Hacker News Reader

Comment by NackerHughes | Hacker News Reader

Starting in 2027, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID.

Every app and every device, worldwide, with no opt-out.

This includes apps shared between friends, distributed through F-Droid, built by hobbyists for personal use.

Independent developers, church and community groups, and hobbyists alike will all be frozen out of being able to develop and distribute their software.

Registration requires:

- Paying a fee to Google - Agreeing to Google's Terms and Conditions - Surrendering your government-issued identification - Providing evidence of your private signing key - Listing all current and all future application identifiers

If a developer does not comply, their apps get silently blocked on every Android device worldwide.

View on HN

I understand why you didn't mention it, but there is an opt-out: you enable developer mode and wait 24 hours.

As it runs through Google Play Services, it's pretty likely they'll boil the frog and make it even harder in the future. Moving to an open platform is a good idea.

A wait of 24hrs is not an opt out, it is a demonstration of absolute control.

Or might it be when a cron job runs?

The stated intention is to discourage scams. Bur this is exactly the same way Xiaomi makes their devices "unlockable" and in reality they just turned off their unlock server years ago and the button doesn't do anything, so you can't unlock.

Why do I need a remote cron job to install an app on my phone?

IIRC it is a cooldown to prevent less tech-savvy individuals from being tricked into installing malicious apps.

I don't think Google is doing this out of some egotistical obsession over "control," it's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.

There are plenty of problems with walled gardens, but IMO this isn't one of them.

> It's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.

Maybe it's because direct installs are too hard to do already? Fortnite tried to go to that route and failed, if Fortnite couldn't make it who can?

And let's be real, I'm not going to accept any talk of "security" from Google when I type "chatgpt" in the search bar of the play store and I have an app with a counterfeit logo coming up at the top spot.

The first result in the app store if you search the name of the local public transport company is NOT the app for said public transport.

As I understand they're being pressured into it by governments like the Brazilian government to prevent a widespread form of scam there, but of course they're happy to comply because it means they have more control as well

We'd all be safest in a cage but no one wants to live like that

I doubt they care about the Brazilian government. They're not going to lose customers there, the only alternative is iPhones and those are completely unaffordable in Brazil due to their local manufacturing laws. Only the rich few can afford one. They cost about twice as much as anywhere else and this is in a country where people have much less money.

So sanctioning Google means taking the smartphone away from 95% of their population. Which isn't going to happen.

Google is doing this because Google wants to.

The worst problem with walled gardens is when everything is walled. Android is not supposed to be an "ecosystem", it is a damn OS on compatible hardware.

> I don't think Google is doing this out of some egotistical obsession over "control," it's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.

It's also that that fraction is one they don't get any income from. We don't use Google accounts, Google apps or services etc.

So they don't get to track us as much except the few things you can't turn off in play services. Not everyone can work with custom rom (on those the new restriction obviously doesn't apply at all)

It's certainly true of the "average user" problem, but the stealth style update is concerning.

This keeps getting missed out every time it's reported. I can't figure out whether people genuinely don't know, or they're trying to push a narrative that this is worse than it is

Because it's a workaround on Googles control. Next year it will be a week, then a month, then never again.

It's under google's control because it's a Play Protect feature. It doesn't exist on non Play Protect devices

You say, "Play Protect" as if it is a thing that users can choose to avoid. Or as if it justifies the behavior. I don't think either of those is true.

>non Play Protect devices

Such as...?

It's clearly stated and expanded upon in this reporting.

Firstly, TFA has a bright red banner describing the opt-out mechanism. It's probably the second most attention-grabbing element on the page, after the countdown. Secondly, initially Google didn't mention any plans for an opt-out at all[1]. That was was only ceded after pushback[2].

[1]: https://web.archive.org/web/20260312134021/https://developer...

[2]: https://web.archive.org/web/20260328133800/https://developer...

Because apparently banking apps stop working if you do this.

They do not. If you /root/ your device play-protect, and apps that depend on it (many banking, security and 2fa apps) decide you're compromised. If you turn on developer mode - nothing happens... except you get menu options for a developer and can upload your APKs (or any others if you're a scofflaw)

There are certainly apps that stop working (at least in significant part) only because of Developer Mode, on otherwise stock Android, no root, Pixel phone.

Though the only example I’ve encountered is the SumUp Business App’s Tap To Pay feature. If you use e.g. Geto to hide (automatically disable and later re-enable) the developer options, it works fine.

I seem to recall some apps refusing to run if developer mode is enabled. A workaround that means I can no longer use the apps I use every day isn't much of a workaround.

Correct, some of the banking apps I use don't work unless I turn off Developer Mode It's actually annoying to have to turn on and off every time

The app my government pushes on everyone does not work with Developer Mode either.

Inevitably we're going to need a separate device for banking apps. Which makes sense until every single app bans developer mode...

Or, we're going to have to start choosing banks without apps or with apps that don't have such ridiculous restrictions. Fortunately, at least in the USA there is an abundance of banks and credit unions, so if one of them treats you like this, just move your account over to a different one. I've changed my primary bank in a single day--It's not hard.

It's not just choosing a bank without an app, existing banks have been neglecting their web sites so that some things are only possible with the app even if an alternative exists. I've had that with my bank, and when I called them to report the problem with their web site their "fix" was that yeah, the web site is kinda broken, just use the app instead and it'll work.

those restrictions are actually about safety, which in case of banking apps is actually justified.

Either way, what Google plans to do is absolutely crazy.

It's not obvious to me how those restrictions improve safety

They don't.

It's not hard but it is annoying to update card numbers and payroll and stuff

I've considered this before, but the short software support timeframe given by device manufacturers makes this a costly endeavour. I still have a perfectly functional Galaxy Tab S2 9.7, but even the third party ROMs have dropped it. I have a pixel 4a, and although it works beautifully running a supported version of lineage it's very likely that the modem baseband has a significant vulnerability that Google isn't patching. I don't think running banking or crypto wallet software on those devices is any smarter than running it on my daily driver pixel 8.

Is it Developer mode those apps trip on or USB debugging? I've seen several examples of the latter but haven't come across the former yet. I run Google-free Android (14, 15, 16) devices which run the Swedish and Dutch banking and e-ID apps I use on, some of these only work when USB debugging is disabled while others don't care. Some of them complain about Google Play Services not being available but they run nevertheless, that warning is produced by some part of the SDK which gets imported at build time but it does not (yet...) disable anything.

Although USB debugging (ADB) is arguably the main concern, a lot of apps just lazily check for developer mode - meaning they won't boot even if the menu is enabled. It allows stuff like location faking I suppose?

As of Android 17, "Developer Mode" consists of an extra options panel that is enabled through a sort of "Easter egg" process. It's not really even a mode. It's simply a bundle of options that are somewhat dangerous or confusing to twiddle. Users don't need to enter this mode for any practical reason, but entering this "mode" doesn't do anything except exposing more options behind one big toggle.

It doesn't affect the phone's security in any way, unless you specifically tweak a security-related option in that panel. It doesn't degrade the device encryption or Google Play Services. I don't see how any app could balk while it's enabled. There are no apps I have that even run differently. I use the same banking apps and all the other things as normal, whether or not this mode is enabled for me.

You can likely disable developer mode after installing the app.

I’m not sure if you would have to re-enable it every time to sideload updates or new apps. You can also install via adb with no waiting period.

> You can also install via adb with no waiting period

Is this confirmed? If so, that largely removes my issue with the 24 hour waiting period for enabling/disabling dev mode.

Yes, this has been widely reported everywhere except for the scaremongering OP.

https://android-developers.googleblog.com/2026/03/android-de...

The 24 hour waiting period is only once per account, not on every activation, or even every device.

Adb also requires developer mode.

And my work doesn't permit it even with byod, it's so annoying. I've stopped running byod for that reason but now I'm stuck with two phones again.

If your device is under MDM it's already far more pwned than the topic of this article

Yes these days it is. It didn't use to be like that.

In the early days of BYOD, all they could do is delete the device if it would be lost. Which was not really a bother to me because I back it up to my own servers anyway, and in that case it would be lost anyway. And they would enforce a few basic things like setting a decent pincode and device encryption.

But lately the MDM and antimalware solutions have become more intrusive. Recently my work's MDM complained about an app I had on the personal side of my phone, something they should have no visibility of. Also they now want to route all the traffic through their VPN to inspect it which was obviously a non-starter.

Android 5 is where capabilities really took off, including the Device Owner profile which has pretty ultimate control over the device -- they've actually done some work to limit what admins could see across profiles in Android 11+

Android 7 is when always-on-vpn was could be enforced by an admin, in 2016.

Never byod. Besides MDM issues, it makes your personal device in scope for discovery if any lawsuit against the company.

Oh I don't live in America so this wouldn't happen, we don't have discovery here like that.

Besides, I would not comply anyway. I would just delete the device.

IANAL, however IIRC delete a device data is effectively destruction of evidence under most jurisdictions.

again IANAL but be careful.

Once enabled, it stays enabled even after developer mode is turned back off. It's also associated to the Google account (if any) so later device purchase don't have to wait the 24 hours period

As I understand it, you yourself will also need a google account to unlock the setting to "sideload" in the hidden "developer options" before waiting 24 hours.

What I am not sure is what will happen if I then remove the "google account" which I don't want in my device.

Because this entire movement has gone from being a noble cause to instead spreading FUD.

The amount of misinformation to scare people is alarming.

But I have Google Play Services disabled, since I couldn't uninstall it.

And then you find your banking app no longer works...

Then you switch banks

There are exactly three banks here that are worth using as a business and all of them have the same idiotic policy.

So you probably need a political action like supporting https://edri.org or similar.

No way, they support groups who openly terrorize communities with violence and rioting by attacking critical infrastructure and hold anti-capitalist views which are inherently anti-business.

Shame on them.

Source?

Gladly: https://home.treasury.gov/news/press-releases/sb0616

Are you trolling? Or just linking this ironically?

I'm completely serious, for the record.

> and hold anti-capitalist views

https://amieboakye.substack.com/p/why-we-never-hear-about-th...

> and hold anti-capitalist views

Oh no!

Overall I'd say "bollocks".

Not quite. When the update is pushed, there will be an initial 24 hour waiting period to unlock your device. And then you can install unsigned APKs from hobbyist devs or Fdroid as before

What happens to existing APKs and FDroid apps?

Can be installed as usual after the 24 hour wait, or via ADB without the wait

SO can I use them in the meantime?

For now. They’re going to remove that option after everyone gets used to the new normal.

Not to mention, one of the most important things, the absolute best app out there for controlling insulin pumps for diabetics is an open source app you have to "sideload." I'm not usually one to make hyperbolic accusations, but in this case Google attempting to kill sideloading could put real people's lives in danger, or substantially damage their quality of life.

Is it safe to assume that GrapheneOS will not be affected by this?

Yes, because GrapheneOS completely controls app installation and google play services is just an optional module.

GrapheneOS or other similar OS won’t be the issue.

The issue will be your bank, your gov, your uni, and school not releasing a compatible app for you.

And nowadays a device that cannot communicate or be trusted by other actors of the network (internet) is pretty much useless.

I hope those entities will wake up and start serving equivalents functionalities via the open web.

That is why we have the good old WWW for.

> That is why we have the good old WWW for.

We can use AI to take back the entire tech stack.

Every moat, every walled garden, every infrastructure piece can be rebuilt with AI.

We're seeing it with desktop apps, with games. It will happen to infrastructure and platforms. I'm itching at the opportunity to build open cloud primitives and P2P social protocols.

We don't need big tech anymore. We just need to be able to run our models.

I want to see every *aaS’s functionality required to be offered -on reasonable and non-discriminatory terms- as an API

Who is Ford to tell me I can’t have a widget for each of my ford EVs visible at the same time? Or even that the single-car widget they do allow has has to be four times bigger than I want it to be, and waste screen real estate on dead space and things that I don’t want?

Great for local stuff but won't help for remote services like banks when they rely on hardware attestation unfortunately.

Perhaps in a year's time, AIs can run fault injectors and devise hardware exploits too.

I already have to tell everyone I don't have a smartphone because stuff doesn't work so we'll on graphene and I don't want to explain.

I typically tell them I don't have an Apple or Google play store. That typically confuses them enough that I can avoid explaining more than just telling them that that is indeed possible.

Nearly everything works on GrapheneOS.

the network (~~internet~~ Business interests)

Can you imagine of those "de-banking" people actually existed and could read?

Although many people do say that there's an issue with banking apps on GrapheneOS, I don't believe that's actually the case. Many banking apps work just fine. In cases where other apps refuse to run, GrapheneOS has compatibility toggles. After toggling those on, many banking apps that complain start working again.

In other cases, banks add Play Integrity checks to their apps, which is a more complex subject. In short, many banking apps check for the basic integrity verdict, which GrapheneOS can get. In other cases, the checks are not implemented properly, and GrapheneOS has a toggle which often gets those apps to work. Finally, a very small number of banking apps require the strong integrity verdict and the apps will refuse to run on GrapheneOS.

Although there are no statistics about this, it does seem that a majority of banking apps work or can be made to work with different compatibility toggles.

It's not a banking app, but there are definitely apps that don't work on GrapheneOS that can't be made to work. A friend of mine is "required" to use Microsoft Authenticator for his work MFA, which won't run. He's looking at having to carry another phone.

I have to use the awful thing, too, so if I go to GrapheneOS next year when, hopefully, a non-Google phone supports it, I'll have to carry two phones. Ugh.

Not at all. The app that is enforcing the change is a privileged Google app. Even if someone tried installing it on GrapheneOS, it wouldn't be able to do anything like remove apps, block installation, or disable apps.

And my experience has been that it's frequently harder to sidestep Google's bullshit on GrapheneOS because you don't have as much control of your phone, in the interest of security.

Honestly at this point, I'm just gonna start transitioning to Ubuntu Touch. The Android experiment has run its course.

What you're saying doesn't make any sense. I literally just said that GrapheneOS isn't affected.

The narrative that GrapheneOS is so focused on security that it affects usability, especially given the context, is nonsense. The change that's being discussed here doesn't affect GrapheneOS or other non-GMS operating systems. The only affected OSes are the ones that install Google apps with privileged permissions.

If you want to switch to something else, go ahead. GrapheneOS is still a better overall choice.

That is not the case. It is significantly easier to the point it is entirely optional. GrapheneOSs privacy and security features do not make avoiding google more difficult.

On stock OSs, google signs major portions of the OS and is highly privileged, which is impossible to sidestep.

Optional is obviously easier than impossible.

I haven't paid any fee to Google. Where does it say that you have to? Only Apple requires me to pay a (yearly) fee.

I believe that author is talking about a fee of 25$ you must pay to google when publishing your app in their ecosystem.

You pay that fee once to setup your publishing account (unless they close it on you, in that case you won't be able to reopen the account.. you'll have to start fresh and pay again). Not per app-publish, not per-year.

IMHO, this is a great time to push PWAs even harder. I know they're not a fit for every use case, but most of the apps I saw and/or use would work just fine as PWAs. If Mozilla wants to do the right thing this time, they could reconsider bringing first-class PWA support back across all platforms.

Good luck with that, the PWA standard is a moving goalpost with every Chrome update.

Stop using Chrome and switch to Firefox.

Not that i make any difference but I'm very much committed to building everything as PWAs.

But there literally is an opt-out. Users can disable this system if they want.

I am being completely honest here - what is the reason that the government id thing is a problem here? And why is attesting the private key (evidence that you have it) an issue?

I get the rest but I can’t get my head around people who find these two things upsetting.

I am doing by best to never give a tech company my government ID, and especially not to install apps i build myself on hardware that i own

Because the Company have no support and it is all AI and Bots… their verifications don't work..

I have a company with both App Store and Play Store apps out, but when I wanted to use my Personal account to distribute a free app, it took with Apple 1 hour with registration and then one phone call to their EU Developer support to get approved. 4 months later and I am nowhere with Googles new system and have given up..

My app is now iOS and APK only, which mean no none nerd users on Android.

Will it block existing apps already installed on the phone?

Good, this will get rid of scammers, poorly written apps, and ten a penny vibe coded apps. They should have done it a while ago.

Because the Play Store has none of those?

Removing freedom, and control will never get rid of scammers. Nor will it get rid of the plethora of poorly written corporate owned apps that will still be allowed to fester. It won't even get rid of the apps that scammers use to scam.

At best it gets rid of some scams, certainly not most of them or poorly written apps, which continue to flood the Google PlayStore.

Despite Google's best efforts to automatically ban malicious developers, catching many legitimate developers in the crossfire, their store isn't exactly a bastion of quality or scam-free.

> Despite Google's best efforts to automatically ban malicious developers, catching many legitimate developers in the crossfire, their store isn't exactly a bastion of quality or scam-free.

I honestly doubt their "best efforts".

Fact of life is they make money off apps including malicious ones. For the same reason a lot of promoted content on Google search is clickbait and they even serve malicious apps. Money corrupts.

and installing AI-monitored CCTV that calls the cops when it thinks you're up to no good in every room of every dwelling would reduce the number of murders and rapes by at least half.

I'm sure you will not object when that happens. you are not a murderer or rapist, are you?

and reduce domestic violence and child abuse by even more. Funny no one thinks of the children when it comes to an idea like that.

I wouldn't, as long as humans aren't viewing it, think of the murders/abuse prevented, it could even monitor your behaviour and be like a pre-cog so if it thinks you sound weird or creepy it sends a robot round to question/arrest you.

24/7 omnipresent behavioral monitoring by an uncompromising algorithm, its hand always hovering over the button that ruins my life? Hell yeah sign me up!

I hope this isn't satire, because it's hilarious how often when someone logically extends the arguments of the authoritarian corporate tech overlords until they turn into a direct retelling of dystopian nightmares from the past, someone pops up and goes "Yes that is my dream world, I would like that please"

What is wrong with you

I just don't like crime, abuse, murders etc. Giving up a little privacy to stop thousands of murders of innocents is a trade-off im willing to make. What is wrong with people who argue 'No let those kids die, I want to be able to pirate movies'

"A little privacy" is not "a camera in my house watching me 24/7"

Thousands of murders are not happening inside private homes. Almost every single murder that happens in my city happens on the street.

Something is in fact wrong with you. You want political dissidents arrested for the fake safety of preventing nonexistent murders.

> Giving up a little privacy to stop thousands of murders of innocents is a trade-off im willing to make.

That's disgusting.

All of these are mainly distributed through the playstore actually so it won't change anything in that regards since google doesn't care.

Lmao

I can’t stand this sort of hyperbole.

Obviously this does not affect “every device worldwide”. I don’t have a single Android phone, and the devices I own that do run Android are not affected.

Clearly from context they meant every android device not every device.

there are plenty of android devices without google apps, I was running many of them in the last 10 years, my current phone is after long time still with enabled gapps, though no google account, I have zero problem to stop using gapps

Hopefully it won't affect outdated Android versions, either. Then the fix is easy: never update again.

It doesn't affect my air conditioner, my coffeemaker, or my slide rule! I'm really angry about this sort of rhetoric!

So you hand over your passport at hotels, but here it is.. unacceptable?

I, at least, also consider it unacceptable at hotels... But that battle already seems lost.

Please don't use one loss of privacy to justify more.

Something, something, slippery slope.

Hotels have a reasonable need to know that I am the person who paid for the service, so I can get what I paid for. The hotel also does not remember, a human glances at your ID to compare your name and that's that.

Google has no need to know who anyone is here. I want to provide an app, someone else wants to use my app, all entirely off Google's sacred platforms. We should be able to work together, but in comes a middleman who demands to see our IDs because he owns the platform and can just do that. That ID, of course, is digitally stored and will be retained indefinitely.

Reply on news.ycombinator.com