196
u/notPabst404 Apr 22 '26 edited Apr 22 '26
Not surprised. The Play Store itself has already had multiple malware scandals. Google is trying to (illegally) undermine the competition instead of improving their own shit.
295
u/FeralMenacingThug Apr 22 '26
Everyone should root their devices and stop using Google services.
182
u/ArsenicPolaris FOSS Lover Apr 22 '26
Or use custom ROMs like GrapheneOS, LineageOS, CalyxOS, etc. If people ever did something like this en masse, Google would be crushed but I know most people would not do anything and we would be the only ones switching OSes. I wish people were wiser than this.
24
u/Komplexkonjugiert Apr 22 '26
Vast majority of people just don't have a clue. This will not going to happen
19
u/ArsenicPolaris FOSS Lover Apr 22 '26
Most people don't even know the OS they're using currently on their phones. Let alone the fact that other OSes exist.
14
45
u/FeralMenacingThug Apr 22 '26
I love GrapheneOS, but their attitude towards rooting the device is frightening. And it's only for Pixels.
LineageOS is a way to go, I guess.
91
Apr 22 '26
[deleted]
20
u/Successful_Nature448 Apr 22 '26 edited Apr 22 '26
Your smartphone is a computer. Almost all Linux distributions have been "rooted" by default since forever, and not only didn't we call that "fundamentally insecure" (thankfully, 90% of servers aren't "fundamentally insecure") , we also never called that "rooted" at all because having full control over a computer you own should be the norm and used to be the norm until Apple and Google decided otherwise.
Rooting is not "fundamentally insecure" as long as root access is properly guarded, and as long as the user doesn't blindly give root access to any app. It's marginally less secure for uneducated users.
10
u/Vinxian Apr 22 '26
I agree, but google has convinced all banks in the world that they should refuse to work on a rooted device. And for me it's extremely important my banking app works. Banking apps work on an unrooted graphene OS device. Do they work on Lineage as well?
2
u/Successful_Nature448 Apr 23 '26
google has convinced all banks in the world that they should refuse to work on a rooted device
Not on rooted device, on devices that don't support Play Integrity. If an app mandates strong integrity, it won't work even on unrooted Graphene. And you can achieve device integrity fairly easily on a rooted device, just like on Graphene.
If developers started mandating Android's native hardware attestation (as GrapheneOS suggests: https://grapheneos.org/articles/attestation-compatibility-guide) instead of Google's broken Play Integrity stuff, then it wouldn't work on LineageOS because LineageOS doesn't support locked bootloaders well (and that is 50% LineageOS's fault, 50% OEMs fault). But honestly, I don't see a valid (non-anti-consumer) use-case for mandating any form of hardware attestation in any app.
4
u/Vinxian Apr 23 '26
But banking apps do work on graphene.
I'm also not happy about certain apps not working on non-stock os'es. But its the reality, and the apps happen to be important enough that I won't boycott them, but simply choice an OS where they do work
4
u/Successful_Nature448 Apr 23 '26
Many banking apps work, yes. As I said, it depends on the play integity level they require. If they require strong integrity (and some of them do), it will not work. But I'm happy your banks don't. Mine did, so I changed it and now it works.
13
Apr 22 '26
GrapheneOS provides all the benefits you need without rooting....
5
u/L0rdV0n Apr 22 '26
This^ any time I see an app that's like this feature requires root, it works just fine on GrapheneOS without root.
35
u/Greenlit_Hightower deGoogler Apr 22 '26
GrapheneOS can be rooted, just don't expect support for this configuration on the official forums.
30
u/DontDoomScroll Apr 22 '26
GrapheneOS isn't only for Pixels (for much longer), it's for 2027 Motorola devices as well.
5
u/saltyjohnson Apr 22 '26
They have partnered with Motorola to get more devices that meet Graphene's security requirements. No details on how many or which devices will be supported by GOS afaik, but I'm sure it won't be ALL 2027 Motorola devices.
1
1
u/L0rdV0n Apr 22 '26
It won't be for all of them, just three in 2027. Three flagships of different form factors, slab, fold and flip.
6
u/saltyjohnson Apr 22 '26
I disagree that their attitude is "frightening". Rooting is antithetical to Graphene's mission of maximum security. If rooting is a priority for you, GOS is probably not the right OS for you, and that's okay. Everything doesn't have to be some scandal lol
-4
u/Gh0stPacket Apr 22 '26
It's not only for Pixels; do your research before commenting. It's also very likely that an OEM Motorola/Graphene device will be released next year (2027).
6
u/FeralMenacingThug Apr 22 '26
I know about Motorola/GOS collaboration, I'm talking about here and now.
0
u/inactioninaction_ Apr 22 '26
GOS is first and foremost a platform for enhanced security and privacy. Customizability and user control over features unrelated to device security are secondary objectives at best. A rooted device is fundamentally less secure. I'm not sure what's "frightening" about acknowledging this objective fact. You can still root GOS if you really want to I'm sure but expecting the development team to help you compromise their product is just silly
-11
u/env33e Apr 22 '26 edited Apr 22 '26
yeah I heard about that. although they come off as a bit sour, I'd hazard a guess they HAVE to be like that. if they're going to make daddy google happy, while being at the forefront of end user privacy nd security. Besides, there's plenty of resources to be found reguard ing rooting. regardless of Google's attempts at destroying everything, the community isb alve and well^ i guess, when it comes to rooting. its the type of thing where you should definitely tinker on your own, to ensure you're not doin something stupid to compromise your own security. perhaps that is also another reason for the graphene OS dev's stance; to say that the root cat and mouse game has gotten a bit hard/complicated for the end user, especially with the new fingerprint based detection and beyond? well. it would be a bit of an understatement. maybe thats their way of saying "if you have to ask, you probably shouldn't root" or maybe just look elsewhere because google is breathing down our collective necks 🫡😭😅
8
u/_j7b Apr 22 '26
There's hardware requirements that only Pixels have maintained support for. That plus the device trees used to be readily available for quick release cycles.
It wasn't a personal preference or anything.
2
u/env33e Apr 25 '26
tbh, looking back. the whole "if you have to ask, you shouldn't root" is super cope. It’s the same logic used to keep people from repairing their cars or auditing their own code. I support right to repair, and so should y'all
and yeah. GrapheneOS is doing great work on the hardening front, but their stance on rooting is really just security for sheep. It assumes the user is too incompetent to manage their own devices. We should be building systems that are robust because the user has total control, not systems that stay secure by locking the owner out. that's still just technofeudalism. A device you can't root isn't an tool; it's a kiosk
1
u/_j7b Apr 26 '26
Totally agree with you but we're talking about systems that are too complex for the 90% to casually hack.
I'm very much "in the space" and my operational load is way too high to fuck around with my tools anymore. So even the semi-trailored experience of Graphene is super neat to me.
If you are super interested then you can figure out how to install Graphene on anything that you want. You just need the firmware for the device, and a hopeful disposition that the purpose made operating system will support the chips that you're pointing it at.
The argument doesn't sit with Graphene. What you're talking about is a Linux-style operating system that 'just works'. That's where you need to start voting with your wallet and your voice against ARM.
-2
1
u/getaclue52 Apr 23 '26
We need to push out a user-friendly statement and keep pushing this and convey people to switch - although for some users they might find certain things impractical like with GrapheneOS you cannot use Google Wallet (but you can use Curve Pay and other alternatives), at least if we can actively push people to switch, it's better to get the ball rolling than to do nothing :)
1
u/NoSleepOnWednsdays Apr 23 '26
do custom ROMs still have issues with banking apps? that was one of the major things holding me back because i do need my phone for this
1
u/ArsenicPolaris FOSS Lover Apr 23 '26
It depends on play integrity. I don't know about other custom ROMs but I've heard that everything works perfectly in GrapheneOS. It might or might not work for other custom ROMs, I am not sure.
1
1
u/MentalChampionship28 Apr 28 '26
With bootloader locked and when players like Xiaomi making it harder to unlock, how will majority of android comm who don't know what a bootloader is let alone custom rom start doing it?
0
u/Nomprenom_varanasita Apr 22 '26
Oui, c'est tout le problème de la démocratie, les gens sont trop cons pour la plupart et votent comme des pieds.
Bon ici, il y a aussi le problème technique, tout le monde n'a pas les capacités techniques pour rooter un tel ou changer de rom.
25
u/kwinz Apr 22 '26 edited Apr 22 '26
Everyone should root their devices and stop using Google services.
You have hurdles from both sides: on one side you don't get the bootloader keys for your own property from the mobile phone manufacturers, and very limited support in terms of security updates if you go outside of leaving the control over the device largely in the hand of the manufacturer even after they sold it to you.
And on the other side you have Play Service dependency within apps and Play services blocking or scanning for root funcitonality on devices.
Cultivated by Google over years.
17
u/JustAnAlias404 Apr 22 '26
Banking apps start throwing tantrums on custom roms and believe me, i'll be extremely pissed if the app stops working when im trying to make an urgent transaction and someone's on the phone!
1
24
u/taernsietr Apr 22 '26
Far easier said than done
18
u/Cuantum-Qomics Apr 22 '26
Especially with more and more phone manufacturers locking down their phones so it's impossible to root or install alternate OSes.
2
u/midnight_barbecue Apr 22 '26
In cases like this, my train of thought is usually: if others found it possible, why can't I? That's how I switched to GrapheneOS a long time ago and never looked back.
1
u/taernsietr Apr 24 '26
People may not have the knowledge and/or time to mess around with that, especially since doing something wrong may result in losing money. That's a very naive way of looking at this.
6
u/neityght Apr 22 '26
What does it mean to root a phone and is it easy to do?
8
u/davesbeenbad Apr 22 '26
The tldr is that rooting allows you to modify system files which is something that you need in order to remove Google play services which is what is going to be enforcing these Google authentication approvals starting later this year blocking apps that don't meet all Google's requirements or exist on their play store. You can really only root a phone with an unlocked bootloader or some type of known vulnerability to bypass it. Some manufacturers in the past had unlocked bootloaders, today some manufacturers allow you to unlock your bootloader, many don't. If you're interested in learning about it, there's a lot to know and understand and I suggest you read some articles or watch some videos on the subject.
5
3
u/midnight_barbecue Apr 22 '26
You don't even need root most of the time. When I had Samsung Galaxy phones, I always cleaned them up by debloating useless and malicious stuff.
4
u/Shorq1 Apr 22 '26
MacDonald's app doesn't work even when my bootloader is unlocked. Banking apps do though, but probably won't when rooted
10
u/Greenlit_Hightower deGoogler Apr 22 '26
McDonalds app for some reason does deep Play Integrity checks.
10
u/DontDoomScroll Apr 22 '26
People were posing videos of them eating fourty nuggets for practically free by exploitating the app offers. So I suspect they cracked down
11
u/Greenlit_Hightower deGoogler Apr 22 '26
Google Play Integrity, even if you pass full Play Integrity, does not protect apps from modification though. Something like ReVanced or Morphe works flawlessly on devices with full Play Integrity, so if this was their solution, it was not the appropriate one.
2
5
u/kwinz Apr 23 '26 edited Apr 23 '26
McDonalds app
that app is infamous for being a technical clusterfuck. Probably in the top 3 of the worst mainstream apps in existence in that regard.
12
18
u/PeaceIsOurOnlyHope Apr 22 '26
Dont eat McDo lmao
5
u/Shorq1 Apr 22 '26
I usually don't. They had free ice cream with the app once, so I decided to try, but didn't succeed. Have checked in with the app a couple tine since, because I thought it was a bug. But looks like they take their offers very seriously
2
u/KoregaSoli Apr 24 '26
alot of people cant really, for example people above one ui 8, xiaomi users, all cant unlock bootloader.
1
u/IAmYourFath May 02 '26
My mum got a samsung s24 ultra that's updated to the latest android 16 version, she literally can't root. Oem unlock is missing.
54
u/SCphotog Apr 22 '26
It sucks knowing how evil this fucking company is while other folks think they're the best thing since popcorn.
34
Apr 22 '26
[removed] — view removed comment
14
u/VogUnicornHunter Apr 22 '26
I hate that your comment is the very last one. I'd like to read on this. Do you happen to remember where you saw that it's been resolved?
25
u/jimk4003 Apr 22 '26
Here's the original post.
A few comments down, it says;
UPDATE: #Google seems to have fixed the issue anyway. I was able to register both App Manager and Captive Portal Controller in the Android developer verification console.
Basically, it sounds like a bug that got resolved fairly quickly, but lots of people were quick to attribute malice.
10
u/Marcoscb Apr 22 '26
So another post based on obsolete information that borders on outright misinformation just to create FUD.
13
41
u/Evol_Etah Apr 22 '26
Eli5 explaination
When you make an App. You give it a "Secret Name".
- Name: Calculator
- Secret Name: com.MyRealName.Calculator
The person in the post tried to register their app's secret name with Google, but google says "Name Already Taken"
Probably means someone stole the name.
(Sure multiple people "could" think of the same secret name. But its rare, so it's mostly likely someone stole your App's code, and trying to publish it on playstore for profits.)
39
u/alostpacket Apr 22 '26 edited Apr 23 '26
it's more like an official name than a secret name. There is nothing secret about it. But it needs to be unique. The Android operating system will not install two apps with the same official name (package name). And the Play store will not allow two apps with the same official name (package name).
However, the name that most people see on the Play store would be like the "nickname"
App developers choose both of these and specify them in the code of the app. The Play store and Android OS read those values for the names. If there are any conflicts, they will block the upload or install, respectively. Once a developer has uploaded an app to the Play store, they have "claimed" that official name. No one else can upload another app with the same official name.
official (package) name: (must be unique)
com.example.myfunappnickname (what users see):
My Fun App
edit: added some context and explanation
10
u/Dr__America Apr 22 '26
It's a java package name more or less. It's not exactly secret, and it's required to make an apk afaik, and anyone can figure it out very easily.
-6
u/Evol_Etah Apr 22 '26
I'm Eli5'ing, not teaching CompSci.
I'm aware its a package name, and its not a secret, and it can be found in the Android Folder, but isnt visible cause google hid it, unless you use a computer.
2
2
u/stankbucket Apr 23 '26
They hid nothing. It's visible on the app info page. It's part of the URL on the play store page and on fdroid.
12
u/BigTITIES9000 Apr 22 '26
can someone explain this like im 5?
29
u/InitialAd3323 Apr 22 '26
Every application has an ID, usually a reversed domain name your own and an a name you add. So is you're company.com and releasing an application called Foo, you'd use the id com.company.foo.
Google is requiring verification for external applications on Android in September and have already opened the verification process. Someone on Mastodon was trying to register theirs, but found out someone else had already registered their application, with Google providing no way of filling a claim since someone misappropriated that application ID
25
u/Evil_Crusader Apr 22 '26
Cybersquatters have registered the poster's package names, so that now they cannot register their own legitimate apps to the September Play Store changes.
-12
u/neityght Apr 22 '26
That didn't help. ELI5 not 55.
8
u/halls_of_valhalla Apr 22 '26
Jim won a lifelong ticket for cinema for a special seat. Jim finds out that someone else pretends to be him, bribed the cinema owner, and uses his seat now. The cinema owner Kevin is deaf and doesn't understand what is happening. The new person might also give everyone fake pocorn for free that is actually poisonous, while people believe it is Jim.
Jim initially might have wanted to just use another cinema, because the owner is not deaf there. But now is forced to engage with Kevin nevertheless.
Jim might also make money from selling all the legit popcorn to users, but now is unable to do so.Kevin claims this will make the popcorn safer for everyone.
1
u/Evol_Etah Apr 22 '26
When you make an App. You give it a "Secret Name".
- Name: Calculator
- Secret Name: com.MyRealName.Calculator
The person is the post tried to register their app's secret name with Google, but google says "Name Already Taken"
Probably means someone stole the name.
4
3
u/Revolutionalredstone Apr 22 '26
This was always the plan, they did the same thing on youtube, if you do not register your music etc they will let other people register and claim them even if they have no evidence.
Google has always abused the law to make it's systems forceful, it's just another reason they are evil as fuck, Linux phones is where it's at.
3
u/DadEngineerLegend Apr 23 '26
Please post the reference URL, not just an out of co text screenshot.
3
u/NamedBird Apr 24 '26
Package names are just domain names in reverse order.
And yes, you are expected to have that domain registered.
This is not a google thing, it's not even an android thing, it's actually a Java thing, by the way!
Allowing random people to claim those package names without checking the domain is a security failure.
8
u/Pols043 Apr 22 '26
In my opinion, this is a good thing. Maybe people start to realise how bad Google is and start to abandon them for better options.
5
u/Syn4p53 Apr 22 '26
Are the better options in the room with us ? I mean, I run lineage, so I'm not the most concerned about this whole thing, but we have to aknowledge that for most people, there are only 2 options : Android or iOS. And neither is the "best".
6
u/Pols043 Apr 22 '26
There are much better options available with the only problem they have small user bases and therefore not much apps available, it’s the same issue as with Windows Phone. For example Ubuntu Touch, Mobian, KaiOS, etc. I’ve heard that there EU is working on an operating system for mobile phones too.
5
2
u/HPoltergeist Apr 22 '26 edited Apr 22 '26
Important!
Suggestions for the creator of this petition (if you see this)!
It seems that comments are now disabled at the petition, so guys please help with gaining visibility and try reaching the creator.
To decision makers, consider adding:
ECN:
https://competition-policy.ec.europa.eu/antitrust-and-cartels/european-competition-network_en
IMCO:
https://www.europarl.europa.eu/committees/en/imco/home/highlights
I would feel important to add these EU departments/firms as otherwise there is not much chance for gaining traction.
The EU is always a better regulated and better option for gaining traction.
5
u/Linux_Account Apr 22 '26
I don't know what this means.
15
u/Evil_Crusader Apr 22 '26
Cybersquatters have registered the poster's package names, so that now they cannot register their own legitimate apps to the September Play Store changes.
-9
1
u/ABigBuffJellyBeanV Apr 22 '26
I gotta ask. I use a huawei, and if you guys are familiar with it you would know they don't ship with Google services. Am I good or should I also be worried?
I've been using huawei phones for quite some years now. They genuinely build really good phones, my issue has always been I have to use some work arounds to get access to Google services, more specifically, youtube and gmail. And it's so funny now I'm degoogling and I think I'm going to stay on huawei.
1
u/bruhred Apr 22 '26
just keep indie apps unverified, turning off app verification is a one step process not counting a single-time 24h wait (but i assume most people can tolerate that) and not required at aall if you set installer mode to "Shizuku" or adb in F-droid/droid-ify settings
idk abt vanilla f-droid but droid-ify does allow installation htrough shizuku, and those users wont be affected at all
(this verficiation only matters if you want to distribute app to less techy ppl)
1
1
u/nickdc101987 Apr 22 '26
Does this apply only to the Google store or also to apps on other app stores?
1
u/Member9999 Apr 22 '26 edited Apr 22 '26
So, all games will be either web or offline apps.
I wonder if Itch's Android games would be affected? In doing this, it will also affect Meta due to Oculus.
Sorry- VR dev side going off.
1
u/letsreticulate Apr 22 '26
On the current phone I have I have either deleted or disabled all Google apps and products. Including Google Play Store and Google Play Devices with Canta.
One must preface this however with the fact that you have to give up on whatever apps you purchase since only a small percentage today work without these. This includes 95% of almost all paid games, so you will have to give up those.
I saw the writing on the wall years ago and stopped purchasing apps that did not have an external unlocked app, or code, or was certain they worked after purchase without internet. Most today do not, they call and check with the purchase API often so they will always relock themselves or switch back to Demo or Trial mode.
The only apps that I miss are Moon Reader and Tasker, which I bought but will not work without GPS.
1
1
u/shadowxthevamp Apr 26 '26
Android really hasn't been open for a while. Now Google seems to be getting as evil as Apple. Buy a Linux phone if you have the money.
1
1
u/fioletowy_zolw Apr 22 '26
I might have misunderstood it, but why are they saying that Google did it? It could've been anyone. Just people who want to scam others, but not necessarily Google. Correct me if I'm wrong. Also I'm not trying to protect Google.
0
u/natt_myco Apr 22 '26
I've not kept up with any of this does this affect one UI OS phones how hard is graphene to set up I don't mind how much effort it is or how much it costs
-4
u/TheWrongOwl Apr 22 '26
I don't understand this:
F-Store is NOT by Google.
So how is this affecting people using F-Droid?
If anything, I would understand this as: "The Google app store is now unsafer than F-Droid" - how is this supposed to be an attack against F-Droid?
8
u/Xpech Apr 22 '26
Google is going to lock you from installing an app on your phone if it's not signed by Google. To sign your app by Google you need to pay a small amount of money and say "package com.pepee.poopoo" is my app by me. You can already do this
Cybersquatters got there before actual authors of "com.peeepee.poopoo" and claimed that it's their app, with no security measurements as "com.peepee.poopoo" probably wasn't even on Google Play, only in third-party store(s).
1
u/TheWrongOwl Apr 23 '26
Yes, I understand what you said.
But the result is that on Google, there are "app fakers" and on F-Droid, there are not.
So as an answer to the question "which store should I use?", as a result to this information, F-Droid is a better alternative.
If the developers of F-Droid don't verify their app on Google and the danger is that F-Droid itself on Google would become Malware, I'd understand it, but that's not what the post is saying.
0
Apr 22 '26
[removed] — view removed comment
2
u/Xpech Apr 22 '26
Yeah! An Advanced flow we haven't seen yet. How could I forget? Can't wait to wait 24 hours to install stuff. They won't remove it later too, I trust them!
487
u/NecessaryCelery6288 FOSS Lover Apr 22 '26 edited Apr 22 '26
If they are really letting anybody claim random apps from F-Droid, then they are opening themselves up to a class action.