We know it’s coming. Google has confirmed a game-changing Android upgrade that has triggered a major backlash from users. What we don’t know is how difficult it’s going to be to install new apps on your Android phone when it goes live.
We’re talking sideloading. Perhaps the feature above all others that sets Android apart from iPhone. Responding to the continuing tidal waves of malware, adware and permission abuse, Google is now clamping down. Starting this year and rolling out by region, only apps from verified developers will be available to users.
As Bitdefender points out, “social engineering attacks often focus on this direct attack vector: convince the victim that it’s a good idea to manually install an app. At the very least, it’s just an annoying app that serves full-screen ads. At the very worst, the victim installs a banking trojan that takes control of the device and drains the accounts.”
The security firm says “the phone is really dangerous, and people agree.” That’s undoubtedly true. But power Android users don’t want their freedom to run their own phones their own way to be curtailed. I might as well buy an iPhone, was the riposte from many on Reddit and elsewhere when Google confirmed the changes.
The Android-maker responded by promising that sideloading is here to stay. But sideloading apps will now difficult enough to put off all but the most ardent users.
Per Bitdefender, “one way to make it more difficult for users to get infected is to make the actual procedure for sideloading apps more complicated, or at least to force users to jump through multiple hoops that also inform them of potential dangers.”
We don’t yet know how painful sideloading will become.
All Google has said is that “it’s not a sideloading restriction, but an ‘Accountability Layer.’ Advanced users will be able to’Install without verifying,’ but expect a high-friction flow designed to help users understand the risks.”
The challenge is that if this is really just a new set of pop-up warnings, they’ll be ignored in the same way as now. And that defeats the entire purpose of the change. This needs to be much more rigorous to have the desired effect.
As Google says itself, “online scams and malware campaigns are becoming more aggressive. At the global scale of Android, this translates to real harm for people around the world.” Thus the change. But as ever, the devil is in the detail.
Watch this space.
