Summary
- Android tightens sideloading: Developer Verifier checks apps; uncommon installs require internet.
- Pre-auth tokens ease third-party store installs; Play Protect backports rules to older Android.
- Student/hobbyist accounts lower fees but cap device installs; malware or fraud leads to account blocks.
Bad news. Android, which has for years been pretty democratic when it comes to sideloading, is locking things down a lot starting next year. The company has now gone into detail on how this will work, and while there’s some silver linings, it might still be bleak for some of you.
Google has now detailed how sideloading will work starting on Android 16’s second quarterly release. The company is insisting that “sideloading is fundamental to Android” and is here to stay, and to that effect, these new measures are meant to make sideloading safer to use. But it might still lead to problems.
When a user attempts to install an app for the first time, a new system service called the “Android Developer Verifier” will be activated. This service will communicate with Google’s backend to confirm that the app’s signing key and package name have been submitted by a verified developer. The Developer Verifier service will maintain an on-device cache of popular, already-verified apps, allowing them to be installed without a network connection, so it doesn’t have to check online every time you want to install an app. For less common apps not in the cache, however, an internet connection will be required, which might suck for some.
The new system recognizes the legitimate need for some users to install apps from independent developers or third-party stores, and tries to work around it. To streamline the process for third-party app stores, Google is also introducing a “pre-auth token,” a cryptographic blob that stores can pass to the system to verify an app without additional network calls. These changes will also be backported to older Android versions through updates to Google Play Protect.
Google also detailed its plans for a separate account type for students and hobbyists. These accounts will have fewer verification hurdles and will waive the standard $25 registration fee. However, they come with a significant limitation designed to prevent misuse by malicious actors: a strict cap on the number of devices that can install their apps. To enforce this, a user must provide a unique device identifier to the developer, who then must manually authorize that specific device in the Android Developer Console, effectively limiting distribution to a small, known group of people.
The company also outlined its strategy for preventing bad actors from bypassing the system. Developers will have to prove ownership of an app’s package name by demonstrating they possess the correct signing key. Those caught distributing malware will face account-level restrictions, blocking all apps associated with them from being installed. Google also claims to have proprietary techniques to detect identity fraud during the verification process, including spotting AI-generated false submissions.
All of this might feel insufficient when it comes to third-party stores like F-Droid, which make a point of actually making apps from independent developers that don’t rely on Google’s servers available. But we’ll have to see how this all turns out, and whether Google can reach a point where everyone is happy.
Source: Android Authority
