Hacker News Reader

Comment by rjh29 | Hacker News Reader

I understand why you didn't mention it, but there is an opt-out: you enable developer mode and wait 24 hours.

As it runs through Google Play Services, it's pretty likely they'll boil the frog and make it even harder in the future. Moving to an open platform is a good idea.

View on HN

I seem to recall some apps refusing to run if developer mode is enabled. A workaround that means I can no longer use the apps I use every day isn't much of a workaround.

Correct, some of the banking apps I use don't work unless I turn off Developer Mode It's actually annoying to have to turn on and off every time

The app my government pushes on everyone does not work with Developer Mode either.

Inevitably we're going to need a separate device for banking apps. Which makes sense until every single app bans developer mode...

Or, we're going to have to start choosing banks without apps or with apps that don't have such ridiculous restrictions. Fortunately, at least in the USA there is an abundance of banks and credit unions, so if one of them treats you like this, just move your account over to a different one. I've changed my primary bank in a single day--It's not hard.

It's not just choosing a bank without an app, existing banks have been neglecting their web sites so that some things are only possible with the app even if an alternative exists. I've had that with my bank, and when I called them to report the problem with their web site their "fix" was that yeah, the web site is kinda broken, just use the app instead and it'll work.

those restrictions are actually about safety, which in case of banking apps is actually justified.

Either way, what Google plans to do is absolutely crazy.

It's not obvious to me how those restrictions improve safety

They don't.

It's not hard but it is annoying to update card numbers and payroll and stuff

I've considered this before, but the short software support timeframe given by device manufacturers makes this a costly endeavour. I still have a perfectly functional Galaxy Tab S2 9.7, but even the third party ROMs have dropped it. I have a pixel 4a, and although it works beautifully running a supported version of lineage it's very likely that the modem baseband has a significant vulnerability that Google isn't patching. I don't think running banking or crypto wallet software on those devices is any smarter than running it on my daily driver pixel 8.

Is it Developer mode those apps trip on or USB debugging? I've seen several examples of the latter but haven't come across the former yet. I run Google-free Android (14, 15, 16) devices which run the Swedish and Dutch banking and e-ID apps I use on, some of these only work when USB debugging is disabled while others don't care. Some of them complain about Google Play Services not being available but they run nevertheless, that warning is produced by some part of the SDK which gets imported at build time but it does not (yet...) disable anything.

Although USB debugging (ADB) is arguably the main concern, a lot of apps just lazily check for developer mode - meaning they won't boot even if the menu is enabled. It allows stuff like location faking I suppose?

As of Android 17, "Developer Mode" consists of an extra options panel that is enabled through a sort of "Easter egg" process. It's not really even a mode. It's simply a bundle of options that are somewhat dangerous or confusing to twiddle. Users don't need to enter this mode for any practical reason, but entering this "mode" doesn't do anything except exposing more options behind one big toggle.

It doesn't affect the phone's security in any way, unless you specifically tweak a security-related option in that panel. It doesn't degrade the device encryption or Google Play Services. I don't see how any app could balk while it's enabled. There are no apps I have that even run differently. I use the same banking apps and all the other things as normal, whether or not this mode is enabled for me.

You can likely disable developer mode after installing the app.

I’m not sure if you would have to re-enable it every time to sideload updates or new apps. You can also install via adb with no waiting period.

> You can also install via adb with no waiting period

Is this confirmed? If so, that largely removes my issue with the 24 hour waiting period for enabling/disabling dev mode.

Yes, this has been widely reported everywhere except for the scaremongering OP.

https://android-developers.googleblog.com/2026/03/android-de...

The 24 hour waiting period is only once per account, not on every activation, or even every device.

Adb also requires developer mode.

And my work doesn't permit it even with byod, it's so annoying. I've stopped running byod for that reason but now I'm stuck with two phones again.

If your device is under MDM it's already far more pwned than the topic of this article

Yes these days it is. It didn't use to be like that.

In the early days of BYOD, all they could do is delete the device if it would be lost. Which was not really a bother to me because I back it up to my own servers anyway, and in that case it would be lost anyway. And they would enforce a few basic things like setting a decent pincode and device encryption.

But lately the MDM and antimalware solutions have become more intrusive. Recently my work's MDM complained about an app I had on the personal side of my phone, something they should have no visibility of. Also they now want to route all the traffic through their VPN to inspect it which was obviously a non-starter.

Android 5 is where capabilities really took off, including the Device Owner profile which has pretty ultimate control over the device -- they've actually done some work to limit what admins could see across profiles in Android 11+

Android 7 is when always-on-vpn was could be enforced by an admin, in 2016.

Never byod. Besides MDM issues, it makes your personal device in scope for discovery if any lawsuit against the company.

Oh I don't live in America so this wouldn't happen, we don't have discovery here like that.

Besides, I would not comply anyway. I would just delete the device.

IANAL, however IIRC delete a device data is effectively destruction of evidence under most jurisdictions.

again IANAL but be careful.

Once enabled, it stays enabled even after developer mode is turned back off. It's also associated to the Google account (if any) so later device purchase don't have to wait the 24 hours period

As I understand it, you yourself will also need a google account to unlock the setting to "sideload" in the hidden "developer options" before waiting 24 hours.

What I am not sure is what will happen if I then remove the "google account" which I don't want in my device.

This keeps getting missed out every time it's reported. I can't figure out whether people genuinely don't know, or they're trying to push a narrative that this is worse than it is

Because it's a workaround on Googles control. Next year it will be a week, then a month, then never again.

It's under google's control because it's a Play Protect feature. It doesn't exist on non Play Protect devices

You say, "Play Protect" as if it is a thing that users can choose to avoid. Or as if it justifies the behavior. I don't think either of those is true.

>non Play Protect devices

Such as...?

It's clearly stated and expanded upon in this reporting.

Firstly, TFA has a bright red banner describing the opt-out mechanism. It's probably the second most attention-grabbing element on the page, after the countdown. Secondly, initially Google didn't mention any plans for an opt-out at all[1]. That was was only ceded after pushback[2].

[1]: https://web.archive.org/web/20260312134021/https://developer...

[2]: https://web.archive.org/web/20260328133800/https://developer...

Because apparently banking apps stop working if you do this.

They do not. If you /root/ your device play-protect, and apps that depend on it (many banking, security and 2fa apps) decide you're compromised. If you turn on developer mode - nothing happens... except you get menu options for a developer and can upload your APKs (or any others if you're a scofflaw)

There are certainly apps that stop working (at least in significant part) only because of Developer Mode, on otherwise stock Android, no root, Pixel phone.

Though the only example I’ve encountered is the SumUp Business App’s Tap To Pay feature. If you use e.g. Geto to hide (automatically disable and later re-enable) the developer options, it works fine.

And then you find your banking app no longer works...

Then you switch banks

There are exactly three banks here that are worth using as a business and all of them have the same idiotic policy.

So you probably need a political action like supporting https://edri.org or similar.

No way, they support groups who openly terrorize communities with violence and rioting by attacking critical infrastructure and hold anti-capitalist views which are inherently anti-business.

Shame on them.

Source?

Gladly: https://home.treasury.gov/news/press-releases/sb0616

Are you trolling? Or just linking this ironically?

I'm completely serious, for the record.

> and hold anti-capitalist views

https://amieboakye.substack.com/p/why-we-never-hear-about-th...

> and hold anti-capitalist views

Oh no!

Overall I'd say "bollocks".

A wait of 24hrs is not an opt out, it is a demonstration of absolute control.

Or might it be when a cron job runs?

The stated intention is to discourage scams. Bur this is exactly the same way Xiaomi makes their devices "unlockable" and in reality they just turned off their unlock server years ago and the button doesn't do anything, so you can't unlock.

Why do I need a remote cron job to install an app on my phone?

IIRC it is a cooldown to prevent less tech-savvy individuals from being tricked into installing malicious apps.

I don't think Google is doing this out of some egotistical obsession over "control," it's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.

There are plenty of problems with walled gardens, but IMO this isn't one of them.

> It's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.

Maybe it's because direct installs are too hard to do already? Fortnite tried to go to that route and failed, if Fortnite couldn't make it who can?

And let's be real, I'm not going to accept any talk of "security" from Google when I type "chatgpt" in the search bar of the play store and I have an app with a counterfeit logo coming up at the top spot.

The first result in the app store if you search the name of the local public transport company is NOT the app for said public transport.

As I understand they're being pressured into it by governments like the Brazilian government to prevent a widespread form of scam there, but of course they're happy to comply because it means they have more control as well

We'd all be safest in a cage but no one wants to live like that

I doubt they care about the Brazilian government. They're not going to lose customers there, the only alternative is iPhones and those are completely unaffordable in Brazil due to their local manufacturing laws. Only the rich few can afford one. They cost about twice as much as anywhere else and this is in a country where people have much less money.

So sanctioning Google means taking the smartphone away from 95% of their population. Which isn't going to happen.

Google is doing this because Google wants to.

The worst problem with walled gardens is when everything is walled. Android is not supposed to be an "ecosystem", it is a damn OS on compatible hardware.

> I don't think Google is doing this out of some egotistical obsession over "control," it's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.

It's also that that fraction is one they don't get any income from. We don't use Google accounts, Google apps or services etc.

So they don't get to track us as much except the few things you can't turn off in play services. Not everyone can work with custom rom (on those the new restriction obviously doesn't apply at all)

It's certainly true of the "average user" problem, but the stealth style update is concerning.

But I have Google Play Services disabled, since I couldn't uninstall it.

Because this entire movement has gone from being a noble cause to instead spreading FUD.

The amount of misinformation to scare people is alarming.

Reply on news.ycombinator.com