Your Phone Is About to Stop Being Yours: 70 Days Until Lockdown

As it runs through Google Play Services, it's pretty likely they'll boil the frog and make it even harder in the future. Moving to an open platform is a good idea.

Obviously this does not affect “every device worldwide”. I don’t have a single Android phone, and the devices I own that do run Android are not affected.

I get the rest but I can’t get my head around people who find these two things upsetting.

Also. I regularly remove malware from people's android phones pro bono in and around my community. It all comes from the play store.

Fear, uncertainty, and doubt is a propaganda technique that tech companies have used for long against open source and competitors. The propaganda is to pretend that a 24 hour cooldown and making it difficult to install externals apps is for the good of the user meanwhile stealing their data and giving it to anybody that pays for it.

People are getting hurt. Mass spying should stop now.

1) make it optional

2) don't put it on a timer. What's most damning, in my opinion, is that this is the very definition of a bait-and-switch. Any rational person thinks this won't apply to their existing phone because it came before the rollout, right? It's only android 15 and onward? No. That's wrong, it'll apply to YOUR phone. Google. Non-Google. Doesn't matter. Android 12, 13, 14? Nope applies to them all. That's just an accident then?

It's just a public confession that none of these organizations - not the carriers, not the government, and not Evil Google, are fit for the responsibilities they've claimed.

The propaganda I'm seeing is coming from Google. I can't tell you how many times lately I've seen ads on TV/streaming pushing the security narrative for Play Store. Google knows what it is doing is blatantly anti-consumer and they very much want public sentiment to think it's not.

There will always be means to scam individuals through technology. Pulling stunts like this is not justified simply because it closes off one means of doing so.

The real problem here is not that Google is doing this bad thing. The real problem is that they can do this bad thing. They shouldn't have this power. Something needs to be done to rain in Google and take back Android as an open platform.

The best solution would have been to be able to mark ANY alternative app store like fdroid as trusted and no such cooldown period would hit every time people install an app from there. This avoids that people can immediately use installed apps downloaded from an arbitrary URL but at the same time keeps the alternative app stores as a good alternative. Google decided to play unfair again.

Full disclosure, I am an iPhone user in part because I personally like living in the walled garden. But I also acknowledge that it has its downsides. I have a separate Android device just for language learning because the open source language learning app ecosystem is basically nonexistent on Apple’s locked-down platform. I’m not thrilled about the possibility of that ecosystem withering and dying on Android, too.

> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.

I would turn this right around and say that until the proponents of this measure acknowledge that the Play Store is not safe and is in fact a primary vector for scams, you're just doing propaganda.

The correct move is to remove the (icon for) the google app store from inexperienced user's phones. (I'm dead serious, and it works)

Unfortunately, that's exactly the move that now gets sabotaged by this google change.

So sure I'll acknowledge the very real risk to users that this is meant to mitigate. It does in fact marginally mitigate the precise narrow risk they state, but introduces a fatal flaw in its place. Probably unwise to let naive users use android at all anymore after this.

The vast majority of tech support scams come through apps on the Play Store. Not only that, but malicious apps get approved on the Play Store constantly.

There is no reason to take any claim that this change is meant to mitigate scams seriously, because there's no evidence to support that it makes a noticeable dent in such activity.

What this change does noticeably and impactfully do, is prevent, via chilling effects, users from being able to use their phones in ways that could lose Google and its partner vendors post-sales revenue.

As you said, serving people should be the end in itself, and this change doesn't do that - it hurts people.

There are people at my gym who often have very bad form who I worry about. I will occasionally chat them up so they're not, for example, shoulder pressing with their arms outside of the scapular plane [0] or benching without any arch in their back [1]. Sometimes they appreciate it and ask me more questions. Sometimes they give me a terse 'thanks' and go back to doing it the way they want to do it.

If somehow every gym started forbidding people from using any equipment with which they could harm themselves unless they could prove, with a 24h cooling off period, that they knew the form and dangers in detail, I'm sure it would probably save a few people from suffering temporary injuries. I think it would also drive a lot of people away from any kind of sustained resistance training and be an overall net negative for public health.

Personally, I don't think such a nanny-state implementation is necessary? That you should be able to easily toggle off such a feature if you like and what happens to you happens. Perhaps there should be a 'tech-illiterate' mode toggled on by default but easily toggled off if you know how to access Developer Options with a little more forewarning about common scams. Perhaps gyms (or Google) could pay people to proactively assist and help people they see as the most vulnerable to certain kinds of exploits. Perhaps instead of spending time training Gemini to be a general-assist LLM they could train a very small local model to hyperspecifically guard against known intrusions.

There are so many more pro-social, less-draconian ways of tackling safety issues, from socialization to ongoing support to education efforts. A lockdown that just happens to also help ensure that they can extract their pound of flesh inside the abattoir that is Google Play seems at best overly protective and at worst just more corporate extraction of surplus value from individuals.

[0] https://brookbushinstitute.com/glossary/scapular-plane

[1] https://www.strongerbyscience.com/how-to-bench/#:~:text=it%2...

Simply add a setting to the phone for the technologically illiterate and/or young and old.

I can't even imagine how locked down and terrible the internet would be if we had this rhetoric around in the 90s.

I strongly agree with this statement.

If a piece of public communication is intended to sway the reader's opinion without informing them (or while selectively informing them, which is close to the same thing), it is propaganda.

I don't. An hour would make the same point and provide the same level of protection. So would clicking through a few screens with very simple and easy to understand warning messages about the risk of scams. Sure, it's a compromise, but it's pretty much the opposite of excellent.

One important way that scams reach end users are through the willing participation of ad platforms, and even before DSA (not that much has changed) people (myself included) have done countless reports of straight up scam ads with no recourse and a templated "we have found nothing wrong with the ad".

As a data point, have you not seen the Tai Chi AI ads on YouTube that will "make you a different person by the end of the week" which where run by a company that sold you a subscription via dark patterns with all the surprises that brings (like a big headache of an unsubscribe process).

Or the fact that Meta knows that X% of it's ads are scam/phising and do nothing about it because it hurts the bottomline (an AI chat will help you with references).

The hypocrisy is too much coming from Google since they are owners of the machine that feed scams right to your doorstep.

And let's not ignore all the other fronts they are fighting on to further lock down the Android platform (such as not making source available immediately and moving more of the runtime in their play services and platform integrity nonsense).

If I have to wait 24h to install an app from another store, I demand the same to apply to AppStore. I see app stores just like browsers: users must have the ability to choose which browser they want when installing an operating system, and for Android, users must be able to select which app store they want and they should work the same way.

The risk of people cutting themselves is not a responsibility nor a concern for the knife manufacturers. I would be very upset if one day all kitchen knives would be sold blunt just to mitigate some clueless people from cutting their fingers off.

Similarly, I seriously and absolutely don't get it why people falling for scams should be a reason to require KYC to distribute apps.

Especially given that KYC-passed accounts are easily obtainable online for pennies.

People gotta learn. Sometimes the best teacher is pain and suffering. I wish that weren’t true, but in my time on this planet, there has never been more truth to “you can lead a horse to water, but you certainly can’t make it drink it.”

Trying to save people against their will just doesn’t seem the best path. I’d rather more effort be put into education on best practices, or investment in an app sniffer that can try and identify common attack vectors. Idk, anything other than “some people are too stupid for their own good, so now we all have less freedom.” I mean truly, if you’re worried about grandma’s phone safety, only let her buy an iPhone. No android for mi-ma.

All I see here is Google snatching at the opportunity to get some of that scrumptious walled garden money.

Apple's is a scam in comparison and must be repaid every year.

1. Is requiring developers to submit government ID actually an effective way to prevent tech support scams? Will scammers actually be deterred by a government ID requirement in addition to the existing developer registration process?

2. Is requiring developers to submit government ID the best option to prevent tech support scams? Are there other options that Google could use to make Android user less susceptible to tech support scams?

> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.

The tradeoff, such as it is, is acknowledged on keepandroidopen.org under the "But wait, isn't this...just about security?" section:

> The security rationale is a smokescreen. Google Play Protect already scans for malware independent of developer identity. Requiring a government ID doesn't make code safer.

Finally:

> Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.

I don't think this is an excellent compromise. Scammers are persistent. I'm not convinced a 24 hour cooldown is enough to deter them in any meaningful way. I, on the other hand, am not persistent enough to wait 24 hours to install an Android app from F-Droid just to try it out.

There is a third position beside "I agree/disagree with the tradeoff", which is "I don't consider the tradeoff as stated truthful and refuse to frame the conversation that way".

Every closing of rights comes with a legitimate-sounding reason. Protect the children, etc. Most activist have been through this process enough times to see the play coming a mile away.

It is also surprising to see, on a place called hacker news, people defending closed systems and removal of agency from end users by giant corporations.

Why do we have to be lectured on how important this change is for their safety, while the Play store continues to be the primary location scam apps come from?

When do the companies get to be the ones that have to give up their own freedoms in favor of everyone else's safety?

I don't mind warnings and even brief cool downs but 24 hours is ridiculous.

If I lose or break my phone, I have to wait 24 hours after acquiring my new phone to use the apps I previously used? It's just absurd.

If I had to explain to clients that I was unable to do work until tomorrow, I'd be ridiculed.

> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.

I would argue pretending like this is actually for anyone's security is propaganda hiding the fact that this is all for Google to tighten its grip on Android.

Personally, I'm sick and tired of dealing with corporate overreach based on the excuse that so many people are too stupid to operate the device responsibly.

I'm on a 3rd party, no goggle account, AOSP built OS. So I don't think this immediate change in 2027 will affect me.

While AOSP is a current workaround, this whole ability to build a non-goggle android via AOSP is also under threat from goggle lockdown.

That means this trend of having to part with the OS intended for the too stupid population is only going to increase.

So, needing to depart from android completely is in the near term.

Linux phones become ever more usable, including android in a jail.

The current furiphone is a great example.

https://furilabs.com/

No, no it is not. If Google didn't love these changes, they'd do what Apple does with the EU. Malicious compliance, or at worst, only complying there. The LLM providers do the same.

Google loves, wants, and has instigated these changes. They are not being rolled out because some governments are asking for them. Those governments would never have specifically asked for these measures anyway; they'd have asked "can you reduce these scams?". And if Google had wanted to act on this, they wouldn't have done this either because they know that the overwhelming majority of these scams are from Play Store apps or from ads, often through AdMob itself, never passing through non-store apps. Those are a sliver of scams.

This is propaganda with zero backing in evidence.

As far as I am aware, the 24-hour cooldown will be required to use F-Droid. Has the situation changed regarding that?

"Currently, the predominant business model for commercial search engines is advertising. We expect that advertising funded search engines will be inherently biased towards the advertisers and away from the needs of the consumers... we believe the issue of advertising causes enough mixed incentives that it is crucial to have a competitive search engine that is transparent and in the academic realm."

October 2000: Google adds ads.

[0] https://research.google/pubs/the-anatomy-of-a-large-scale-hy...

This will not arrive through Android updates but through Google Play Services.

You can try to block Play Services using DNS trickery, but it's like whackamole. The only way to be guaranteed safe from this update is to run a ROM without Google services installed.

It's the user's phone. The user paid for it. The user pays for the internet connection. The phone belongs to the user not to Google. The user can control traffic to and from the phone if he so chooses

I have been blocking connections to Google servers, e.g., "updates", Google Play Services, and many, many others, on old phones for years. There are many ways to do it

For example, a local forward proxy works well; I run proxies on the phone and on the gateway

Blocking can also be done using only Android apps, e.g., Netguard, etc.

You can't just click a random apk in a website and install it. At least without the 24 hour wait workaround, done once per device.

...

30 cents out of every dollar, you say?

24h delay is not all of it, there's developer verification.

I believe this is usually referred to as "boiling the frog".

Any sources for this claim? I don't buy it.