Business Google will block sideloading of unverified Android apps starting next year - Google says it's no different than checking IDs at the airport.

Suggested I&T threads to sperg:
https://kiwifarms.st/threads/sideloading-general.209934/
https://kiwifarms.st/threads/android-hate-thread.175965/
https://kiwifarms.st/threads/your-current-and-next-phone.103205/

https://arstechnica.com/gadgets/2025/08/google-will-block-sideloading-of-unverified-android-apps-starting-next-year/

https://archive.ph/9bzZd

Google says it's no different than checking IDs at the airport.

Ryan Whitwam – Aug 25, 2025

Android's open nature set it apart from the iPhone as the era of touchscreen smartphones began nearly two decades ago. Little by little, Google has traded some of that openness for security, and its next security initiative could make the biggest concessions yet in the name of blocking bad apps. Google has announced plans to begin verifying the identities of all Android app developers, and not just those publishing on the Play Store. Google intends to verify developer identities no matter where they offer their content, and apps without verification won't work on most Android devices in the coming years.

Google used to do very little curation of the Play Store (or Android Market, if you go back far enough), but it has long sought to improve the platform's reputation as being less secure than the Apple App Store. Years ago, you could publish actual exploits in the official store to gain root access on phones, but now there are multiple reviews and detection mechanisms to reduce the prevalence of malware and banned content. While the Play Store is still not perfect, Google claims apps sideloaded from outside its store are 50 times more likely to contain malware.

This, we are led to believe, is the impetus for Google's new developer verification system. The company describes it like an "ID check at the airport." Since requiring all Google Play app developers to verify their identities in 2023, it has seen a precipitous drop in malware and fraud. Bad actors in Google Play leveraged anonymity to distribute malicious apps, so it stands to reason that verifying app developers outside of Google Play could also enhance security.

However, making that happen outside of its app store will require Google to take a page from Apple's playbook and flex its muscle in a way many Android users and developers could find intrusive. Google plans to create a streamlined Android Developer Console, which devs will use if they plan to distribute apps outside of the Play Store. After verifying their identities, developers will have to register the package name and signing keys of their apps. Google won't check the content or functionality of the apps, though.


An early look at the streamlined Android Developer Console for sideloaded apps.

Google says that only apps with verified identities will be installable on certified Android devices, which is virtually every Android-based device—if it has Google services on it, it's a certified device. If you have a non-Google build of Android on your phone, none of this applies. However, that's a vanishingly small fraction of the Android ecosystem outside of China.

Google plans to begin testing this system with early access in October of this year. In March 2026, all developers will have access to the new console to get verified. In September 2026, Google plans to launch this feature in Brazil, Indonesia, Singapore, and Thailand. The next step is still hazy, but Google is targeting 2027 to expand the verification requirements globally.

A seismic shift​

This plan comes at a major crossroads for Android. The ongoing Google Play antitrust case brought by Epic Games may finally force changes to Google Play in the coming months. Google lost its appeal of the verdict several weeks ago, and while it plans to appeal the case to the US Supreme Court, the company will have to begin altering its app distribution scheme, barring further legal maneuvering.



Among other things, the court has ordered that Google must distribute third-party app stores and allow Play Store content to be rehosted in other storefronts. Giving people more ways to get apps could increase choice, which is what Epic and other developers wanted. However, third-party sources won't have the deep system integration of the Play Store, which means users will be sideloading these apps without Google's layers of security.

It's hard to say how much of a genuine security problem this is. On one hand, it makes sense Google would be concerned—most of the major malware threats to Android devices spread via third-party app repositories. However, enforcing an installation whitelist across almost all Android devices is heavy handed. This requires everyone making Android apps to satisfy Google's requirements before virtually anyone will be able to install their apps, which could help Google retain control as the app market opens up. While the requirements may be minimal right now, there's no guarantee they will stay that way.

The documentation currently available doesn't explain what will happen if you try to install a non-verified app, nor how phones will check for verification status. Presumably, Google will implement this whitelist in Play Services as the implementation date approaches. We've reached out for details on that front and will report if we hear anything.

 

[Lapsus of the bepsus]

Yet that insane person runs a project that (still) has access to insider-knowledge while better maintaining the interests of those outside. GrapheneOS is the first one to warn about AOSP closing source. They create privacy features, that Apple copies a few years later.

not tryna cast doubt at the benefits of graphene but rather at its reliability and trustworthiness. for most people who own a smartphone its not an expendable device, they need it for various important tasks every day. you cant have serious trust in a privacy and freedom focused alternative operating system if its run by a guy who spends his day crying on mastodon or xitter under the official grapheneos handle about muh haters who are supposedly causing members of his team to quit out of fear, and how malicious internet trolls such as *gulp* LOUIS ROSSMANN and the evil kiwi farms are a grave threat to the project. he employs rhetoric that shows hostility towards specific groups of potential users based on their politics and other shit that should be irrelevant. that honestly makes the whole project look like a fucking joke and its certainly something that i will consider when (not even an "if" anymore) im forced to switch away from plain android

 

[Butter]

There are mentions, by GrapheneOS, partnering with a hardware manufacturer to produce phones with Graphene preinstalled. Via this yet unnamed manufacturer, they get earlier access to AOSP source (not Pixel-specific but still).
Depending on how long you can wait for a new phone (there seems to be no ETA), you can buy a new phone without directly giving money to Google (or Apple which pioneered all horrible trends).

I can wait. My Pixel 9 Pro XL running Graphene OS works very well, it's basically just a DAP at this point. I am just a cansoomer with extreme sadbrains (therapy resistant major depressive disorder, got to do ket because of it) that likes new toys. It makes my brain produce Dopamine for a few moments.

not tryna cast doubt at the benefits of graphene but rather at its reliability and trustworthiness. for most people who own a smartphone its not an expendable device, they need it for various important tasks every day. you cant have serious trust in a privacy and freedom focused alternative operating system if its run by a guy who spends his day crying on mastodon or xitter under the official grapheneos handle about muh haters who are supposedly causing members of his team to quit out of fear, and how malicious internet trolls such as *gulp* LOUIS ROSSMANN and the evil kiwi farms are a grave threat to the project. he employs rhetoric that shows hostility towards specific groups of potential users based on their politics and other shit that should be irrelevant. that honestly makes the whole project look like a fucking joke and its certainly something that i will consider when (not even an "if" anymore) im forced to switch away from plain android

what the fuck

I had no idea about this.

 

[HildegardOrgonAkkumulator]

not tryna cast doubt at the benefits of graphene but rather at its reliability and trustworthiness. for most people who own a smartphone its not an expendable device, they need it for various important tasks every day. you cant have serious trust in a privacy and freedom focused alternative operating system if its run by a guy who spends his day crying on mastodon or xitter under the official grapheneos handle about muh haters who are supposedly causing members of his team to quit out of fear, and how malicious internet trolls such as *gulp* LOUIS ROSSMANN and the evil kiwi farms are a grave threat to the project. he employs rhetoric that shows hostility towards specific groups of potential users based on their politics and other shit that should be irrelevant. that honestly makes the whole project look like a fucking joke and its certainly something that i will consider when (not even an "if" anymore) im forced to switch away from plain android

(TL;DR: Actions speak louder than Words) All the unhinged rants by Daniel exist in a separate space from the software he develops.
Despite all his threats, there is no way, GrapheneOS can be kneecapped for a specific group or individual. He won't even dare to put anything resembling a backdoor or tracker in any of his projects due to the reputation he already gained in the industry.

If it's difficult to trust Graphene, it may also be hard to trust their upstream contributions to Linux, AOSP and other major projects.

There is conflict between Graphene and competing projects due to varying threat-models and how they market themselves. This is one source of Daniel's meltdowns.
And as for his political hostility, it's nothing.
Null uses Rust, Signal and Librewolf, despite people running said projects not being so friendly towards the Farms.
If I have to choose between a tard-project but with a proven track-record but run by someone who wants me dead against a more chuddly-run alternative that is less proven, I'll take the former.
Rossmann's FUTO still funds GrapheneOS despite Daniel's attacks.

Overall, it's even more impressive that a schizo can run a project that someone like Edward Snowden can rely on despite all the infighting.

 

[The Big Bad D]

Ever since the latest GrapheneOS update, there's an option to get early security fixes that are behind an embargo: https://grapheneos.org/releases#2025092500. Since the source of these fixes is not disclosed, this makes these builds of GrapheneOS closed source and irreproducible.

I have been a GrapheneOS user for years, but this makes it clear to me that Google already won on this front and will only make things worse for custom ROMs.

 

[The Mass Shooter Ron Soye]

what the fuck

I had no idea about this.

Bad time for search to be broken. Here's the thread:

💪 Tough Guys Thread 'Daniel Micay / strcat / strncat / thestinger / GrapheneOS'

May 31, 2023

Daniel Micay / strcat / strncat / thestinger​

(facedox here)

source (archive)​

Daniel Micay is a software developer from Toronto, Ontario who gets himself in arguments online. Often ranting and screeching, you can tell if a message is written by him based on it insulting the other person:


source (archive)

Or insinuating they're harassing him:


source (archive)

Or accusing them of concern trolling...

• Markass the Worst
• Replies: 369
• Forum: Lolcows

Reactions: x 32 x 26 x 12 x 4 x 1 x 1

 

[Dammit Mandrake!]

Yeah the GrapheneOS guy is as dumb as a sack of hammers, sadly.

But I'll consider GrapheneOS again when Google makes a Pixel that folds like the Samsung Flip.

 

[The Connected Nose]

F-Droid's position is clear: If you own a device, you should be allowed to decide what software to run on it. To force everyone to register with a central authority is an affront to the ideas of free speech and thought, says F-Droid.

F-Droid doesn't have a leg to stand on with regard to free speech though, since they banned Gab over "muh heckin' hatespeecherino" and claimed such censorship was "necessary."

"To recap the situation: a website joined the fediverse only half a month ago that is well known to be a “free speech zone”, meaning it claims to tolerate all opinions. While in theory this might seem to be a good concept, it has serious consequences: things like racism, sexism, verbal abuse, violent nationalist propaganda, discrimination against gender and sexual minorities, antisemitism and a lot more things become popular on such instances. For good reasons, all these things are prohibited on the clear majority of instances in the fediverse. Because of this, yet even before mentioned website joined the fediverse, most instances already blocked it.
.
.
.
F-Droid as a project soon celebrates its 9th birthday. In these 9 years, F-Droid’s mission was and is to create a place where people could download software they can trust – meaning only free, libre and open source software is available on its flagship repository. As a project, it tried to stay neutral all the time. But sometimes, staying neutral isn’t an option but instead will lead to the uprise of previously mentioned oppression and harassment against marginalized groups. We don’t want and won’t support that. F-Droid is taking a political stance here.

F-Droid won’t tolerate oppression or harassment against marginalized groups. Because of this, it won’t package nor distribute apps that promote any of these things. This includes that it won’t distribute an app that promotes the usage of previously mentioned website, by either its branding, its pre-filled instance domain or any other direct promotion. This also means F-Droid won’t allow oppression or harassment to happen at its communication channels, including its forum. In the past week, we failed to fulfill this goal on the forum, and we want to apologize for that."

As for GrapheneOS, I've been using it for over a year now and there's no way I'd go back to stock Android. Yes, Micay is a sped of the highest order. But as was pointed out already, I'll take austistic slapfights over being raped by jewgle any day of the week.

 

[dick brain]

I finally got around to installing Graphene, seems fine. Gonna use it as an opportunity to find better apps for my use cases.

I don't really give a shit if the autist rugpulls it because it's not like he can take the rom off my phone.

My plan moving forward is essentially an extension of how I've been handling the general enfaggoting of the Internet, which is to say I'll use deniggered software to access corpo services and websites without ads/telemetry/bloat until the corpos make it impossible and then when those sites and services become too fagged up to denigger I'll stop using them altogether and do better shit with my time, just like I've done with social media and content aggregators and video games and porn and streaming services and TV and movies. You cannot make me use your bullshit. You can suck my dick.

 

[The Mass Shooter Ron Soye]

Ars Technica: Google confirms Android dev verification will have free and paid tiers, no public list of devs (archive)

Google promises verification will make Android safer, but at what cost?

Ryan Whitwam – Oct 3, 2025

As we careen toward a future in which Google has final say over what apps you can run, the company has sought to assuage the community's fears with a blog post and a casual "backstage" video. Google has said again and again since announcing the change that sideloading isn't going anywhere, but it's definitely not going to be as easy. The new information confirms app installs will be more reliant on the cloud, and devs can expect new fees, but there will be an escape hatch for hobbyists.

Confirming app verification status will be the job of a new system component called the Android Developer Verifier, which will be rolled out to devices in the next major release of Android 16. Google explains that phones must ensure each app has a package name and signing keys that have been registered with Google at the time of installation. This process may break the popular FOSS storefront F-Droid.

It would be impossible for your phone to carry a database of all verified apps, so this process may require Internet access. Google plans to have a local cache of the most common sideloaded apps on devices, but for anything else, an Internet connection is required. Google suggests alternative app stores will be able to use a pre-auth token to bypass network calls, but it's still deciding how that will work.

The financial arrangement has been murky since the initial announcement, but it's getting clearer. Even though Google's largely automated verification process has been described as simple, it's still going to cost developers money. The verification process will mirror the current Google Play registration fee of $25, which Google claims will go to cover administrative costs.

So anyone wishing to distribute an app on Android outside of Google's ecosystem has to pay Google to do so. What if you don't need to distribute apps widely? This is the one piece of good news as developer verification takes shape. Google will let hobbyists and students sign up with only an email for a lesser tier of verification. This won't cost anything, but there will be an unclear limit on how many times these apps can be installed. The team in the video strongly encourages everyone to go through the full verification process (and pay Google for the privilege). We've asked Google for more specifics here.

A high degree of harm​

When it announced developer verification, it said the process would not evaluate the content of an app. However, Google now clarifies that it will be on the lookout for malware in sideloaded apps. Google says it won't enforce any of the other Play Store rules—it's only interested in apps that could pose "a high degree of harm." It's unclear if Google will be checking for malware at all during the verification process; it may simply rely on the anti-malware features built into Android to report bad actors.

https://preservetube.com/watch?v=A7DEhW-mjdc

Even without verification, Android already has many safeguards in place. Play Protect scans all apps on your device, not just those from the Play Store. Android also has the ability to deactivate and remove known malware, and it will warn you about lesser types of potentially dangerous apps. Google's system can even reset permissions in apps if they are behaving maliciously. Once Google has rolled out verification, sideloaded apps caught in this net will lead to all of that developer's apps being deactivated.

One of the top concerns among Android users is that verification will be used to kill apps that Google doesn't like; ad-blockers, for example. The Play Store's harmful app policy is well-established, though. It details all the types of nefarious apps that Google considers malware, with some carveouts for things like non-malicious rooting apps.

Based on Google's statements and publicly available policy information, it doesn't look like developer verification would directly ban things like YouTube ReVanced and other ad-blockers. However, it's easy to imagine Google changing or reinterpreting the rules at some point to do just that. Google does have a history of lumping its least favorite software in with malware. Recent changes to make Chrome extensions safer also happened to kill some of the most popular and effective ad-blockers. Funny how that works.

A lack of trust​

Google has an answer for the most problematic elements of its verification plan, but anywhere there's a gap, it's easy to see a conspiracy. Why? Well, let's look at the situation in which Google finds itself.

The courts have ruled that Google acted illegally to maintain a monopoly in the Play Store—it worked against the interests of developers and users for years to make Google Play the only viable source of Android apps, and for what? The Play Store is an almost unusable mess of sponsored search results and suggested apps, most of which are little more than in-app purchase factories that deliver Google billions of dollars every year.

Google has every reason to protect the status quo (it may take the case all the way to the Supreme Court), and now it has suddenly decided the security risk of sideloaded apps must be addressed. The way it's being addressed puts Google in the driver's seat at a time when alternative app stores may finally have a chance to thrive. It's all very convenient for Google.

Developers across the Internet are expressing wariness about giving Google their personal information. Google, however, has decided anonymity is too risky. We now know a little more about how Google will manage the information it collects on developers, though. While Play Store developer information is listed publicly, the video confirms there will be no public list of sideload developers. However, Google will have the information, and that means it could be demanded by law enforcement or governments.

The current US administration has had harsh words for apps like ICEBlock, which it successfully pulled from the Apple App Store. Google's new centralized control of app distribution would allow similar censorship on Android, and the real identities of those who developed such an app would also be sitting in a Google database, ready to be subpoenaed. A few years ago, developers might have trusted Google with this data, but now? The goodwill is gone.

 

[Otis Mallebrok]

Don't be evil

 

[The Mass Shooter Ron Soye]

Android Developers Blog: Android developer verification: Early access starts now as we continue to build with your feedback (archive)

9to5Google: Android will let ‘experienced users’ sideload unverified apps as Google makes case for verification (archive)

While the developer verification plans are proceeding (with early access starting today), Google shared that it’s “building a new advanced flow that allows experienced users to accept the risks of installing software that isn’t verified.” This is for developers and power users.

We are designing this flow specifically to resist coercion, ensuring that users aren’t tricked into bypassing these safety checks while under pressure from a scammer. It will also include clear warnings to ensure users fully understand the risks involved, but ultimately, it puts the choice in their hands.

Android Authority: Breaking: Google is easing up on Android's new sideloading restrictions! (archive)

The Verge: Google will let ‘experienced users’ keep sideloading Android apps (archive)

 

[teriyakiburns]

The Verge: Google will let ‘experienced users’ keep sideloading Android apps (archive)

So either they're putting it in the debug menu, or they're adding a series of ultimately pointless "are you sure?" prompts that will just create another layer of prompt fatigue and turn the whole exercise into pointless security theatre.

 

[The Mass Shooter Ron Soye]

So either they're putting it in the debug menu, or they're adding a series of ultimately pointless "are you sure?" prompts that will just create another layer of prompt fatigue and turn the whole exercise into pointless security theatre.

That's a lot better than what we were expecting when this kicked off. Pressing the hidden thingy to turn on dev options? Yeah, I'll take the 15 seconds to do that. Although it sounds like they want to add additional friction.

 

[Coolio55]

I'll believe it when I see it.
Expect some "minor clause" like it "temporarily disabling" Play Integrity API or something.

 

[dick brain]

Android Developers Blog: Android developer verification: Early access starts now as we continue to build with your feedback (archive)

9to5Google: Android will let ‘experienced users’ sideload unverified apps as Google makes case for verification (archive)


Android Authority: Breaking: Google is easing up on Android's new sideloading restrictions! (archive)

The Verge: Google will let ‘experienced users’ keep sideloading Android apps (archive)

Too late to backpedal now retards, I already switched to Graphene, now you don't get my ad views or my data. Congrats on fucking up.

 

[Caligura]

Will this affect emulator apps and Mihon/tachiyomi forks?

 

[Hepativore]

Too late to backpedal now retards, I already switched to Graphene, now you don't get my ad views or my data. Congrats on fucking up.

The bigger issue, is that by making side loading more difficult for Android devices, wouldn't this kill off most if not all of the interest for third-party app developers to make apps that you can sideload? The number of people who put custom ROMs on their phones is vanishingly small. If Google makes it to where doing so is the only feasible way to get around their sideloading restrictions, this will probably kill off the entire third-party app ecosystem because most developers won't have much of an audience, anymore.

 

[dick brain]

The bigger issue, is that by making side loading more difficult for Android devices, wouldn't this kill off most if not all of the interest for third-party app developers to make apps that you can sideload? The number of people who put custom ROMs on their phones is vanishingly small. If Google makes it to where doing so is the only feasible way to get around their sideloading restrictions, this will probably kill off the entire third-party app ecosystem because most developers won't have much of an audience, anymore.

Linux still exists.

 

[oh no its pipkun]

The number of people who put custom ROMs on their phones is vanishingly small.

the devices you can bootload is also vanishingly small. it's no go for samsung's newer devices.

 

[Merton J. Dingle]

Well, at least one won't have to hook their phone up to a Windows or Linux machine with ADB every goddamn time they want to install an app outside of the Play Store.