2026/07/googles-new-remote-attestation-scheme-every-bit-terrible-its-old-remote https://www.eff.org/deeplinks/2026/07/googles-new-remote-att...
- ddxv 2mo agoIt's this stuff thats caused me to start degoogling as much as I can. I've started using nongmail emails and removing photos. I Don't know what else I can do though, next up is switching to grapheneOS but I'm a ways off from that for now.
- ithadhumor 2mo agoGoogle is going the Apple route. When will we get the year of the Linux Phone?
- poetaster 2mo agohttps://jolla.com/ https://jolla.com/
- zzril 2mo agoI use postmarketOS btw...
- grishka 2mo agoThe apps that are the reason some people use smartphones at all — bank apps — require Google services and remote attestation that runs in an environment with more privileges than the OS kernel. Otherwise everyone interested would just unlock their bootloader and use a ROM with all the asinine restrictions removed.
- ColdStream 2mo agoFor the longest time the free software foundation (well Stillman) were against all mobile phones because of their ability to track people. In the last year they have finally admitted that they were not going to win that battle and have gone head first into trying to build a fully open software stack. Not saying it will be good or arrive anywhere in the next 5 years but they are very persistent and that tends to work in their favour.
- dankobgd 2mo agoCan they ruin it faster i am sick of it already. Need to root the phone to get basic functionality, i need like 6-7 magisk modules to do basic things. I can't access file system on device i paid 250$. I have to use adb to change basic things, i rather use symbian.
- LightBug1 2mo ago"AI ... please create a very efficient emulator which will take an Android app, and convert it to any other operating system" Anyone up for the challenge? Or a better solution. Fuck this bullshit. It's only going to get worse.
- Eueudhsbsj32 2mo agoIf only it were that simple. Anything important like banking apps will require attestation.
- donalhunt 2mo ago[flagged]
- stuaxo 2mo ago[dead]
- bayindirh 2mo agoWhen Google first announced sideloading restrictions, somebody told “but we have ADB”, and who disagreed with them was criticized harshly. Now, I’m waiting for a workaround to enable ADB, so sideloading can be handled now, too. Android is not more open that iOS for a very long time now. The trend will continue. Again, this is not a technical problem (the mindset of Google), so technological solutions won’t help.
- gruez 2mo ago[flagged]
- zb3 2mo ago> which is the intended use "Intended use" (as understood by Google) for my smartphone is apparently providing them with data, consuming their advertisements and overpaying for apps that display ads and where you need in-app purchases to unlock basic functionality. > not as a hack for escalating privileges Hack for "escalating privileges" on my own device so I can do nefarious actions like uninstalling bloatware, denying apps internet access, recording calls (legally).. how could that be?
- gruez 2mo ago>like uninstalling bloatware, denying apps internet access All of these can be done with a computer. >recording calls (legally).. A second phone does the same thing. >Hack for "escalating privileges" on my own device so I can do nefarious actions Whether it's a "hack" is orthogonal to whether you control the device or not. I don't think anyone disputes that you "own" your linux PC, but using the well known `docker run --privileged ...`[1] method to get root on your machine is still a hack. [1] random result: https://github.com/Volodishlav/Docker-Privilege-Escalation https://github.com/Volodishlav/Docker-Privilege-Escalation
- zb3 2mo ago> All of these can be done with a computer. Can you permanently apply chain3 (FIREWALL_CHAIN_OEM_DENY_3) firewall rules, so that when the device reboots these are still applied? I see no persistence. And if I'm forced to install some crappy app on-the-go, the solution you propose is to always carry a computer with me, right? > A second phone does the same thing. So does a Phonograph from 1877, right? > Whether it's a "hack" is orthogonal to whether you control the device or not. I didn't object to it being called a hack, I just pointed out how evil and malicious that privilege escalation on my own device is. Google must block it immediately, it endangers the mankind.
- hn_submit 2mo agoLEA, Customs and intelligence agencies regularly use GDB to hack and extract information from an Android phone. So in that sense it may be a valid concern and reason to restrict this. However, I'm pretty sure these entities will already have negotiated exemptions from the restrictions so in that sense they don't add much security.
- felooboolooomba 2mo agoYeah, and they regularly use USB cables to do that too.
- ur-whale 2mo agoTo quote Scott McNealy, then CEO of Sun microsystems, circa 1999: "You have zero privacy anyway. Get over it". It has become truer every year that has passed since then. The 2026 version : "If you believe you will be allowed to keep any kind of control over the devices you "own", you are deluding yourself".
- nicman23 2mo agoi am not running stock ROMs and neither should you
- free652 2mo agoLooking what's this is about - Shizuku https://github.com/thedjchi/Shizuku/wiki/setup https://github.com/thedjchi/Shizuku/wiki/setup So it requires * Enable Developer Options if not already enabled (Generally, this is done by going to Settings > About device and tapping Build number 7 times). * Enable both USB debugging and Wireless debugging. Tap "Allow" if prompted to allow wireless debugging on the current network. * Tap Pair device with pairing code. * Downloadd other apps like ShizuCallRecorder Or seems to be exactly what this user described. https://news.ycombinator.com/reply?id=49046291&goto=item%3Fid%3D49045159%2349046291 https://news.ycombinator.com/reply?id=49046291&goto=item%3Fi...
- minraws 2mo agoAnd I might soon restrict use of Android and iOS in my life. Because of this nonsense, how will I get around the app issue is something I am still trying to figure out but I won't pay money to companies that make my products(I own them after I bought them) worse bit by bit anymore.
- 6d6b73 2mo agoIf they stop sideloading and adb why should I even stay with Android?
- chii 2mo agoTINA - https://en.wikipedia.org/wiki/There_is_no_alternative https://en.wikipedia.org/wiki/There_is_no_alternative
- Telaneo 2mo agoAnd people wonder why we're in the rut that we are. Sidenote: The poster in that article is insane to me. Imagine advertising yourself as the only alternative. I'd rather vote for an empty seat than for someone who's that arrogant! Then again, I don't really have to imagine it, since there have been quite a few politicians within the last 10 years who have functionally done that same, just without actually saying those words out loud.
- surajrmal 2mo agoadb is not being stopped, the bug is talking about a niche way folks use it without a secondary device. There is also no conclusion from the bug on what action will actually be taken.
- ChocolateGod 2mo agoIIRC Google never originally intended for Wireless ADB to be used by the very same device, as it skirts the intended app permission model even if it takes many steps to opt in.
- phonkd 2mo ago[dead]
- qphe95 2mo agoAnother day of AI another day of AI not being able to maintain useful features people used to take for granted
- 999900000999 2mo agoI just installed CachyOS on one of my laptops. I like Open Suse a bit more, but my vpn and a few other applications work better on Arch. Android is turning into the iOS/OSX/Win11 model. It’s not your device, you’re just renting it. You need permission to install applications, or do anything else outside of consuming subscription services. Where are the Linux phones ?
- createful 2mo agoLinux phones exist but work on a limited number of devices (see PostMarketOS) or Linux primary devices like Purism or Pinephone (which I've heard are expensive). That's the primary issue, you either need to buy an expensive and potentially underpowered phone OR have one that is supported most of the way with PostMarketOS (Wifi, SIM card, GPU, etc. sometimes may not work even though the phone can boot PostMarketOS). I personally don't have a problem with a mediocre-performance phone but it should not be expensive. Not to mention app ecosystems - there aren't a lot of Linux apps for Linux phones.
- righthand 2mo agoThere are plenty of apps for Linux phones because you get all of the Linux software automatically. What there isn’t plenty of is commercial pop culture apps from social media companies, banks, and other businesses but for some of those you can run an android emulator or use their website.
- zzril 2mo agoI've paid 200€ for my PinePhone. It is underpowered, but at least it doesn't have to waste its resources on rendering ads. Where Android/iPhone users have "apps", I mostly end up writing small shell scripts around existing linux tools. My alarm clock "app" is realized via cron jobs; my TOTP "app" is a one-liner around `oathtool`. Messenger apps are a bit tricky; I'll probably end up hosting my own matrix homeserver and then have bridges running for Signal and the likes.
- createful 2mo ago
- Raheela00321 2mo ago[flagged]
- MaskNinja 2mo ago...why? Android is the holy grail of freedom, since iOS never was. It's gotten worse since ~2024, despite the lawsuit. Or maybe Google is genuinely about thinking this in good faith. I can't see how, though.
- ktosobcy 2mo agoI'm sorry but F* Google. They started with "we love open" and when became virtual monopoly they extort the position :/
- luen 2mo agoIncreasing constraints will turn people into marionettes.
- luen 2mo agoIn this scenario, it means shutting off more possibilities.
- ilaksh 2mo agoDies this affect GrapheneOS or CalyxOS? I assume Sailfish and Ubuntu Touch are completely unimpacted?
- husky8 2mo agoWould rooted phones still be game? I am fearful as this ruins all of my home built AI apps
- wafflemaker 2mo agoAll this is happening in a country where it's legal and OK to make unsubscribing from a paid service nearly impossible. I mean it's OK for the crowd here, because amongst us are people who created the technical backends to let these rackets going.
- kmmbvnr_ 2mo agoI switched to a MacBook b/c I couldn't find a comparable PC laptop I feel like an iPhone will be next. Good Android phones are already pricey
- QwenGlazer9000 2mo agoI'm sick of having my shit be locked down because of "security". Do these people even know tech illiterate people? They couldn't enable ADB even with instructions.
- arend321 2mo agoAndroid Wireless debugging is already a major pita to work with. Requires a wifi connection to even work, so I need to carry a mobile wifi router with me, instead of having it bound to my secure WireGuard connection. Next it assigns a random port number every time the wifi connection is interrupted, or when it considers now is a good time to reset the port number. It should be possible to set a stable port and and have it available, perhaps behind a few awkward UI/adb toggles.
- falsemyrmidon 2mo agoSo glad we're becoming as locked down as iOS
- arjie 2mo agoLooks like some developer just suggested an idea. Doesn’t seem concrete.
- ZiiS 2mo agoLocked down hardware vendor's proprietary ROMs maybe, true open source Android not so much. Unfortunately one of these matters more then the other.
- neet_dev 2mo ago[flagged]
- himata4113 2mo agoI was thinking a lot about how these restrictions are paved with good intentions, but every time these new security measures are implemented we see criminals adopt new strategies and continue going about their day like nothing ever happened. I've been seeing this specifically with ID / business verification requirements where they just have some innocent (or sometimes complicit) third party grant them access to verasign 'verified' trust signing keys which actually makes them way more trusted than they were ever before often making anti-malware applications way less strict about blocking it which in turn buys them just enough time to compromise the system and disable said anti-malware applications. The problem here is that anti-malware applications try to be seemless and are effectively in a giant race condition to terminate the application, more recently microsoft anti malware service will now block program execution until it validates that it is safe. Although it is not something other companies do as making the device feel sluggish is something they avoid at all costs (looking at you bitdefender).
- cat_plus_plus 2mo agoDo you want your smart TV to become a persistent access point to your home network? If not, you should prefer to have an explicit unbypassable confirmation before another device is allowed to install arbitrary apps on it and pregrant them arbitrary permissions.
- inigyou 2mo agoCall me crazy but that actually makes sense. ADB is clearly meant for one device to control another, otherwise it's just a hack to bypass sandboxes.
- ptx 2mo agoThat would make sense if they hadn't first taken away the user's ability to control their own device directly. Some people were OK with that because users could still use this hack, but are presumably less OK with it in retrospect now that this second step finishes the job.
- wafflemaker 2mo agoGuess it's time to contact support for the few necessary apps that still don't work on GrapheneOS.
- arendtio 2mo agoEvery time I want to connect ADB to a device, it takes me far more time than it should. Having different ports for pairing and connecting is already a pain. I wonder what new hurdles will come up once they restrict adb to wlan0, even though atm I can't see any problems for my use cases (like pushing APKs, reading logs or connecting dev tools). Not being able to use VPNs might be a problem in corporate setups (e.g. debugging an issue in production environments).
- ourcat 2mo agoAmazon crippled the ADB functionality on FireTV Sticks a while ago. Making it an absolute pain to build and debug TV apps on. Currently, the only way to test is to install a release build every time.
- qiine 2mo agoWe will end up having a gov phone and a personal phone at this rate.
- a-dub 2mo agouse encryption and keys for all socket connections to adb, listen on 0.0.0.0 and unify the wifi thing with the socket thing, add an app level permission that allows apps to access an ephemeral system key via the binder to enable libadb style usecases?
- Doohickey-d 2mo agoI think one attack vector this sort of overlooks in the first point, regular users installing malicious apps. My elderly mum has an Android phone. She is not very tech-literate. She might see a full page ad "your phone has a virus, clean it now", or somehow end up on something like it (e.g. a scam email). She then dutifully clicks on it, which prompts to download an apk. The webpage provides clear instructions for how to install the just-downloaded APK. That APK (app) then walks her though enabling ADB, so it can "clean the phone". The app gave very good instructions (customized to reflect the UI that her device manufacturer would use), so she manages to click through to the hidden settings menu and enable ADB. The app can now exfiltrate all sorts of data, without needing any scary permissions prompt which will tell the user what is being accessed. I think this sort of pattern is very real, and many users are being affected by these scams. And undoubtedly more android users than iOS ones. Finding a balance that allows power users like me to use my device as I wish, and protecting regular users, is quite hard. I think the solution Google came up with of requiring a 24 hour wait, + some extra scary warnings, for unsigned apps is a step in the right direction, it helps less tech literate users avoid scams, and power users just have to be patient for 24h. But of course it's still not satisfactory for everyone, mum might still get scammed, and power users get annoyed at it.
- TeMPOraL 2mo agoYour post switched half-way from "this hypothetical app your mum might hypothetically install" to "this apparently real app doing these specific things". Which way is it? Are you describing an actual threat in the wild, or just speculating about possibility? FWIW, similar kinds of attacks is exactly why side-loading apps is about to require a reboot and 24 hour cooldown. Which you mention at the end. It sucks, but it's a decent compromise; power users like me will just do the dance and pick the "indefinite" option the moment they unpack their new phone, and rest of the people will never even know about it until they're half-way through being scammed. I personally don't believe doing anything more in this direction is warranted.
- jimrandomh 2mo agoAs far as I can tell, this is a big overreaction to a misunderstanding. I'm a developer with remote adb enabled, using it in the normal intended way (to install new builds of an Android project I'm developing, retrieve log files related to it, etc). Currently, I access this via VPN (tailscale), but it's exposed to connections (and any pre-auth security vulnerability risks) on any random public wifi network I connect to. Adding the ability to restrict this to just tailscale will be an improvement, for me. The proposal at the top of the thread is that you specify which interface you want it to bind to, when you set up remote adb, rather than binding to every interface. Nothing in that proposal suggests that "localhost" would be rejected as a choice of interface. One person suggested binding only to "wlan0", but that was a short throwaway comment that is obviously wrong (wlan0 is less-trusted than VPNs) and obviously not what they're going to do.
- subarctic 2mo agoThanks for clarifying, if your read is correct and they're just putting more control in the user's hand then this isn't an issue at all
- kitsumed 2mo agoThe person who made that suggestion (sa...@google.com) is presumed to be the one of the main maintainer of ADB as their name (Fabien Sanglard) showed up in non-redacted in the history and CC here (https://android-review.googlesource.com/c/platform/packages/apps/Settings/+/4118073 https://android-review.googlesource.com/c/platform/packages/...) after it was linked in the original Google IssueTracker. We can confirm they are a Google employee as per their @google.com top domain name. (For users reading, please don't target this person, it won't change anything AT ALL, i'm stating this since its public informations, and for proof) Their email is also in the CODEOWNER of ADB, and they made the recent ADB Wifi 2.0 presentation at Droid-Con Paris. They stated, "Connection to localhost has also been the source of exploits where apps are using that socket to adbd to escalate their privileges," which suggests that internally they viewed it primarily as an exploit bad actor uses. Without feedback, they would most lickly not consider changing their point of view, this is why the blog post was made. The article shows that this is technically possible for bad actors to use it, assuming the user allow it, but highly unlikely in practice: https://kitsumed.github.io/blog/posts/android-may-soon-restrict-on-device-adb/#:~:text=While%20it%20can%20indeed%20be%20used%20to%20elevate%20privileges%2C%20a%20%E2%80%9Cmalicious%E2%80%9D%20application%20cannot%20do%20so%20alone%2E%20It%20requires%20multiple%20actions%20that%20MUST%20be%20performed%20by%20a%20human%2E https://kitsumed.github.io/blog/posts/android-may-soon-restr... I do agree, however, that many of the comments, mainly on Reddit, blow the issue way out of proportion. Based on the website analytics, I can also confidently say that most people didn't even open or read the blog post. That's fine with me, though. My goal was to get the attention of actual developers and more technical users. I have been very carful in the blog post not to write something too dramatic like some news outlets do, but if no one read it, I can't do anything about it. EDIT: I have purposefully left that person name out of the blog post I originally made to avoid encouraging people to message them directly. However, if I need to update the blog or publish some kind of follow-up with supporting evidence, I may end up linking it. I'm not sure tbh.
- masonwan 2mo agoApple did this since day one on 2007, no one bat an eye. If we want this to be fixed, IMO, we have to do this in politics.
- inisirex 2mo ago[flagged]
- 1saadcodes 2mo agoI'd be interested to see whether this comes with a replacement for legitimate use cases. Removing a capability without offering an alternative tends to push developers toward even more fragile or in some cases "rule breaking" workarounds
- kitsumed 2mo agoThe On-Device ADB work-arounds and a lot of open-source apps related to it are already in that fragile workarounds "zone". For most, this is the last resort / only way possible. As AOSP refuse to add secure permission or services to allow third-party application to do specific actions. If this get fixed, it will be the end of thoses project on-device for non-rooted ROMs. Sure, you could still run it via a computer, or to be far fetched, start Shizuku via a computer. But that's no longer "on-device". It kill a lot of usages, including developers who need it "on-the-fly".
- horseandcart 2mo ago[dead]
- wolvoleo 2mo ago> This feature was proposed following a major security issue identified as CVE-2026-0073, which allowed the Wireless ADB authentication process to be fully bypassed. What is proposed in this issue is actually a nice idea. Clearly this is not an issue when the wireless authentication process works as intended. I see no need to change that at all. They just need to fix that bug. It's quite difficult to do this. You need to enable wireless debugging. Then pair to a random port with a random pairing code and then connect to yet another random port. When it works as intended it's more than secure enough. If they really want to restrict it, just let the user choose in the development settings what interface to listen to.
- Grimblewald 2mo agowhy not cut to the chase and simply remove user access to devices? preventing non playstore installs and restricting adb are addressing symptoms, user behaviour, not actual security issues. RIP android.
- easyissimple 2mo ago[flagged]
- nesa_techs 2mo ago[dead]
- BoredSmurf 2mo agoWell, I ordered my first iphone last week. if I have a choice between a walled garden with ads and a walled garden without, the outcome us easy to guess.
- sharts 2mo agoHaven’t used Android in forever but…Isn’t ADB the only way to do real backups?
- surcap526 2mo ago[dead]
- flyingcapabara 2mo agowww.github.com/jegly/box
- mastermage 2mo agoThere is a reason that I am considering switching to IOS because google keeps pulling this shit. Atleast with Apple I know what I get. Which is not the most flexible system, with apple only implementing the mandatory minimum of interoptability and features required by EU rules. But other than that delivering a rather solid product with excellent vertical integration. And at least i know that unlike Google their main business is not in advertising. (but in pricing their incremental upgrades ridiculously)
- 1vuio0pswjnm7 2mo agoShizuWall seems quite useful For example, the user can keep network access for all apps disabled Then enable apps needing connectivity on-the-fly only when need to use them It can be combined with a VPN that does port forwarding like PCAPDroid to be more like NetGuard, i.e., only allowing selected apps to have network access I have been using Shizuku for years with NMM and some other apps but wasn't aware of ShizuWall; looks like it's been around since 2025
- 1vuio0pswjnm7 2mo agoUnfortunately it does not block "system" apps