Technology @lemmy.world lemme in @lemm.ee 2 mo. ago

Android apps are blocking sideloading and forcing Google Play versions instead

arstechnica.com Android apps are blocking sideloading and forcing Google Play versions instead

"Select Play Partners" can block unofficial installation of their apps.

You might sideload an Android app, or manually install its APK package, if you're using a custom version of Android that doesn't include Google's Play Store. Alternately, the app might be experimental, under development, or perhaps no longer maintained and offered by its developer. Until now, the existence of sideload-ready APKs on the web was something that seemed to be tolerated, if warned against, by Google.

This quiet standstill is being shaken up by a new feature in Google's Play Integrity API. As reported by Android Authority, developer tools to push "remediation" dialogs during sideloading debuted at Google's I/O conference in May, have begun showing up on users' phones. Sideloaders of apps from the British shop Tesco, fandom app BeyBlade X, and ChatGPT have reported "Get this app from Play" prompts, which cannot be worked around. An Android gaming handheld user encountered a similarly worded prompt from Diablo Immortal on their device three months ago.

Google's Play Integrity API is how apps have previously blocked access when loaded onto phones that are in some way modified from a stock OS with all Google Play integrations intact. Recently, a popular two-factor authentication app blocked access on rooted phones, including the security-minded GrapheneOS. Apps can call the Play Integrity API and get back an "integrity verdict," relaying if the phone has a "trustworthy" software environment, has Google Play Protect enabled, and passes other software checks.

Graphene has questioned the veracity of Google's Integrity API and SafetyNet Attestation systems, recommending instead standard Android hardware attestation. Rahman notes that apps do not have to take an all-or-nothing approach to integrity checking. Rather than block installation entirely, apps could call on the API only during sensitive actions, issuing a warning there. But not having a Play Store connection can also deprive developers of metrics, allow for installation on incompatible devices (and resulting bad reviews), and, of course, open the door to paid app piracy.

251

251 comments

If the Play Store becomes required like that then Android's already-shaky status as an open source base platform is going to go out the window. I'm glad there are non-Google distros of Android but there really needs to be more of a push to make a completely FOSS phone platform.
This seems like a brilliant feature to roll out as they're getting investigated by the DOJ for being a monopoly.
Just the term "side loading" instantly frames installing software on a device you own as something shady.
What is a "trustworthy software environment"?

Does that mean that it will get mad and fail you for having Developer options enabled? Having F-Droid installed? Having it plugged into a computer?
Androids best advantage used to be full control of the device... Those were the days. Then it started with saying they know better than you, then locking you out. Now I'm waiting on a new, better solution.

Honestly it's not like native Linux is too far fetched, but there would have to be a big open source common ground device collaboration.
So the EU's been forcing Apple to allow sideloading and Google goes Nah, it'll be fine?
Google and Apple have come out against legislation that would broaden sideloading rights for smartphone owners, citing security and reliability concerns.

Fuck off google.
What's the point of having an android phone then? I fucking hate android so much, but I only use it, not iOS, because of sideloading. Of If they take that away from us then why not just get an iPhone then? Our only hope is Linux phones picking up a little.
It's not like dedicated people aren't going to be able to just patch out the calls to this API from the apps themselves...

This feels like yet another attempt at DRM that is doing more harm than help.
the google store environment is such a pain, at work we have android based Zebra barcode readers... today when I was sideloading our app one of the devices kept uninstalling it because of google play... what a fucking pain in the ass

only when intune fully took it over did it stop...

DONT MAKE ME LIKE INTUNE GOOGLE.... JFK
I get most of my stuff via F-Droid or I could use Obtainium. My tablet is Google-free. This sounds like my phone should be Google-free as well.
yup they are tightening their grip again
Haha, gross: We can't control the devices we own.
Was always inching closer, but looks like android has fully outstayed its welcome. The revolving door of executives hit its last person with any integrity on the ass on their way out the door.
They’re still pissed that people won’t put up with their shitty YouTube app and use Revanced instead, eh?
I have an android DAP (music player) that runs Android 7. It's a box with a headphone jack (remember those?) and it's sole purpose is to play offline music from an SD card.

I side-loaded a few music players, because there's no way I'm putting my Google password in android 7 in 2024.

I'd be upset if I couldn't side load. These DAPs never have an up to date android.

Let's hope the music apps I use don't block sideloading.

Poweramp won't. Musicolet?
The only reason I'm still sticking with Android is the ability to sideload

I have no reason to use an android if this is the road Google wants to follow and expect my next phone to be an iPhone SE
I just won't use any apps that do this. Simple.
Google Pain Services. Google Pisses Itself API.
Long live custom degoogled ROM.
which cannot be worked around.

Well, at least not without root lol

Root detecting apps to Side loading detecting apps:

First time?
The EU is going to be furious about this
The whole point of #Android is the ability to control your device without #Apple, or #Google, or anyone else dictating your apps and content.

@lemmee_in @android
Well that fucking sucks
gee I wonder how long it will be before I can download the custom patches to get around this
Good that most apps I use now are open source but for those few that I still get from Aurora Store it might be a death sentence but perhaps this API could be spoofed?
I use apps that aren't available in my region for language study, so this could end up being a real problem for me.
OK I'm not going crazy then.
This is stupid. I will dig further into the real impact to Graphene.
Can we do anything ?
Yeah, it happens to Spotify mods as well. This isn't good
Ew. Fuck google
Lucky Patcher?
i JUST started enjoying adfree YouTube via revanced, now it could go away?! fuck lol
I'm pretty new to this sort of stuff. I was planning to buy Google Pixel 8 sometime in November when they usually have sales. And install GrapheneOS. I never used this type of stuff before.

So will I have some trouble installing some stuff like some of mobile games, banking app, emails, etc? I'm in Canada if this help.
This explains why I couldn’t install retroarch on the GalaxyS24 Ultra of a friend via apk or google play store. Would not work, but somehow the Galaxy store version worked….
App developers need ways to know the app has not been modified in unsanctioned manner, glad to see Android finally catching up on security with integrity checks.

You've viewed 251 comments.