Comment by tavavex

4 days ago

The part in the flow where you select between allowing app installs for 7 days or forever is a glimpse into the future. That toggle shows the thought process that's going on at Google.

I can bet that a few versions down the line, the "Not recommended" option of allowing installs indefinitely will become so not recommended that they'll remove it outright. Then shrink the 7 day window to 3 days or less. Or only give users one allowed attempt at installing an app, after which it's another 24 hour waiting period for you. Then ask the user to verify themselves as a developer if they want to install whatever they want. Whatever helps them turn people away from alternatives and shrink the odds of someone dislodging their monopoly, they will do. Anything to drive people to Google Play only.

An actual example of this lives in the Gmail iOS app. Click a link in an email and every x days, a sheet appears: https://imgur.com/a/nlGS4Yk

1. Chrome

2. Google

3. Default browser app (w/unfamiliar generic logo)

They removed the option for Safari some time in the last two years; here's how it looked in 2024: https://imgur.com/1iBVFfc

And the cherry on top of dark UX patterns: an unchecked toggle rests at the bottom. "Ask me which app to use every time." You cannot stop getting these.

  • The darkest UX pattern I have ever hit is trying to cancel Google Workspace; whereby they disable the scrollbar on the page so you cannot actually get to the cancel button.

  • I was so mad when they removed the fourth option. I can't remember which one was which, but one meant "open in a webview inside this app" and the other was "open in a new tab in your default browser". It was still terrible UX but I liked at least having that choice.

  • I hate this pop-up so much. I don’t even have Chrome installed on my phone. How about open up on the only browser I have installed…

    This kind of thing should be illegal. The default browser is the default for a reason, to avoid this kind of stuff.

    I think I’ve reported this as a bug to Google a couple times, in a couple different apps… as they do it in their other apps too.

    The only thing that bothers me more are the, “sign-in with Google”, prompts on 90% of websites now. How about just giving the option to login with Google if so choose to login, and not spam it on every website just for visiting?

    Google really has made the internet and worse place in so many ways.

    • It's OK. This is the dying, last gasp effort that a company makes when it has no way to innovate, no way to add any real value, no capacity to drive change internally, and has become completely non-user focused.

      In short, it's what companies like IBM and Broadcom are now.

      Shallow husks of their former self, mere holding companies for patents, with a complete lack of care and concern about any end-user retention.

      Google search has turned completely into junk over the last two weeks. You may think "two weeks only?!", and you're right there, but this is a whole new level of stupid.

      You may not be getting this where you are, but here searches are constantly prepended with human checks, searches can take up to 5+ seconds, you name it. They literally spend so little on maintaining and working on their search engine, that it's effectively unusable much of the time now. I don't care whether it's bot traffic, or what, and no it's not just me, or my ISP. This is wide-scale.

      It takes so long I just click on an alternate search engine and search there. I don't have time to waste in their inanity.

      Any sane and sensible company wouldn't entirely trash and destroy their mainline product, which is key to drive users to experience Google products. But this degree of sheer, unbridled arrogance is what topples empires. The thought that it really doesn't matter, flows off of google as a foul stench.

      Look at Microsoft of old, the god of arrogance. Once the most dominant, powerful tech company in the world. They were king. Browser king. OS king. Everything king. Now they are barely noticed by large swaths of the market.

      So goes Alphabet these days.

      33 replies →

    • The funny thing is that until like 2024 iOS actually HAD no default browser control, so this kind of thing was a huge help for people who wanted to use Chrome against Apple’s monopolistic wishes. Of course it’s fair to argue that it should be eliminated now. The commenter who mourned the web view option also has a good point, but tbh that ought to just be asked once and then live in settings.

      2 replies →

    • > I think I’ve reported this as a bug to Google a couple times, in a couple different apps… as they do it in their other apps too.

      Alas, I don't think it's a bug. A PM or VP probably got a bonus for this.

      > How about just giving the option to login with Google if so choose to login, and not spam it on every website just for visiting?

      Yeah this is kinda weird. I don't know if it's browser specific though. I use Firefox on my main computer and I think I still see it. Which means that the website owner opted into this weird pattern. No other auth providers do this. Just Google.

      5 replies →

    • > The only thing that bothers me more are the, “sign-in with Google”, prompts on 90% of websites now This drove me really, really mad last winter. How did they even achieve this? My policy is no US vendors. Period. Not for work stuff at least; not for things I depend on. What a mess.

    • > not spam it on every website just for visiting?

      It's the website that spamming that.

      Either via google.accounts.id.prompt(), or options provided to loaded Google scripts.

      Google is guilty only insofar as that feature is possible.

      8 replies →

    • > This kind of thing should be illegal.

      That's a bit silly.

      Some people think pineapple doesn't belong on pizza, but that means you should avoid buying pineapple pizza, not outlaw it.

      9 replies →

  • An annoying extension of this is opening a Google maps link on mobile. It always prompts to open Google Maps (the app) no matter what. If you click no, its bugs the fuck out and opens an App Store link. If you click yes, even if you have Google Maps installed, it bugs the fuck out and opens an app store link. In neither case will it properly show the location on a first attempt. It's been like this for years. I'd ask what they're thinking when they came up with this, but I remain unconvinced that any such activity happens inside any Google offices today.

    • I think this is an Apple bug.

      I’ve seen it with non-Google apps too. I’m not sure what causes it, but I believe sometimes you can long tap the link and select the correct option.

      I believe the behavior where you say no and it still tries to open the app is because the default behavior on Google Maps links is to open Google Maps.

      1 reply →

  • If you use iPhone, you can use iOS Mail app (and with iCloud mail) if you really care.

    Apple dark UX pattern is that there always has badges on Settings app if you do not subscribe to iCloud even if you have manual backup. You cannot dismiss it.

    • This has tripped up non-technical family members who ask for help and aren't sure if they are required to pay for these things.

      "What is Arcade, am I supposed to be paying for it?"

      Sigh. Apple used to be better than this.

    • They keep enshittifying the experience for those not using iCloud Mail. They just removed the feature to use alternate email aliases on non-iCloud accounts on iOS 26.

  • I don't understand why people don't use alternative mail clients to avoid that? Is the Gmail app the only one that is good enough? If so, and if it is essential to you, just go with the bundle (Gmail, Chrome, etc). (FWIW, I left gmail entirely, I pay for my email provider)

  • the YouTube app does the same. Infuriating. I don't have Chrome installed and it doesn't list the only third party browser I _do_ have installed: Orion

  • Why are you even using the Gmail as your mail app?

    • The switching cost on a 20+ year old email address is high. It’s basically impossible to totally migrate away from. On top of that, since Google does their own thing, it doesn’t fit well into standard IMAP that most clients use.

      Sparrow made Gmail a great experience, but Google bought it and shut it down. I’m still rather bitter about that. It’s the only email client that actually made me enjoy email.

      21 replies →

I hope the EU cracks down on them like they did with Apple.

  • Merely regulating them isn't enough. The world needs to start enforcing antitrust laws. If we don't break up all these big tech companies, our future will be a technofeudalist cyberpunk dystopia.

  • Has the Apple situation really improved?

    I'm probably out of the loop, but last I checked, to put an app somewhere that's not the official App Store, they required you to pay their hefty fee for putting it in the App Store (even if you weren't going to do that), _and_ an additional Core Technology Fee.

    (And if that's still accurate, one thing I don't get is how that isn't also anti-competitive.)

  • Fast forward, and a few years from now, developers will have to sign their app with some EU bureau, otherwise it won't install anywhere. It's a choice about from whom come the restrictions. I don't like how much EU mandates and regulates hardware and software. It is about 20% helpful and 80% garbage regulations so far.

Pay verification fee to continue

[flagged]

  • > "That's just FURTHER PROOF that you're secretly trying to destroy my phone."

    What a ridiculous strawman. I outlined a specific issue with what they introduced. To make it even more clear - the new flow Google created would work just the same with just the 24 hour delay, but the way how they introduced the "For how long should you be able to install apps?" question comes out of left field and suddenly makes you think about timing. Why would they ask you that? After all, you jumped through a sufficient number of hoops for Google, they probably estimated that anyone who has gone that far out of their way should know what they're doing. So why ask a developer or power user about the duration when this feature works? The very unsubtle hint here is that the question is asked because soon enough, 'Forever' will not be an option anymore. It's a very common tactic - restrictions start light, and then are ratcheted up into a nagging reminder that works to dissuade everyone but the most dedicated.

    > You understand there's a real goal being pursued here, right? Suppose Google is dealing in good faith.

    I do. But why are you so implicitly adamant that the only goals here are good, noble, moral goals? Google will do everything in its interests, regardless of how good or bad it is for people. Decreasing the vectors of attack on their platform is profitable for them, and it also coincides with the public interest of not getting hacked. But ensuring that other brands, OEMs or developers can't interfere with them building an app distribution monopoly is also good for them. Being the sole arbiters of what goes on the devices that have now become mandatory for participating in society is extremely good for them. Do you think they're only pursuing the first one of the three?

    > How should they solve it differently?

    You're not going to like the answer, but there's no clean, perfect solution that balances everyone's interests. Companies are pushing the safety angle in pursuit of the three interests I listed above. You can see just how much it ramped up in the last few years, even though we've been living under this status quo for decades. But it's not as simple as turning devices into grandma-phones with approved functionality only, because both extremes have big drawbacks. If you have 90s-style insecure fully-privileged computing for everyone, that's a path towards extremely unsafe and vulnerable systems, worked on by people who don't know what they're doing. If you have full lock-down, you're awarding current market leaders with an endless reign of power by insulating them from competition and giving them more control over users. The way we were doing things before this crackdown was striking a good balance of keeping most grandmas out while not choking the abilities of the hobbyists or third-party app distributors too much. If you want an alternative, an ADB flag that you have to change once through a command prompt would've been good too.

what's your solution to combat scammers?

  • Do you think regular desktop computer should be locked down like this too? Scammers can also tell people to run Windows programs. Should that be banned too?

    I'm fine with an opt-in lock-down feature so people can do it for their parents/grandparents/children.

    Also, just let people get used to it. People will get burned, then tell their friends and they will then know not to simply follow what a stranger guides them to do over the phone. Maybe they will actually have second thoughts about what personal data they enter on their phone and when and where and who it may be sent to.

    Same as with emails telling you to buy gift cards at the gas station. Should the clerk tell people to come back tomorrow if they want to buy a gift card, just in case they are being "guided" by a Nigerian prince scammer?

    • Exactly. There's a sucker born every minute. I'm not saying people deserve to be taken advantage of. The reality is that there will always be people who can be lead off a cliff with minimal effort. There will always be people who believe that a guy with a thick Indian accent and broken English is a representative of Microsoft and that he can fix their computer in exchange for gift card codes. There comes a point where society sacrifices too much under the pretense of protecting the gullible. Prevent people from using technology at all and they'll go back to buying actual snake oil.

    • Keep in mind that Android has like a billion users who have never touched a Windows computer. (And unmanaged Windows was/is also a disaster zone.) Coming at this from a internet forum perspective is missing the scope of the problem.

      > I'm fine with an opt-in lock-down feature

      Me too, but it's really just some UI semantics whether this is 'opt-in' or 'opt-out'. Essentially it would be an option to set up the phone in "developer mode".

      6 replies →

    • Maybe? Let people form CAs, and if a CA gives out certs for malicious apps remove them. (Old apps continue to work, to publish new one get new cert.)

      Yes, sad, but works.

      People will learn about scams, but scammers are unfortunately a few steps ahead. (Lots of scammers, good techniques spread faster among them than among the general public.)

      1 reply →

    • The scams are more sophisticated than getting gift cards to pay the IRS. A number saying that it’s from the bank will say they need to verify some account information.

      I have had to actually verify my “investment profile” with a major broker in order to unfreeze some trades, in a high friction process. To the extent that a sideloaded app that looks exactly like the bank app has a low friction install, then people can get fooled and irrevocably lose savings.

      If the lock-down is opt-in, almost nobody will opt in to it. If the lockdown is opt-out, then whether scams still happen depends on how much friction there is in opting out.

      Freedom to install other unsigned sandboxed apps has a solution: Banks could use passkeys and other non-phishable methods. Sideloaded apps in Android can’t get to the bank app’s passkey.

      Passkeys or hardware tokens get worries about the enshittification of the theoretical recovery process. Which, if that’s the case, I guess we should hope for/pay a better world, at least with banks and brokers. For them specifically, for account recovery allow either showing up in person or using ID checks.

      Both for personal accounts and business accounts (i.e. with Business Email Compromise), I believe the onus should be on the bank to use non-phishable methods to show the human-readable payee from their app for irrevocable transfers.

  • Let's say I'm sitting outside of your office with a bazooka and boxes of high explosives. You ask my why, and I say, "someone might try to rob this office." You say, "somehow, that does not persuade me that a stranger should loiter outside of my workplace with a massive stockpile of ordinance." I reply, "what's your solution to combat robberies?"

    • let's say I put a lock on an office door. You say "Why? Bazookas will get through the door anyways".

      I don't know how I feel about this change but context does in fact matter about whether something is a good idea or not

      6 replies →

  • Would you support Microsoft doing the same thing to Windows?

    These are general purpose computing devices. It's sure taking a long time, but Cory Doctorow's talk on the war on general purpose computing is sure starting to become a depressing reality: https://www.youtube.com/watch?v=HUEvRyemKSg

    • Microsoft is doing the same thing, they call it S-mode. A surprisingly large amount of computers are sold with Windows S. Thankfully S-Mode can usually be disabled even if your computer shipped with it enabled.

         Windows S mode is a streamlined version of Windows designed for enhanced security and performance, allowing only apps from the Microsoft Store and requiring Microsoft Edge for safe browsing.

      3 replies →

  • All apps should be open source and subject to verification by nonprofit repositories like F-Droid which have scary warnings on software that does undesirable things. For-profit appstores like Google and Apple that allow closed source software are too friendly to scams and malware.

    • I don't think that's a realistic suggestion as as the quantity of applications are huge who are going to spend time reviewing them one by one. And and even then it's not realistic to expect that that undesirable things can be detected as these things can be hidden externally for instance or obfuscated

      5 replies →

  • Not the parent or agreeing/disagreeing with them, but to your question: if you get creative, there are a lot of things you could do, some more unorthodox than others.

    Tongue-in-cheek example, just to get the point across: instead of calling it Developer Mode, call it "Scam mode (dangerous)". Require pressing a button that says "Someone might be scamming me right now." Then require the user to type (not paste) in a long sentence like "STOP! DO NOT CONTINUE IF SOMEONE IS TELLING YOU TO DO THIS! THIS IS A SCAM!"... you get the idea. Maybe ask them to type in some Linux command with special symbols to find the contents of some file with a random name. Then require a reboot for good measure and maybe require typing in another bit of text like "If a stranger told me to do this, it's a scam." Basically, make it as ridiculous and obnoxious as possible so that the message gets across loud and clear to anybody who doesn't know what they're doing.

    • The people falling for social engineering now won't be protected by this either. You could gate the functionality behind verification of an anti-scam awareness and education training and certification course, scammers would coach people through the entire course and the verification step, and people would still be victimized.

      20 replies →

  • I'm going to break your kneecaps. Oh, what's that? You don't like it? Well, what's your solution to P=NP?

  • If cooldowns work, put them on granting permissions.

    There are just as many scam apps in play store and this system does nothing to help with those.

  • If I proposed putting mandatory cameras in all homes and you objected, would it then be fair for me to demand that you justify your position by proposing a better alternative to combat domestic violence?

    Locking down computing is just fundamentally wrong and leads to an unfree society.

  • The choice is not between "individuals are on their own against scammers" and "users are locked into Google vetting their phone". Users should be able to choose another organisation to do the vetting. They bought a phone, they didn't sell their life to Google.

  • Tell the unsophisticated users that they would be safer inside the ecosystem that has always been a walled garden.

    Why destroy the ecosystem that gives you the freedom to shoot yourself in the foot?

    Turning Android into another walled garden removes user choice from the equation.

  • Enable unknown sources in developer options, have the user type out in order to proceed "If I am typing this and don't know what I am doing, I am likely being scammed".

  • I suppose you could make the cooldown apply to the actual installed app. Like... when it's first installed it won't work for 24 hours and the clock doesn't start until you reboot. And then on boot it scares you again before starting the clock. And then "scares" you again after the cooldown.

  • Force the phones to be open so I can install my own OS on them.

    Then Google can do whatever they want with their OS and I can do what I need with mine. You might actually get phone OS competition. This is what the walled garden is actually meant to prevent.

  • China just executed couple of them that operated in Myanmar. Since we are hurling towards the bad parts in their dystopia anyway, why not also get the good ones?

  • Like the ones constantly advertising across Google's plethora of platforms without any repercussions or possibility of recourse with Google? For my safety, of course.

  • Education is the only solution to this.

    You can’t feasibly protect someone that believes the person on the phone is their family member or the chief of police.

    This kind of thing has to be verified like how they try drugs. Just randomly doing things will surely be useless, similar to how randomly optimizing parts of a program is generally worthless.

  • Are scammers using sideloaded apps when they can use whatever remote connexion the apps in the store allow ?

    I think a big warning in red "Warning :If you don't personally know the person asking you to install this app, you are getting scammed. No legitimate business or Institution will ask you to install this app"

    • Why would you need to sideload anything when scammers can just use Teamviewer or any remote operation software, readily available in the Play Store, that will surely pass whatever "checkmark" process Google uses to validate "safe" apps?

  • We need to remove the play store from Android phones. People have been scammed there more than any other store.

  • "Warning: if someone is talking to you and walking you through this screen, you may be being scammed!"

    Done.

  • As if Google Play itself isn't a cesspool full of scammers, or Google ads, or Youtube. As long as Google get their cut they don't give a shit about scams. For a reality check, turn off your adblockers and you'll see how much Google profits from scams. Any solution to scamming can't involve Google, since they long have been a willing tool for scammers.

    Pretending that this is about anything but Google's greed is giving them far too much credit.

  • Something called personal responsibility and intelligence.

    ...which clearly companies don't want, because complacent mindless idiots are easier to brainwash, control, and milk.

  • But this has nothing to do with combating scammers in the first place, have you never used the play store before? It's overwhelmingly scam apps with the most intrusive ad/tracking shit imaginable. There are scammers openly buying sponsored search results for names of popular apps so their malicious app with similar name appears as the first result.

  • > what's your solution to combat scammers?

    I'd wipe the Play Store off the face of the earth. Have you looked at the garbage on there that Google considers legit?

    This: https://news.ycombinator.com/item?id=47447600

    is is the shit people are exposed to when they go through the Play Store. You don't find that on F-droid.

    The second thing I'd do to combat scammers is the same thing I'd do to combat child porn and disinformation: educate people. This silly process is a technical answer to a social problem, and those rarely work well.

  • I wonder how this will help combat scammers. Do you really think they don’t have $25 for a fee?

    Furthermore, this verification system also functions as a US sanction mechanism—one that can be triggered against any entity the US decides to ban.

  • [flagged]

    • You didn't even slightly research the topic of phone malware, browse /r/isthisascam for starters. I don't say the problem is an "epidemic" and it doesn't have to be an epidemic to be addressed.

    • It's very obviously not irrelevant. Google is not going to let their main phone app product become associated with Grandma losing her savings! That's not going to help the free software folks... it's going to send everyone over to iOS.

      4 replies →