Apps can now block sideloading more easily and force downloads through Google Play

[JulienL]

Summary

With the latest update to Google's Integrity API android apps are now able to effectively block users from sideloading their app.

 

 

Quotes

Quote

The Google Play Integrity API is an interface that helps developers “check that interactions and server requests are coming from [their] genuine app binary running on a genuine Android device.” It looks for evidence that the app has been tampered with, that the app is running in an “untrustworthy” software environment, that the device has Google Play Protect enabled, and more.

 

My thoughts

I think this is a worrying step toward blocking sideloading that Android is taking. If every app blocks sideloading it isn't that different from sideloading being blocked on the device. After Apple's recent EU rulings forcing them to allow sideloading this feels like both major providers trying to move to closed ecosystems.

 

Sources

https://www.androidauthority.com/play-integrity-sideloading-detection-3480639/

[porina]

I suspect this might be more of a move to protect paid apps and security sensitive apps (e.g. banking). 

[Poinkachu]

3 minutes ago, JulienL said:

If every app blocks sideloading it isn't that different from sideloading being blocked on the device.

The device allows but the particular app doesn't =/= the device itself doesn't allow at all

[Holmes108]

12 minutes ago, porina said:

I suspect this might be more of a move to protect paid apps and security sensitive apps (e.g. banking). 

 

Yeah, I don't see why a majority of apps would bother taking this step, outside of things like the example you listed. I'm not too worried about this (yet).

[ImorallySourcedElectrons]

4 hours ago, Holmes108 said:

 

Yeah, I don't see why a majority of apps would bother taking this step, outside of things like the example you listed. I'm not too worried about this (yet).

This would become problematic if Google were to make this mandatory if you want to use their payment system.

[RejZoR]

5 hours ago, porina said:

I suspect this might be more of a move to protect paid apps and security sensitive apps (e.g. banking). 

Nothing worse than my banking app refusing to work because I also have certain remote control app on the phone (that I knowingly put there). Between being forced to uninstall that app or go through the entire fuckery of changing your bank for the other bank to pull the same kind of BS at any time is the dumbest nonsense I've encountered in a while on a smartphone.

[Kisai]

6 hours ago, porina said:

I suspect this might be more of a move to protect paid apps and security sensitive apps (e.g. banking). 

Bingo.

 

Do you know how many apps MUST be side-loaded to work on Bluestacks or MEMU? Kiss using those pirated APK's on dubious sites goodbye.

 

I don't expect many apps and games to actually enforce this, because I see the consequences for doing so (Eg people using custom builds of Android, Bluestacks, MEMU, and other emulators all being locked out of the app store.)

 

It's more likely that Banking apps and 2FA/Password managers will all opt-in to this, but if games start doing this, people aren't going to bother with playing the game.

 

[TetraSky]

I can see why they would want to do this. Especially apps that rely on subscriptions and the likes, to stop modified apps that removes that stuff and enables subscription perks for free.

 

But man I still hate it.

[tim0901]

2 hours ago, RejZoR said:

Nothing worse than my banking app refusing to work because I also have certain remote control app on the phone (that I knowingly put there). Between being forced to uninstall that app or go through the entire fuckery of changing your bank for the other bank to pull the same kind of BS at any time is the dumbest nonsense I've encountered in a while on a smartphone.

 

So... your bank wants to protect you against fraud... and you're angry about it?

 

Because that's what they're doing - they're trying to prevent remote access attacks. A scammer gets full access to a mobile device via remote access (basic social engineering techniques) and then uses that access to steal OTP/PIN codes to get access to their account. Because they have full access, that can be done days or even weeks later, when you aren't even using the device.

[Mark Kaine]

8 hours ago, JulienL said:

Summary

With the latest update to Google's Integrity API android apps are now able to effectively block users from sideloading their app.

 

 

Quotes

 

My thoughts

I think this is a worrying step toward blocking sideloading that Android is taking. If every app blocks sideloading it isn't that different from sideloading being blocked on the device. After Apple's recent EU rulings forcing them to allow sideloading this feels like both major providers trying to move to closed ecosystems.

 

Sources

https://www.androidauthority.com/play-integrity-sideloading-detection-3480639/

 

ok but here's the thing, why would you sideload an app that's on the store... like, why?

 

reason for sideloading was always apps that are *not* on the store..

 

 

If the app makers want you to download their app *only* through a certain store that's their prerogative.  what in the world makes you feel entitled to obtain products in any way you wish?  that's never been a thing, at least not legally.  

 

 

[Mark Kaine]

4 hours ago, ImorallySourcedElectrons said:

This would become problematic if Google were to make this mandatory if you want to use their payment system.

true... but if they do that's one step more towards losing the whole European market, because that would be almost certainly against a plethora of anti competitive rules.

 

Sure that might not stop them, its still a very big step into that direction considering recent rulings and laws. 

[CarlBar]

3 hours ago, Mark Kaine said:

 

ok but here's the thing, why would you sideload an app that's on the store... like, why?

 

reason for sideloading was always apps that are *not* on the store..

 

 

If the app makers want you to download their app *only* through a certain store that's their prerogative.  what in the world makes you feel entitled to obtain products in any way you wish?  that's never been a thing, at least not legally.  

 

 

 

The thing is not all apps are available in all regions on the store so you have to sideload in some cases if your in a region where the store doesn't get it.

[Mark Kaine]

7 minutes ago, CarlBar said:

 

The thing is not all apps are available in all regions on the store so you have to sideload in some cases if your in a region where the store doesn't get it.

yeah true, but that's usually because they're not "allowed" in a country or whatever,  i doubt the app itself would have a block in this case... but its a tricky scenario i admit.

 

interesting question though, what examples do we even have for this? 

 

I only know billibilli app is not available on playstore here, i had to sideload it from the website directly, thanks google! Yikes.

[CarlBar]

1 hour ago, Mark Kaine said:

yeah true, but that's usually because they're not "allowed" in a country or whatever,  i doubt the app itself would have a block in this case... but its a tricky scenario i admit.

 

interesting question though, what examples do we even have for this? 

 

I only know billibilli app is not available on playstore here, i had to sideload it from the website directly, thanks google! Yikes.

 

Back when i was doing unemployment courses i liked to play mobile games, (lots of traveling and also waiting around), and 2 that i really got into, Fate Grand Order and Azure Lane where not available at the time in Europe. Available in the US but not Europe, though Azure Lane did come to Europe later. Had nothing to do with being banned, the people handling the games just didn't care to make them available in Europe at the time.

[Caroline]

4 hours ago, Mark Kaine said:

 

ok but here's the thing, why would you sideload an app that's on the store... like, why?

 

reason for sideloading was always apps that are *not* on the store..

 

 

If the app makers want you to download their app *only* through a certain store that's their prerogative.  what in the world makes you feel entitled to obtain products in any way you wish?  that's never been a thing, at least not legally.  

 

 

What if you want a certain app but not the Google store?

 

Another reason to degoogle and install a custom ROM. But reading other comments it appears tradfi banking shitware only works with googled android and not custom ones cuz muh suckurity, while still using a 4 digit pin for ATM cards.

 

I don't have a smartphone but know a few things.

[williamcll]

Oh this is going to mess with a bunch of phones that doesn't have google play pre-installed (see: Huawei).

 

3 hours ago, Mark Kaine said:

yeah true, but that's usually because they're not "allowed" in a country or whatever,  i doubt the app itself would have a block in this case... but its a tricky scenario i admit.

 

interesting question though, what examples do we even have for this? 

 

I only know billibilli app is not available on playstore here, i had to sideload it from the website directly, thanks google! Yikes.

It's more interesting because the play store version which has less functions due to licensing issues instead of downloading straight from bilibili. Not to mention the SEA version which goes to bilibili.tv instead.

[Mark Kaine]

i mean ok that's some valid reasons people would want to sideload. 

 

it also kinda defeats the whole android "freedom" of installing whatever you want obviously...

 

 

 

[Vishera]

3 hours ago, Caroline said:

What if you want a certain app but not the Google store?

 

Another reason to degoogle and install a custom ROM. But reading other comments it appears tradfi banking shitware only works with googled android and not custom ones cuz muh suckurity, while still using a 4 digit pin for ATM cards.

 

I don't have a smartphone but know a few things.

Fellow privacy "freak" here,

My phone is de-googled and i sideload everything, as pretty much all app stores spy on you.

[Holmes108]

12 hours ago, Mark Kaine said:

 

ok but here's the thing, why would you sideload an app that's on the store... like, why?

 

reason for sideloading was always apps that are *not* on the store..

 

 

If the app makers want you to download their app *only* through a certain store that's their prerogative.  what in the world makes you feel entitled to obtain products in any way you wish?  that's never been a thing, at least not legally.  

 

 

 

While it wasn't a common thing, there were instances where the app claimed to not be compatible with my specific model of phone, and I suspected there was no good reason for that. Sure enough, after sideloading, it worked perfectly fine.  That happened a handful of times for me years ago (I don't really sideload much anymore. I'm a much more simple phone user these days).

 

One other time I wanted to downgrade due to a bug that was introduced. 

 

It certainly was a rarity that I needed to sideload when it was also available in the play store. But it's a nice option to have. I just like feeling that I have control of my device, like a computer.

 

Nothing makes me see red more than trying to access something on my PC, for example, and then being told I don't have access/permissions that aren't easily bypassed with an admin password.

[wanderingfool2]

12 hours ago, CarlBar said:

 

Back when i was doing unemployment courses i liked to play mobile games, (lots of traveling and also waiting around), and 2 that i really got into, Fate Grand Order and Azure Lane where not available at the time in Europe. Available in the US but not Europe, though Azure Lane did come to Europe later. Had nothing to do with being banned, the people handling the games just didn't care to make them available in Europe at the time.

I mean there are a whole bunch different types of laws that you need to follow by publishing in Europe.  When I was making apps [and GDDPR started becoming a thing] I just went and said "You know what, I really can't be bothered figuring out all the legal disclaimers etc involved when it's just easier to not release there and I will only loose out a bit vs the amount of work I would need to put in in order to make sure I don't trip up on a single thing".  e.g. having a game with "violence" you have to classify as such etc [or something like that].  Then if yours is lets say boarderline "violent" like lets say roadrunner/coyote type you still have to classify and get a higher age restriction.

 

I dont know, I sometimes understand why companies don't want to venture out and release  apps everywhere because frankly it's a pain.  99% of apps I've seen don't even comply correct, which could make them in trouble if they were looked in at.

 

 

 

As for this whole topic, I think it's at least good to let the app publisher decide.  If they don't want to say comply with some laws in a country, and decide not having it operate at all there then it should be their right to.

[CarlBar]

14 minutes ago, wanderingfool2 said:

I mean there are a whole bunch different types of laws that you need to follow by publishing in Europe.  When I was making apps [and GDDPR started becoming a thing] I just went and said "You know what, I really can't be bothered figuring out all the legal disclaimers etc involved when it's just easier to not release there and I will only loose out a bit vs the amount of work I would need to put in in order to make sure I don't trip up on a single thing".  e.g. having a game with "violence" you have to classify as such etc [or something like that].  Then if yours is lets say boarderline "violent" like lets say roadrunner/coyote type you still have to classify and get a higher age restriction.

 

I dont know, I sometimes understand why companies don't want to venture out and release  apps everywhere because frankly it's a pain.  99% of apps I've seen don't even comply correct, which could make them in trouble if they were looked in at.

 

 

 

As for this whole topic, I think it's at least good to let the app publisher decide.  If they don't want to say comply with some laws in a country, and decide not having it operate at all there then it should be their right to.

 

his was a fair while back, i'm not sure GDDPR had even been proposed at the time.

[Sauron]

On 9/12/2024 at 12:13 AM, TetraSky said:

I can see why they would want to do this. Especially apps that rely on subscriptions and the likes, to stop modified apps that removes that stuff and enables subscription perks for free.

If someone is able to crack the app to remove these checks they are also likely able to remove the sideload check...

[williamcll]

6 hours ago, Sauron said:

If someone is able to crack the app to remove these checks they are also likely able to remove the sideload check...

Not that easy, unless you're rooted sometimes you need to go through a lot of anti-verification workarounds.

[LAwLz]

Just want to add that according to the Google specification, Google is strongly advicing phone manufacturers to not let users disable this globally. However, the same spec also dictates that phone manufacturers must let users disable this feature on an app by app basis. 

 

In other words, you will have the option to disable this block for an app if you really want to. 

[ImorallySourcedElectrons]

On 9/12/2024 at 1:42 AM, Mark Kaine said:

true... but if they do that's one step more towards losing the whole European market, because that would be almost certainly against a plethora of anti competitive rules.

 

Sure that might not stop them, its still a very big step into that direction considering recent rulings and laws. 

Enforcement typically takes years, the damage is long done by then and plenty of profits were made.