from Hacker News

Apps can now block sideloading easier and force downloads through Google Play

by cglong on 9/12/24, 7:31 PM with 22 comments

  • by zb3 on 9/12/24, 9:58 PM

    There's no such thing as "your Android phone" - this phone is not really yours. Not just because Android acts against your interest, but also because you have no access to the TEE (which powers DRM for example).

    Things will get even worse because Google is working on the AVF framework which includes so called "protected VMs" - of course they're meant to be protected from you, the user. Their "security" (where you're the "attacker") is based on the TEE but also a so called "protected vm firmware". In their design document they explicitly say that these protected VMs can provide "security" only with locked bootloader.. you probably know what that means..

  • by hollow-moe on 9/12/24, 9:29 PM

    Smart move, you're not forcing the use of your app store if all major applications enable this of their own will

  • by Boltgolt on 9/12/24, 9:04 PM

    Seems like it's going to get even more annoying to get apps for a country that you're traveling in. So many apps you want to use as a tourist are geolocked

  • by zb3 on 9/12/24, 9:44 PM

    Note this can practically only be enforced by apps that communicate with a server. For pure client side apps, one can simply patch the code (albeit this won't give them access to the saved data due to signature mismatch).

    However, Google is developing a new obfuscation method called pairip (officially automatic integrity protection) that makes it really hard to patch apps by moving some java code to an encrypted vm riddled with checksums and anti debugging checks.. Fortunately "really hard" (and yes, the vm is crazy..) doesn't mean impossible.

    But for server side services, this will unfortunately serve its purpose.

  • by ChrisArchitect on 9/13/24, 2:46 AM

  • by dartharva on 9/12/24, 8:15 PM

    sigh so no more cracked Spotify on Android, I guess. Too bad. A lot of the Android warez scene will take a huge hit from this.