Elyse Betters Picaro / ZDNET
Follow ZDNET: Add us as a preferred source on Google.
ZDNET’s key takeaways
- Google reiterates that sideloading isn’t going away.
- But the requirements for developer verification will still be rolled out.
- The move mirrors Apple’s long-standing security approach.
About a month ago, Google announced that the rules around sideloading apps — the ability to install apps from unverified developers, bypassing Google’s Play Store — onto Android devices were set to change. In a nutshell, Google announced that it was going to make developer verification mandatory for Android certified devices.
New rules
Predictably, some Android users were concerned by this change, that it would limit the apps users would have access to, and that linking real-world identities to developers of privacy tools, political apps, or security software could put developers in danger.
Also: This silent Android feature scans your photos for ‘sensitive content’ – how to disable it
It’s a sort of “sideloading is dead, long live sideloading” thing. The principle of the idea remains, but there are new rules.
And this is what Google reiterated in an FAQ-esque blog post the other day by Matthew Forsythe, director of product management for Android App Safety.
Predictably, the top question in relation to developer verification was “does this mean sideloading is going away on Android?”
And the answer was equally predictable.
Also: How to turn on Android’s Private DNS mode – and why it makes such a big difference
“Absolutely not,” writes Forsythe. “Sideloading is fundamental to Android and it is not going away. Our new developer identity requirements are designed to protect users and developers from bad actors, not to limit choice. We want to make sure that if you download an app, it’s truly from the developer it claims to be published from, regardless of where you get the app.”
Bottom line
You will still be able to sideload apps, but only those that are digitally signed by the developer.
No signature, no sideloading.
Also: Your Android phone’s most powerful security feature is off by default and hidden – turn it on now
Also, if that developer was caught doing shady stuff, their certificate would be pulled and all their apps would stop working.
It’s being done in the name of security.
And Google has the receipts to back up this move, claiming that there is 50 times more malware from internet-sideloaded sources than on apps available through Google Play.
But it also means that apps Google doesn’t like — Revanced, a sideloaded app that, among other things, enables YouTube Premium features without paying springs irresistibly to mind — could have the plug pulled on them forever. If this happens, then this move is definitely straying into the “limit choice” category.
Also: How to clear your Android phone cache (and why you shouldn’t wait to do it)
The vast majority of Android users aren’t going to notice any change whatsoever, beyond that they won’t be able to install some sketchy malware app on their phone when one ad from some shady website offers it to them. And that’s what Google is relying on here.
Get the morning’s top stories in your inbox each day with our Tech Today newsletter.
