In August, Google announced that it will require developer verification to install Android apps, including through sideloading. That\u2019s continuing, but Google is working on a solution for \u201cexperienced users.\u201d<\/b>
\nIn August, Google announced that it will require developer verification to install Android apps, including through sideloading. That\u2019s continuing, but Google is working on a solution for \u201cexperienced users.\u201d
While the developer verification plans are proceeding (with early access starting today), Google shared that it\u2019s \u201cbuilding a new advanced flow that allows experienced users to accept the risks of installing software that isn\u2019t verified.\u201d This is for developers and power users.
We are designing this flow specifically to resist coercion, ensuring that users aren\u2019t tricked into bypassing these safety checks while under pressure from a scammer. It will also include clear warnings to ensure users fully understand the risks involved, but ultimately, it puts the choice in their hands.
Google is \u201cgathering early feedback on the design of this feature now and will share more details in the coming months.\u201d
The company today provided more details on why it thinks developer verification is important to protect Android users. Highlights include:
\u201cTechnical safeguards are critical, but they cannot solve for every scenario where a user is manipulated. Scammers use high-pressure social engineering tactics to trick users into bypassing the very warnings designed to protect them.\u201d
\u201cFor example, a common attack we track in Southeast Asia illustrates this threat clearly. A scammer calls a victim claiming their bank account is compromised and uses fear and urgency to direct them to sideload a \u201cverification app\u201d to secure their funds, often coaching them to ignore standard security warnings. Once installed, this app \u2014 actually malware \u2014 intercepts the victim\u2019s notifications. When the user logs into their real banking app, the malware captures their two-factor authentication codes, giving the scammer everything they need to drain the account.\u201d
\u201cWhile we have advanced safeguards and protections to detect and take down bad apps, without verification, bad actors can spin up new harmful apps instantly. It becomes an endless game of whack-a-mole. \u201c
Google says verification forces bad actors to use \u201creal identity to distribute malware, making attacks significantly harder and more costly to scale.\u201d It says that developer verification requirements in Google Play have been \u201ceffective\u201d
\u2026we are now applying those lessons to the broader Android ecosystem to ensure there is a real, accountable identity behind the software you install.
Google also reiterated today that it is continuing work on a \u201cdedicated account type for students and hobbyists\u201d that will allow for distribution to a \u201climited number of devices without going through the full verification requirements.\u201d<\/p>\n