Lauren Weinstein
@lauren@mastodon.laurenweinstein.org  ·  activity timestamp 5 days ago

***** Google's plans to restrict sideloading on Android are an authoritarian wet dream come true *****

Let me be really clear about how horrifically dangerous #Google's plans are to restrict #Android sideloading to "verified developers" (that is, entities for which Google has full verified identity and associated information that they could hand over to authorities on demand).

This means that even though you own your Android device, you cannot install apps obtained from ANY source (except perhaps apps you build yourself that will only be permitted to run on your own device) unless Google knows pretty much everything about who created that app.

The ways that this could be abused are so numerous I won't even start listing them here, other than to note that it is absolutely horrific overreach by Google and at least appears to be Google bending over for abusive government demands, and could put already vulnerable individuals and groups at even more risk.

Absolutely disgusting.

L
Whispr
@Whispr@mastodon.social replied  ·  activity timestamp 5 days ago
@lauren You’re right to be sounding the alarm on this — it’s a big deal for privacy and control over our own devices. Have you ever listened to Rob Braxman (he’s known as the ‘Internet Privacy Guy’)? He’s been covering Google’s tightening grip on Android and sideloading for a while now. I think you’d appreciate his perspective — he breaks it down in a way that makes sense for both the technical and everyday user. Worth a listen if you haven’t run across him yet.
Lauren Weinstein
@lauren@mastodon.laurenweinstein.org replied  ·  activity timestamp 5 days ago
@Lacze @rzeta0 @GrapheneOS It's a distinction without a difference. To install any alternate OS, you need to be able to unlock the bootloader, and the same applies to rooting. If the bootloader can't be unlocked you can't effectively do either in any realistic sense. And again, this is not a solution for the overwhelmingly large majority of users.
tranquil_cassowary
@tranquil_cassowary@infosec.exchange replied  ·  activity timestamp 5 days ago
@lauren @Lacze @rzeta0 @GrapheneOS
That's not true. it's a distinction with a difference. If you are installing a proper third-party OS on a phone that supports installing third-party OSes with all security features intact you are supposed to unlock the bootloader, flash the third-party OS and then relock the bootloader. After relocking the bootloader verified boot and all other hardware security features are still supposed to work. Root is something entirely different and completely undermines the security model of Android.
rzeta0
@rzeta0@mstdn.social replied  ·  activity timestamp 5 days ago
@lauren @GrapheneOS

I agree with your focus on the vast majority of non-techie people.

I feel sad about it but that 99.999% are easy victims of surveillance and control.

I something think there must be a gap in the market for secure tech that is usable by that 99.999% ... but on thinking further, I think the established interests have the capability to kill any such venture quite easily.

If democracy depends on everyone being a PhD in electronics and software then that democracy is broken.
GrapheneOS
@GrapheneOS@grapheneos.social replied  ·  activity timestamp 5 days ago
@rzeta0 @lauren GrapheneOS is gradually working towards making the out-of-the-box experience better, overhauling or replacing the legacy AOSP apps and also launching phones with official support for GrapheneOS with an OEM. It's not at all intended for only technical people. We aren't going to take problematic shortcuts which massively sacrifice privacy and security though. We're only willing to launch a device with an OEM able to meet our official requirements (https://grapheneos.org/faq#future-devices).
slash
@agreeable_landfall@mastodon.social replied  ·  activity timestamp 5 days ago
@lauren I'm hopeful that the non-Google Android ROMs (like LineageOS or Graphene) will drop that code from the AOSP base sources.

To be honest, Google is the most obvious example of a "lateral arabesque" in software. Start a FOSS project, get everyone to contribute and ensure alternatives die off. Then, slowly, move code to non-FOSS licensing.

I think TIVO did something similar, years ago.

I do wonder if we have what it takes to fork Android.
Brian Swetland
@swetland@chaos.social replied  ·  activity timestamp 5 days ago
@lauren I suspect that it's primarily driven by malware complaints (and ensuing customer service costs) rather than government demands (though it certainly makes those much easier to fulfill).

It's still horrible overreach and combined with the killing off of AOSP build support for Pixel devices it's a bad sign for the health of the Android platform and ecosystem.

We (early Android team) fought hard for open app installation and replaceable OS images. Sad to see that finally dying.