|
|
Log in / Subscribe / Register

Google details new 24-hour process to sideload unverified Android apps (Ars Technica)

[Posted March 19, 2026 by corbet]

Ars Technica describes the ritual that will be required before a future Android device will deign to install apps from somewhere other than the Play Store. It is not for the impatient.

Here are the steps:

  • Enable developer options by tapping the software build number in About Phone seven times
  • In Settings > System, open Developer Options and scroll down to "Allow Unverified Packages."
  • Flip the toggle and tap to confirm you are not being coerced
  • Enter device unlock code
  • Restart your device
  • Wait 24 hours
  • Return to the unverified packages menu at the end of the security delay
  • Scroll past additional warnings and select either "Allow temporarily" (seven days) or "Allow indefinitely."
  • Check the box confirming you understand the risks.
  • You can now install unverified packages on the device by tapping the "Install anyway" option in the package manager.

to post comments

Wtf

Posted Mar 19, 2026 19:34 UTC (Thu) by mb (subscriber, #50428) [Link] (171 responses)

>Wait 24 hours

What the actual fuck, Google.
I am not an idiot although you clearly think I am.

Wtf

Posted Mar 19, 2026 19:38 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (161 responses)

This is to protect against scams that happen all over Asia, where people are tricked into installing malware.

I think this is too excessive, but as long as they don't block third-party package managers, it's a good compromise.

Wtf

Posted Mar 19, 2026 20:09 UTC (Thu) by mb (subscriber, #50428) [Link] (157 responses)

Why not wait a week? Or a year? Just to protect stupid people from doing stupid things.
It's a good thing!
Can we install such a mandatory wait thing for the US administration?
I would really appreciate it.

I'm not an idiot, though.
Thanks for the attempt to protect me, but I don't need it.

Wtf

Posted Mar 19, 2026 20:23 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (97 responses)

Perhaps you don't understand what is happening in a lot of countries. At this point, in many places _any_ phone call from an unknown number is a scam. And it's really common for scammers to trick the victim into installing malware. It has become so entrenched that there are criminal gangs that traffic people into illicit "call centers" to run scams: https://www.forbes.com/sites/steveweisman/2026/02/21/un-r...

We're talking about people who have never had any computing device other than their phones, in countries with weak law enforcement. In these countries, scammers can trivially buy _all_ the information about their victims. Up to and including their food delivery history.

I dislike limitations on personal computing devices, but I dislike technologies that help enable human trafficking.

Wtf

Posted Mar 19, 2026 20:36 UTC (Thu) by dskoll (subscriber, #1630) [Link] (53 responses)

But do you think that all the other steps (having to enable developer mode, etc, etc) are insufficient protection? Especially if, when doing it, the device warns that if you have been asked to perform these steps by someone else, then you're being scammed?

Wtf

Posted Mar 19, 2026 21:17 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (5 responses)

They clearly are.

> Especially if, when doing it, the device warns that if you have been asked to perform these steps by someone else, then you're being scammed?

A common tactic is a call from "<your bank name> security service" telling you that your account was compromised by malware on your phone and that you need to remove it NOW. And unlike the calls in the US, the scammer will know all your details because somebody in your bank leaked your statements.

I think that this requirement is a good compromise that can help solve the issue.

Wtf

Posted Mar 20, 2026 10:17 UTC (Fri) by paulj (subscriber, #341) [Link] (4 responses)

You don't get these messages in the USA?

These are extremely common in Europe now too. Though, they don't have your information. They just send out stuff like this en masse:

"This is <bank name>. There is an issue with your account, please call <number>"

"<tax service name in your country>. Repayment of your <previous tax year> Tax Credit is now due. Verify your details at <bogus URI> to complete your repayment". (got this other day)

"Dad, I've got a new number. Can you save it and whatsapp me?"

etc. etc. The creativity is endless. Specific details, where included, will be wrong in many cases, but they're still general enough to apply to many. What the regulator here has done is require that all companies that send out bulk messages are now required to register themselves and their numbers in a national database, and telcos and other messaging operators in the country are required to put "Likely Scam" in the Caller-ID or at the top of messages for any bulk messages from numbers not registered.

So my phone helpfully now files many of these messages under "Likely Scam" - including many from non-scam senders. ;)

Wtf

Posted Mar 20, 2026 22:15 UTC (Fri) by cpitrat (subscriber, #116459) [Link] (2 responses)

And I'm sure the scammer will not think of calling back after 24h if they managed to get the person to do all the steps up to the wait.

Why the delay works

Posted Mar 20, 2026 22:21 UTC (Fri) by farnz (subscriber, #17727) [Link]

The reason the scam fails if there's a delay is that in that 24 hour period, the target is quite likely to talk to someone, and to sleep. Both of those activities are strongly correlated with realising that you're in the process of falling victim to a scam, and having you attempt to undo whatever it was the scammer asked you to do.

Thus, when the scammer calls back, they've got to start from scratch, with a target who's now alert to the idea that you're scamming them. That's often enough to stop the scam completely.

Wtf

Posted Mar 20, 2026 22:32 UTC (Fri) by kleptog (subscriber, #1183) [Link]

Sure they will think of that. But in that period the victim will have slept, mentioned it to a few people and twigged to it being a scam.

Additionally, if the scammer placed pressure on the victim to act now, but then is suddenly ok with waiting 24h, that's enough to twig the suspicion of many people.

Most people are not very technically savvy, but the vast majority of people recognise when they're being ripped off, as long as they get a moment to think about it. Even cats and small children can recognise when they're being short-changed, nothing technical about it.

Wtf

Posted Mar 22, 2026 20:47 UTC (Sun) by SLi (subscriber, #53131) [Link]

My favorite attempt was the Nigerian Anti-Fraud Commission wanting to compensate me for losses to scammers. But yes, the problem is real.

Wtf

Posted Mar 19, 2026 21:29 UTC (Thu) by linuxrocks123 (subscriber, #34648) [Link] (46 responses)

Yes. It is. These scams take the form, "We're the police. We're investigating you. Post bail money and install this "tracking" (malware remote control to take more money) app or we're going to come arrest you right now."

Or, "We're the hospital. Your mother fell down the stairs and has a concussion. Send us money through this app or we'll have to put her out on the street."

Or, "We've kidnapped your daughter. Send money to us through this app right now, or we'll do worse than just kill her."

People lose their life savings through this. Real people. People who are not idiots, and who are just like you and me, except maybe they're not tech-savvy, and maybe they're getting on in years and therefore more likely to fall for a scam. And because many developing nations have prioritized payment convenience over fraud management, unlike in the US, the banks don't catch this and they don't get their life savings back.

A 24 hour wait makes it much more likely someone close to the victim will notice what is happening and be able to protect him or her before it's too late. So, am I willing to wait 24 hours when I buy a new phone to be able to sideload my favorite OpenStreetMap GPS application, when the benefit is that someone I've never met doesn't get his or her life savings stolen by the scum of the Earth? Yes. Yes, I absolutely am.

Wtf

Posted Mar 19, 2026 21:36 UTC (Thu) by mb (subscriber, #50428) [Link] (29 responses)

>We've kidnapped your daughter. Send money to us through this app right now, or we'll do worse than just kill her

Your answer to this is to side load an app instead of calling the actual police?

Wtf

Posted Mar 19, 2026 22:11 UTC (Thu) by malmedal (subscriber, #56172) [Link] (27 responses)

> Your answer to this is to side load an app instead of calling the actual police?

Let me recommend you try traveling a bit in a developing country and talk to the locals. You'll learn why the locals are careful about talking to the police.

Wtf

Posted Mar 19, 2026 22:20 UTC (Thu) by mb (subscriber, #50428) [Link] (26 responses)

Ok. Why do I have this restriction in my country?

Wtf

Posted Mar 19, 2026 22:25 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link]

This is a far more reasonable question to ask Google.

Wtf

Posted Mar 19, 2026 23:01 UTC (Thu) by malmedal (subscriber, #56172) [Link] (3 responses)

Much more reasonable question.

Don't know, but I've noticed that if you use an e-sim from another country for some things it looks to the phone like it is physically in that country, so perhaps that.

Or, more likely, it could be simply that Google does not trust itself to get the per-country restrictions right. E.g. when they released Gemini it was not supposed to be available in the EU, but the announcement said you could use it in the Faroe Islands, Åland etc.

Maybe yet more likely is that the richer and more peaceful countries are where the most gullible victims are...

Wtf

Posted Mar 19, 2026 23:05 UTC (Thu) by mb (subscriber, #50428) [Link] (1 responses)

Or, more likely, Google just wants to restrict what can be "sideloaded" besides their PlayStore?
Google is becoming Apple.

Wtf

Posted Mar 19, 2026 23:25 UTC (Thu) by malmedal (subscriber, #56172) [Link]

That was the original plan, this 24h wait is them backtracking a little bit.

Wtf

Posted Mar 22, 2026 12:40 UTC (Sun) by mnohime (subscriber, #174134) [Link]

> Or, more likely, it could be simply that Google does not trust itself to get the per-country restrictions right. E.g. when they released Gemini it was not supposed to be available in the EU, but the announcement said you could use it in the Faroe Islands, Åland etc.

Faroe Islands are not in the EU and Åland Islands are outside the EU in some respects.

Wtf

Posted Mar 20, 2026 6:58 UTC (Fri) by lutchann (subscriber, #8872) [Link] (1 responses)

The "feature" is getting rolled out in scam-heavy countries first, rather than US, etc, but in the long run I imagine Google does not want to have to appear at a Congressional hearing to explain why users in India have better protection against scammers than Grandma in Iowa.

I share your frustration that we've been gradually losing control over our own computing devices for, oh, 50+ years now, but I'm grateful that Google is trying to address our concerns, given that we're a tiny fraction of their customer base.

Wtf

Posted Mar 20, 2026 8:29 UTC (Fri) by taladar (subscriber, #68407) [Link]

Judging by my email inbox the US is a scam-heavy country, at least in terms of victims of scams. Most scam emails seem to target naive US citizens.

Wtf

Posted Mar 20, 2026 9:17 UTC (Fri) by kleptog (subscriber, #1183) [Link] (3 responses)

Even in my rich western country, there is a daily payment limit from your bank account to unknown other accounts where you need a 4 hour delay to raise it temporarily. Precisely because people are easily placed under pressure to pay their life savings to this east European bank account Right Now or Something Terrible Will Happen. I know several people who have been scammed this way, including young people you'd think would know better. I don't think you really know how this feels until you've experienced it.

The banks have figured out that 4 hours is long enough that people get a chance to think about it, perhaps place a few calls to verify and realise it's an actual scam. But short enough it's not a big issue. It's very hard to keep people under pressure remotely for 4 hours straight. And more importantly, legit institutions are aware of the limit and won't try to pressure you that way.

Yes, if you think you're immune can remove the limit forever (with a 4 hour wait). But even I don't trust myself that much. How often do you make large payments anyway?

Wtf

Posted Mar 20, 2026 12:44 UTC (Fri) by NAR (subscriber, #1313) [Link] (2 responses)

I know several people who have been scammed this way, including young people you'd think would know better.

I believe Cory Doctorow mentioned in one of his talks that even he got scammed once. Somebody asked for the last 4(?) digits of his credit card, he gave it, then later realized that the first 12 digits were fixed by the bank, so the scammer needed only the last 4. Or something like that, I may misremember the details.

It's not a question of intelligence, it could be a weak moment when a person is tired or under some kind of stress, concentration slips, etc.

Wtf

Posted Mar 25, 2026 15:40 UTC (Wed) by stevie-oh (guest, #130795) [Link] (1 responses)

> then later realized that the first 12 digits were fixed by the bank, so the scammer needed only the last 4. Or something like that, I may misremember the details.

I think you've got it backwards.

The following is not 100% true in 2026 but is still mostly accurate:

A 16-digit PAN (Primary Account Number) has three parts:

1. A 6-digit BIN (Bank Identification Number), used by the credit card network to route transactions to the correct bank
2. A 9-digit account number
3. A check digit (to detect common miskeys)

Between PCI (credit card) security requirements and US and other laws, the last 4 digits of the PAN are generally available without significant restrictions (on receipts/statements, in e-mails) while the first 6 and last 4 are frequently visible on-screen to employees.

As such, it's far more likely that the scammer got hold of a receipt/email containing the last 4, then asked him for the first twelve digits.

Wtf

Posted Mar 25, 2026 16:06 UTC (Wed) by Wol (subscriber, #4433) [Link]

I think NAR did get it approximately right, iirc ...

You said

> The following is not 100% true in 2026 but is still mostly accurate:

and I think for *this particular instance* your generalisation is 100% wrong - CD's number did not fit your pattern. Something like that, anyway ...

Cheers,
Wol

Wtf

Posted Mar 20, 2026 16:00 UTC (Fri) by marcH (subscriber, #57642) [Link] (14 responses)

If you are so smart, why are you even running stock Android in the first place? There are many alternatives.

Stock Android is designed for the majority of the world population = billions of people. That includes a lot of potential scam victims. Including many people in rich countries and including even people reading LWN. As others have explained, some amazing social engineering tactics exist and they are getting more and more profitable with the help of AI. Tech savviness helps but it's not a silver bullet, no one is 100% immune.

Wtf

Posted Mar 20, 2026 16:18 UTC (Fri) by mb (subscriber, #50428) [Link] (13 responses)

> why are you even running stock Android in the first place? There are many alternatives

You must be trolling.

Wtf

Posted Mar 20, 2026 17:10 UTC (Fri) by marcH (subscriber, #57642) [Link] (12 responses)

https://www.google.com/search?q=degoogled+phone

Getting more and more attention considering these:
https://www.politico.eu/article/us-congress-judiciary-com...

Wtf

Posted Mar 20, 2026 17:15 UTC (Fri) by mb (subscriber, #50428) [Link] (10 responses)

Ok. A degoogled phone is useless for many many reasons.
If there was an alternative, I would already use it, of course.

Google is actively locking down the only viable Android, and they know that very well. It's on purpose.
And they will continue doing that.
The 24h delay is just yet another brick in the wall. Step by step.

Wtf

Posted Mar 20, 2026 18:00 UTC (Fri) by marcH (subscriber, #57642) [Link] (2 responses)

> Ok. A degoogled phone is useless for many many reasons.

Either you're in control of the security of your phone, or Google is. The same product can't do both at the same time, that's the perfect recipe for a security disaster. That 24h switch looks like a very good trade-off.

> Google is actively locking down the only viable Android, and they know that very well. It's on purpose. And they will continue doing that.
> The 24h delay is just yet another brick in the wall. Step by step.

Yes but not like this. The much more concerning issue is that Android is less and less open-source which makes degoogled phones (or even: Android competition!) harder and harder. _That_ is the real issue. From that control perspective, that 24h timer is anecdotical, a tempest in a teapot.

Wtf

Posted Mar 20, 2026 18:15 UTC (Fri) by mb (subscriber, #50428) [Link] (1 responses)

>_That_ is the real issue

There can only be one real problem at any given time?

Wtf

Posted Mar 20, 2026 19:13 UTC (Fri) by marcH (subscriber, #57642) [Link]

How's your strawman doing?

Wtf

Posted Mar 21, 2026 5:52 UTC (Sat) by donbarry (guest, #10485) [Link] (1 responses)

Is it? I've been running deGoogled Cyanogenmod/LineageOS pretty much since I had a smartphone, 16 years now. I much prefer my GNU+Linux computer anyway. But my phone does what I need a mobile device to do. Others are just now figuring out how untrustworthy Google is. I never bought the "don't be evil' shtick from the start. Having just had to wait 7 *days* for Motorola to let me unlock the bootloader for my latest hardware update, and a process byzantine enough that it is clearly determined to dissuade, I'm all the more determined to keep my freedom to conduct general purpose computing on all my devices.

Wtf

Posted Mar 21, 2026 14:08 UTC (Sat) by Wol (subscriber, #4433) [Link]

Plus one ...

I think I got my first mobile phone late last century (so it wasn't googled at all :-)

Since then, what do I actually need Google FOR? I can't be bothered to de-google it, but I doubt I'd even notice (or indeed, I might well notice - I would love to be able to tell Android to lie to all these apps pestering me for permissions they don't need, and I don't want to grant ...)

No I DON'T want to know what my family are up to 24/7
No I DON'T want adverts every day for a shop I rarely visit
No I DON'T want the latest news every five minutes
No I DON'T WANT MY PHONE PESTERING ME!

Cheers,
Wol

Wtf

Posted Mar 22, 2026 9:43 UTC (Sun) by thoeme (subscriber, #2871) [Link] (1 responses)

There is a long article in Heise News (and a corresponding "Password" podcast episode) about GrapheneOS, which seems paranoid about security, but still allows an only slightly limited daily operation. The drawback is that it only runs on Pixel phones which need to be supported by Google, so its not about prolonging your device' useful life.

Wtf

Posted Mar 23, 2026 12:08 UTC (Mon) by paulj (subscriber, #341) [Link]

We will hopefully see GrapheneOS supported on some Motorola phones at some point in the future. Hopefully sooner rather than later.

Wtf

Posted Mar 23, 2026 12:06 UTC (Mon) by paulj (subscriber, #341) [Link] (2 responses)

> A degoogled phone is useless for many many reasons.

That is news to me. Been using them for years, mostly without issue. Yes, there are the odd apps that refuse to run, but both my banks' apps work, as does everything else I need. The only app that bothers me that doesn't work is Twitter, which recently (couple of months ago) started to refuse to work, but... a) there are 3rd party apps (not 100% of the features) and b) it's actually doing me a favour by putting a barrier up to my spending time on that brainrot. ;)

As a bonus, my phone isn't shovelling tonnes of data about my location, use and habits to Google and dozens (if not hundreds) of other spyware-business-model big-tech entities.

Wtf

Posted Mar 23, 2026 15:13 UTC (Mon) by marcH (subscriber, #57642) [Link] (1 responses)

> As a bonus, my phone isn't shovelling tonnes of data about my location, use and habits to Google and dozens (if not hundreds) of other spyware-business-model big-tech entities.

I helped a non-technical friend install LineageOS. He simply cares about his privacy, unlike the vast, lazy majority of us. He's been very happy with it. Yes, some apps don't work and he has to use a computer instead of those. He thinks that's a small price to pay for not "being the product". As a bonus, he saved an old Samsung phone from going to the landfill and didn't generate the large pollution to manufacture a new one. With limited usage he can make the battery last for... a week! Instead of a day with the stock Android spyware we all use. That says a lot.

There are millions of people using "degoogled" phones; LineageOS is just one of the options. Millions is very small compared to billions but that is still a very big number. There are trade-offs but it's obviously not useless at all and that is _actual_ control on your phone.

Wtf

Posted Mar 23, 2026 16:11 UTC (Mon) by anselm (subscriber, #2796) [Link]

There are millions of people using "degoogled" phones; LineageOS is just one of the options. Millions is very small compared to billions but that is still a very big number. There are trade-offs but it's obviously not useless at all and that is _actual_ control on your phone.

I'm using GrapheneOS and that seems to work just fine with all the banking apps, etc., that I've thrown at it so far. The Google Play stuff is confined in a separate user profile and only runs when it is actually being used, not all the time in the background. 95% of the time I'm using the phone with a profile where the Google Play stuff isn't even available.

Wtf

Posted Mar 20, 2026 19:24 UTC (Fri) by dagobayard (subscriber, #174025) [Link]

Any that I can buy other than on Amazon or EBay? Let's add `-site:amazon.com` to that query. I have tried it too many times.

Wtf

Posted Mar 19, 2026 22:52 UTC (Thu) by pmallory (subscriber, #122252) [Link]

These scams work by instilling a sense of urgency that prevents the victim from thinking rationally. Salesmen use similar techniques. These techniques work. Not on everyone, but on a big enough fraction to make the scheme viable.

This sets aside the issue that useful police aren't universally available to begin with. Victims don't even have any legal recourse after the fact, from what I've heard from coworkers whose family back home have been scammed.

I'm extremely sympathetic to the desire to run the software of my choosing on computers that I own, without hassle. I don't think there is a trivial answer to the ethnical question how Google should accommodate our "happy path" user journey while mitigating this type of scam. Mitigating this somehow does seem like a worthy goal.

Wtf

Posted Mar 20, 2026 4:22 UTC (Fri) by rsidd (subscriber, #2582) [Link] (13 responses)

Many educated and well-off people in India have fallen to an absurd scam called a "digital arrest". The government has tried to send messages to all mobile users, via SMS etc, that there is no such thing as a digital arrest. Media have extensively covered such scams. Despite that, when told that they are under "digital arrest" and asked to sit in front of their computer or phone with their camera on for hours, people have done that. Because the trust in police is very low, awareness of rights is even lower, and bullshit detection sense almost non-existent.

Anyway, yes, malware scams are common too.

Wtf

Posted Mar 20, 2026 8:15 UTC (Fri) by gspr (subscriber, #91542) [Link] (12 responses)

> Because the trust in police is very low,

I'm sorry, but I don't follow how low trust in an institution increases the likelihood of imposters pretending to be that institution being followed blindly. You'd think it would be the opposite, no? That in countries where people do trust the police, they'd be more likely to believe that the police want you to sit still in front of your computer?

> awareness of rights is even lower, and bullshit detection sense almost non-existent.

This is obviously a serious problem, and I don't mean to mock it, but: is a *technical* solution really what's needed here? Even disregarding the hundreds of millions who needlessly gets the technical solution forced upon them – is it not incredibly patronizing for a tech company to try to patch over a serious societal issue by treating the members of that society as a danger to themselves? As incapable of owning their own devices without sleeping on it first?

Low trust increasing the chance of obeying an impostor

Posted Mar 20, 2026 9:05 UTC (Fri) by farnz (subscriber, #17727) [Link] (2 responses)

In a country with high trust in the institution of the police, you know that if it was an actual officer ordering you to sit still in front of the computer, the worst case outcome from calling the local equivalent of 911 and asking if you can stop now is someone telling you that it was a legitimate demand from an officer, not a crime, and the best case is being told to stop doing it and someone coming out to talk to you with a view to investigating the officer in question.

Similarly, if you disobey the officer by walking into a manned police station, and ask to be put in their cells for the arrest period, the worst that happens is that they put you in their cells, and the best case is that they laugh and tell you that there's no such thing as a digital arrest and you walk out free.

In a country with low trust, you expect the worst case to be the emergency operator notifying the police that you've questioned their authority, and thus getting you into more trouble - maybe a beating, maybe a further arrest, and the best case is that you're told to just respect the police's authority and do as you're told. Worse, you also expect that if you disobey the officer, you'll get a beating, or if you go to the police station, they'll give you a beating for being dumb enough to believe the lie - or even arrest you properly "to teach you not to waste their time".

Low trust increasing the chance of obeying an impostor

Posted Mar 20, 2026 9:34 UTC (Fri) by gspr (subscriber, #91542) [Link] (1 responses)

These are fair points. But to me, it sounds more like they're pertaining to a *corrupt* police force, rather than one that enjoys little trust from society. Of course, the former may be a reason for the latter – but the actual problem is that the police are corrupt and might beat you for checking their identity, not that you felt the need to check their identity in the first place.

Low trust increasing the chance of obeying an impostor

Posted Mar 23, 2026 9:01 UTC (Mon) by MarkVandenBorre (subscriber, #26071) [Link]

The nuance is slightly different and broader. The powers that be are untouchable and unaccountable, or at least perceived to be so. In a low trust society, you are trained to not look for trouble by interacting with these forces as little as possible. They often bite ruthlessly before they bark.

The closest analogy I have found in my native generally high trust Belgium is being forced to deal with the tax authorities. "Oh, but I've done everything right." Yes, but they can still make your life miserable because they don't believe you. They can bury you in procedural load. They will find some arcane requirement you haven't followed to the letter. Etcetera.

Lack of trust and the resulting lack of communication. That is often a very effective attack vector for scammers.

Wtf

Posted Mar 20, 2026 11:19 UTC (Fri) by NAR (subscriber, #1313) [Link] (8 responses)

Even disregarding the hundreds of millions who needlessly gets the technical solution forced upon them – is it not incredibly patronizing for a tech company to try to patch over a serious societal issue by treating the members of that society as a danger to themselves? As incapable of owning their own devices without sleeping on it first?

I doubt there are hundreds of millions users out there who want to install applications outside from Google Play. On the other hand I've just read that one in six(!) bank consumers got scammed and lost money in my country. I am somewhat skeptical about this number, because I don't know anyone personally who got successfully scammed - on the other hand it's not something people are boasting about. There are definitely hundreds of millions people out that who can be easily scammed. Also I see bank implementing delays in transfers - it's a big enough problem to do something about it.

This the very same reason why we have two factor authentication nowadays everywhere - it's fairly easy to trick passwords out of people. My mother told her password to a scammer, thankfully they couldn't login to the bank account. Also, after she put down the phone, she called me immediately - outside of the high pressure situation created by the scammer she could reason clearly and notice that something is wrong.

Wtf

Posted Mar 20, 2026 11:43 UTC (Fri) by mb (subscriber, #50428) [Link] (7 responses)

>one in six(!) bank consumers got scammed

With the use of sideloading?
Yes, many many crimes happen. But unless these can be prevented by restricting sideloading, this is off topic.

Wtf

Posted Mar 20, 2026 12:54 UTC (Fri) by NAR (subscriber, #1313) [Link]

There were no details in the article I've read, but one case study I did read involved a key logger installed ("sideloaded") on the victim's computer. It was a couple of years ago, before most of the online banking was moved to apps.

Wtf

Posted Mar 20, 2026 13:12 UTC (Fri) by higuita (guest, #32245) [Link] (5 responses)

in case you still didn't understand, this is a needed security feature that is perfect to help protect google store profits... just like age verification is great way for facebook track you... but it would not be accepted if sold like that, so it is sold as protect kids

There is a real security need to make side-loading less easy, non-tech savy people can install apps without understanding what they are doing.... but google also is being pushed to open the store and they don't want that. Joining both was perfect for google, can give from one side and take from another!

Now imagine that google didn't also wanted to control the app install, just solve the security problem... just this alone is a hard problem, just warnings do not work, people ignore them, specially if they are under pressure and the other side say "it is ok, just press ok". i would imagine some possible solutions (layers, not one solves all):
- name and icon. this is perfect for AI, if its name is too similar to any existent app. Block if too similar. may require existent apps to actually be renamed as this problem exist already in google store
- no app install during calls
- store signature, each apk need a store signature and yes, google can keep track of valid stores... but also allow say a EU signature repo, japan/south korea or even china repos, to avoid google totally blocking a store by US gov order. user can choose to enable or not other signature repos. This allow brands to have their own app stores too. User can choose also to override trust in any signature (say i want to forbid google signatures, but allow fdroid)
- no side-load without a valid store (ie: allow third party store, but they require above store signatures), except below rules
- adb sideload always possible, mostly for devs
- new key signature load via adb possible
- do not see any way to allow user-enabled side-load that can't be abused, even the 24h delay can be abused with "(call me/i will call you) tomorrow", so the push should be to move the side-load to third party stores and adb requirement as less likely to be mass abused

Wtf

Posted Mar 20, 2026 15:10 UTC (Fri) by intelfx (subscriber, #130118) [Link] (4 responses)

> this is a needed security feature that is perfect to help protect google store profits

This wording was perhaps unintended on your part, but it is in fact brilliant. This is a much-needed security feature, where the thing being secured is Google's profits :-)

Wtf

Posted Mar 20, 2026 16:21 UTC (Fri) by malmedal (subscriber, #56172) [Link] (3 responses)

What's the argument you're making, exactly?

Are you saying the change will not reduce the number of people being scammed?

Are you saying it will help Google and therefore it shouldn't be done regardless of utility?

Something else?

A time-based lockout is not a new idea. It has been successfully used since before computers were invented.

Wtf

Posted Mar 20, 2026 17:12 UTC (Fri) by intelfx (subscriber, #130118) [Link] (2 responses)

> Are you saying <...>

I am saying that "Think of the victims" is the "Think of the children" 2.0. If that doesn't explain it to you, I'm not quite certain what will.

In any case, it is fundamentally pointless to argue with people intent on not seeing the obvious, and I'm not going to waste my time doing that.

Wtf

Posted Mar 20, 2026 17:41 UTC (Fri) by malmedal (subscriber, #56172) [Link]

> "Think of the victims" is the "Think of the children" 2.0

Some of those actually did help, others did not, some even made it worse.

In all cases there would be somebody screaming NO NO NO.

Wtf

Posted Mar 20, 2026 17:56 UTC (Fri) by Cyberax (✭ supporter ✭, #52523) [Link]

Have you considered that some changes might be good overall, even if they are made for less-than-generous reasons? And vice versa.

Wtf

Posted Mar 20, 2026 12:52 UTC (Fri) by LtWorf (subscriber, #124958) [Link] (1 responses)

I have seen plenty of these scams, even know someone who fell for it.

NONE of them involved installing apps from outside the play store. Interestingly some of them involved installing apps that are, to this day, on the play store.

Plus it's google, they've used up all of their goodwill, so the chances they are really doing it to protect the ~~children~~ adults are very slim.

(interestingly one scam involved installing a virus on osx)

Wtf

Posted Mar 23, 2026 10:41 UTC (Mon) by taladar (subscriber, #68407) [Link]

After just uninstalling a dozen very dubious apps that were all in the play store from my dad's phone last weekend (most with names that suggest they clean up your phone or PDF readers, weather apps,...), including some that had spam notifications that immediately reappeared when you dismiss them I have my doubts that apps in the play store are any safer too.

Wtf

Posted Mar 19, 2026 20:40 UTC (Thu) by mb (subscriber, #50428) [Link] (3 responses)

> but I dislike technologies that help enable human trafficking.

So you dislike Debian Linux?
Because it doesn't have idiotic 24h delays that supposedly prevent human trafficking for some unknown reason.

Do you really not see how this is going *way* too far?

> Perhaps you don't understand what is happening in a lot of countries

I do very well understand what's going on in the US at the moment and I do understand why Google wants to do something about idiots because of this.
But what does this have to do with my phone?

Wtf

Posted Mar 19, 2026 21:36 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

If Debian was specifically and directly facilitating a continent-wide scam industry, then yes. I would be very much against it.

Wtf

Posted Mar 20, 2026 9:52 UTC (Fri) by gspr (subscriber, #91542) [Link] (1 responses)

> If Debian was specifically and directly facilitating a continent-wide scam industry, then yes. I would be very much against it.

Let me get this straight: If a continent-wide scam industry decided to base their operations on Debian, you'd be very much against Debian as an operating system and/or project?

Wtf

Posted Mar 20, 2026 16:02 UTC (Fri) by marcH (subscriber, #57642) [Link]

> Let me get this straight:

Fail.

Wtf

Posted Mar 19, 2026 21:16 UTC (Thu) by leromarinvit (subscriber, #56850) [Link] (9 responses)

I think most people will agree that scams are bad, and that human trafficking is worse. But what's the connection to malware? Is it only that getting the victim to install malware is a common goal for scammers? If so, I don't think this 24h wait will do much to help the victims of human trafficking. At best, it would shift their focus to different types of scams.

In any case, I'm wondering how long call centers filled with slaves will be more profitable for those collecting the money than combining LLMs with voice recognition and generation. Even slaves need to eat and sleep somewhere - surely a bunch of GPUs (or even API credits for less-scrupulous cloud providers) must be cheaper in the not-so-long run. Many (most?) will probably be able to tell it's not a human on the other end of the line - but then again, most people will recognize human scammers as well, by what they say more so than how. They make their money on the tiny minority of those who don't.

Wtf

Posted Mar 19, 2026 21:39 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link]

Yes, malware is a typical attack vector, with the aim to spy on one-time passwords.

Wtf

Posted Mar 20, 2026 4:39 UTC (Fri) by wtarreau (subscriber, #51152) [Link] (7 responses)

It's not just a tiny minority. Most people don't *choose* to have a remotely infectable networked computer in their pocket, with all their lives and money on it, yet they're *forced* to by the fading away of local services and the ongoing transformation of the world. Most of them would likely prefer to continue to visit their bank physically once or twice a month to put their salary there or to get a bit of cash to pay their food. Instead they're carrying a spying device in their pocket that smarter people can turn into whatever they want or use to intercept money transfers, and of course there's the ability to trigger money transfers either without the person's consent or by pressuring them. In the real world, these scammers would be welcome with a gun when they knock at the door, but here it's so riskless and easy that companies develop around this profitable activity and they act on a very wide scale. All the conditions are there to exploit this situation to make easy money, so there's no reason it would diminish. Will this hinderance work well enough ? I don't know. At least it will increase the failure rate of these scams, and help people who didn't choose to have their security put at risk by stupid devices they didn't need in the first place but were forced to have.

Wtf

Posted Mar 20, 2026 11:29 UTC (Fri) by Wol (subscriber, #4433) [Link] (5 responses)

> and help people who didn't choose to have their security put at risk by stupid devices they didn't need in the first place but were forced to have.

Which is why all my banking and other sensitive stuff is done on my desktop. My phone has no banking stuff on it at all.

But as wtarreau says, there's this mad rush to force everybody to possess a smartphone and use it for all this dangerous stuff. It's hard to refuse, and an utter nightmare if you're not capable of using a smartphone.

Cheers,
Wol

Wtf

Posted Mar 20, 2026 11:48 UTC (Fri) by mb (subscriber, #50428) [Link]

>Which is why all my banking and other sensitive stuff is done on my desktop

This is *extremely* risky, because you can easily sideload apps on the desktop.
We must immediately force desktop OS vendors to add a sideload delay to protect you.
I mean, this would just annoy you and not protect you at all. But well, all the victims!

Wtf

Posted Mar 20, 2026 11:48 UTC (Fri) by pizza (subscriber, #46) [Link] (1 responses)

> Which is why all my banking and other sensitive stuff is done on my desktop. My phone has no banking stuff on it at all.

I can do everything from my bank's web page in a standard browser (indeed the app is effectively just a thin wrapper around the web site!) ...except make deposits.

And simply having developer mode enabled on the phone is enough to make the app fail to launch (with an error about doing this "for a better user experience")

Wtf

Posted Mar 20, 2026 18:31 UTC (Fri) by lutchann (subscriber, #8872) [Link]

Remember 20 years ago when most of us owned a separate Windows PC (or at least dual booted) because we were occasionally forced to use Microsoft Office or some such Windows-only software? We're getting back to the same situation in which we're forced to own two phones, one that's locked down to run certain apps and a second that we actually use.

In the future we'll look back fondly on this era when we could, for a time, do everything on open devices, much like I look back fondly on the decade or so (in the US at least) between when public places stopped smelling like cigarette smoke before they started smelling like marijuana smoke.

Wtf

Posted Mar 22, 2026 21:04 UTC (Sun) by SLi (subscriber, #53131) [Link] (1 responses)

For 99% of the people who say they trust their desktop security I would bet that their Android or Apple phone is way more secure. You may or may not be in the 1% that most people think they are in. Although I do think any unqualified claim of their desktop being "more secure" is a huge red flag. Most people don't know they're rooted.

Wtf

Posted Mar 23, 2026 15:19 UTC (Mon) by ssmith32 (subscriber, #72404) [Link]

It depends on your threat model. If you're worried about incidental hacking by low-level criminals, yes.

If you're worried about apps harvesting information about you - with almost no ability to gain any insight into the data they're gathering (no root) - and selling it to the highest bidder (e.g. in the U.S., ICE) - no way, no how, you're just wrong.

If you're worried about corporations re-possessing property you've purchased without anything resembling due process (looking at you Amazon Prime Video), well, you're probably better off if they do, but, again, you're wrong.

And, ironically, if it's a government agency, you're probably screwed, but, in the U.S., at least, you're probably better off with anything but Apple or Android, because they'll take so long trying to find the person that understands what they've got that it buys you time.

Wtf

Posted Mar 21, 2026 23:59 UTC (Sat) by roc (subscriber, #30627) [Link]

> Most people don't *choose* to have a remotely infectable networked computer in their pocket, with all their lives and money on it, yet they're *forced* to by the fading away of local services and the ongoing transformation of the world.

Smartphones became incredibly popular very quickly, before that "fading away" happened, so I think it's actually very clear that most people *would* and *did* choose to have a remotely infectable networked computer in their pocket over the existing alternatives.

> Most of them would likely prefer to continue to visit their bank physically once or twice a month to put their salary there or to get a bit of cash to pay their food.

In many countries, you could avoid visiting the bank long before smartphones: have your pay directly deposited to your bank account, and use EFTPOS or credit cards to payments, or visit any ATM to get cash. And we did! Honestly I'm not sure I've ever met anyone who visited their bank branch regularly for pleasure.

Wtf

Posted Mar 19, 2026 22:32 UTC (Thu) by moep (guest, #182840) [Link] (18 responses)

If that would be the reason then I'm confused as to why they haven't announced any actions that hinder that scam model yet. E.g. banning scam or spy apps from their app store.

It's also incredibly easy to handle this suggested 24 wait for the scammers, here is how:

- Provide the irstructions on how to enable that app install
- Explain to the victim that this 24h wait time is to ensure the security of their account/device (e.g. "We have to check your account in our database which will take 24 hours, we will call you as soon as this check is complete")
- Continue the normal scam

Google knows this, they aren't idiots. This is NOT about protecting scam victims, this is about attacking alternative ecosystems (and anti-Google apps like NewPipe) as well as a direct challenge to the EU's DMA regulation.

Wtf

Posted Mar 19, 2026 22:42 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (17 responses)

> If that would be the reason then I'm confused as to why they haven't announced any actions that hinder that scam model yet. E.g. banning scam or spy apps from their app store.

The malware apps are usually downloadable APKs, because they need to request permissions that trigger deep reviews on Play Store.

> Google knows this, they aren't idiots. This is NOT about protecting scam victims, this is about attacking alternative ecosystems (and anti-Google apps like NewPipe) as well as a direct challenge to the EU's DMA regulation.

As a side motivation? Yes. But it's still a good change overall.

Wtf

Posted Mar 22, 2026 7:23 UTC (Sun) by danieldk (guest, #27876) [Link] (16 responses)

> The malware apps are usually downloadable APKs, because they need to request permissions that trigger deep reviews on Play Store.

Google Play Protect (used on certified Android phones) scans each installed app, including side-loaded apps, for malware already:

https://support.google.com/work/android/answer/15162069?h...

Besides that, plenty of malware is distributed through the Play Store. No surprise, many of them are banking trojans:

https://www.malwarebytes.com/blog/news/2025/08/77-malicio...

It's all about control. It is possible that Google is worried that the settlement with Epic is not approved as-is and Judge Donato will require that Google support for alternative app-stores through the Google Play Store. If such stores would allow installing apps that were not signed with Google-approved developer keys, they lose a lot of control over the platform. So what do you do? You make it *really* annoying to install such apps, so that developers in third-party app stores still need to go through you. Of course, putting these annoyances in place for keeping control would raise a lot of regulatory scrutiny, so you find a variation of "think of the children".

https://en.wikipedia.org/wiki/Epic_Games_v._Google#Appeal...

Scammers will find new ways to scam. The only thing that works is education.

Wtf

Posted Mar 22, 2026 13:21 UTC (Sun) by pizza (subscriber, #46) [Link] (13 responses)

>It's all about control.

Yes and no. You cannot ignore the context, including the long history what led to this point.

Google put a decent amount of work into ensuring alternative app stores were not only viable but actively supported, along with supporting direct sideloading. And what did that get them versus Apple's "completely locked down with a single storefront" approach? *larger* penalties and legal headaches. (see; Epic vs everyone)

"Being more open with a relatively light touch" takes significantly more work, has left them worse off in today's legal+regulatory climate. So why bother?

And that doesn't even touch on the whole "wild west" aspect of Android OEMs shipping all manner of crap leading to massive amounts of blowback onto Google, which led Google to exercise incrementally greater control over the ecosystem. And oddly enough, the market/press/etc nearly-universally lauded Google for their efforts while parasites like Epic resented having to have _any_ conditions placed on their activities. I'm only using a Pixel phone because as every other option is (much!) shittier and/or physically too large.

Wtf

Posted Mar 22, 2026 15:03 UTC (Sun) by mb (subscriber, #50428) [Link] (12 responses)

Yeah, this is a pretty nice story.

But why can I install any application I like on my PC without waiting 24h?
It Microsoft at an extremely large risk, due to all the horror scenarios you paint, or is this all just bs?

Google is locking down their platform to gain full control. Step by step. No crazy legal and regulatory story needed.

Wtf

Posted Mar 22, 2026 17:07 UTC (Sun) by pizza (subscriber, #46) [Link]

> But why can I install any application I like on my PC without waiting 24h?

I'd wager all the cash in my pocket that completely locked-down PCs outnumber non-locked ones at this point.

But don't worry, that's coming for everyone else as soon as Microsoft thinks they can get away with it. Which will be sooner rather than later, especially if this "age verification by the OS" crap holds up in court and Microsoft inevitably finds themselves being targeted by governments and private lawsuits.

(MacOS is already there if you wish to install unsigned-by-Apple stuff, incidentally)

(And please, PLEASE keep in mind that you can't "nerd harder" your way out of legal/regulatory requirements, and even talking about breaking digital locks that will inevitably implement this crap is a literal felony in most of the developed world)

Wtf

Posted Mar 22, 2026 21:08 UTC (Sun) by SLi (subscriber, #53131) [Link] (10 responses)

> But why can I install any application I like on my PC without waiting 24h?

I think quite possibly because once people realized how utterly broken PC security is it was too late. That's why banks nowadays like to have the HSM in your phone to verify even what you do on your PC.

Wtf

Posted Mar 22, 2026 21:41 UTC (Sun) by mb (subscriber, #50428) [Link] (9 responses)

How does a phone two factor app help against malware installed on the PC?
Spoiler: It doesn't. At all.

I am sorry, but this is all snake oil. Let me override it without waiting arbitrary snake oil delays.

Wtf

Posted Mar 22, 2026 21:53 UTC (Sun) by malmedal (subscriber, #56172) [Link] (8 responses)

> How does a phone two factor app help against malware installed on the PC?

One of the banks I use requires me to press "Yes, it's me" on the phone whenever I log in on the PC.

Another bank even requires me to approve the transaction on the phone when I send money to a new account.

This limits what damage malware on my PC can do.

Wtf

Posted Mar 22, 2026 22:02 UTC (Sun) by mb (subscriber, #50428) [Link] (7 responses)

That doesn't work, though. I have learnt it in this thread. We need a 24h delay for it to be effective.

Let me decide, Google (and banks).

Wtf

Posted Mar 22, 2026 22:15 UTC (Sun) by malmedal (subscriber, #56172) [Link] (6 responses)

> I have learnt it in this thread. We need a 24h delay for it to be effective.

No, the thing you should have learnt is that a 24h delay is effective against a scammer talking to you.

The two-factor on the phone is effective against malware on your PC, the subject of the message I replied to.

One of my banks also has delays of 72 hours, 14 days or 30 days before you can do certain actions.

Wtf

Posted Mar 22, 2026 22:17 UTC (Sun) by mb (subscriber, #50428) [Link] (4 responses)

>The two-factor on the phone is effective against malware on your PC

Yeah, except it isn't.
Pressing Ok on a second device is useless against malware.

Wtf

Posted Mar 22, 2026 22:25 UTC (Sun) by malmedal (subscriber, #56172) [Link] (3 responses)

It protects my bank-account from being drained by credentials exfiltrated by malware. It stops malware from injecting additional transactions when I am legitimately logged in.

Wtf

Posted Mar 22, 2026 22:32 UTC (Sun) by mb (subscriber, #50428) [Link] (2 responses)

Sure. Mr McAfee would agree. In reality it doesn't do that, though.

Where can I click to opt out of 24h snake oil?

Wtf

Posted Mar 22, 2026 22:57 UTC (Sun) by malmedal (subscriber, #56172) [Link] (1 responses)

> In reality it doesn't do that, though.

You are arguing against industry-wide consensus, also and more importantly against common sense. And thirdly you are confusing different practices like anti-scam and anti-malware protections.

Wtf

Posted Mar 22, 2026 23:41 UTC (Sun) by corbet (editor, #1) [Link]

... And we are again going around in circles. Before posting, please think about whether you're really saying something new that advances the conversation.

Delay before action

Posted Mar 23, 2026 9:43 UTC (Mon) by farnz (subscriber, #17727) [Link]

Note that when studied, a delay of more than 24 hours doesn't help you avoid being scammed.

Once a delay is long enough that (a) you've slept on it, and (b) you've had a chance to talk to a friend or family member about what you're doing, it's done everything a delay can do.

Extending the delay before action beyond 24 hours is only helpful if the entity acting is doing further checks and needs the time to complete those checks (for example, if it's doing an identity check on the recipient to confirm that they're not a known fraudster).

Wtf

Posted Mar 22, 2026 20:35 UTC (Sun) by Cyberax (✭ supporter ✭, #52523) [Link] (1 responses)

> Google Play Protect (used on certified Android phones) scans each installed app, including side-loaded apps, for malware already

This doesn't work well when the app just sets itself as a device admin. Never mind that malware can obfuscate itself past any hope of detection.

Wtf

Posted Mar 22, 2026 20:44 UTC (Sun) by mb (subscriber, #50428) [Link]

True. The worst part, though, is that I can't turn it off anymore.
I do not install malware. Therefore I don't need it to be "scanned" by some voodoo snake oil software.

Wtf

Posted Mar 20, 2026 8:09 UTC (Fri) by gspr (subscriber, #91542) [Link] (9 responses)

> Perhaps you don't understand what is happening in a lot of countries.

If Google truly had the victims of scam in those countries in mind, they could just provide a switch at first boot: "if you were ever to want to own your own device, do you want us to force you to sleep on it first?"

Toggle it off, and the 24 h part of this nonsense doesn't happen.

Wtf

Posted Mar 20, 2026 17:56 UTC (Fri) by lutchann (subscriber, #8872) [Link] (8 responses)

> they could just provide a switch at first boot: "if you were ever to want to own your own device, do you want us to force you to sleep on it first?"

Because pretty much every user is gonna click the "of course I know what I'm doing, give me maximum power immediately" button. 99% of people are convinced they'd never fall for a scam. I'm more supportive of hiding the option in the developer menu than I am of the 24 hour delay.

> Toggle it off, and the 24 h part of this nonsense doesn't happen.

Maybe it should be possible to skip the 24 hour delay if you toggle the setting immediately after a factory reset/first boot? I suspect we would then see scammers convincing people to factory-reset their phone, toggle the setting, install the malware, then reinstall their banking app or whatever. Then people would lose not only their money but anything stored on their phone, which is an arguably worse outcome.

Wtf

Posted Mar 20, 2026 18:13 UTC (Fri) by mb (subscriber, #50428) [Link] (1 responses)

>"of course I know what I'm doing, give me maximum power immediately" button.
>99% of people are convinced they'd never fall for a scam.

And where is the problem?

I do not need mommy Google looking after me.
I make decisions and I live with the consequences of my decisions. Even if they turn out to be wrong decisions.

If people suppress this warning and install malware, it is their own fault. Only.

Wtf

Posted Mar 20, 2026 19:59 UTC (Fri) by malmedal (subscriber, #56172) [Link]

> I make decisions and I live with the consequences of my decisions. Even if they turn out to be wrong decisions.

Highly admirable(if upheld in practice), but this is a minority view.

A lot of governments will be happy if it turns out that this works as claimed and Google can provide statistical evidence they have protected so and so many of their citizens from scams.

Wtf

Posted Mar 23, 2026 7:56 UTC (Mon) by gspr (subscriber, #91542) [Link] (5 responses)

> Because pretty much every user is gonna click the "of course I know what I'm doing, give me maximum power immediately" button.

I'm sorry, I really struggle to see how this is any different from letting people have really sharp kitchen knives. Warnings: great. Laws against wielding them to do harm: great. But that's where it ends. In the end, if someone insists on juggling them nomatter what, there's very little we can or should do.

PS: I'm not some libertarian. I'm a scandinavian centrist, which probably aligns me somewhere à la Bernie on the spectrum of US politics for comparison. I believe that a lot of society's ills are down to people refusing to recognize that we're billions of humans who have to share this world, like it or not. I just have a huge problem with forced paternalism from the state, or here, even worse, a private company. I believe that it is possible both to recognize the need for collective action, for societal institutions, for a relatively broad state, without the collective/institutions/the state (or here, again, even worse, a megacorp) becoming paternalistic.

Wtf

Posted Mar 23, 2026 8:39 UTC (Mon) by kleptog (subscriber, #1183) [Link] (4 responses)

> I'm sorry, I really struggle to see how this is any different from letting people have really sharp kitchen knives. Warnings: great. Laws against wielding them to do harm: great. But that's where it ends. In the end, if someone insists on juggling them nomatter what, there's very little we can or should do.

Not really comparable. People know knives, have handled knives for years if not decades. They know the uses and the risks.

Take a random person off the street and ask them: what are the risks of enabling developer mode, they'll ask you what developer mode is. If you ask them what the risks are of installing random applications on their phones they'll probably say they let other people install software. People have *no idea* about malware and what it can do. But the effects of their phone being infected are very concrete. It can and does ruin lives.

So yeah, a time delay you have to do *once* over the lifetime of the phone seems reasonable. You can debate the 24 hours.

An actual comparable real-world situation would be time-delay locks on safes at a business. The staff know what's in the safe, they know the risks of opening it. So you would argue we could remove the delays. But we don't, because we know duress can make people evaluate risks differently. And in the end it makes things safer for the staff as well. Yes, in theory thieves could hang around for a while waiting for the safe to open. In practice they don't for various reasons and so they don't even try.

Wtf

Posted Mar 23, 2026 8:57 UTC (Mon) by gspr (subscriber, #91542) [Link] (3 responses)

> Not really comparable. People know knives, have handled knives for years if not decades. They know the uses and the risks.

Quite a large amount of people have handled digital devices for decades at this point. They know the uses and the risks. Granted, that amount of people isn't quite as large as for knives, but still.

> Take a random person off the street and ask them: what are the risks of enabling developer mode, they'll ask you what developer mode is. If you ask them what the risks are of installing random applications on their phones they'll probably say they let other people install software. People have *no idea* about malware and what it can do. But the effects of their phone being infected are very concrete. It can and does ruin lives.

Absolutely! Write all of this in big red font in the menu where the developer mode toggle is. I'm all for!

> So yeah, a time delay you have to do *once* over the lifetime of the phone seems reasonable. You can debate the 24 hours.

I am debating the 24 hours. If it instead said "spend a minute to reflect on the abovementioned big red warning – after that, a button will appear where you can make an informed choice" I wouldn't be upset in the slightest.

> An actual comparable real-world situation would be time-delay locks on safes at a business. The staff know what's in the safe, they know the risks of opening it. So you would argue we could remove the delays. But we don't, because we know duress can make people evaluate risks differently. And in the end it makes things safer for the staff as well. Yes, in theory thieves could hang around for a while waiting for the safe to open. In practice they don't for various reasons and so they don't even try.

It's a great analogy when it comes to *the technology of time delay in itself*. And of course, I welcome *technical functions that introduce time delays* when the owner of the device wants it, as for those safes. With safes, I'm pretty sure the owner can disable said functionality. Or at the very least, there's a gazillion providers of safes, so you can always take your business elsewhere. With smartphones, there's two providers – and no way to turn off the feature. That's my complaint. Not that the feature exist, but that it's forced upon me.

Wtf

Posted Mar 23, 2026 11:14 UTC (Mon) by taladar (subscriber, #68407) [Link]

I would be in favor of having to type something along the lines of "if someone told me to enable this there is a very high chance they are trying to scam me" before you can enable developer mode/side-loading.

Wtf

Posted Mar 23, 2026 15:13 UTC (Mon) by kleptog (subscriber, #1183) [Link] (1 responses)

>With smartphones, there's two providers – and no way to turn off the feature

Sure there is: you do the indicated procedure once and you're done. If you had to do it for every app then that would get annoying pretty quickly.

You seem to suggest you think the option should be default-allow (sideloaded apps) rather than default-deny. I guess we'll have to agree to disagree on that.

> Quite a large amount of people have handled digital devices for decades at this point. They know the uses and the risks.

It's not about the risks of the devices. It's the fact that people are easily manipulated under pressure and thousands of years of evolution haven't fixed that. I don't think the next generation is going to be any better.

Wtf

Posted Mar 23, 2026 15:46 UTC (Mon) by gspr (subscriber, #91542) [Link]

> Sure there is: you do the indicated procedure once and you're done. If you had to do it for every app then that would get annoying pretty quickly.

I think you understand what I meant: no *reasonable* way to turn it off. The process is so insane that it warranted an LWN story with a huge discussion.

> You seem to suggest you think the option should be default-allow (sideloaded apps) rather than default-deny. I guess we'll have to agree to disagree on that.

No. I'm fine with default-deny. I just want a reasonable way to toggle allow.

Wtf

Posted Mar 19, 2026 20:49 UTC (Thu) by rgmoore (✭ supporter ✭, #75) [Link] (47 responses)

Just to protect stupid people from doing stupid things.

Two points:

  1. It's not just stupid people. Even smart people can make dumb decisions. Sometimes it's because they're inattentive or under pressure, and sometimes because the people trying to trick them are able to deceive them successfully. The idea that only dumb people can be deceived encourages people to become complacent by thinking they're too smart to be taken advantage of.
  2. Even if it were true that only stupid people fall for scams, society exists to protect all its members. Talking about people who fall victim to scammers as "stupid people ... doing stupid things" excuses criminals by implying their victims' stupidity means they deserved what they got. This is backward thinking and only makes life easier for criminals.

Wtf

Posted Mar 19, 2026 20:59 UTC (Thu) by mb (subscriber, #50428) [Link] (45 responses)

Sure. And how does a 24h delay protect anybody from doing stupid things? Remember, that we already have dozens of warnings and buttons to click. How does wasting my time prevent anything? Criminals will just integrate this delay into their scam.

Can we please educate people instead of forcing the lowest common denominator onto everybody, please?
And can we please accept that we cannot protect everybody?

I am willing to press many buttons and do stuff.
But preventing me from getting necessary work done *now* is going way to far.

I feel insulted when being taught to wait 24h because I could be a scam victim when trying to install my application. I am going to install it anyway! No matter how long you make me wait. You are just wasting my time, Google.

Wtf

Posted Mar 19, 2026 21:43 UTC (Thu) by tuna (guest, #44480) [Link] (2 responses)

Google is wasting scammers time as well. You only have to wait 24 hours once, after that you can install whatever you want if I understand correctly.

It is more important to help people not get scammed than for you to not "feel insulted".

Wtf

Posted Mar 19, 2026 21:55 UTC (Thu) by mb (subscriber, #50428) [Link] (1 responses)

>Google is wasting scammers time as well.

Not it isn't. Scammers are either fully automated these days or are operating massively parallel or both and cost nothing.

It *just* wastes the time of users doing legitimate use cases.

>It is more important to help people not get scammed

Educate them instead of annoying everybody.
There *already* are dozens of buttons and warnings to click and ignore.

Wtf

Posted Mar 20, 2026 16:24 UTC (Fri) by tuna (guest, #44480) [Link]

It has proven not to be possible to educate programmers to not leak memory or to overwrite data from different threads. Instead we need tools (garbage collectors and Rust) to stop that.

I think it is impossible to educate people not to be duped by scammers, but as always, I could be wrong.

Wtf

Posted Mar 19, 2026 21:49 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (25 responses)

> Sure. And how does a 24h delay protect anybody from doing stupid things?

Yes. A delay that can not be bypassed by social engineering will be helpful. Scammers work by creating time pressure, to make sure the victim doesn't have time to think or consult with other people.

You're living in a high-trust society where the worst thing that can happen to you is somebody opening a false bank account under your name.

Can you imagine a situation where you receive a call telling you that they're police, and they have arrested your daughter/son/... with drugs (worth a death penalty in some places). They even will send you their photos and videos, with all the personal details. But you can pay them a bribe (not bail, a bribe) and they'll let your daughter/son/... go and "disappear" all the evidence.

THIS is the situation with which people are dealing. And for people in low-trust societies, such a scenario is very much a real possibility. It's believable because such things can and do happen all the time.

My mother in Russia was a victim of a scam. She got a call from an "officer of the FSB" saying that they detected Western propaganda coming from her phone, and she needs to install a scanner to prove that it's not her.

What are your suggestions for these kinds of scenarios? I think that 24h delay is a good solution.

Wtf

Posted Mar 19, 2026 22:08 UTC (Thu) by mb (subscriber, #50428) [Link] (12 responses)

>THIS is the situation with which people are dealing

No, it isn't.
This is about installing applications on a phone that I own.

You are building a straw man.

>My mother in Russia was a victim of a scam.

I am sorry about that.

But we cannot prevent every crime on earth, no matter what safety mechanism we implement.
What if somebody uses a knife incorrectly and hurts themselves? Do we have to implement a safety mechanism for knifes? Where do we stop?
For me, we stop right here, right before where we implement 24h waiting.

>What are your suggestions for these kinds of scenarios?

Educate your mom and people around you.
You are a tech literate person it seems.

*Help* people around you. Do not restrict them.

Wtf

Posted Mar 19, 2026 22:15 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (11 responses)

> But we cannot prevent every crime on earth, no matter what safety mechanism we implement. What if somebody uses a knife incorrectly and hurts themselves? Do we have to implement a safety mechanism for knifes?

We have driving licenses for cars, and we also ban private possession of explosives.

> *Help* people around you. Do not restrict them.

Yes, and that's why I like that 24h restriction.

Wtf

Posted Mar 19, 2026 22:19 UTC (Thu) by mb (subscriber, #50428) [Link] (10 responses)

> We have driving licenses for cars, and we also ban private possession of explosives.

So installing an app is as dangerous as driving a car and owning explosives?
Why don't we introduce an app install license then?
I would be all for it.

You are building a straw man.
This is about installing an app on my phone.

Wtf

Posted Mar 19, 2026 22:24 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (9 responses)

> So installing an app is as dangerous as driving a car and owning explosives?

Given that it's leading to suicides and people losing their life savings?

Yes.

Wtf

Posted Mar 19, 2026 22:29 UTC (Thu) by mb (subscriber, #50428) [Link] (8 responses)

Ok. Then please don't sell these dangerous devices to your people in your country.

Wtf

Posted Mar 19, 2026 22:37 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (7 responses)

Sure. And feel free to build your own devices where you can install whatever software you want in whatever manner you want.

Wtf

Posted Mar 19, 2026 22:40 UTC (Thu) by mb (subscriber, #50428) [Link] (6 responses)

Exactly. This Google change restricted my ability to do that even more. Why?

Wtf

Posted Mar 19, 2026 23:38 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (4 responses)

I'm sorry, what? You're saying that Google is not free to do whatever it wants with its software? Why do you feel entitled to stiffle the creativity and/or business models of Google?

If you don't like what they're doing, feel free to switch. It's a free country, nobody's forcing you to use Android.

Wtf

Posted Mar 20, 2026 7:05 UTC (Fri) by mb (subscriber, #50428) [Link] (3 responses)

>feel free to switch

To what?

Wtf

Posted Mar 20, 2026 8:55 UTC (Fri) by farnz (subscriber, #17727) [Link]

Something you and like-minded people built, rather than Apple iOS or Google Android. Maybe even a free derivative of AOSP like GrapheneOS or Replicant, maybe something like Sailfish OS.

Wtf

Posted Mar 20, 2026 17:15 UTC (Fri) by Cyberax (✭ supporter ✭, #52523) [Link] (1 responses)

Why should Google be concerned with that? They have their own freedom to develop their OS however they want.

Wtf

Posted Mar 20, 2026 17:18 UTC (Fri) by mb (subscriber, #50428) [Link]

Sure they do. Nobody said anything else.

Do you also realize that this doesn't mean I have to agree with them?

Wtf

Posted Mar 20, 2026 0:49 UTC (Fri) by ptime (subscriber, #168171) [Link]

It’s a one-time configuration nag, you big baby

Wtf

Posted Mar 19, 2026 22:30 UTC (Thu) by dskoll (subscriber, #1630) [Link] (11 responses)

All right, I am convinced of the desirability of the 24h delay. Thanks for the explanations, Cyberax and rgmoore.

Wtf

Posted Mar 19, 2026 22:33 UTC (Thu) by mb (subscriber, #50428) [Link] (10 responses)

You see, we need at least a month of delay, because it was shown that we need at least this amount of time before we can really before nobody falls for a scam ever.

Wtf

Posted Mar 19, 2026 22:42 UTC (Thu) by dskoll (subscriber, #1630) [Link] (9 responses)

No, there's a balance to be had. And "appeal to extremes" is a logical fallacy.

I agree that for people who know what they're doing and are unlikely to be scammed, the 24h wait is irritating. But by the same token, a 40 km/h speed limit on certain streets is irritating to professional drivers who might be able to drive those streets safely at 60 km/h. But society accepts irritating some experts to make non-experts safer.

Wtf

Posted Mar 19, 2026 22:56 UTC (Thu) by mb (subscriber, #50428) [Link] (8 responses)

>irritating

You misspelled unacceptable.

>40 km/h speed limit on certain streets is irritating to professional drivers who might be able to drive those streets safely at 60 km/h.

We are increasing the speed limit from 24 seconds to 24 hours.

See the difference? It's two orders of magnitude.

Wtf

Posted Mar 20, 2026 0:57 UTC (Fri) by dskoll (subscriber, #1630) [Link] (2 responses)

If it's truly unacceptable, then you have a choice not to buy or use an Android device.

Wtf

Posted Mar 20, 2026 17:40 UTC (Fri) by tuna (guest, #44480) [Link] (1 responses)

There is no more open option that has the digital tools you need to function in society. Today you basically need an Android or iOS device with a phone number connected to function in society.

Wtf

Posted Mar 20, 2026 18:05 UTC (Fri) by dskoll (subscriber, #1630) [Link]

It depends on where you live and what you do. My partner does not have a smartphone and he seems to be able to function in society decently. (This is in Canada. Don't know what the situation is like in other places.)

Wtf

Posted Mar 20, 2026 7:52 UTC (Fri) by pbonzini (subscriber, #60935) [Link] (1 responses)

The point is exactly to be a nuisance to scammers. The comparison with speed limits makes no sense. If I have to drive from Milan to Turin (120 km/70 miles) it's not okay f I have to go at walking speed and it takes me one day. But over the whole life of a smartphone, a once-only 1 day wait before installing your favorite APK is irritating but acceptable.

I understand that in principle it's blocking you from doing what you want with your phone immediately. But just like a F1 driver that could get to Turin safely in 40 minutes if it wasn't for the speed limit, you and I are not the person that the process was designed for.

But in fact it can be beneficial even for me, in a different setting. If I have to explain to my son "I have enabled the setting you need to have this apk installed, but it's asking to install it tomorrow evening because it's a kinda dangerous setting", I have the occasion to teach him about malware and how to check that the apk is not malware. And I can reinforce that tomorrow when I actually explain how to do the install.

Wtf

Posted Mar 20, 2026 8:13 UTC (Fri) by mb (subscriber, #50428) [Link]

>irritating but acceptable.

It's not.
It's another piece in a long chain of little little "acceptable" things that are being installed one by once since a couple of years ago.

- You want to install your own OS? Oh, your vendor locked you down. Choose another one until no one is left.
- It's just these couple extra clicks! Just go into this menu and press this a dozen times and just these few warnings.
- Oh let's add jet another barrier. It's just a couple of clicks! (Today it actually makes me press three confirm buttons and entering my password for installing an app on my phone. Every time.)
- You can get around that! You just need to register your identity to an US company! It's easy! We all know that can be trusted.
- Your app is using an older API level? Let's just show another warning to click away!
- More and more security "services" are added to GooglePlay that basically all apps (banking, etc..) need and won't work without. Locking your life to Google.
- It's just a 24h wait, but you can then disable the check permanently. That's acceptable, right? It's only once!

Let me extrapolate from the past into the future:
- The permanent option will be removed. Now you have to wait 24h every time you install an app because the permission will time out after a week or so.
Mark my words.

Google is quite obviously slowly locking down their platform since a couple of years, step by step.
Each step is "acceptable" as such so that people don't complain or even think that this is a good thing. After all, if you don't want this additional lock down step, you are helping criminals. You don't want to do *that*, right?

Wtf

Posted Mar 20, 2026 9:03 UTC (Fri) by azumanga (subscriber, #90158) [Link] (2 responses)

Making driving comparisions is, I find, quite funny, because every country in the world has decided you need to wait *way* longer than 24 hours to be allowed to drive a car.

If you want to compare driving to phones, we could require you pass a government test to be allowed to install 3rd party apps.

Wtf

Posted Mar 20, 2026 10:34 UTC (Fri) by paulj (subscriber, #341) [Link] (1 responses)

> Making driving comparisions is, I find, quite funny, because every country in the world has decided you need to wait *way* longer than 24 hours to be allowed to drive a car.

The thing is, the countries where - from other comments - the scams that this measure is trying to stymie are, it is said, absolutely rife are also countries where, to a significant degree and in de facto terms you do not need to wait 24 hours to drive. Either bribe someone or just ignore any law. Hell, in India that is (by some reports) an issue not just for driving licences but even a little bit of a problem with *commercial pilot's licences*.

What I don't understand is why it is more rife there than here. We also get continuous scam attempts over here. Including many that are directed from call centres in those countries other comments indicate are an issue. Many people are falling for them here too. Even solicitors (who handle the transfer of money of property sales here in the Celtic Isles) have been targeted and tricked into sending very large amounts of money to scammers.

So.. what's the difference? Why is this a bigger issue there than here?

Why scams are a bigger issue in places with a corruption problem than Ireland

Posted Mar 20, 2026 12:05 UTC (Fri) by farnz (subscriber, #17727) [Link]

The core is that the scammers in Ireland don't have any way to get officialdom to support them. You can be confident that if you suspect that it's a scam and go to the Garda, they will not be in on the scam, and they'll at least stop you from being conned.

In contrast, in countries with a corruption problem, your expectation is that the scammer has bribed the local authorities already, and if you go to the local police, there's a good risk that they will scam you, too, as will any other authority you go to.

It's basically the difference between "if I'm not sure about this, I can go to someone who definitely will not try to scam me" and "if I'm not sure about this, I get a choice between being scammed by the person on the phone, or scammed by local authorities".

Wtf

Posted Mar 19, 2026 22:02 UTC (Thu) by rgmoore (✭ supporter ✭, #75) [Link] (14 responses)

And how does a 24h delay protect anybody from doing stupid things?

Because it gives people some time to realize they're being scammed. A very common trick, not just in outright scams but in high pressure sales and negotiations, is to create a sense of urgency so people don't have time to stop and think things through. If you listen to stories of people who have been scammed, it's pretty common for them to realize it once they've had a chance to stop and think, but the scams are designed to keep people from stopping and thinking until it's too late. Building in a 24 hour wait reduces that time pressure. It means potential victims will have time to stop and think, or to talk to other people who can point out they're probably being scammed, or just to call whatever institution is allegedly pressuring them to install the special app.

The flip side of this is that this is, or can be, something you only have to do once per phone. Once you've jumped through the hoops, you can say "allow indefinitely" and not have to jump through them again, at least with that phone. It sounds like it will still warn you about your package being unsigned every time after that, but you won't have to wait 24 hours every time.

Can we please educate people instead of forcing the lowest common denominator onto everybody, please? And can we please accept that we cannot protect everybody?

If there were some way of educating people so they were highly resistant to scams, we would have done it already. I'm not saying education is useless- telling people what to look for is definitely helpful- but even smart people can still fall for scams they've been specifically taught how to spot. We need something beyond just education. And "we can't protect everybody" shouldn't be an excuse to give up and fail to protect anyone.

Wtf

Posted Mar 19, 2026 22:15 UTC (Thu) by mb (subscriber, #50428) [Link] (1 responses)

>Because it gives people some time to realize they're being scammed

I want to install an app and I am not being scammed.
Where is way to install an app without waiting an arbitrary amount of time?

I *guarantee* you that this 24h wait is not the end. People will continue to be scammed and this will be the excuse to implement more and more and more and more restrictions.

Wtf

Posted Mar 20, 2026 2:37 UTC (Fri) by somlo (subscriber, #92421) [Link]

by buying into a proprietary, corporate controlled ecosystem you've relegated yourself to indignantly complaining about the corporate overlords' decision to optimize for their own profit, regulatory compliance, and PR virtue signaling, with zero ability to actually do anything about it.

i wish i could recommend a free alternative, but there isn't a viable one i'm aware of :(

life's a bitch, and then you die :)

Wtf

Posted Mar 20, 2026 11:42 UTC (Fri) by Wol (subscriber, #4433) [Link] (11 responses)

>> Can we please educate people instead of forcing the lowest common denominator onto everybody, please? And can we please accept that we cannot protect everybody?

> If there were some way of educating people so they were highly resistant to scams, we would have done it already. I'm not saying education is useless- telling people what to look for is definitely helpful- but even smart people can still fall for scams they've been specifically taught how to spot.

And legit businesses spend a lot of time and effort educating people that falling for scams is okay !!! Every time you tell someone "This is how to spot a scam" you suddenly find loads of *legitimate* businesses - banks especially half the time !!! - are doing exactly that.

Cheers,
Wol

Wtf

Posted Mar 20, 2026 11:55 UTC (Fri) by pizza (subscriber, #46) [Link] (1 responses)

> And legit businesses spend a lot of time and effort educating people that falling for scams is okay !!! Every time you tell someone "This is how to spot a scam" you suddenly find loads of *legitimate* businesses - banks especially half the time !!! - are doing exactly that.

I'd wager that nearly *every* business does this to their own employees on a regular basis, with official communiques (be it direct or from official [IT/HR/etc] vendors) bearing a majority of the flags/markers/indicators that the required anti-phishing training says to watch out for.

(Most recently happened at $dayjob two days ago, and this is a company heavily involved in [offsensive] cybersecurity)

Wtf

Posted Mar 20, 2026 14:48 UTC (Fri) by Wol (subscriber, #4433) [Link]

Which is why our cyber-security group has (and monitors!) an internal slack group for security conscious users.

While we don't believe in shaming people, there are plenty of people who take pleasure in pointing out cock-ups, and the cyber-security guys will quite happily go off and have a quiet word in peoples' ears :-)

Cheers,
Wol

Wtf

Posted Mar 23, 2026 11:47 UTC (Mon) by paulj (subscriber, #341) [Link] (8 responses)

> And legit businesses spend a lot of time and effort educating people that falling for scams is okay !!!

Including the banks themselves. We've had industrial phishing and social engineering attacks going on for... approaching 2 decades now. And still, in the past year, I have had a phone call from someone (with a foreign/non-native accent) saying basically:

"I'm with <your bank>, and we need to verify some of your recent transactions"

<me suspicious> "Ok...."

"If you can just confirm your name and Date of Birth"

"Uhm... but you just range me?"

"Well I need to verify who you are"

"You're calling me, I need to verify who you are surely?"

Now, I actually thought the call was genuine, cause I did just have an issue with some card payments, but I couldn't believe they'd call me up and then demand that *I* give my details to _them_, when they were behaving no differently to a scammer. I told them how bad this was, how they were *training* their users to fall for scams by doing this. They told me to search for the customer support number and phone them back.

Sigh.

Wtf

Posted Mar 23, 2026 21:12 UTC (Mon) by madscientist (subscriber, #16861) [Link] (7 responses)

Obviously you do need to verify who they are. But, it's not completely ridiculous for them to need to verify who you are. After all just because you answered the phone number they have on file for the account, doesn't mean you're actually the account holder, or even know them. You could have stolen the phone, or found it, or whatever.

We need secret passwords like in spy movies where you configure two phrases in your account settings, and when they call you they give the first phrase and you have to give the correct second phrase :)

Wtf

Posted Mar 23, 2026 21:17 UTC (Mon) by Wol (subscriber, #4433) [Link] (5 responses)

We've got that already ...

On at least one of my accounts somewhere I was asked for three challenge/response pairs. Of course there's the classic "mother's maiden name", or "your first pet" or whatever, but I've got a couple of cryptic questions which for me the answer is obvious. But even for someone who knew me, if they didn't know a bit of esoteric history they'd never put two and two together ...

Cheers,
Wol

Wtf

Posted Mar 23, 2026 22:05 UTC (Mon) by mgb (guest, #3226) [Link] (3 responses)

Challenge response answers don't have to be correct. You can list your first school as Apple and your home town as Banana. Provided you can remember them.

Wtf

Posted Mar 24, 2026 10:55 UTC (Tue) by paulj (subscriber, #341) [Link]

> Challenge response answers don't have to be correct. You can list your first school as Apple and your home town as Banana. Provided you can remember them.

Unix password-store ("pass" https://www.passwordstore.org/) for the win. Best password store ever. Best "cloud" sync support ever (anything git can do, it can do). Etc.

Wtf

Posted Mar 24, 2026 11:08 UTC (Tue) by Wol (subscriber, #4433) [Link] (1 responses)

Which is why I like cryptic clues

Challenge: "Red Arrows"
Response: "Gnat"

or even more obscure (I've just had to check the answer myself :-)

Challenge: "Black Arrow"
Response: "Hunter"

Anyone get the connection? I'm sure someone will, but if you don't know the response you're pretty certain to get the first one wrong, and the second one could be anything.

Cheers,
Wol

Wtf

Posted Mar 24, 2026 11:44 UTC (Tue) by paulj (subscriber, #341) [Link]

> Anyone get the connection?

Pretty obvious to me. ;) I think you'd quickly get hacked if you used question/responses like that. ;)

Wtf

Posted Mar 24, 2026 17:36 UTC (Tue) by madscientist (subscriber, #16861) [Link]

No, that is not at all good enough. This doesn't prove anything to ME about who is calling me. They can ask me some random challenge question and then accept my response. Since they don't have to prove who they are before you provide information, they can even use this to get your challenge responses. It only works if I give them the wrong answer and they know it's wrong and call me on it. But of course if that became common, scammers would just reject the first answer and if people said "no, I'm sure that's it" they would say "oh yes, I see, sorry".

I'm suggesting that the user would configure two separate random passphrases in their account configuration. When the provider calls me they would have to provide the first one to me, and that would prove to me that they have access to my account. Then I would respond with the second phrase, and that proves to them that I am the person they intended to contact.

I'm not really serious about this, though. There are various problems with this (for one thing, most people can't remember one passphrase, let alone two, for accounts they don't use every day).

Wtf

Posted Mar 24, 2026 18:00 UTC (Tue) by paulj (subscriber, #341) [Link]

Sure, but they *first* have to authenticate themselves to me. Otherwise, asking me /cold/ to provide personal details is just training users to co-operate with phishing scams (at a minimum, fall for a data gathering phase of scams).

Some banks have some clueful security people, some don't. Even the banks that have can still have a lot of people who are clueless about security, and who then sometimes are involved in designing customer facing processes that have security implications, without the clueful security people being aware (or they are and they get overriden or ignored because of vast organisational inertia - I once worked in card transaction processing, and we had to deal with committees of clueless people from banks at times).

Wtf

Posted Mar 20, 2026 9:00 UTC (Fri) by azumanga (subscriber, #90158) [Link]

Having been caught by a phone scam, a 24h delay would definately have saved me. Even a 30 minute delay. As soon as I got off the phone from my 'bank' I realised what had happened, immediately locked my cards, and fortunately I didn't lose any money.

The problem with scammers is they just need to catch you on that one day when you are tired, distracted, when you (in my case) had just made a purchase from a website you maybe shouldn't have trusted, then the 'bank' rings 2 minutes later.

Wtf

Posted Mar 20, 2026 11:36 UTC (Fri) by Wol (subscriber, #4433) [Link]

> Talking about people who fall victim to scammers as "stupid people ... doing stupid things" excuses criminals by implying their victims' stupidity means they deserved what they got.

If you've been trained to do stupid things, then you'll do stupid things and it doesn't matter how clever you are, there's a good chance you'll fall for a scam.

There's a reason scammers mimic legit business behaviours, and it's THAT.

How many businesses actually follow the mantra "make the RIGHT thing to do the EASY thing to do"? Any at all? The typical motto seems to be "make it easy, who cares whether it's secure or sensible", and scammers lay landmines that you *instinctively* tread on. There's a lot of evidence that most of your decisions/actions are driven by your sub-conscious, and your conscious mind only kicks in AFTER you've done whatever instinct tells you to do. How often do you go "Oh **** I didn't mean to do that!".

Cheers,
Wol

Wtf

Posted Mar 23, 2026 15:10 UTC (Mon) by ssmith32 (subscriber, #72404) [Link] (10 responses)

To be fair, you fell for the scam that "you can't live without google". Or that de-googling isn't possible.

Or that this development is somehow shocking.

I admit that I still haven't fully de-googled yet, but it's been obvious the direction things were heading for many many years now. But I've certainly made strides, and am getting a lot closer than I was. I am not surprised or disappointed by this hack at all.

Perhaps google does need to protect you from yourself by making it *painfully* obvious that you really need to quit this relationship you have with them. They don't care about you, and it's not healthy.

To everyone claiming this was necessary to prevent scams: maybe it prevents some scams, but no, that's not why google is doing this. They've been pretty obvious that they didn't want to do this at all.

They did not suddenly start caring - after years of it happening - about scams and develop a well-thought out solution. They tried to take the final step to take over the last bit of uncontrolled territory their ecosystem, got a lot of push back, and then came up with a bizzaro-hack around it.

They are following the same logic as commercial scammers that get you to sign up for something where you "can cancel anytime", but then you can only cancel by personally hand-delivering a form in a 15 minute window, on every fifth February 29th.

Wtf

Posted Mar 23, 2026 16:30 UTC (Mon) by mb (subscriber, #50428) [Link] (9 responses)

>that you really need to quit this relationship you have with them

I did not choose to have this relationship for the most part.
Google/Android is infrastructure at this point.

It's not optional for so many things anymore.

Just saying that I have to de-google or just use something else or just develop something else (said by others in this thread) is just utter nonsense.
Believe me, if the day had 2400 hours I *would* develop an alternative by myself, even though knowing that's also not fully possible due to DRM baked into the Android system and everybody and their mom requiring this DRM (Playstore).

I do fully agree that we need to de-google as much as possible. And I do that. I haven't had Android until 2017 and I have used alternatives until then.
But unfortunately it's not really possible to fully do that anymore.

De-googling (was Wtf)

Posted Mar 23, 2026 16:32 UTC (Mon) by dskoll (subscriber, #1630) [Link] (8 responses)

It's not optional for so many things anymore.

Really? Could you give a few examples of things where being part of the Google world is not optional?

De-googling (was Wtf)

Posted Mar 23, 2026 16:41 UTC (Mon) by mb (subscriber, #50428) [Link] (7 responses)

Banking, Neobrokers, Public Transport in many German cities (costs are higher without using Android), many twofactor things which don't use totp, using certain postal services in Germany, Paying things in many asian countries, etc etc

All these things (well except Neobrokers, because they didn't exist) was possible to be used without Android 10 years ago.
De-googling would mean I would have to stop using these things.

De-googling (was Wtf)

Posted Mar 23, 2026 16:52 UTC (Mon) by intelfx (subscriber, #130118) [Link] (1 responses)

>> It's not optional for so many things anymore.
> Really? Could you give a few examples of things where being part of the Google world is not optional?

They'll just tell you that none of these services are life-critical and participating in the modern society is a privilege that you should be ready to give up.

It's a great motte-and-bailey. Wonderful, really.

A: "Android is getting user-hostile by the day and it needs to stop."
B: "Google does not owe you anything, nobody is forcing you to use Android, go develop your own, filthy nerd."
A: "Except they are forcing me to use Android, services X and Y in country Z are only available through that."
B: "Well, it's your problem then, sucks to suck."

De-googling (was Wtf)

Posted Mar 23, 2026 17:01 UTC (Mon) by paulj (subscriber, #341) [Link]

This issue ultimately requires EU level action, to address both the (anti) competition issues of Google, privacy rights of individuals (in particular, right to not shovel data to big-tech), and the issue of EU member states to remain functionally independent of big-tech in increasingly unfriendly powers abroad.

Email your MEPs today and lay out your concerns.

De-googling (was Wtf)

Posted Mar 23, 2026 17:20 UTC (Mon) by dskoll (subscriber, #1630) [Link]

OK, I assume you live in Germany. You should be complaining loudly to your politicians. Relying on an American company for important digital infrastructure is clearly folly.

I live in Canada and none of the things you mentioned applies. Banking can be done via a generic web browser. I guess Neobroker is an investment platform? I manage my investments again with a generic web browser. Public transit has its own smart card (or you can use a credit card). I'm not aware of any two-factor things that don't use TOTP (or worse, SMS) in Canada.

There is only one thing I've encountered that absolutely requires a mobile device, and that's Ticketmaster "mobile tickets". So I just don't go to events that require them. There are plenty of venues and performers that support normal PDF tickets.

I suspect, too, that in Canada, we are very unlikely to see important services requiring Android or Apple devices to work, and certainly not any government services, because there is a very strong anti-American-corporation sentiment here and everyone's talking about digital sovereignty.

De-googling (was Wtf)

Posted Mar 23, 2026 17:23 UTC (Mon) by Wol (subscriber, #4433) [Link] (2 responses)

> Public Transport in many German cities

You mean you can't just use a credit/debit card? (We have to make sure we use the same card every time, or we lose discounts.)

Admittedly it's a PITA, but where we have a serious price difference (buying rail tickets), you can still just go down the station and buy your ticket in advance for a discount. Okay, finding a ticket office that's open can be a problem ...

Cheers,
Wol

De-googling (was Wtf)

Posted Mar 23, 2026 17:43 UTC (Mon) by mb (subscriber, #50428) [Link] (1 responses)

>You mean you can't just use a credit/debit card?

Together with the Android/iOS apps I can use the credit/debit card.
Or I can "choose" to pay a higher price elsewhere with credit/debit to get the same product/ticket.

Also answering dskoll here:

Yes, of course complaints to our government happen and there *are* actions to become independent from US. There are these actions for all sorts of software products at least since MS Windows came to life.
But you can imagine how well that works in practice and how the progress is. There is some marginal progress, but the EU is very far from being independent from the big US software companies.

And I can do multiple things at the same time:
Complain about Google *and* support national and EU initiatives to use free alternatives. This is not a contradiction.

De-googling (was Wtf)

Posted Mar 23, 2026 18:14 UTC (Mon) by dskoll (subscriber, #1630) [Link]

Sure, but look at it like this: You can complain to Google: "Please don't enshittify your platform, because our politicians require us to use it to access services." And Google will say "Are you a shareholder? If not, why should we listen to you?"

Or you can complain to your elected representatives: "Google is enshittifying its platform. Please don't require us to use it to access services."

No matter how slow the process, I suspect the second approach will have more success in the end.

De-googling (was Wtf)

Posted Apr 19, 2026 6:22 UTC (Sun) by ssmith32 (subscriber, #72404) [Link]

>Banking, Neobrokers, Public Transport in many German cities (costs are higher without using Android),

Dang, that sounds... frustrating. I guess I just kind of assumed the US would be the hardest place to de-google, but, apparently, I stand corrected. Apologies.

Canada sounds best, but here in the US, there's just a few inconveniences holding back my libre phone (other than the slowness, lack of water resistance, and mild tendency to overheat).

The one I'm most stumped on (currently, now that proton has a very nice Auth app!!) is routing with traffic via something like Organic Maps. There are some hacks floating around, but certainly nothing that meets the spare-time implementable (even for this introvert nerd...) plus reliable.

And the fact that, by the time I have it working, I'll probably finally be upgrading to a car with CarPlay or Android Auto or whatever it is.

Wtf

Posted Mar 20, 2026 8:57 UTC (Fri) by valderman (subscriber, #56479) [Link] (2 responses)

I came into this thread fully expecting to rage about Google's evil anti-competitive practices, but your arguments (as well as the "arguments" of the people who do rage about it) have convinced me that this is actually quite reasonable.

Thank you for your patient explanation!

Agreed

Posted Mar 22, 2026 0:21 UTC (Sun) by ringerc (subscriber, #3071) [Link] (1 responses)

The folks arguing against this change are doing a good job of inadvertently supporting it IMO.

I do see the slippery-slope here. I used to control my Android device to a moderate degree; this is no longer the case. And increasingly I'm _required_ (to access government services, banking services, employment related tools etc) software that _refuses to run_ on a device I actually control.

But I also understand why this is the case. Much as I dislike it. I actually benefit from these restrictions too; I don't _want_ other software on my phone to be able to peek at my banking data for example.

IMO a helpful middle ground would be to have a "secure arena" (secured against the user, too, as the user may be fooled, inadvertently install compromised releases, etc) then a "general arena" that has greater user control, more inter-app interaction etc. So maybe I can't use my whizz-bang custom keyboard when I'm using my banking software... ok.

There are still concerns there of course. The abuse of security systems to protect user-hostile antifeatures, for instance. Accessibility being another, given good accessibility can require a fair degree of personal customization for a particular person's individual needs.

Hopefully we can do better than "rooted" or "not rooted" in future. Whether there's the motivation to do so for the large commercial players is another matter entirely.

Agreed

Posted Mar 22, 2026 1:20 UTC (Sun) by pizza (subscriber, #46) [Link]

> IMO a helpful middle ground would be to have a "secure arena" (secured against the user, too, as the user may be fooled, inadvertently install compromised releases, etc) then a "general arena" that has greater user control, more inter-app interaction etc. So maybe I can't use my whizz-bang custom keyboard when I'm using my banking software... ok.

In other words... the current status quo?

...Whomever controls the underlying system controls this "secure arena".

Wtf

Posted Mar 19, 2026 20:19 UTC (Thu) by lutchann (subscriber, #8872) [Link] (1 responses)

How is your phone supposed to know whether you're an idiot? They've already tried inserting a dialog where you have to click "I confirm I am not an idiot," but for some reason it didn't stop the idiots...

Wtf

Posted Mar 19, 2026 20:33 UTC (Thu) by mb (subscriber, #50428) [Link]

Now they try inserting a 24h delay which annoys everybody with a functioning brain, but for some reason it won't stop the idiots...

Wtf

Posted Mar 19, 2026 20:28 UTC (Thu) by leromarinvit (subscriber, #56850) [Link] (6 responses)

I think the actual process in practice will be more like:

(0. choose device that can either be unlocked officially or has working exploits)
1. unlock bootloader
2. install AOSP/LineageOS/GrapheneOS/whatever
3. don't wait 24 hours
4. install whatever you want

It used to be true that even for "techies", if you wanted your Android phone to be Google-free, it required some dedication. No matter how principled you were, the temptation was always there to make your life easier and just use stock firmware. But no more. Congratulations, Google. Using a de-googled Android phone is now officially easier and less of a hassle than dealing with stock nonsense.

Wtf

Posted Mar 19, 2026 22:26 UTC (Thu) by pizza (subscriber, #46) [Link] (5 responses)

> Using a de-googled Android phone is now officially easier and less of a hassle than dealing with stock nonsense.

Uh, in what universe is it "Easier and less of a hassle" to:

> (0. choose device that can either be unlocked officially or has working exploits)
> 1. unlock bootloader
> 2. install AOSP/LineageOS/GrapheneOS/whatever
> 3. don't wait 24 hours
> 4. install whatever you want

...versus "just use the device as it was delivered to you"?

Also, you left out:

5. Be prevented from using your device to interact with any financial, medical, or governmental institution... as well as your employer. (On top of the usual consumption of DRM media which the overwhelming majority of folks actually do care about)

Wtf

Posted Mar 20, 2026 10:36 UTC (Fri) by paulj (subscriber, #341) [Link] (2 responses)

> versus "just use the device as it was delivered to you"?

You can buy degoogled phones fairly easily. So, "just use the device as it was delivered to you?" is exactly the experience you can have, and what most non-techy users of degoogled phones will have had.

Oh, also I have prepared degoogled phones for non-techy friends, FWIW.

Wtf

Posted Mar 21, 2026 11:48 UTC (Sat) by cesarb (subscriber, #6266) [Link] (1 responses)

> You can buy degoogled phones fairly easily. So, "just use the device as it was delivered to you?" is exactly the experience you can have, and what most non-techy users of degoogled phones will have had.

Please tell me, which "degoogled" smartphones are available for buying here in Brazil? (Keep in mind that only phones with ANATEL certification can be imported, non-certified phones will be rejected by customs, so buying from another country is not an option, unless it's a model which already has ANATEL certification.) I've been looking, and so far haven't found any.

Wtf

Posted Mar 23, 2026 12:18 UTC (Mon) by paulj (subscriber, #341) [Link]

I'm not familiar with Brazil. I suggest you look around in the typical forums where small businesses advertise digital / tech services. E.g., where I am there are a number of vendors within Europe selling degoogled phones on eBay and other similar e-commerce sites. Also, look at the more specialist "digital freedom" commerce sites, like xmrbazaar.com - some vendors there too, I don't know if there are any in Brazil or shipping to Brazil.

Otherwise, there is a large Brazilian community in Europe, find someone who can bring something back with them next they visit home. The Brazilian I know here - I gather - brings various things back for other people when he goes home.

Wtf

Posted Mar 20, 2026 10:38 UTC (Fri) by leromarinvit (subscriber, #56850) [Link]

Depends on the demographic I guess - I was talking about the sort of power user who would do things like install F-Droid or just some manually downloaded APKs. Lots of people do that do block ads (obviously Google doesn't want that, so at the very least they don't actively care about that use case). If that now implies waiting 24h, it might just be easier to spend half an hour to install a different OS.

Of course, anything that forces people to use locked-down walled-garden devices is a problem in and of itself. Public services, at the very least, should be accessible without that IMHO (fortunately not an issue where I live), and employers should provide devices if they want to enforce specific rules. But I realize that many people (most even, globally speaking) don't have the luxury of being able to choose or put up a fight.

Wtf

Posted Mar 22, 2026 7:32 UTC (Sun) by danieldk (guest, #27876) [Link]

> 5. Be prevented from using your device to interact with any financial, medical, or governmental institution... as well as your employer. (On top of the usual consumption of DRM media which the overwhelming majority of folks actually do care about)

When you relock the bootloader after installing GrapheneOS, most financial, medical, or government apps work fine, as well as Netflix, etc. I can use all these things on my GrapheneOS phone without an issue.

https://privsec.dev/posts/android/banking-applications-co...

Pretextual garbage

Posted Mar 19, 2026 19:37 UTC (Thu) by jbills (subscriber, #161176) [Link] (8 responses)

> Flip the toggle and tap to confirm you are not being coerced

https://xkcd.com/538/. Nobody is gonna be fooled by this. This is obviously just a pretext to make sideloading more difficult, probably with the end goal of saying "nobody's using it, so we can just remove it".

Pretextual garbage

Posted Mar 20, 2026 7:55 UTC (Fri) by pbonzini (subscriber, #60935) [Link] (7 responses)

It's swiss cheese. The confirmation will catch 5% of the cases but its annoyance level is almost zero.

Pretextual garbage

Posted Mar 20, 2026 16:48 UTC (Fri) by rgmoore (✭ supporter ✭, #75) [Link] (6 responses)

The other thing is that it doesn't have to be perfect to be useful. All Google needs to do is to make scamming someone into installing a fake app on their phone less appealing to scammers than their many other options. It's like parking your bicycle next to one that has a worse lock than yours; you lock doesn't have to be impregnable, just a less appealing target than the next guy.

Pretextual garbage

Posted Mar 20, 2026 16:56 UTC (Fri) by mb (subscriber, #50428) [Link] (5 responses)

> All Google needs to do is to make scamming someone into installing a fake app on their phone
> less appealing to scammers than their many other options.

Oh. Interesting.
I thought this was all about protecting people?
Now you say it isn't about protecting people, because they will get scammed anyway. Which I fully agree with.
Scammers will just do something else? Correct! Scammers will just wait 24h and continue the scam? Correct!

This is about making sideloading as hard as possible for everybody. I oppose to that, because it makes my life harder with no benefit for anybody.

Pretextual garbage

Posted Mar 20, 2026 17:29 UTC (Fri) by pizza (subscriber, #46) [Link] (3 responses)

> I oppose to that, because it makes my life harder with no benefit for anybody.

It makes your life harder, sure.

But as numerous folks have pointed out, a "cooldown period" has been repeatedly demonstrated to make a sizeable difference in numerous other contexts, so please stop claiming that "nobody benefits".

This change is a poster child of unintended [1] consequences of regulatory actions. Google (along with Apple!) is being forced to place 3rd party app stores onto equal footing with their own, while simultaneously holding them responsible for "bad things happening" on the platform as a whole -- ie not just via apps delivered through their own storefront. While Google is arguably getting some secondary lock-in benefits from this, keep in mind that Android as a whole is *still* just a loss-leader moat around their actual business: targeted advertising.

Google doesn't have to provide this "unlock" option to placate a bunch of whiny nerds [2]. As much as it pains me to type this, we should be grateful they are bothering to provide this path at all -- Their competition certainly isn't.

[1] Cynics could reasonably argue that these consquences were in fact intentional, because keeping the platform owner as a singular gatekeeper makes it much easier for $governments to (a) get apps taken down and (b) go after app authors.
[2] That's what this looks like from the outside

Pretextual garbage

Posted Mar 20, 2026 21:36 UTC (Fri) by rgmoore (✭ supporter ✭, #75) [Link] (2 responses)

Google (along with Apple!) is being forced to place 3rd party app stores onto equal footing with their own, while simultaneously holding them responsible for "bad things happening" on the platform as a whole -- ie not just via apps delivered through their own storefront.

Count me as skeptical of how much blame Google will actually get for this kind of thing. Consumers are actually smarter judges than they're often given credit for. Yes, they will pay attention if one of the phone manufacturers lets their app store fill up with malware-ridden junk, but they understand how things work well enough to blame the scammers if people are convinced to install scam apps through unofficial channels.

Pretextual garbage

Posted Mar 21, 2026 13:50 UTC (Sat) by pizza (subscriber, #46) [Link] (1 responses)

> Count me as skeptical of how much blame Google will actually get for this kind of thing. Consumers are [...]

I'm not talking about "consumer" blame; I'm talking about *regulatory* blame, and efforts are underway (if not already in place) in more jurisdictions than not now that hold Google [+Apple] legally responsible for things that happens in their ecosystem **even if not distributed through their own storefronts**. For example:

https://torrentfreak.com/apple-revokes-eu-distribution-ri...

(tl;dr: Apple was ordered to yank a developer certificate due to sanctions. Apple complied, because what else are they supposed to do?)

Pretextual garbage

Posted Mar 21, 2026 14:55 UTC (Sat) by kleptog (subscriber, #1183) [Link]

> now that hold Google [+Apple] legally responsible for things that happens in their ecosystem **even if not distributed through their own storefronts**

Except that isn't happening (yet anyway). Your example shows that the DSA required Apple to allow third-party repositories. However, Apple choose to still be the gatekeeper of who was allowed to do that. And if they are the gatekeeper, of course they're going to be asked to revoke access in some situations.

Apple could also have chosen to allow side-loading apps without making themselves the gatekeeper. Then they couldn't have acceded to this request. Microsoft can't block people running programs on Windows, so they don't get asked to either.

This is classic: if you set yourself up as gatekeeper, you become responsible for the stuff you allow in. You can allow anything being loaded, then you are not responsible. What you can't choose (especially as a monopolist) is to gatekeep but disclaim all responsibility.

Pretextual garbage

Posted Mar 20, 2026 17:38 UTC (Fri) by farnz (subscriber, #17727) [Link]

It's the "swiss cheese" model of security. Each layer is like a slice of Emmentaler cheese; the overall security posture is a stack of randomly chosen slices of Emmentaler, and the scammer succeeds if, and only if, when they jab the top of the stack at random, they find a point where there's no cheese between them and the plate.

Very few layers are good enough to stop all scams. But enough layers, and the scammer's chance of success falls to the point where they find a new line of work, that doesn't involve mobile apps.

Third party stores

Posted Mar 19, 2026 19:45 UTC (Thu) by mikelr (subscriber, #99300) [Link] (4 responses)

> install apps from somewhere other than the Play Store

It seems this process won't apply to all apps installed outside of the Play Store, but rather apps signed by developers which haven't gone through the new proposed verification/registration steps.

Third party stores

Posted Mar 20, 2026 13:26 UTC (Fri) by LtWorf (subscriber, #124958) [Link] (2 responses)

So, most developers of libre software?

Third party stores

Posted Mar 20, 2026 14:06 UTC (Fri) by pizza (subscriber, #46) [Link] (1 responses)

> So, most developers of libre software?

... that don't already distribute their software through "official" channels too. Many (if not most!) already do.

But the reason this affects F-Droid so disproportionately is that everything they distribute is built on their own infrastructure using only the public source code of these libre applications -- and then sign said builds with F-droid's key, not the developer's.

Third party stores

Posted Mar 24, 2026 11:27 UTC (Tue) by LtWorf (subscriber, #124958) [Link]

Which is the sane thing to do if you want to know what you're shipping to the users, especially if reproducible builds aren't a thing yet.

F-Droid?

Posted Mar 20, 2026 14:02 UTC (Fri) by eru (subscriber, #2753) [Link]

Interesting point. I don't normally sideload, but I definitely want to use the F-Droid app store, which distributes binaries of FOSS apps. Does this mean I have to perform the enabling rain dance to use it, or only for some of what is offered there?

Equating F-Droid and other unofficial app stores to side-loading would make the change affect more people.

Experiment...

Posted Mar 19, 2026 19:55 UTC (Thu) by dskoll (subscriber, #1630) [Link] (3 responses)

What if you take out the SIM card and turn off the WiFi router in your house, set the device's clock back by 24 hours, do the unlocking ritual and reboot. When you then enable connectivity and the clock gets set correctly, can you skip the 24-hour delay? Interested to know the results of this experiment.

Experiment...

Posted Mar 19, 2026 20:00 UTC (Thu) by IanKelling (subscriber, #89418) [Link]

That was my first thought as well. date -s @$((EPOCHSECONDS + 60*60*24))

Experiment...

Posted Mar 19, 2026 21:13 UTC (Thu) by tux3 (subscriber, #101245) [Link]

I suspect they'll be using their Android TrustedTime, where they try to periodically sync time with a Google server.
If you just change the time through the OS, that's a different time source, this check probably doesn't trust the regular system clock. When the device boots it will refuse to return trusted time until you let it sync with Google servers again, so presumably you're stuck on the wait screen until you let your phone commune with the mothership again.

Experiment...

Posted Mar 20, 2026 11:13 UTC (Fri) by eduperez (guest, #11232) [Link]

The purpose of this feature is to protect users from scammers. If you really want to be scammed, and jump over all the safeguards, then I guess you deserve to be scammed.

Just warn

Posted Mar 19, 2026 21:09 UTC (Thu) by herber (subscriber, #16074) [Link] (3 responses)

Why not just add a warning that scammers ask you to do this so they can steal your information? That warning might be all the user needs to make a better decision.

Warning won't work

Posted Mar 19, 2026 21:16 UTC (Thu) by jpeisach (subscriber, #181966) [Link] (2 responses)

Scammers will just say "ignore it", or humans impulsively will just ignore things in their way of getting to what they want

24h won't work

Posted Mar 19, 2026 21:31 UTC (Thu) by mb (subscriber, #50428) [Link]

Sure.
And scammers will just call the other day and continue to scam.
And magazines for computer illiterate people will describe how to disable these things.
And websites will describe how to disable all these things.
And and and

We have all these things today and they will continue to exist.
People will continue just do stupid things.

Why do I have to wait 24h before I can do the stuff I need to do?
I am not going to install malware. I was never going to. Why do I have to wait?
Why do I have to wait, even if I already clicked dozens of buttons saying that I really want to do it?
Why does clicking dozens of buttons and warnings not work, but waiting 24h magically solves everything?

Can I please not be treated like an idiot?

Warning won't work

Posted Mar 22, 2026 19:59 UTC (Sun) by stephanlachnit (subscriber, #151361) [Link]

How about requiring to wait 30s before one can confirme the dialog?

Acceptable trade-off

Posted Mar 19, 2026 22:41 UTC (Thu) by hailfinger (subscriber, #76962) [Link] (3 responses)

The one-time 24-hour wait may be annoying, but IMHO it is a very reasonable trade-off between preventing impulse installation ("impulse buy") of an app from a non-Google app store for whatever reason and making it possible to install arbitrary apps.

It's absolutely not about preventing "stupid" people from doing stupid things. It may be effective in preventing people from doing things which other people consider to be stupid. However, "stupidity" is a highly subjective trait ascribed to people who disagree with you. Think "stupid for wanting nuclear power" vs. "stupid for rejecting nuclear power". A similar mechanism exists for "common sense", which is usually ascribed to persons who agree with you.

Such a forced wait time does one thing very effectively: forcing people to wait. A side effect may be that people being forced to wait will complain to others about it, and maybe those others can intervene if the reason for installing an app from another store is illegitimate. And as others have written in the comments, removing time pressure from a social engineering attack can make that attack more difficult to carry out.

People who want to enable another app store can either do that during phone setup (the wait still applies, but usually a phone needs to be set up before usage, so not all time is lost) or later (waiting is probably more annoying). There's also the option of installing another Android build (at least if the manufacturer allows that).

Acceptable trade-off

Posted Mar 19, 2026 22:52 UTC (Thu) by mb (subscriber, #50428) [Link] (2 responses)

>However, "stupidity" is a highly subjective trait ascribed to people who disagree with you

You are building a straw man.
Nobody thinks that it's a good idea to install malware.
Nobody disagrees with that it's bad to install malware.

>removing time pressure from a social engineering attack can make that attack more difficult to carry out.

How? We live in the time of LLMs. Attackers have access to LLMs that talk to victims.

Where do we go from here? Yesterday we clicked dozens of buttons. Today we wait 24 hours. Tomorrow we try to convince an LLM that we are intelligent. We are going to write exams about how we want to install an app that is not malicious and an LLM is going to grant access on pass.
Or we can stop here and not let Google waste our time.

It took 24 seconds to convince Android that we want to install an app yesterday.
Today it takes 24 hours.

>the wait still applies, but usually a phone needs to be set up before usage

Since when does that take anything near 24h?

>There's also the option of installing another Android build

This option doesn't exist, did never exist and is actively prevented by apps from banks, governments, etc...

Acceptable ending point?

Posted Mar 19, 2026 22:55 UTC (Thu) by corbet (editor, #1) [Link] (1 responses)

While this discussion has been mostly on-topic, it is beginning to go around in circles a bit. I would ask that all participants (not just the one I'm replying to) think before posting further, about whether they are adding something new to the conversation. If not, please consider holding off.

Acceptable ending point?

Posted Mar 21, 2026 0:39 UTC (Sat) by tmassey (guest, #52228) [Link]

> consider holding off

Oh, the irony… :)

(Sorry: couldn’t resist.)

Wipe or wait?

Posted Mar 20, 2026 0:50 UTC (Fri) by Fowl (subscriber, #65667) [Link] (4 responses)

I hope there's an alternative flow like for bootloader unlocks where you can wipe the device instead of waiting 24 hours.

I also wish it was "enroll new keys" rather than the being binary choice "disable enforcement".

"Trust Google+OEM" vs "trust anyone" is much worse than "Trust who I choose". Secure boot at least tried that direction.

Wipe or wait?

Posted Mar 20, 2026 6:42 UTC (Fri) by lutchann (subscriber, #8872) [Link]

> I also wish it was "enroll new keys" rather than the being binary choice "disable enforcement".

For my own use, I would like this option as well, but we're not the target audience. For a user who is just blindly following directions from a scammer, there is little functional difference between those two.

Wipe or wait?

Posted Mar 20, 2026 10:43 UTC (Fri) by paulj (subscriber, #341) [Link] (2 responses)

I'm hoping the EU MEPs will step in and mandate phone makers allow install of alternative ROMS *and* with the device programmable to recognise trust keys of said alternative ROMs.

They won't do so cause of tech-geek freedom, but the geo-political issues coming to the fore should make it clear to EU legislators that EU users should NOT be forced to trust non-EU giant-tech companies (which are completely infiltrated by Five Eyes plus a number of others), and that hence it would be best to require that EU users are able to install Free Software phone distros on their devices.

Wipe or wait?

Posted Mar 20, 2026 11:06 UTC (Fri) by pizza (subscriber, #46) [Link] (1 responses)

> the geo-political issues coming to the fore should make it clear to EU legislators that EU users should NOT be forced to trust non-EU giant-tech companies

....then they need to stop passing regulations that continue to entrench the market position of those existing (and very) dominant non-EU companies.

(Then there's the other problem of governments universally *wanting* a handful of big gatekeepers because that makes the job of their own police + intelligence apparatuses a lot easier/more effective)

Wipe or wait?

Posted Mar 20, 2026 14:37 UTC (Fri) by paulj (subscriber, #341) [Link]

> ....then they need to stop passing regulations that continue to entrench the market position of those existing (and very) dominant non-EU companies.

Indeed. Though, I think regulations in such a category largely were before the current geo-political shifts.

> Then there's the other problem of governments universally *wanting* a handful of big gatekeepers because that makes the job of their own police + intelligence apparatuses a lot easier/more effective

Indeed, I agree again. Again, there will be a tension here between the security-state interests in terms of ease of access for investigating normal criminal matters versus the interests of other parts of the security-state in guarding national-security interests (i.e., subversion by the USA, which clearly is no longer quite the friend of Europe it used to be - see reports today about Denmark having actually had plans to blow up some its own infrastructure in Greenland to at least ensure any US take-over would have to be an overt military action).

Then there is a further tension between the member state governments of the EU and the MEPs. The MEPs are much more attuned to individual and consumer interests (though, in terms of process at the EU, the EP is subsidiary to the member states in terms of setting agenda).

Welp

Posted Mar 20, 2026 8:18 UTC (Fri) by cmm (guest, #81305) [Link] (7 responses)

This actually is a reasonable compromize, provided you are at peace with the fact that most aspects of your life are shittier than they should be because "we live in a society", i.e. your every participation in a broad ecosystem is beholden to mental and behavioral deficiencies of the bottom quantile of that ecosystem's participants -- and if you are not at peace with this then don't blame Google, they are just the messenger.

What concerns me about the implementation is that the set property will probably be visible to things like Microsoft Intune in the work profile, and then I'll probably have to choose between having a work profile on the phone at all or keeping on using F-Droid (if that happens I'll personally choose F-Droid, but I imagine there are people who are less privileged).

Welp

Posted Mar 20, 2026 18:48 UTC (Fri) by ballombe (subscriber, #9523) [Link] (6 responses)

This is not about end user security : Google is actively distributing scam and malware through its ad network and has no plan to stop.

Google had made it much harder and costly to publish a truly free app on Google play (which is the real reason users need sideloading) because 35% of 0$ is 0$. By increasing developers cost, Google mechanically increases the proportion of paying or ad-supported apps, for which it can takes its cut. This is the goal, not an unfortunate side effect.

Welp

Posted Mar 20, 2026 19:14 UTC (Fri) by pizza (subscriber, #46) [Link] (3 responses)

> Google had made it much harder and costly to publish a truly free app on Google play

A one-time $25 registration fee is a fraction of the cost of the equipment you will need to develop -- and test -- your code. Along the way, you'll spend more than that on electricity, to say nothing of the value of your own time/expertise.

Welp

Posted Mar 20, 2026 20:58 UTC (Fri) by ballombe (subscriber, #9523) [Link] (2 responses)

The 25$ cost is the visible part of the scheme. My lab had a free app on Google Play and it was removed by Google without justification and we never managed to get it reinstated even after we paid fees.

Welp

Posted Mar 22, 2026 3:28 UTC (Sun) by gutschke (subscriber, #27910) [Link] (1 responses)

I recommend looking into making your app into a PWA. That completely avoids the Play Store. And other than being installed through the browser, it looks very similar to the end user. PWAs have access to a very powerful API these days and can do most of what native apps can do.

Welp

Posted Mar 22, 2026 18:46 UTC (Sun) by ballombe (subscriber, #9523) [Link]

This particular app is also available as a wasm PWA, but using the Android NDK provides better performance and power efficiency. It is also available through fdroid and termux.

Welp

Posted Mar 21, 2026 8:41 UTC (Sat) by cmm (guest, #81305) [Link] (1 responses)

I'm not sure how "Google is imprecise at executing other things and I suspect their incentives don't always align with the user's" is a relevant argument exactly?

Welp

Posted Mar 21, 2026 17:12 UTC (Sat) by ballombe (subscriber, #9523) [Link]

Because the easiest it is to publish through Google Play, the less side-loading is necessary, but Google is making both harder at the same time.

Select "Allow indefinitely" after device setup

Posted Mar 20, 2026 8:24 UTC (Fri) by kugel (subscriber, #70540) [Link] (2 responses)

I guess many people will go through these steps immediately after unpacking their new phone. At least I understand "Scroll past additional warnings and select either "Allow temporarily" (seven days) or "Allow indefinitely."" such that you can make the 24h wait a one time pain.

I would suggest to not apply the 24h wait time within the first hours of device setup. I think that would avoid the annoyance for the vast majority of people that *need* sideloading. Once after the phone is in use for a while the (questionable) 24h scammer protection is in place.

Select "Allow indefinitely" after device setup

Posted Mar 20, 2026 10:37 UTC (Fri) by farnz (subscriber, #17727) [Link]

Note that the 24h delay is a well-understood thing in circles that analyse scams - more than 24 hours is wasteful of time, but less isn't enough.

The point of a 24 hour delay is that you are very likely, in 24 hours, to speak to another person, sleep, and then speak to another person again before the delay expires. That takes all the urgency out, giving you time to think it through (and who hasn't had the experience of sleeping on a hard problem and then waking up with a good idea), and gives you a high chance of deciding to cancel the install because someone you spoke to convinced you it was a scam, resetting the timer for the scammers (who have to convince you to restart it).

Remember that it's a very well-known fact that people don't perform well when they're under pressure to get it right first time and in a hurry; a significant chunk of the discipline of Site Reliability Engineering in computing, and almost all of Crew Resource Management in flying, is about putting structures in place so that people don't feel under pressure to get it right first time in a hurry. Adding time (where you can), and making sure that you can make mistakes and correct them without feeling like you've created a worse problem by making the mistake. Scammers play on this by putting you under pressure to get it right immediately, and making you feel like you must not make a mistake for fear of the consequences; the time delay is well-understood to result in people rethinking what they're doing and going "no, that's surely a scam".

It's related to this paper about why scammers might claim to be from a country that is known for scamming - the key is that you don't want to try and scam people who won't fall for it, because it costs you something to attempt a scam, and if you're guaranteed not to fall for it, they'll get nothing, which in turn means they move onto something else (scamming someone else, trying a different scam, maybe even legitimate work).

Select "Allow indefinitely" after device setup

Posted Mar 20, 2026 18:16 UTC (Fri) by lutchann (subscriber, #8872) [Link]

> I would suggest to not apply the 24h wait time within the first hours of device setup.

I considered this too, but I suspect it would simply add a factory reset into the scammer's directions, making the situation even worse for the victim.

Keep Android Open update

Posted Mar 20, 2026 11:51 UTC (Fri) by gdiscry (subscriber, #91125) [Link] (3 responses)

I have followed what’s happening through the F-Droid blog and their open letter. Keep Android Open has published an update about this:

[…]

This entire flow is delivered through Google Play Services, not the Android OS, meaning Google can modify, restrict, or remove it at any time without an OS update and without any user consent. The advanced flow has still not appeared in any Android beta, dev preview, or canary release. As of the date of this update, it exists only as a blog post and UI mockups. The community is being asked to accept a product announcement as a functional safeguard five months before the mandate takes effect.

Until Google provides a shipping implementation that can be independently verified, our position remains unchanged: all apps from non-registered developers will be blocked once their lockdown goes into effect in September 2026.

Keep Android Open update

Posted Mar 20, 2026 12:17 UTC (Fri) by insi-eb (subscriber, #161562) [Link] (2 responses)

I can only agree with this.

Google is not doing this for blocking scams for the average 'joe phone-user' (that is just a very handy excuse). As stated elsewhere here, they could give us an easy way to disable that restriction if this would be just for blocking scams (also fine via developer options and a "you might be getting scammed" warning banner ...).

If you care about this and haven't done so, support 'Keep Android Open'.

Keep Android Open update

Posted Mar 20, 2026 16:24 UTC (Fri) by kleptog (subscriber, #1183) [Link] (1 responses)

> As stated elsewhere here, they could give us an easy way to disable that restriction if this would be just for blocking scams (also fine via developer options and a "you might be getting scammed" warning banner ...).

But that won't work:

Victim: it's telling me that enabling this option will allow scammers to install stuff on my phone.
Scammer: Yes, sorry about that. We've complained to Google about that but for now the only way to prevent Bad Thing is to enable it now.
Victim: I dunno...
Scammer: Remember, if you don't so this now, Bad Thing will destroy your life tomorrow.
Victim: oh, ok. [presses button]

Time delays have proven very effective to combat these kinds of tactics, which is why they are deployed in many places.

Personally, I find 24 hours a bit on the high side, but it seems like a lot of people here would still be complaining if it was 4 hours.

Keep Android Open update

Posted Mar 21, 2026 2:01 UTC (Sat) by Klaasjan (subscriber, #4951) [Link]

For the record, I am with kleptog on this matter.
4 hours is fine.
24 hours is on the long side, but it is less than an order of magnitude off. Close enough on a logarithmic scale.

rumbling on privacy and scammers

Posted Mar 20, 2026 12:14 UTC (Fri) by vuji (guest, #182841) [Link]

* i am from country, where access to internet is easy using mobile device and there are virtually no other reliable alternatives
* persons wishing to install apps even after 1 week is also possible. here intent and your decision are primary
* google itself provides innumerous methods or ways about how a person is utilising or what are other installed apps legally !
* frankly scammers should adapt and legally earn more money by simply utilising anti privacy methods provided by android os. period.
* as a person, do you want to become part and parcel of android survelliance ?
* disclaimer: i am writing lot here, but did i read LWN.net Privacy Policy at the time of account sign up. hell no.

What about Play Protect?

Posted Mar 20, 2026 15:14 UTC (Fri) by rbtree (guest, #129790) [Link] (31 responses)

It is only a matter of time before Google Play Protect, or whatever it is called these days, marks phones with "sideloading" unlocked as unsafe. In my country, your phone must pass all Play Protect checks if you want to participate in the society.

For example, if the bootloader is unlocked, or you're running something like Lineage or Graphene, you will not be able to do remote banking (since banking applications will refuse to start, and websites have been shut down ages ago by all major banks). You will not be able to access government services remotely. Banks especially are very intrusive: one major bank refuses to to launch if your phone has any remote access applications, and (I believe) even Discord.

Surely, Google will also be happy to provide "sideloading" status to them.

I am on many years out of date stock Android image because of this, even though my phone has excellent support by Lineage, with the latest Android version and all functionality working.

Looks like running two phones is the only way forward, one for personal things, and one for all of the official junk. It's probably safer anyway.

What about Play Protect?

Posted Mar 22, 2026 7:30 UTC (Sun) by danieldk (guest, #27876) [Link] (1 responses)

GrapheneOS supports relocking the bootloader. When you do so, a lot of banking apps work fine:

https://privsec.dev/posts/android/banking-applications-co...

(My Dutch credit card and banking apps work without any issues on GrapheneOS.)

GrapheneOS

Posted Mar 22, 2026 14:49 UTC (Sun) by corbet (editor, #1) [Link]

I run several banking apps under Graphene without problems. One definitely should check their specific apps before making the jump though, and it is always possible that a future update will refuse to run.

Online banking via browser (was What about Play Protect?)

Posted Mar 22, 2026 14:55 UTC (Sun) by dskoll (subscriber, #1630) [Link] (27 responses)

websites have been shut down ages ago by all major banks

Wow. I find that quite shocking. I do almost all of my banking from my Linux desktop computer and I think there would be a massive revolt if our banks (I'm in Canada) shut off web-based online banking. I can do everything from my computer that I could do from my phone except for deposit cheques by taking a picture of them. And since I hardly ever receive cheques anyway, that's no big deal.

Online banking via browser (was What about Play Protect?)

Posted Mar 22, 2026 16:04 UTC (Sun) by Wol (subscriber, #4433) [Link] (25 responses)

Same - I just think it a bit naff that you can't deposit a cheque by scanning it and uploading an image. Oh well.

And you can deposit cheques at some cash machines - both in-branch and street-accessible.

Cheers,
Wol

Online banking via browser (was What about Play Protect?)

Posted Mar 22, 2026 19:07 UTC (Sun) by lutchann (subscriber, #8872) [Link] (24 responses)

> I just think it a bit naff that you can't deposit a cheque by scanning it and uploading an image.

When my old bank originally rolled out remote check deposit years ago, they only supported it on their phone app. I emailed and asked why I couldn't do it through their website, and got a surprisingly honest reply that their vendor wouldn't support it because so many people are incompetent at scanning, so taking a picture with a smartphone was much more reliable at producing usable images.

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 10:55 UTC (Mon) by taladar (subscriber, #68407) [Link] (23 responses)

As an over 40yo German who has never used a cheque in his life or even seen one other than traveller cheques I sometimes wonder what kind of outdated systems other countries use there. Everything here has been direct bank transfers for as long as I remember, back in the day before online banking via paper form the sender of the money put into a special mailbox (or a box inside the bank during opening hours).

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 11:32 UTC (Mon) by amacater (subscriber, #790) [Link]

My trades union membership provides a death benefit to a nominated dependant. It's not a huge amount of money, but if I die in employment they will pay it to my daughter - by paper cheque :(
Even banks have difficulty with cheques these days - I hope to live a long and happy life and to still be in employment five years from now (I'm in my 60s).

Heaven knows what will happen when darling daughter finally gets to collect, if she does.

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 12:02 UTC (Mon) by paulj (subscriber, #341) [Link] (21 responses)

I think it's just the USA and (judging by dskoll's comment) Canada that still use cheques.

I havn't seen one in decades in the Celtic Isles.

Likes of NL never really used cheques (in my lifetime) - you did a "giro", which I guess was pretty much the same system as DE. Just a straight bank transfer back in the day to pay someone. Giro form was somewhat standardised and businesses could print a giro form with all their details already filled in with their invoice to make it easy to pay them. As you say, you just added your own details and handed it in (or posted it) to your bank branch and it would be taken care of. No bad cheques!

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 14:01 UTC (Mon) by Wol (subscriber, #4433) [Link] (14 responses)

> I havn't seen one in decades in the Celtic Isles.

I've still got a bunch of cheque books. I still use them occasionally.

> Likes of NL never really used cheques (in my lifetime) - you did a "giro", which I guess was pretty much the same system as DE. Just a straight bank transfer back in the day to pay someone. Giro form was somewhat standardised and businesses could print a giro form with all their details already filled in with their invoice to make it easy to pay them. As you say, you just added your own details and handed it in (or posted it) to your bank branch and it would be taken care of. No bad cheques!

Sounds like a "giro" as you call it was just a standard paying in slip (I thought it was something else). There's never been any need for the person paying in, and the bank account, to be related in any way. If you know the account details you're paying into, you can pay into pretty much any account. Banks do tend to want the details on the standard slip, though, if you're doing it in person at a branch (I believe so they can check the details - money laundering and all that stuff).

Cheers,
Wol

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 16:05 UTC (Mon) by anselm (subscriber, #2796) [Link] (1 responses)

Sounds like a "giro" as you call it was just a standard paying in slip (I thought it was something else). There's never been any need for the person paying in, and the bank account, to be related in any way. If you know the account details you're paying into, you can pay into pretty much any account.

Not quite. The idea is to tell your bank to take X amount from your account P and transfer it to another person's or company's account Q, possibly at a completely different bank. No actual money is involved. Way back when, the bank had little paper forms for you to fill out, but now this is mostly online, and in fact according to new regulations in the EU must be able to be performed in real-time. (Back in the days of the little paper forms the banks would take a few days to sort things out and put the money to good use on their own behalf in the meantime – nowadays they have 10 seconds to get their act together. The banks really, really hate this because now they must track every transaction on its own, where in the old days bank X would just total up, overnight, everything going from it to bank Y on that day and bank Y would total up everything going from it to bank X on that day, and they would figure out the difference and settle up in a single transaction.)

When I used to live in the UK (a few decades ago, to be fair) I was appalled when I opened my bank account and the bank guy handed me a cheque book. I found out to my horror that direct giro transfers (even with the little paper forms) weren't actually a thing in the UK, even though cheques had already been virtually abolished here in Germany at the time. It felt like the Middle Ages to me.

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 17:05 UTC (Mon) by Wol (subscriber, #4433) [Link]

> Not quite. The idea is to tell your bank to take X amount from your account P and transfer it to another person's or company's account Q, possibly at a completely different bank. No actual money is involved.

Not quite? Yes exactly!

I just walk into my bank with my bank card and the paying-in slip, and say "please transfer £X" (actually, I would probably have already filled in X). No actual money is involved!

(If I couldn't attend the bank during banking hours, I regularly stapled the paying-in slip to a cheque, and posted it through the letter box.)

In your scenario, how does your bank know where to take the money FROM? Fill that in, and our two scenarios are exactly identical.

Cheers,
Wol

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 16:53 UTC (Mon) by paulj (subscriber, #341) [Link] (11 responses)

> Sounds like a "giro" as you call it was just a standard paying in slip (I thought it was something else).

Kind of, but a bit more formalised. The deposit and transfer slips in Celtic Isle banks tended to be bank-specific and vary a bit between them. You would get the slip from your own bank, and you would fill it in.

The giro slips (apparently 'acceptgiro' is the full term, but IIRC everyone just said 'giro', but ICBM) in NL were standardised, and they came pre-filled in with the bank details of the recipient. Businesses issuing invoices often also printed in the required amount, and there was space for stuff like an invoice/refernece number. The payer then took/received/got the 'acceptgiro' from the payee (recipient), put their own details in and gave/sent the completed giro slip to their bank and payment would be made by the payer's bank to the payee's.

I.e., it worked the /other way/ around from the anglo cheque system. The payee gave the slip with the payee's details to the payer, and the payer would give the slip to their bank to make the payment. Where the cheque, the payer had a book of slips with the payer's details, which they filled in with the payee's details, and gave to the payee for the payee to give to the payee's bank to /request/ payment from the payer's.

Push Vs pull. Also, acceptgiros were cleared and reconciled within days usually - where cheques often took 1 to 2 weeks to reconcile (cheque reconciliation requiring the extra step of that first 'pull' communication from the payee's bank to the payer's).

I gather giros could also be used to setup recurring payments. I don't have experience of that though.

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 17:19 UTC (Mon) by Wol (subscriber, #4433) [Link] (10 responses)

> The giro slips (apparently 'acceptgiro' is the full term, but IIRC everyone just said 'giro', but ICBM) in NL were standardised, and they came pre-filled in with the bank details of the recipient. Businesses issuing invoices often also printed in the required amount, and there was space for stuff like an invoice/refernece number. The payer then took/received/got the 'acceptgiro' from the payee (recipient), put their own details in and gave/sent the completed giro slip to their bank and payment would be made by the payer's bank to the payee's.

> I.e., it worked the /other way/ around from the anglo cheque system. The payee gave the slip with the payee's details to the payer, and the payer would give the slip to their bank to make the payment. Where the cheque, the payer had a book of slips with the payer's details, which they filled in with the payee's details, and gave to the payee for the payee to give to the payee's bank to /request/ payment from the payer's.

??????

Bear in mind I'm not talking a couple of decades ago, I'm talking a lifetime ago, ... your two scenarios are the exact same scenario, just described in two different ways!

The British banking system requires TWO pieces of information - where the money is coming from, and where it is going to. Seen in that light, there is absolutely no difference between a giro and a paying in slip. They both provide the "where it's going to".

The payer (in both your scenario and mine) has to provide the "where it is coming from".

So let's take a concrete example. A business sends me a bill, with a "giro" printed on the bottom. I take it to the bank and pay it. I want some money from a friend, I give them a paying-in slip, they take it to a bank and hand over the money.

As for how long it takes to clear, if I walk into a bank with a debit card to pay the "giro" it clears instantly. If I staple a cheque to it, it clears like any other cheque (which is basically down to a - then somewhat antiquated - nightly batch processing system. It's improved a lot since).

So what I was doing forty years ago exactly matches BOTH of your scenarios, depending on how it was done. Your "acceptgiro" is exactly the same as our cheque system, except that the payee printed the cheque, not the bank!

Cheers,
Wol

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 22:18 UTC (Mon) by kleptog (subscriber, #1183) [Link] (9 responses)

> So what I was doing forty years ago exactly matches BOTH of your scenarios, depending on how it was done. Your "acceptgiro" is exactly the same as our cheque system, except that the payee printed the cheque, not the bank!

Your examples are not making very clear which bank you're going to. I know in Australia we could print a pay-in slip on the invoice but it only worked for one bank and people had to go to that bank to pay it. The magic of acceptgiro was that it was standardised and that you submitted your payments your own bank. You basically received invoices in the mail, tore off the slips, filled in your details and then mailed them all to your bank. Since your own bank has your signature on file, it cleared quickly.

What make cheques slow is that the bank receiving the cheque doesn't have the info to verify it. Unless you're saying in the UK you could mail a cheque to your own bank to get money transferred? I didn't think it worked like that.

Your example of stapling a cheque to pay-in slip makes little sense if you're submitting to your own bank. The teller can simply execute the payment on the spot.

Online banking via browser (was What about Play Protect?)

Posted Mar 24, 2026 8:24 UTC (Tue) by Wol (subscriber, #4433) [Link] (8 responses)

> Your examples are not making very clear which bank you're going to. I know in Australia we could print a pay-in slip on the invoice but it only worked for one bank and people had to go to that bank to pay it. The magic of acceptgiro was that it was standardised and that you submitted your payments your own bank. You basically received invoices in the mail, tore off the slips, filled in your details and then mailed them all to your bank. Since your own bank has your signature on file, it cleared quickly.

All official slips (both cheques and paying in slips) had the account details in a standard ocr-friendly font at the bottom, in a standard layout.

Otherwise, how would you pay your cheque into someone else's bank? Generally a bank would refuse to accept the payment unless it was either the payer's bank or the payee's. But you could take it to any bank and they could process it for you.

> What make cheques slow is that the bank receiving the cheque doesn't have the info to verify it. Unless you're saying in the UK you could mail a cheque to your own bank to get money transferred? I didn't think it worked like that.

And isn't exactly the same true for your "acceptgiro"? Unless you take it to a cashier, and they verify your identity, how do they know they know the pay*er*s account is genuine (as in, somebody isn't fraudulently using someone else's account to take the money out of?)

> Your example of stapling a cheque to pay-in slip makes little sense if you're submitting to your own bank. The teller can simply execute the payment on the spot.

And if I take it to the pay*ee*s bank the teller can simply execute the payment on the spot!

What we've both missed in previous comments is fraud prevention! (Me taking a signed cheque to my own branch is not proof said cheque is genuine!)

The UK's system is - and has been my entire life - symmetric. I have two pieces of paper (in your case one, your acceptgiro), that contains the payees details and the payers details. I can take them to ANY bank.

Banks now verify both the payee and payer account (which is why the Post Office won't accept cash for deposit with a hand-filled paying in slip - they can't verify it). It's usually the case that if you use and hand-filled paying in slip you have to pay in at the payee's bank, so they can check their systems and show the account exists.

Then lastly, there's the fraud aspect. Is the payment irrevocable (cash-equivalent), or revocable (cheque equivalent, is the cheque (a) genuine, and (b) authorised).

You haven't touched at all on the revocability of fraudulent transactions. What happens with your acceptgiro system if I buy your account details on the dark net, and use them to pay my bills? (Or worse, pay them into another stolen account that I can withdraw cash from?).

So the UK system is very simple. Provided I have the payer's AND the payee's account (your examples keep on forgetting one of them), I can make a payment at ANY bank. If the payment is irrevocable (cash, debit card, and the like) they will insist on verifying the payee, and the money will appear as available in the payee's account "instantly". If the payment is revocable (cheque, as far as I can tell this includes your acceptgiro), the money again appears in the payee's account "instantly", but is held in "clearing" until the payer has had a chance to see and object to the payment.

The reason our system seemed archaic is that the clearing system WAS archaic. All cheques went to a central clearing house for sorting, then they got returned to the "issuing branch" where the customer had their account, then they got checked by the branch. Nowadays, all this paperwork is scanned, and emailed to the appropriate "branch" for checking as required.

"Instantly" usually meant "next day", because the banks would send all transfers by CHAPS on 9-track tape to be processed at Central Clearing, which just happened to be physically located down the road from where I lived :-) - a mile away?

Cheers,
Wol

Online banking via browser (was What about Play Protect?)

Posted Mar 24, 2026 11:04 UTC (Tue) by paulj (subscriber, #341) [Link] (4 responses)

> The reason our system seemed archaic is that the clearing system WAS archaic. All cheques went to a central clearing house for sorting, then they got returned to the "issuing branch" where the customer had their account, then they got checked by the branch.

This was part of the 'innovation' of acceptgiros - it didn't just mandate the standardised slips (the user "UI") it also standardised the bank transfer system so that the giros would be reconciled fairly clearly. Even "back in the day" (e.g. 80s), a giro would clear within about 2 days. Cheques over in the Celtic isles took about a week minimum, often more (cheque reconciliation inherently requires extra steps, given the cheque goes via the payee to the payee's bank, then has to go to the payer's bank, and only /then/ can the process of the payer's bank paying the payee's start).

You keep noting that you could hand in a transfer slip to your local bank. That may be so, but... people overwhelmingly used cheques in the Celtic Isles back in the day. I assume there was a reason why payer-initiated bank transfers were not the norm, and hence I assume there was a reason why they were not better / more convenient than cheques. Possibly bank transfers were just as slow as cheques.... (??).

Either way, the normal way to pay people/businesses in the Celtic Isles - cheques - sucked back in the day, in terms of convenience and (especially speed, compared to what was the norm in the likes of NL (and perhaps other Germanic countries like DE?).

Anyway... I fear Jon is about to drag me out of LWN and eject me on to the street. ;)

Online banking via browser (was What about Play Protect?)

Posted Mar 24, 2026 11:26 UTC (Tue) by Wol (subscriber, #4433) [Link] (3 responses)

> This was part of the 'innovation' of acceptgiros - it didn't just mandate the standardised slips (the user "UI") it also standardised the bank transfer system so that the giros would be reconciled fairly clearly. Even "back in the day" (e.g. 80s), a giro would clear within about 2 days. Cheques over in the Celtic isles took about a week minimum, often more (cheque reconciliation inherently requires extra steps, given the cheque goes via the payee to the payee's bank, then has to go to the payer's bank, and only /then/ can the process of the payer's bank paying the payee's start).

You've just missed out "checked for fraud". Even in the 60s in the UK, it took just one day for cheques to be *reconciled* clearly. If I paid a cheque in on Monday, that money would be in the payee's bank account on Tuesday. They just couldn't touch it until the following Monday, in case it was fraudulent.

> You keep noting that you could hand in a transfer slip to your local bank. That may be so, but... people overwhelmingly used cheques in the Celtic Isles back in the day. I assume there was a reason why payer-initiated bank transfers were not the norm, and hence I assume there was a reason why they were not better / more convenient than cheques. Possibly bank transfers were just as slow as cheques.... (??).

I *guess* because the pay*ee*s systems weren't up to it? They couldn't reconcile a bank statement against their sales ledger? Or maybe because the bank statements didn't (couldn't) show a "reference" field. So the payee needed to process the cheque so they knew who had paid what bill.

> Either way, the normal way to pay people/businesses in the Celtic Isles - cheques - sucked back in the day, in terms of convenience and (especially speed, compared to what was the norm in the likes of NL (and perhaps other Germanic countries like DE?).

It sucked even compared to what was available in the UK! My bank in the 60s was the London Trustee Savings Banks, and cash(equivalent) transactions happened instantly. Likewise the Building Societies. It was only the big old banks that took 24 hours.

(Oh - and I didn't think of it, but the reason why there was no difference between going to my bank or the payee's bank, was that *validating* the cheque took place in the back office, which was quite often not the same place as the front office, so it didn't matter where a cheque entered the system they were all handled exactly the same ... it took legal changes to make the banks shorten the time before cheques were considered "cleared" and the funds available to payees.)

> Anyway... I fear Jon is about to drag me out of LWN and eject me on to the street. ;)

Ditto :-)

Cheers,
Wol

Online banking via browser (was What about Play Protect?)

Posted Mar 24, 2026 12:06 UTC (Tue) by paulj (subscriber, #341) [Link] (2 responses)

Hmm, I can't remember exactly what happened with cheques and where you saw the amount pending, just remember it took time to clear.

If you say the amount was posted to the payee's account quickly as a pending amount, but not available, well exactly! The payee's bank can indeed easily do that but it still took a week to complete the reconciliation (cheque -> payer's bank, payer's bank validates the cheque and debits the payer's account, payer's bank notifies payee's, payee's bank and posts the amount as a final credit to the payee). That was exactly the inefficiency. It took time.

Online banking via browser (was What about Play Protect?)

Posted Mar 24, 2026 12:55 UTC (Tue) by Wol (subscriber, #4433) [Link] (1 responses)

> but it still took a week to complete the reconciliation (cheque -> payer's bank, payer's bank validates the cheque and debits the payer's account, payer's bank notifies payee's, payee's bank and posts the amount as a final credit to the payee). That was exactly the inefficiency. It took time.

Except most of what you describe never happened, apart from the paper shuffling. I remember being shocked when a cheque I wrote bounced. Bear in mind I'd been banking with this bank for 15 years, when it bounced a check for £5000. Being a large amount, it set off the fraud alarms, and when the bank went to check the signature, they discovered they didn't have an official signature to check against!

All this five days, two days, whatever, was just a delay the banks built in to give the pay*er* time to spot a problem and say "this is fraudulent". The banks didn't do anything unless a transaction was suspicious in one way or another.

So this clearing delay is exactly the same sort of idea as the 24hr delay (trying to keep this post on topic :-). It provides time for the parties involved to spot a problem before the transaction becomes irreversible. But the actual transaction does go through "immediately", it just doesn't finalise until the time limit was up. (Which is just an automated "okay, five days have passed, make this money available".)

Cheers,
Wol

Online banking via browser (was What about Play Protect?)

Posted Mar 24, 2026 13:30 UTC (Tue) by paulj (subscriber, #341) [Link]

> Except most of what you describe never happened, apart from the paper shuffling.

It is what happened. Banks did club together to create clearing houses, to make clearing between member banks in bulk easier, and give more centralised places to clear cheques between clearing houses (e.g., Scottish banks had their own clearing house). The cheque (or an image or some form of the information aggregated into the bulk update to member bank's accounts) still did have to be reconciled by the bank itself though to finalise the transfer ("detect fraud" as you put it).

The process for clearing cheques between banks within the City of London was literally called "walks". ;)

According to this (page 21), while there was significant automation in the collation and telling of cheques, the process in England still required transferring the actual paper cheques up until 1996!

https://www.scribd.com/document/39451807/History-Publicat...

Anyway, Jon is standing here with a baseball bat, and I think we both can further just defer to histories such as the above and googling with our favourite search enginge (e.g. DDG, whatever). ;)

Online banking via browser (was What about Play Protect?)

Posted Mar 24, 2026 14:38 UTC (Tue) by rgmoore (✭ supporter ✭, #75) [Link] (1 responses)

And isn't exactly the same true for your "acceptgiro"? Unless you take it to a cashier, and they verify your identity, how do they know they know the pay*er*s account is genuine (as in, somebody isn't fraudulently using someone else's account to take the money out of?)

I think the idea is that your payee info and payer info are distinct, kind of like a public and private crypto key. You can publish your payee info for everyone to see, and all they can ever do with it is to give you money. You keep your payer info secret from everyone but your own bank, which has an incentive to keep it safe. That improves security.

There's also less room for someone to alter the information on the giro than there is on a check. One form of check fraud is for the payee to alter the amount of the check. That doesn't work with a giro because the payee never sees it again after sending it out. The payer could theoretically change it, but that's just like writing a check for a different amount than the invoice; the payee can refund an excess or demand complete payment. There's also less room for the payer to send the wrong amount inadvertently; they don't have to transcribe the payment amount from the bill to the giro, so there's one less place to make a mistake.

It also saves a step, at least for things like paying a bill. With a check, the payee sends the payer a bill, the payer sends the payee a check, the payee endorses the check and sends it to the bank, and the bank then clears the check. With giro, the payee can include the giro with the bill. Instead of having to send something back to the payee, the payer sends the giro straight to the bank to be cleared.

Let's stop here

Posted Mar 24, 2026 14:43 UTC (Tue) by jzb (editor, #7867) [Link]

This is way off topic, and we've asked a few times now elsewhere to end the thread. Please stop here.

Online banking via browser (was What about Play Protect?)

Posted Mar 24, 2026 15:04 UTC (Tue) by kleptog (subscriber, #1183) [Link]

> Then lastly, there's the fraud aspect. Is the payment irrevocable (cash-equivalent), or revocable (cheque equivalent, is the cheque (a) genuine, and (b) authorised).

This is getting off into the weeds, but you couldn't transfer to any account. The organisation asking for payment pre-printed the amount, their bank account details and reference numbers. They often also preprinted your name and account details so the only thing you had to do was sign it. The printing of acceptgiros was strictly regulated with all sorts of checks.

That said, fraud did happen, just like with cheques. You got your money back in that case.

It's all theoretical now, since they were abolished a few years ago due to lack of use, having been replaced by digital payment methods (e.g. iDeal).

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 14:26 UTC (Mon) by dskoll (subscriber, #1630) [Link]

Cheques are used occasionally in Canada, but much less often than in the USA. We have a very convenient and free payment system called Interac e-Transfer which has pretty much eliminated cheques.

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 16:49 UTC (Mon) by rgmoore (✭ supporter ✭, #75) [Link] (3 responses)

I think it's just the USA and (judging by dskoll's comment) Canada that still use cheques.

Canadians may use cheques, but the USA has always used checks*. In the past 10 years or so, they've moved from being a common way of transferring money to being a weird old tech that still gets used for the occasional corner case and to accommodate people who haven't adapted to the modern financial system. In my personal experience they are used in two cases: when a company wants to send money to a whole bunch of people without bothering to ask for their financial information first, or when dealing with people who haven't adapted to the modern financial system.

*This is actually the rare case where the USA stuck with a traditional spelling and the UK switched to a new one. I don't know all the details, but the traditional spelling was "check", and the UK adopted the French spelling "cheque" sometime during the 1800s, probably because it looked fancier and more sophisticated.

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 17:19 UTC (Mon) by pizza (subscriber, #46) [Link]

> In my personal experience they are used in two cases: when a company wants to send money to a whole bunch of people without bothering to ask for their financial information first, or when dealing with people who haven't adapted to the modern financial system.

Also: large transactions/payments between arbitrary parties -- because the various convenient/electronic options either have low upper limits, high fees, or are unavailable to mere mortals.

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 17:26 UTC (Mon) by Wol (subscriber, #4433) [Link] (1 responses)

> This is actually the rare case where the USA stuck with a traditional spelling and the UK switched to a new one.

Not rare at all, in fact it's the NORM that American spelling is closer to traditional than English spelling.

When they were in the middle of codifying the language with dictionaries, London was in the middle of a French craze, so all our "official" spellings were frenchified.

Cheers,
Wol

Please stay on-topic

Posted Mar 23, 2026 17:37 UTC (Mon) by corbet (editor, #1) [Link]

It seems to me that this conversation is already long enough; perhaps we can try to stay on topic at least? Once again, I'll ask everybody involved: only post if you are advancing the conversation in a useful way. Please.

Online banking via browser (was What about Play Protect?)

Posted Mar 23, 2026 17:56 UTC (Mon) by bobolopolis (subscriber, #119051) [Link]

In my small city in the USA, the city accepts credit cards or checks as payment for certain utility services, mainly water, sewer, and garbage collection. If you pay with a credit card, they charge an additional 3% fee. This fee makes it slightly cheaper for me to mail a check than to use a credit card, including the cost of the stamp, envelope, and check. I could save the cost of the stamp and envelope if I wanted to drop the payment off at their office in person. It must cost them more in labor to manually process the checks, but maybe enough people pay with credit cards they don't care?

So I still write a check every month, but this is the only thing I've used a check for in years. It's still quite common for people that rent housing to pay their landlord with a check, at least in my area.

Online banking via browser (was What about Play Protect?)

Posted Mar 24, 2026 13:36 UTC (Tue) by rbtree (guest, #129790) [Link]

Last time I was able to use a bank's website was 2019, and it was barely functioning even then, with several critical features bugging out. They then shut it down to save money, allegedly because nobody used it. And that bank was one of the last to close their web portal, others did it even earlier.

Several banks still maintain web portals, but only for their business clients. Private individuals are 100% out of luck.

Western countries have a habit of copying questionable tech ideas from countries like mine with a delay of 5-10 years (I can think of several, but I'd rather not digress into even further offtop).

So I wouldn't be surprised to see something like this pop up by ~2030 or a bit later. Either them shutting down web portals, or introducing device attestation "for your safety". Google already tried this recently.

Try credit unions (at least in the US)

Posted Mar 22, 2026 22:02 UTC (Sun) by jjs (guest, #10315) [Link]

"websites have been shut down ages ago by all major banks".

I use credit unions. Unless I'm doing something that requires it (depositing physical currency or something like that), I don't need to step into my credit unions - can do everything remotely via their websites, can even do electronic deposits.

Don't know if their apps don't work in GraphenOS or Lineage, but certainly their websites should still work in a web browser.

Attack on General Purpose Computing

Posted Mar 21, 2026 19:25 UTC (Sat) by donbarry (guest, #10485) [Link]

I'm reminded of an Apple fanboy tech inviting an Apple sales team to give a program on moving education onto iPads in my academic college department about 15 years ago. I prepared a dossier on the downsides which I circulated as the salesmen arrived (and also passed to the two giving the presentation).

I pointed out that the hardware would require that any instructional software we prepared be sent up to Apple and signed/endorsed before we could even install it on the hardware we (or students) owned. They could alter that trust unilaterally at
any time.

The Apple team was furious. But my points were pretty much unanimously received and agreed by my academic colleagues (if not by the fanboy tech, who was just as furious as the Apple team). No one wanted a closed Apple shop for education.

In the old days, one could trivially pass a floppy disk (later, memory stick) to another to share something one had created or curated with another. The F-Droid Android free/libre play store replacement allows sharing packages with nearby
devices also running F-Droid.

But the trend towards locking things down for only mother-ship approved and signed officialdom proceeds apace.

We were assured that Mozilla's package signing policy was a mere formality. Now we have to run special respins of Firefox to install certain paywall-bypass extensions that Mozilla won't sign. Whenever we are told that signed authority chains on OUR OWN HARDWARE are "for our own safety" (when not "for our own good") the "safety" and "good" are rarely as simple or as personal as we are assured.

Even some free/libre software ships that enforce antifeatures, like "respecting" anti-copy flags in PDF documents. At least there, one can patch the software to remove the antifeature.

As the old saying goes about software, that when using proprietary software that has a lord and master, they become your master, the same can be said for the encroachment of antifeatures "for our own good" in both hardware and software of increasingly essential devices. Those who decide the antifeatures become our lords and masters if we allow it.

I won't, and I'll continue to recruit others in the common fight against it.

took them long enough

Posted Mar 23, 2026 11:44 UTC (Mon) by d4no0 (guest, #115694) [Link] (3 responses)

The only thing that is strange to me is that it took Google so long to lock down the devices, I expected it much sooner. The last time they pulled a stinker like this was when they pretty much silently changed how native binaries can be embedded into an android application, breaking in the process a lot of useful tools like termux. Back then their motive was pretty much the same: "making the OS more secure", when in reality their main scope was to lock down all app developers in their bloated SDK and to restrict free computing as much as possible.

I guess it's only a question of time now until they close their last holes that give users any form of freedom.

took them long enough

Posted Mar 23, 2026 14:27 UTC (Mon) by mjg59 (subscriber, #23239) [Link] (2 responses)

> The last time they pulled a stinker like this was when they pretty much silently changed how native binaries can be embedded into an android application

As someone who was in the room for that decision: it was genuinely about security, and security actually had to push for it to happen. It wasn't about embedded binaries, it was about apps being able to download other arbitrary code (native or otherwise). We were seeing malware being distributed via the Play Store in a way where the malicious code was downloaded by the app after installation, preventing scanning of it. After the change, Play Store installed apps had to download any additional code from the Play Store.

took them long enough

Posted Mar 23, 2026 14:53 UTC (Mon) by mb (subscriber, #50428) [Link]

Sure, we all make mistakes. And that's fine.
But now there's the opportunity to fix this mistake and let the user owning the device decide whether they want to install such "dangerous" apps like termux.

If you are going to pull the opportunity to sideload termux of if you pull the API level that termux needs to load and execute internal binaries, this will be the end of Android for me.

I am the user of the device, I am not going to install malware and I want to install the applications that I want to have.
I don't need mommy Google to look after me and make my device "secure" by disabling the things I depend on.

Please keep that in mind when doing the next decision that would prevent termux completely.

took them long enough

Posted Mar 23, 2026 15:49 UTC (Mon) by fsp (subscriber, #182291) [Link]

I can understand that logic, even though I guess nowadays everything can be justified with "security".
A 24h delay however, does not seem genuine at all and it actually feels like a slap in the face.
If they want *actual* security, they will have to lock all of it all the way down to the actual hardware.
I guess I can't feel safe until the day comes, when every single instruction is signed with a burned-in google key (which surely will never be leaked) checked by hardware and I will need to send my own programs to them for a signature.
Seems like a bright future to me.


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds