Android Developer Verification: Difference between revisions
Added archive URLs for 16 citation(s) using CRWCitationBot |
→Criticism: reuse citation instead of duplicating it |
||
| (26 intermediate revisions by 17 users not shown) | |||
| Line 1: | Line 1: | ||
On August 25th, 2025, [[Google]] announced an upcoming application installation restriction on Google-certified [[Android]] devices, requiring '''all''' developers to register and verify their real-life identity through the Developer Verification program and be approved by Google before their apps can be installed on Android devices. This requirement extends to '''''all''''' installation methods including "[[sideloading]]", third-party app repositories like [[F-Droid]], and direct APK installations. Google stated that this change "keeps the ecosystem open".<ref>{{Cite web |last= |date=Aug 2025 |title=Elevating Android's security to keep it open and safe |url=https://developer.android.com/developer-verification |url-status=live |archive-url=https://web.archive.org/web/20250825180832/https://developer.android.com/developer-verification |archive-date=2025-08-25 |website=Android Developers}}</ref> | |||
On August 25th, 2025, [[Google]] announced an upcoming application installation restriction on Google-certified [[Android]] devices, requiring '''all''' developers to register and verify their real-life identity through the Developer Verification program and be approved by Google before their apps can be installed on Android devices. This requirement extends to '''''all''''' installation methods including "[[sideloading]]", third-party app repositories like [[F-Droid]], and direct APK installations. Google stated that this change "keeps the ecosystem open".<ref> | |||
This is a giant shift from Android's traditionally open ecosystem and an abandonment of Android's founding principles. | This is a giant shift from Android's traditionally open ecosystem and an abandonment of Android's founding principles. It renders all existing APK files created throughout the years useless, and gives Google the ability to censor apps they dislike, such as those that can create permanent local backups of YouTube videos outside of Google's ecosystem with no data lock-in (a popular example being TubeMate), and lets them terminate developers out of spite for reasons unrelated to their apps (such as holding political views Google disagrees with), in addition to giving governments the ability to order Google to censor unwanted apps, similar to what already happened with Apple in China. | ||
It also prevents new Android applications from being developed offline with no Internet connection or Google account, given that every package name has to be registered in the developer console. This can prevent even verified developers from creating apps in countries where governments intermittently turn off Internet access, block access to Google services, or selectively block individuals from accessing the Internet. | It also prevents new Android applications from being developed offline with no Internet connection or Google account, given that every package name has to be registered in the developer console. This can prevent even verified developers from creating apps in countries where governments intermittently turn off Internet access, block access to Google services, or selectively block individuals from accessing the Internet. | ||
Individuals who lose access to their Google accounts (for example, as a result of losing an authentication factor) would no longer be able register new applications. | Individuals who lose access to their Google accounts (for example, as a result of losing an authentication factor) would no longer be able register new applications. Unlimited offline distribution can also become a thing of the past. Google can impose arbitrary installation quotas, meaning limit the number of installations, like they are planning to do with student accounts. In the future, Google can also stop accepting submissions for older Android versions altogether, forcing people to purchase new devices to run software that could technically run on their existing device. | ||
As with any Google service, there exists a possibility that it will shut down entirely, given that Google has a long history of launching and shutting down experimental services. | As with any Google service, there exists a possibility that it will shut down entirely, given that Google has a long history of launching and shutting down experimental services. If Google shut down the Android Developer Console, no one could develop new Android application anymore, for any device sold with this verification requirement built in. | ||
==Take action, make our voice heard== | ==Take action, make our voice heard== | ||
Direct link to the useful resources provided by the [https://techlore.tech Techlore] https://keepandroidopen.org/ | Direct link to the useful resources provided by the [https://techlore.tech Techlore] https://keepandroidopen.org/ | ||
===Open Letter to Google=== | |||
[https://keepandroidopen.org/open-letter/ The Open Letter] signed by most of the privacy advocates and organizations. | |||
The keep android open website includes the following resources: | The keep android open website includes the following resources: | ||
| Line 58: | Line 50: | ||
*90-day deadline extensions available for developers needing additional time | *90-day deadline extensions available for developers needing additional time | ||
*After deadlines, users encounter system-level blocks with no override option when attempting to install unverified apps | *After deadlines, users encounter system-level blocks with no override option when attempting to install unverified apps | ||
===Updates=== | |||
Google announced that it is developing an 'advanced flow' for 'experienced users' to be able to install apps from unverified developers and described the process as 'maximally obscure and high-friction'.<ref>{{Cite web |last=Forsythe |first=Matthew |date=12 Nov 2025 |title=Android developer verification: Early access starts now as we continue to build with your feedback |url=https://android-developers.googleblog.com/2025/11/android-developer-verification-early.html}} ([http://web.archive.org/web/20260221030624/https://android-developers.googleblog.com/2025/11/android-developer-verification-early.html Archived])</ref><ref>{{Cite news |last=Schoon |first=Ben |date=19 Jan 2026 |title=Google calls Android’s new sideloading flow ‘high friction’ |url=https://9to5google.com/2026/01/19/google-calls-androids-new-sideloading-flow-high-friction/}} ([http://web.archive.org/web/20260120014243/https://9to5google.com/2026/01/19/google-calls-androids-new-sideloading-flow-high-friction/ Archived])</ref> Free and open software distributor, F-Droid, clarified in a blog post that the android developer program remains to a credible threat to open source ecosystem on android and added a banner on the website as well as app linking to https://keepandroidopen.org/, for informing the dangers and recommending users to voice their concerns to relevant authority.<ref>{{Cite web |date=20 Feb 2026 |title=Keep Android Open - TWIF curated on Friday, 20 Feb 2026, Week 8 - f-droid.org |url=https://f-droid.org/en/2026/02/20/twif.html}} ([https://web.archive.org/web/20260223025319/https://f-droid.org/en/2026/02/20/twif.html Archived])</ref> | |||
In February 24 2026, the KeepAndroidOpen movement published an open letter to google signed by various free and open source software organizations, digital rights groups and developer communities accessible under https://keepandroidopen.org/open-letter/.<ref>{{Cite web |date=24 Feb 2026 |title=An Open Letter to Google regarding Mandatory Developer Registration for Android App Distribution |url=https://keepandroidopen.org/open-letter/ |url-status=live |archive-url=https://web.archive.org/web/20260224172459/https://keepandroidopen.org/open-letter/ |archive-date=24 Feb 2026}}</ref> The letter criticizes the need for google to gatekeep software beyond its own distribution platform, centralization of power having implications to privacy, censorship and surveillance especially with Google's historically opaque decision-making and review approach, imposition of barriers to entry for developers in various scenarios, anti-competitive implications and regulatory concerns. F-Droid was among the various organizations to sign the letter that in a blog post also stands opposed to signing up for developer verification that will begin the process in March 2026, recommending to developers to oppose the move by refusing to sign up as well.<ref>{{Cite web |date=24 Feb 2026 |title=An Open Letter Opposing Android Developer Verification |url=https://f-droid.org/en/2026/02/24/open-letter-opposing-developer-verification.html |url-status=live |archive-url=https://web.archive.org/web/20260224172628/https://f-droid.org/en/2026/02/24/open-letter-opposing-developer-verification.html |archive-date=24 Feb 2026}}</ref> | |||
On 4 March 2026, as part of changes following Google vs. Epic store Lawsuit, Google announced that it is allowing registered app stores to be published on google play platform if they "meet certain quality and safety benchmarks", which would otherwise be subject to same restrictions as those for other 'sideloaded' app.<ref>{{Cite web |last=Samat |first=Sameer |date=4 Mar 2026 |title=A new era for choice and openness |url=https://android-developers.googleblog.com/2026/03/a-new-era-for-choice-and-openness.html |url-status=live |archive-url=https://web.archive.org/web/20260305062940/android-developers.googleblog.com/2026/03/a-new-era-for-choice-and-openness.html |archive-date=5 Mar 2026}}</ref> Notably as part of the settlement, Epic games signed away its rights to sue Google over anything related as covered in the term sheet, until September 2032.<ref>{{Cite news |last=Hollister |first=Sean |date=5 Mar 2026 |title=Tim Sweeney signed away his right to criticize Google’s app store until 2032 |url=https://www.theverge.com/news/889595/tim-sweeney-signed-away-his-right-to-criticize-google-until-2032 |url-status=live |archive-url=https://web.archive.org/web/20260305000517/www.theverge.com/news/889595/tim-sweeney-signed-away-his-right-to-criticize-google-until-2032 |archive-date=5 Mar 2026}}</ref> | |||
===Advanced flow=== | |||
On 19 March 2026, Google finally revealed how its advanced flow program for installing unverified apps is being implemented. Google mentions that this is a one-time process for power users, but was crafted to prevent coerced install of unverified apps.<ref>{{Cite web |last=Forsythe |first=Matthew |date=19 Mar 2026 |title=Android developer verification: Balancing openness and choice with safety |url=https://android-developers.googleblog.com/2026/03/android-developer-verification.html |url-status=live |archive-url=https://web.archive.org/web/20260319202706/android-developers.googleblog.com/2026/03/android-developer-verification.html |archive-date=19 March 2026}}</ref> | |||
*'''Enable developer mode in system settings''' | |||
*'''Confirm you aren't being coached''' | |||
*'''Restart your phone and reauthenticate''' | |||
*'''Come back after the protective waiting period and verify''' '''-''' One-time, one-day wait | |||
*'''Install apps''' '''-''' option of enabling for 7 days or indefinitely | |||
Since advanced flow is delivered through Google Play Services and not through Android OS, Google can modify, restrict, or remove it at any time without an OS update and without any user consent. Organizations such as keep android open movement continue to hold the position against the program because of this aspect. Since the implementation has not appeared in dev, beta or canary builds of android yet, Google is prompting the community to accept a product announcement as a functional safeguard five months before the mandate takes effect. | |||
Preventing critical banking apps from functioning due to enabled state of developer mode also makes installing unverified applications unfeasible to many users which majorly affects the rapidly growing FOSS android community and forces developer verification as well as payment of verification fee to Google, only to operate under limitations Google grants. | |||
On March 23, 2025, Matthew Forsythe, Director of Product Management for Developer Experience on Google Play at Google, answered a question from an Android user on X (formerly Twitter) regarding advanced flow on Android. Forsythe explained that it will be possible to disable developer node once advanced flow is enabled to use apps that don't work with developer Mode enabled, such as banking apps. | |||
However, at present, it's not yet clear whether it will actually be possible to use advanced flow with Developer Mode disabled, and we don't know if enabling advanced flow will affect critical apps like banking apps, which might not function properly if the Advanced Feed system is enabled. | |||
==Technical implementation== | ==Technical implementation== | ||
| Line 65: | Line 81: | ||
====Limited distribution==== | ====Limited distribution==== | ||
*Allows for distribution on up to 20 devices<ref>{{Cite web |date= |title=Android Developer Console: Account creation form |url=https://get.google.com/adc-early-access/u/0/onboarding |access-date=2025-12-19 |website=Android Developer Console}}</ref> | *Allows for distribution on up to 20 devices<ref>{{Cite web |date= |title=Android Developer Console: Account creation form |url=https://get.google.com/adc-early-access/u/0/onboarding |access-date=2025-12-19 |website=Android Developer Console}} ([https://web.archive.org/web/20260223010845/https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fget.google.com%2Fadc-early-access%2Fu%2F0%2Fonboarding&dsh=S-116450265%3A1771808922850823&followup=https%3A%2F%2Fget.google.com%2Fadc-early-access%2Fu%2F0%2Fonboarding&ifkv=ASfE1-qms7IwZjbAdjvxowYFy5Kb9DL9vPDu06W9LMpkaBqy285wVRrX7HSp5xXdFaxXqzHM9tztDA&osid=1&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin Archived])</ref> | ||
*Intended for ''"students, hobbyists, and other personal use"'' | *Intended for ''"students, hobbyists, and other personal use"'' | ||
*Free registration | *Free registration | ||
| Line 84: | Line 100: | ||
===Package name registration=== | ===Package name registration=== | ||
Developers must register package names before apps can be installed. The system creates a cryptographic link between developer identity & app signing keys. Ownership priority is determined by installation statistics - developers whose signing keys account for over 50% of known installs receive registration priority.<ref>{{Cite web |date=2025-08-25 |title=Updates to Play Console for Android developer verification: A first look |url=https://developer.android.com/developer-verification/assets/pdfs/updates-to-play-console-for-android-developer-verification.pdf |website=Android Developers |access-date=2025-09-01 |url-status=live |archive-url=http://web.archive.org/web/20260128020558/https://developer.android.com/developer-verification/assets/pdfs/updates-to-play-console-for-android-developer-verification.pdf |archive-date=28 Jan 2026}}</ref><ref>{{Cite web |date=2025-08-25 |title=Resources {{!}} Android developer verification {{!}} Android Developers |url=https://developer.android.com/developer-verification/guides/resources |website=Android Developers |access-date=2025-08-25}}</ref> | Developers must register package names before apps can be installed. The system creates a cryptographic link between developer identity & app signing keys. Ownership priority is determined by installation statistics - developers whose signing keys account for over 50% of known installs receive registration priority.<ref>{{Cite web |date=2025-08-25 |title=Updates to Play Console for Android developer verification: A first look |url=https://developer.android.com/developer-verification/assets/pdfs/updates-to-play-console-for-android-developer-verification.pdf |website=Android Developers |access-date=2025-09-01 |url-status=live |archive-url=http://web.archive.org/web/20260128020558/https://developer.android.com/developer-verification/assets/pdfs/updates-to-play-console-for-android-developer-verification.pdf |archive-date=28 Jan 2026}}</ref><ref>{{Cite web |date=2025-08-25 |title=Resources {{!}} Android developer verification {{!}} Android Developers |url=https://developer.android.com/developer-verification/guides/resources |website=Android Developers |access-date=2025-08-25}} ([http://web.archive.org/web/20251123194919/https://developer.android.com/developer-verification/guides/resources Archived])</ref> | ||
===Affected devices=== | ===Affected devices=== | ||
| Line 92: | Line 108: | ||
*Devices with Play Protect | *Devices with Play Protect | ||
*All mainstream Android devices from manufacturers including Samsung, Xiaomi, Motorola, OnePlus, and Google Pixel | *All mainstream Android devices from manufacturers including Samsung, Xiaomi, Motorola, OnePlus, and Google Pixel | ||
*The vast majority of Android devices sold outside of China | |||
Custom ROMs without Google services & uncertified devices are not affected by these restrictions. | Custom ROMs without Google services & uncertified devices are not affected by these restrictions. | ||
| Line 111: | Line 128: | ||
*Open source developers fear harassment and doxxing after forced identity disclosure | *Open source developers fear harassment and doxxing after forced identity disclosure | ||
*F-Droid mentions that play store verification is proven to be ineffective at combating malware due to repeated instances of malware distributed through play store<ref>{{Cite web |last=Arntz |first=Pieter |date=2025-09-17 |title=224 malicious apps removed from the Google Play Store after ad fraud campaign discovered |url=https://www.malwarebytes.com/blog/news/2025/09/224-malicious-apps-removed-from-the-google-play-store-after-ad-fraud-campaign-discovered |url-status=live |archive-url=https://web.archive.org/web/20251005173848/www.malwarebytes.com/blog/news/2025/09/224-malicious-apps-removed-from-the-google-play-store-after-ad-fraud-campaign-discovered |archive-date=2025-10-05 |website=malwarebytes}}</ref><ref>{{Cite web |last=Thompson |first=Lain |date=2025-08-26 |title=Malware-ridden apps made it into Google's Play Store, scored 19 million downloads |url=https://www.theregister.com/2025/08/26/apps_android_malware/ |url-status=live |archive-url=https://web.archive.org/web/20251005173850/www.theregister.com/2025/08/26/apps_android_malware/ |archive-date=2025-10-05 |website=The Register}}</ref> | *F-Droid mentions that play store verification is proven to be ineffective at combating malware due to repeated instances of malware distributed through play store<ref>{{Cite web |last=Arntz |first=Pieter |date=2025-09-17 |title=224 malicious apps removed from the Google Play Store after ad fraud campaign discovered |url=https://www.malwarebytes.com/blog/news/2025/09/224-malicious-apps-removed-from-the-google-play-store-after-ad-fraud-campaign-discovered |url-status=live |archive-url=https://web.archive.org/web/20251005173848/www.malwarebytes.com/blog/news/2025/09/224-malicious-apps-removed-from-the-google-play-store-after-ad-fraud-campaign-discovered |archive-date=2025-10-05 |website=malwarebytes}}</ref><ref>{{Cite web |last=Thompson |first=Lain |date=2025-08-26 |title=Malware-ridden apps made it into Google's Play Store, scored 19 million downloads |url=https://www.theregister.com/2025/08/26/apps_android_malware/ |url-status=live |archive-url=https://web.archive.org/web/20251005173850/www.theregister.com/2025/08/26/apps_android_malware/ |archive-date=2025-10-05 |website=The Register}}</ref> | ||
*Jean-Héon points out that mandatory developer registration puts users at risk by pushing them to use dangerous workarounds to install unverified APKs of their choice and also puts developers at risk by exposing them to data leaks and identity theft. Jean-Héon advocates for a solution based on the device's antivirus software. <ref name=":1">{{Cite web |title=Google restricts the installation of third-party APKs on Android: what this means for Jean-Héon™. (Updated March 21, 2026). |url=https://sites.google.com/view/jean-honmctm/communiqu%C3%A9press-releases/keep-android-open-english}}</ref> | |||
===Open source community impact=== | ===Open source community impact=== | ||
The F-Droid community reacted strongly, with one forum member stating: "F*** Google. Use GrapheneOS to drop Android... I find this development downright alarming".<ref>{{Cite web |title=FAQ - App Developers {{!}} F-Droid - Free and Open Source Android App Repository |url=https://f-droid.org/en/docs/FAQ_-_App_Developers/ |website=F-Droid |access-date=2025-08-29}}</ref> Specific challenges include: | The F-Droid community reacted strongly, with one forum member stating: "F*** Google. Use GrapheneOS to drop Android... I find this development downright alarming".<ref>{{Cite web |title=FAQ - App Developers {{!}} F-Droid - Free and Open Source Android App Repository |url=https://f-droid.org/en/docs/FAQ_-_App_Developers/ |website=F-Droid |access-date=2025-08-29}} ([http://web.archive.org/web/20260116144646/https://f-droid.org/en/docs/FAQ_-_App_Developers/ Archived])</ref> Specific challenges include: | ||
*F-Droid builds apps from source with its own signing keys, creating coordination requirements with upstream developers to ensure that the applications distributed are reproducible | *F-Droid builds apps from source with its own signing keys, creating coordination requirements with upstream developers to ensure that the applications distributed are reproducible | ||
*Community estimates suggest 85% of F-Droid apps could be "stuck in limbo" due to package ID conflicts | *Community estimates suggest 85% of F-Droid apps could be "stuck in limbo" due to package ID conflicts | ||
| Line 126: | Line 144: | ||
*Concerns about offline device functionality (barcode scanners, kiosks) requiring internet connections for app signing verification | *Concerns about offline device functionality (barcode scanners, kiosks) requiring internet connections for app signing verification | ||
*Comparisons to Windows, where users noted: "I can install an app onto a Windows computer from any source without verification by Microsoft"<ref>{{Cite web |date=2025-08-26 |title=Google to restrict Android app sideloading to verified devs |url=https://www.theregister.com/2025/08/26/android_developer_verification_sideloading |website=The Register |access-date=2025-08-29 |url-status=live |archive-url=http://web.archive.org/web/20260119211440/https://www.theregister.com/2025/08/26/android_developer_verification_sideloading/ |archive-date=19 Jan 2026}}</ref> | *Comparisons to Windows, where users noted: "I can install an app onto a Windows computer from any source without verification by Microsoft"<ref>{{Cite web |date=2025-08-26 |title=Google to restrict Android app sideloading to verified devs |url=https://www.theregister.com/2025/08/26/android_developer_verification_sideloading |website=The Register |access-date=2025-08-29 |url-status=live |archive-url=http://web.archive.org/web/20260119211440/https://www.theregister.com/2025/08/26/android_developer_verification_sideloading/ |archive-date=19 Jan 2026}}</ref> | ||
*Users voiced their opinions through community wiki, [https://keepandroidopen.org/ keepandroidopen.org] criticizing it as an anti-consumer move since a software update irrevocably blocks right to install any software and requires developers to seek permission from Google to develop apps. The users also noted that it harms digital sovereignty of nations as well as raising questions on placing critical infrastructure "at the mercy of distant and unaccountable organization"<ref>{{Cite web |title= | *Users voiced their opinions through community wiki, [https://keepandroidopen.org/ keepandroidopen.org] criticizing it as an anti-consumer move since a software update irrevocably blocks right to install any software and requires developers to seek permission from Google to develop apps. The users also noted that it harms digital sovereignty of nations as well as raising questions on placing critical infrastructure "at the mercy of distant and unaccountable organization"<ref>{{Cite web |date=Aug 2025 |title=Keep Android Open |url=https://keepandroidopen.org/ |url-status=live |archive-url=https://web.archive.org/web/20251109112509/keepandroidopen.org |archive-date=2025-11-09 |website=Keep Android Open}}</ref> | ||
The Android community produced numerous critical videos,<ref>{{Cite web |last=Mental Outlaw |date=2025-08-29 |title=Google is Locking Down Android |url=https://www.youtube.com/watch?v=L1S0SiBuJN8 |access-date=2025-08-29 |website=YouTube |url-status=live |archive-url=https://preservetube.com/watch?v=L1S0SiBuJN8 |archive-date=16 Feb 2026}}</ref><ref>{{Cite web |last=BrenTech |date=2025-08-26 |title=Google Will Soon Block Apps from Unverified Developers! Is This The End of Sideloading on Android? |url=https://www.youtube.com/watch?v=-nCgnXByGrY |access-date=2025-08-29 |website=YouTube |archive-url=https://preservetube.com/watch?v=-nCgnXByGrY |archive-date=23 Feb 2026}}</ref><ref>{{Cite web |last=TechLore |date=2025-08-27 |title=Android Is Becoming iOS: The End of Sideloading? |url=https://www.youtube.com/watch?v=PxGjwtiI8uM |access-date=2025-08-29 |website=YouTube |url-status=live |archive-url=https://preservetube.com/watch?v=PxGjwtiI8uM |archive-date=16 Feb 2026}}</ref> with titles like "Google is Locking Down Android" and "Android Is Becoming iOS: The End of Sideloading?" | |||
Google quiere dominar el mundo ! | |||
==Industry and organizational response== | ==Industry and organizational response== | ||
| Line 149: | Line 170: | ||
*OSnews criticized it as "the death of our digital freedoms" | *OSnews criticized it as "the death of our digital freedoms" | ||
*Hackaday noted the timing "coincides with Google's court-mandated opening of Android following Epic Games' antitrust victory"<ref>{{Cite web |date=2025-08-26 |title=Google Will Require Developer Verification Even For Sideloading |url=https://hackaday.com/2025/08/26/google-will-require-developer-verification-even-for-sideloading/ |website=Hackaday |access-date=2025-08-29 |url-status=live |archive-url=http://web.archive.org/web/20260203082923/https://hackaday.com/2025/08/26/google-will-require-developer-verification-even-for-sideloading/ |archive-date=3 Feb 2026}}</ref> | *Hackaday noted the timing "coincides with Google's court-mandated opening of Android following Epic Games' antitrust victory"<ref>{{Cite web |date=2025-08-26 |title=Google Will Require Developer Verification Even For Sideloading |url=https://hackaday.com/2025/08/26/google-will-require-developer-verification-even-for-sideloading/ |website=Hackaday |access-date=2025-08-29 |url-status=live |archive-url=http://web.archive.org/web/20260203082923/https://hackaday.com/2025/08/26/google-will-require-developer-verification-even-for-sideloading/ |archive-date=3 Feb 2026}}</ref> | ||
*According to Jean-Héon “Android Developer Verification is an absurdity for the free mobile ecosystem.”<ref name=":1" /> | |||
==Impact on specific use cases== | ==Impact on specific use cases== | ||
| Line 183: | Line 205: | ||
==See also== | ==See also== | ||
*[[Forced account]] | |||
*[[Digital Markets Act]] | *[[Digital Markets Act]] | ||
*[[Sideloading]] | *[[Sideloading]] | ||