Well if you’re in the US you can head down to your LGS, buy a Glock 19 and do some plinking while you wait for the software to install on your phone :/
I mean, it always starts with an inch but what people dont get is that compared to the 2000’s we are a mile deep and compared to rhe 80’s we are already in a dystopia.
It appears that the “security wait” will be a one time thing when you first allow installing from unverified sources. After enabling it it will remain on indefiniately.
Not quite as bad as I was fearing, but will kinda annoying.
“Not quire as bad”? My dude, you have to ask for permission from a corporation to install an app on your phone that you supposedly own and paid for. On what planet is this not awful?
It looks like a glorified ‘developer mode’ switch that has the 1 day wait to prevent someone from grabbing your phone, turning on sideloading, installing some hazardous app, and then having their way with your info.
This appears to be the best of both worlds.
Like when unlocking your bootloader wiped your info. Just do it first. not a year in to using your device, if thats your plan.
Lmfao. I’ll invent a better way and it will only take me negative 50 years to do it.
Passcode.
There is absolutely nothing positive about this. It is only nefarious, full stop. I could open a million dollar restaurant that served microwaved cat shit, but on the menu it’s called “Tbone Steak” and with your logic, people wouldn’t notice the difference.
I agree a day wait is bullshit, but you think a passcode is enough to keep someone from… anything? You can shoulder surf a passcode in no time at all. Hell, it’s not even difficult. Go to a bar, talk someone up, give a legit reason to use someone’s phone, intentionally lock and force a passcode and 99% of people at bars will put their pin in within eyesight, or tell you the code.
A passcode isn’t as big a deterrent as most people seem to think it is. It’ll keep you out of an unattended phone you found, but there are plenty of ways to socially engineer your way into having it for the vast majority of targets.
And yes, you likely wouldn’t give your passcode out. But this is how a number of ne’er-do-wells got unfettered access to hundreds of iPhones, and prompted Apple to put a semi similar 24 hour lock on certain security actions if you aren’t in a “known to the phone” location (somewhere you frequent like home or work).
Edit to note: passwords aren’t much better. One of my hobbies in college was shoulder surfing classmates passwords just to repeat it back to them later in the day. Though on a phone you have far fewer reasons to type in an associated accounts password.
Technically installing an app allows continuous spying instead of one-time offloading. It’s an actual consideration with spyware like Pegasus: it might’ve been used as a bug to listen to offline conversations.
Sure. Because as we know people grabbing your unlocked phone to sideload apps onto it is an almost daily occurrence. Which of us hasn’t had a stranger install a cryto miner while we looked away for a second.
Get real. This is an imaginary problem affecting the 0.01% they are using to tell you this action is justifiable. Getting more control is the aim of their game
Until you have to help someone install an app not available to them.
Xfinity stream for example is not on the Chromecast play store, even though an Android build exists on the Fire TV store. I had to guide my dad through this. In this case it wouldn’t be possible for 24 hours.
Had a similar issue with an app not available in a friend’s region.
I could live with the whole flow minus the delay. This is shit, just pure shit.
I think it is a reasonable compromise. They could have made it a day wait for any and every time you wanted to side load like this. It prevents accidental or malicious activation, while also giving you the feature you want with the smallest of roadblocks as confirmation you want it. And you only have to do it one time. I don’t think it’s the burden you do.
People this willing to let a self-enriching corporate nanny state erode their ability to use the products they paid for terrify me.
People this willing to fall for the blatant corporate strategy of “We’ll announce something unthinkable but then backpedal to something “only” terrible (and then probably do the unthinkable thing later now that we’ve encroached further and softened the blow)” for the millionth time confound me.
Show some dignity; jesus christ. This isn’t a “compromise”. Me breaking into your house, threatening to kill you, but then “only” hitting you with a bat and leaving isn’t a “compromise”.
In the sales world, this effect is called “price anchoring” and is used by tons of companies. All those sales you see where something is “marked down 50%!” are using a manufacturers price that does exist in real life to get that 50% markdown. In reality, the sale price is just the actual price of the item but people see the “huge discount” and think they’re getting a deal.
Yup. I’ve heard this first about Home Assistant, but software like this often inadvertently acts like a pacifier for tech enthusiasts. We may have our neat solution for the moment and be content with that, but that doesn’t help anyone else, or us in the long term. Things will get worse with no push-back.
Disclaimer: That’s not to say that we shouldn’t advocate for those tools in the meantime as well. We just shouldn’t lose track of the actual problem.
This is a basic balance between the needs of the few, and the security of the many. The benefits of a one day speed bump are far more beneficial for the billions of Android users in the world, and offer no meaningful negatives to those that wish to enable this feature beyond that delay.
I realize that many people here are in or adjacent to IT work, and so are more passionate about these sorts of topics and are well versed in the risks, but in my opinion, allowing a simple, immediate way to bypass all security checks and install whatever you want immediately is a pretty big security hole, even if it is self-created. It makes sense to put those roadblocks up to protect the 99.9% that will never use this feature, as well as those that may activate it not understanding the risk. You may be comfortable with it, and that’s great, but that doesn’t mean every Android should. This is why prompts asking about coercion and not your IT prowess.
Finally. your example is poor. Google is not breaking into your phone and hurting you in way. If anything, it’s like a real estate agent that’s not giving you the keys until the bank opens so your check can clear. It’s a process issue, nothing more.
Your ability to use your device, as you see fit, installing anything you want, is entirely possible with a single one-day delay. As I said, I don’t think it is an unreasonable ask, nor the enormous inconvenience you make it out to be.
It will likely have that effect on some, yes. It will also prevent it from being enabled without knowing the full scope of your ask. But that’s kind of the point— it’s a big deal, and the user should be informed. Not everyone is capable of understanding these decisions immediately and accurately assessing risk.
At some point, there is always, always a compromise between user experience and security, and not everyone is going to like it. But in this instance, I think the benefits of having this process and cool-down period to make the risks known far outweigh the need for immediate gratification by the minority of users that will enable and use this feature.
Obviously we need to find a middle ground between owning the things we purchase, and not owning them. Having access, but making it annoying is a very reasonable option.
Why? We are paying full price for these devices and nothing in any agreement made at the time of purchase suggests that you don’t own them. Why is it necessary to meet a middle ground between “you got what you paid for” and “you didn’t”?
A reasonable compromise would be not telling people what they can and can’t do on devices they paid for. If Google wants that level of control, they can buy my phone for me.
While I understand your sentiment, with all due respect, they are giving you the control with this process. You’re only mad you have to wait one day one time before you can do it.
I don’t have to do shit, because I Graphene for the same reason I use Linux. I’m not interested in asking a corporation for permission to do what I want.
A one day wait period to install an app on your mobile pocket computer. Fucken bullshit.
Edit: to all the “its one time” defenders, its one time for now. Stop falling for it. It always starts with an inch.
Well if you’re in the US you can head down to your LGS, buy a Glock 19 and do some plinking while you wait for the software to install on your phone :/
sushhh… the shareholders’ imaginary line has to go up.
I mean, it always starts with an inch but what people dont get is that compared to the 2000’s we are a mile deep and compared to rhe 80’s we are already in a dystopia.
It used to be no time at all. You could just do it. From that perspective they’ve already taken a mile.
From zero to any nonzero value is infinite miles
It appears that the “security wait” will be a one time thing when you first allow installing from unverified sources. After enabling it it will remain on indefiniately.
Not quite as bad as I was fearing, but will kinda annoying.
“Not quire as bad”? My dude, you have to ask for permission from a corporation to install an app on your phone that you supposedly own and paid for. On what planet is this not awful?
This is happening to PCs now too, eg. with the OS ‘age-gating’ laws that IMO only exist to quell competition for MS, Google, and Apple.
It looks like a glorified ‘developer mode’ switch that has the 1 day wait to prevent someone from grabbing your phone, turning on sideloading, installing some hazardous app, and then having their way with your info. This appears to be the best of both worlds.
Like when unlocking your bootloader wiped your info. Just do it first. not a year in to using your device, if thats your plan.
Lmfao. I’ll invent a better way and it will only take me negative 50 years to do it.
Passcode.
There is absolutely nothing positive about this. It is only nefarious, full stop. I could open a million dollar restaurant that served microwaved cat shit, but on the menu it’s called “Tbone Steak” and with your logic, people wouldn’t notice the difference.
Okay, pump the breaks a second.
I agree a day wait is bullshit, but you think a passcode is enough to keep someone from… anything? You can shoulder surf a passcode in no time at all. Hell, it’s not even difficult. Go to a bar, talk someone up, give a legit reason to use someone’s phone, intentionally lock and force a passcode and 99% of people at bars will put their pin in within eyesight, or tell you the code.
A passcode isn’t as big a deterrent as most people seem to think it is. It’ll keep you out of an unattended phone you found, but there are plenty of ways to socially engineer your way into having it for the vast majority of targets.
And yes, you likely wouldn’t give your passcode out. But this is how a number of ne’er-do-wells got unfettered access to hundreds of iPhones, and prompted Apple to put a semi similar 24 hour lock on certain security actions if you aren’t in a “known to the phone” location (somewhere you frequent like home or work).
Edit to note: passwords aren’t much better. One of my hobbies in college was shoulder surfing classmates passwords just to repeat it back to them later in the day. Though on a phone you have far fewer reasons to type in an associated accounts password.
If they’re already into your phone there’s so many legitimate ways to extract your data. The ability to sideload an app won’t impact that.
Technically installing an app allows continuous spying instead of one-time offloading. It’s an actual consideration with spyware like Pegasus: it might’ve been used as a bug to listen to offline conversations.
The OS is the spyware, they’re ensuring you cannot remove it.
Sure. Because as we know people grabbing your unlocked phone to sideload apps onto it is an almost daily occurrence. Which of us hasn’t had a stranger install a cryto miner while we looked away for a second.
Get real. This is an imaginary problem affecting the 0.01% they are using to tell you this action is justifiable. Getting more control is the aim of their game
Oh yeah, because those guys seriously can’t wait a day
This has nothing to do with security
So this feature is disabled if you have a pin?
Until you have to help someone install an app not available to them.
Xfinity stream for example is not on the Chromecast play store, even though an Android build exists on the Fire TV store. I had to guide my dad through this. In this case it wouldn’t be possible for 24 hours.
Had a similar issue with an app not available in a friend’s region.
I could live with the whole flow minus the delay. This is shit, just pure shit.
One day wait period to enable installing third party apps. Afterwards no extra wait time or verification.
For now. Don’t fight to give them an inch
I think it is a reasonable compromise. They could have made it a day wait for any and every time you wanted to side load like this. It prevents accidental or malicious activation, while also giving you the feature you want with the smallest of roadblocks as confirmation you want it. And you only have to do it one time. I don’t think it’s the burden you do.
People this willing to let a self-enriching corporate nanny state erode their ability to use the products they paid for terrify me.
People this willing to fall for the blatant corporate strategy of “We’ll announce something unthinkable but then backpedal to something “only” terrible (and then probably do the unthinkable thing later now that we’ve encroached further and softened the blow)” for the millionth time confound me.
Show some dignity; jesus christ. This isn’t a “compromise”. Me breaking into your house, threatening to kill you, but then “only” hitting you with a bat and leaving isn’t a “compromise”.
In the sales world, this effect is called “price anchoring” and is used by tons of companies. All those sales you see where something is “marked down 50%!” are using a manufacturers price that does exist in real life to get that 50% markdown. In reality, the sale price is just the actual price of the item but people see the “huge discount” and think they’re getting a deal.
Long live lineagos
Things like LineageOS are a workaround, not a solution.
The solution has to be legal, not technical. Companies have to be stopped from trying to fuck with users’ property rights in the first place!
Yup. I’ve heard this first about Home Assistant, but software like this often inadvertently acts like a pacifier for tech enthusiasts. We may have our neat solution for the moment and be content with that, but that doesn’t help anyone else, or us in the long term. Things will get worse with no push-back.
Disclaimer: That’s not to say that we shouldn’t advocate for those tools in the meantime as well. We just shouldn’t lose track of the actual problem.
People get what they pay for.
Hyperbole much?
This is a basic balance between the needs of the few, and the security of the many. The benefits of a one day speed bump are far more beneficial for the billions of Android users in the world, and offer no meaningful negatives to those that wish to enable this feature beyond that delay.
I realize that many people here are in or adjacent to IT work, and so are more passionate about these sorts of topics and are well versed in the risks, but in my opinion, allowing a simple, immediate way to bypass all security checks and install whatever you want immediately is a pretty big security hole, even if it is self-created. It makes sense to put those roadblocks up to protect the 99.9% that will never use this feature, as well as those that may activate it not understanding the risk. You may be comfortable with it, and that’s great, but that doesn’t mean every Android should. This is why prompts asking about coercion and not your IT prowess.
Finally. your example is poor. Google is not breaking into your phone and hurting you in way. If anything, it’s like a real estate agent that’s not giving you the keys until the bank opens so your check can clear. It’s a process issue, nothing more.
Your ability to use your device, as you see fit, installing anything you want, is entirely possible with a single one-day delay. As I said, I don’t think it is an unreasonable ask, nor the enormous inconvenience you make it out to be.
I don’t need google telling me what I can put on this fucking phone I bought and paid for.
And they’re not. Load all the unsigned stuff you want after you wait one day. Again, I don’t see how this is a huge burden to ask.
It sure is a completely unnecessary burden designed as a deterrant.
It will likely have that effect on some, yes. It will also prevent it from being enabled without knowing the full scope of your ask. But that’s kind of the point— it’s a big deal, and the user should be informed. Not everyone is capable of understanding these decisions immediately and accurately assessing risk.
At some point, there is always, always a compromise between user experience and security, and not everyone is going to like it. But in this instance, I think the benefits of having this process and cool-down period to make the risks known far outweigh the need for immediate gratification by the minority of users that will enable and use this feature.
What is it a compromise between? People who think they own the thing they paid for and people who don’t?
Obviously we need to find a middle ground between owning the things we purchase, and not owning them. Having access, but making it annoying is a very reasonable option.
I realize you are making a joke, and I agree that purchase is always better than subscription. Everyone in this situation owns their device.
But that doesn’t mean an easy to activate security bypass should be made available to everyone with no guardrails, either, should it?
Why? We are paying full price for these devices and nothing in any agreement made at the time of purchase suggests that you don’t own them. Why is it necessary to meet a middle ground between “you got what you paid for” and “you didn’t”?
that was a very obvious joke
Because everything must get worse.
A reasonable compromise would be not telling people what they can and can’t do on devices they paid for. If Google wants that level of control, they can buy my phone for me.
While I understand your sentiment, with all due respect, they are giving you the control with this process. You’re only mad you have to wait one day one time before you can do it.
I don’t have to do shit, because I Graphene for the same reason I use Linux. I’m not interested in asking a corporation for permission to do what I want.
No. Fuck all of that. I will not have some fucking Corp tell me what I can install and when on my own goddamn hardware.
If they want to implement something like this, make it an opt-in toggle during device setup to put the phone into nanny mode