What a weird thing to write a blog post about now. Did someone forget to hit publish on this back when it was written? The programme in question, announced a year and four months ago: https://security.googleblog.com/2024/02/piloting-new-ways-to...
AFAIK this only applies within Singapore (not sure if this applies to visiting devices) for apps requesting certain permissions (RECEIVE_SMS, READ_SMS, BIND_NOTIFICATIONS, and accessibility) downloaded outside of app stores (F-Droid is fine) and opened directly on the device (adb install is fine).
You can probably bypass the restriction by just disabling Play Protect if you don't want Google to tell you what you can and cannot install, but I'm not in Singapore so I can't confirm if that will work or not. That said, Google has made it impossible to disable Play Protect while on a call, that's probably a smart move.
Based on this article from the Singapore police, the approach doesn't seem to have helped much: https://www.police.gov.sg/media-room/news/20250417_police_ad...
> In some cases, before downloading the malicious APK file, victims would also be guided to disable Google Play Protect that helps to prevent harmful downloads. Once Google Play Protect is disabled, victims would not receive alerts that there is malware introduced into their mobile phones. Victims may also be asked to download Virtual Private Network (VPN) applications from Google Play Store which would facilitate scammers’ connection to their Android device. Scammers would then be able to bypass the banking anti-malware measures and remotely access the victims’ banking accounts with the phished ibanking login credentials.
Also, people in Singapore seem to be particularly vulnerable to scams:
> Pang is just one of tens of thousands of Singaporeans to fall foul of scams last year, who lost a total of S$1.1bn, according to police, a 70 per cent increase on the previous year. The true figure could be even higher, according to the Global Anti-Scam Alliance, which estimates that more than two-thirds of Singaporean victims did not report their experience.
> This is a small part of a global criminal enterprise worth an estimated $1tn, but Singaporeans, affluent, digitally advanced and compliant, are particularly vulnerable to these scams. As one person involved in the recovery of assets put it: “They are rich and naive”.
> “They are rich and naive”.
This is blaming the victim, and I'm not having it.
The problem has been that BankCorp are all forcing us into online pathways because it's cheaper for BankCorp. Of course, they don't put good security on the pathways because that would dramatically increase the customer support cost for BankCorp. Getting scammed is "just sucks to be you" because that costs LittlePlebian.
The "solution" is that liability for these kinds of scams need to be on BankCorp, period. LittlePlebian simply cannot be expected to protect themselves from every professional scammer in the universe beyond very basic measures. Bitcoin people regularly get scammed and they are supposedly more "sophisticated" than the average bear. Nobody less sophisticated stands a chance against the professionals.
It's also unclear why this post even exists, except as simple marketing FUD.
> Powered by PureOS, a Debian-based Linux operating system, the Librem 5 and Liberty Phones
Can their devices run APKs? The only Linux distro I know of that does is Sailfish, whose weird licensing model makes it really hard to take advantage of unless you have an obscure, obsolete phone and flash it with the image they sell.
To their credit, Purism has invested more into touch Linux with Phosh than most others in the space have, but Linux on a touchscreen is still a befuddlingly garbage experience.
Unless their experience is impacted by the features they're writing about (which it doesn't sound like it is), this post is just trying to make its mainstream alternative sound bad in the hopes that someone buys their crap instead.
Purism devices can run Android APKs via Waydroid. I don't think this Google policy materially affects that, though, so I'm also mystified why they bothered writing this article.
> but Linux on a touchscreen is still a befuddlingly garbage experience.
It's definitely worse than an iPhone, but you're greatly exaggerating. Sent from my Librem 5.
Thanks for the context!
Worth noting - was that before or after Google started getting painful decisions in court battles on the App Store thing?
Because this is not going to be super positive for them on that front.
> victims would also be guided to disable Google Play Protect that helps to prevent harmful downloads.
I feel like there's only so much a company can do when it comes to balancing protecting users from themselves vs allowing users free rights over their own computers, especially when users have gotten habituated to ignoring incessant safety warnings caused by attempts to protect users.
I also keep wondering how safe the Play store is from this stuff. The very existence of obscenely detailed public GPS datasets about Android users show that even "official store" apps are somewhat malicious.
I don't see a real solution besides giving a smart and friendly 3rd party admin rights over the devices of susceptible users.
> I feel like there's only so much a company can do when it comes to balancing protecting users from themselves vs allowing users free rights over their own computers
Convert to a one-time escape hatch unlock via a random-question quiz hosted by Google that assesses security and computing knowledge?
If the intent is to prevent the dumbest users from doing something, then a good place to start would be an assessment to determine if a user is actually dumb or not.
It's oxymoronic to attempt cover-all methods that encompass both (a) advanced users who do want to sideload & (b) people who will type in anything the internet tells them will make a cracked app work.
I mean the most brutal solution would be that for Google Play Store certification the manufacturer must use a cryptographic challenge/response process to enable admin on the phone and run a free global hotline for the user to phone/TTY in to get their their response, circumventable by factory resetting the phone (although scammers might still be able to talk somebody through that too).
Then the staff (or a chatbot) could be trained to intervene and confirm that the caller is not getting scammed.
Phone vendors could also be licensed to use a simple web interface to do this at the shop if the buyer requests, and the vendor license would be logged so if the user gets scammed immediately after unlocking it's not anonymous who helped them get scammed.
Similar to Root, really, but mid-tier since enabling Root involves giving up some other security assertions.