Google Starts Blocking 'Uncertified' Android Devices From Logging In (arstechnica.com) 179
Google logins on unlicensed devices will now fail at setup, and a warning message will pop up stating "Device is not certified by Google," reports Ars Technica. "This warning screen has appeared on and off in the past during a test phase, but XDA (and user reports) indicate it is now headed for a wider rollout." From the report: While the basic operating system code contained in the Android Open Source Project is free and open source, Google's apps that run on top of Android (like the Play Store, Gmail, Google Maps, etc.) and many others are not free. Google licenses these apps to device makers under a number of terms designed to give Google control over how the OS is used. Google's collection of default Android apps must all be bundled together, there are placement and default service requirements, and devices must pass an ever-growing list of compatibility requirements to ensure app compatibility. Android distributions that don't pass Google's compatibility requirements aren't allowed to be called "Android" (which is a registered trademark of Google), so they are Android forks. The most high-profile example of an Android fork is Amazon's Kindle Fire line of products, but most devices that ship in China (where Google doesn't do much business) fall under the umbrella of an "Android fork," too.
While Google's Android apps are only properly available as a pre-loaded app (or through the pre-loaded Play Store), they are openly distributed on forums, custom ROM sites, third-party app stores, and other places online. When a non-compatible device seller (or a user) loads these on a device, they can potentially trigger Google's new message at login. The message pops up when you try to log in to Google's services, which usually happens during the device setup. Users who purchased the device are warned that "the device manufacturer has preloaded Google apps and services without certification from Google," and users aren't given many options other than to complain to the manufacturer. At this point, logging in to Google services is blocked, and non-tech-savvy users will have to live without the Google apps. Users of custom Android ROMs -- which wipe out the stock software and load a modified version of Android -- will start seeing this message, too.
While Google's Android apps are only properly available as a pre-loaded app (or through the pre-loaded Play Store), they are openly distributed on forums, custom ROM sites, third-party app stores, and other places online. When a non-compatible device seller (or a user) loads these on a device, they can potentially trigger Google's new message at login. The message pops up when you try to log in to Google's services, which usually happens during the device setup. Users who purchased the device are warned that "the device manufacturer has preloaded Google apps and services without certification from Google," and users aren't given many options other than to complain to the manufacturer. At this point, logging in to Google services is blocked, and non-tech-savvy users will have to live without the Google apps. Users of custom Android ROMs -- which wipe out the stock software and load a modified version of Android -- will start seeing this message, too.
interesting (Score:4, Insightful)
Re:interesting (Score:4, Insightful)
The core fanbase buys legitimate stuff.
Re:interesting (Score:4, Informative)
Did you miss the part about custom ROMs? I have a legitimate Galaxy Tab 10.1 which Samsung no longer supports, am I supposed to stick with Honeycomb forever?
Re: (Score:3, Interesting)
No you're suppose to run adb shell and get out the insanely long hex code and type it in by hand, cause Google says, "fuck you."
Re: (Score:3)
Re: (Score:2)
Did you miss the part about custom ROMs? I have a legitimate Galaxy Tab 10.1 which Samsung no longer supports, am I supposed to stick with Honeycomb forever?
No, you're supposed to be a good little consumer and buy the latest Android, which will "buy" you one free OS Upgrade, often to the Current -1 Version of Android.
Re: (Score:2)
Re: (Score:2)
So? I don't think they even care what their "fanbase" does. Because their fanbase, core or otherwise, is not part of their business model.
Their core business model sells the access to and data of the masses (in aggregate) to advertisers and market analysis types. (and possibly those trying to sway elections. They have the same business model as Facebook after all).
Apple probably cares what their "core fanbase" thinks, and possibly what they do. But that's because Apple is essentially monetizing fashion in
Re: (Score:2)
Apple probably cares what their "core fanbase" thinks, and possibly what they do.
That much is obvious to the most casual observer.
But that's because Apple is essentially monetizing fashion in the tech industry. And keeping Apple products as the "hip new thing" year after year is an important business function so they can keep cranking out overpriced rounded corners.
So, that's why Apple nearly universally supports their products with OS and Security Updates FAR longer than anyone else?
Riiiiight.
Re: (Score:2)
Re: (Score:2)
They learned from Apple that it's a totally safe an profitable thing to do if you have a "golden parachute" in another market.
Now, with their not
Re: (Score:2)
s/Apple will do/Google will do/
Re: (Score:2)
Geez they are really doing their absolute best to piss off and alienate their core fanbase.
By "core fanbase" do you mean the 0.001% of people that flash custom firmware and want to steal Google software and run it on devices that were never licensed to do so? I'll bet they are okay with that.
Re: (Score:2)
Or the much higher % of people who use affordable chinese no-big-brand-name tablets.
Re: (Score:2)
No he doesn't, because those people are able to run the apps just fine, they only need to submit their Android ID to Google and the warning note even provides a link for them to do it.
Re: (Score:3)
Yep, asinine, to put it mildly.
Also, they're free services and apps that you can't fucking uninstall even if you want to - the best you can do is revert all upgrades to the installed but unwanted google app.
To avoid having the google's cpu/ram/bandwidth-stealing spyware shit (like the Youtube app) on your phone or tablet, you have to root it, flash it with Lineage or something, and use microG rather than Google Play Services.
Which is why this google announcement is both a good thing and a rare instance of g
Re: (Score:3)
Re: (Score:2)
Can't you just root your phone and remove these apps? Or did you buy a phone from someone other than Google that doesn't let you and now you're complaining about the app maker, not the phone maker?
Re: (Score:2)
No, you can not remove these apps, not unless (as i already said) you wipe your phone and install an alternative "ROM" like Lineage without installing gapps.
The most that google allows you to do is to revert to the versions of the apps that were first installed on the phone - i.e. uninstall any updates.
Nothing to do with fans... (Score:5, Interesting)
If /. had bothered to read through the entire article, they'd have gotten to the important bit:
We've actually been unknowing victims of illicit Google app distribution here at Ars before. We once imported a Xiaomi Redmi 3 smartphone from China to review, and, upon booting it up, we were very surprised to find it came with the Google apps pre-installed. As a device from China, this should not have happened. After we posted the review, Xiaomi contacted us with some very scary news: "The Redmi 3 should not come with Google Play pre-installed because it is a China-only product." Xiaomi told Ars. "It is very likely that the Play Store you saw was preinstalled by the importer/seller. This is a very common practice with the unauthorised importers."
This would mean the reseller opened our phone, unlocked the bootloader, flashed on a new ROM with Google Play, re-locked the bootloader, and stuck the phone back in the box. There was no obvious evidence that our device had been tampered with, and, while hopefully the seller only installed Google apps, they could have just as easily loaded malware onto the device. A message like this during setup would have been a big red flag that something was wrong.
This is what Google is trying to fight against here: man-in-the-middle attacks by people selling / re-selling Android devices with pre-loaded malware or spyware. Custom ROM installs are getting hit because they're basically middle-ware too; the difference is that this is stuff that the end-user is specifically authorizing, so there's a workaround to let you install it if you want to.
Re: (Score:2)
Which fanbase is that?
The 99.9% of people in the west who just buy a normal phone off the shelf and arne't affected?
The 0.1% of people who flash their custom ROM and simply need to register their android ID with Google to remain unaffected?
Or maybe you think Google's core fanbase is the Chinese phone makers marketing Android devices for which they don't play by the rules every other Android manufacturer must follow?
Re: (Score:2)
Re: (Score:2)
Their core fan base are the commoners.
You really should add sarcasm tags when you post obviously contrary things like that. Some people don't "get" sarcasm in forum posts without a tag.
Google's "core fan base" are governments, especially their domestic intelligence services, and Leftist political groups.
There needs to be a divestment movement started against Google, Facebook, and Twitter, and the FTC needs to break up Alphabet.
Strat
Re: (Score:2)
Re: (Score:2)
Please consider supporting replicant. It's a free mobile OS that desperately needs support.
And how do we do that if we are not developers or owners of any of the 9 measly, ancient Samsung devices that Replicant supports (poorly)? I don't make enough money to be able to fund fringe projects that seem to be at death's door - my only donations anymore go to the Red Cross.
Who needs Google? (Score:2)
Re: (Score:3, Informative)
Re:Who needs Google? (Score:4, Funny)
Doesn't the Real APK require that you do everything with hosts files?
Meme collision detected. (Score:2)
> Doesn't the Real APK require that you do everything with hosts files?
Only APKy appy APK app can APK apps!
Re: (Score:2)
Shhhh... don't wake him!!
Re: (Score:2)
Re: (Score:2)
Have you ever tried to run a cellphone without the Google set of applications? I have. That's what I got when I installed an AOSP Nougat build on my Nexus 5 (Nougat was never released/supported for the Nexus 5). I can tell you from experience that the phone becomes completely useless. You can make calls, and send and receive texts, and that's about it. I'm not sure it even had a browser. Installing new apps goes from difficult to nearly impossible. I haven't played too much with alternative markets to the G
Re: (Score:2)
Re: (Score:2)
Thanks, there's a good chance I will try this site eventually.
Re: (Score:2)
Have you ever tried to run a cellphone without the Google set of applications? I have. That's what I got when I installed an AOSP Nougat build on my Nexus 5 (Nougat was never released/supported for the Nexus 5). I can tell you from experience that the phone becomes completely useless. You can make calls, and send and receive texts, and that's about it. I'm not sure it even had a browser. Installing new apps goes from difficult to nearly impossible. I haven't played too much with alternative markets to the Google Play Store, but my experience with F-Droid was negative. This specific market feels pretty empty, and the few choices available aren't too good. At least Lineage OS has created a few copycats of some of the most popular Android apps, but it's far from a full replacement. Losing access the the Play Store would leave my phone greatly diminished. If I could not have access to the Google Play Store, I don't think I would want to use an Android phone at all.
So, what you're saying is that Android is EFFECTIVELY and FOR ALL INTENTS a WALLED GARDEN....
Fascinating!
Re: (Score:2)
I'm glad that you find running an AOSP ROM to be a great improvement, but that's missing the point. My point is that I find that the phone loses a lot of its value from not having access to the Play Store. You may disagree, but I think a lot of people would think the same as I do. What's the point of having a great battery life if your phone can't do anything, you might as well use a flip phone at that point.
Re: (Score:3)
I've used an Android phone without the Google apps installed for the past couple months. I installed the handful of apps I needed (using either F-Droid, a downloaded APK, or restored via Titanium Backup) and it's worked fine. Actually, better than fine, because the phone is more responsive without the Google suite installed, which I chose to try going without because I
Re: (Score:2)
I think you're right, my comment was over the top. I flashed Lineage OS overnight a few months ago. I don't have another cell to fall back on if my main one doesn't work, hence my reaction.
Re: (Score:2)
This isn't to suggest that most people would be willing to jump through the necessary hoops to make it work, as I agree they wouldn't. I just think your suggestion that an Android phone without the Google apps and Play Store is useless, and "you migh tas well use a flip phone", is being overdramatic.
Not at all overdramatic, when you AGREE that "most people" wouldn't be willing (or able) to JUMP THROUGH THE NECESSARY HOOPS.
So, what you are ADMITTEDLY saying is that, except for an indeterminate, but admittedly small minority of people, the Google suite REALLY IS a WALLED GARDEN.
Hahahahhaahahahahaha!!!! Welcome to the ILLUSION of "Freedom"!
B. F. Skinner would be Laughing his ASS of!!!
Re: (Score:2)
I'll remember this if (when?) I ever wipe my phone again, thank you.
Don't be evil (Score:5, Funny)
Unless its us. Then fuck you.
Re: (Score:2)
Re: (Score:2, Interesting)
M$ just made mediocre software.
Obviously your knowledge of Microsoft's past behavior is very limited.
Microsoft for years bought competitors and then killed the company they had bought. Microsoft's behavior should have been much more closely scrutinized than it was, by the Antitrust section of the Justice Department. Of course, Microsoft's money most likely enabled it to buy "cooperation"
from legislators, such that Microsoft was not examined more closely by the authorities.
NB : getting away with bad conduct does NOT mean that conduct was
Re: (Score:2)
Re: (Score:2)
That's a powerful and very moving imagination you have there. You should write to the heirs of John Lennon and see if you can get it added to the song.
Re: (Score:2)
Re: (Score:2)
Windows 95 didn't even ship with a web browser. Some of the OEM versions did ship with IE, but if it was too broken to load a URL that started with file:// then it is good the DoJ tried to stop it.
Re: Don't be evil (Score:2)
Please, that was a softball to Microsoft to get out of breaking up Office and Windows, which was the DOJ's original goal.
Re: (Score:2)
This isn't Google being evil. This is Google deciding to stop people who are violating its copyright by copying its apps without permission from doing so.
The question I have is, why isn't Google hitting these entities for copyright violation (take them to court and force them to stop selling devices with Google copyrighted binaries on there)
Re: (Score:2)
This is Google deciding to stop people
This isn't even Google stopping people. It's google stopping companies and pirates. Individual people can happily register their Android ID with Google and all the Play Apps work just fine.
Re: (Score:2)
This is about stopping all the device makers in China who are illegally copying the Google blobs and getting away with it because enforcing western IP laws in China is nearly impossible.
Ha Ha to those who thought you had no wall (Score:4, Interesting)
Delightful to find that people have finally started to realize that all mobile ecosystems are a walled garden, if you thought it didn't have a wall you just didn't look.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
At least (some) Chromebooks can be made to run real operating systems that aren't walled gardens [reddit.com].
Re: (Score:2)
It's not a walled garden (Score:2)
This move is designed to keep people using non-approved Android installations out. You still have the option of choosing if you want to be on the inside or outside. In that respect it's fence with a gate in it, not a wall. And FWIW the common Google Apps (Gmail, Maps, Ca
What are you talking about? (Score:4, Interesting)
Hell, if you RTFA google left a back door in. It's a pain in the ass to use (You have to get your Android Id) but it's there. And if you're an enthusiast running your own roms it's not a big deal. It's just not something that a company selling an Android phone can expect their customers to do.
This has nothing to do with walling the garden. This has to do with protecting the Android brand.
Re: (Score:3)
Google is actually responding to customer demand. They get attacked for not providing updates to Android, so they make Google Play Services able to apply updates and keep them flowing. But that means also specifying some minimum requirements for Play Services, to prevent patches bricking weird devices with strange custom OSs.
Of course, if you are an enthusiast who installed Lineage or whatever, you can self-certify and take on that risk yourself. If it goes wrong, you complain on xdadevelopers, not to Googl
Re: (Score:2)
Re: (Score:2)
Delightful to find that people have finally started to realize that all mobile ecosystems are a walled garden, if you thought it didn't have a wall you just didn't look.
Exactly!
Which API needs to be subverted? (Score:2)
Seriously, this should take about a second. Simply have it always return 'Pixel 2' (or something similar).
Only a matter of time (Score:4, Insightful)
Re: (Score:2, Troll)
Ah yes the proverbial "it's only a matter of time" post.
Software vendor goes way too far and wants their software to be licensed. Why would Google think have have a right to put any conditions on the use of the software they write? Don't they know they are *required* to just give it away? It's only a matter of time before they have wires into our brains causing us to eat babies and puppies.
Re: (Score:2)
The slippery slope is perfectly reasonable
No it's not reasonable.
Making up shit that isn't supported by evidence has a name: FUD. Do you not have enough REAL problems in your life that you have to imagine hypothetical ones?
Re: (Score:2)
Indeed. It's come to people producing products and expecting to be compensated for them. Bring on the Four Horsemen.
Re: Only a matter of time (Score:2)
Google's software is not the product they sell. It's the bait. We're the product - Google makes all their money selling our personal data to advertisers and repressive governments.
Re: (Score:2)
Google's software is not the product they sell. It's the bait. We're the product - Google makes all their money selling our personal data to advertisers and repressive governments.
Are you sure? You mean that Google doesn't spend billions in R&D, resources, and staff just because they are nice people?
Re: Only a matter of time (Score:2)
No one thinks Google is operated by nice people.
This is a good thing (Score:1)
Maybe this will stem the proliferation of shit android devices.
Google has no obligation to let anyone who can slap together an SoC with memory and a screen use their branded services.
Next maybe they'll clean some of the shit and malware off of the play store.
Re: (Score:3)
But they already allow that. HTC, Samsung, etc. are just SoCs and memory slapped together with random chips connected to random pins. There are no standards for Google devices. They don't give a shit because it forces you to buy a new Google device ever two years in order to get upgrades.
At least Microsoft forced all their phones to support UEFI+ARM. Too bad their boot loaders are locked.
It's their ecosystem (Score:2)
Not the end of the world - It's their Trade mark (Score:3)
1) that if you want to call something Android you have to pass their tests
2) if you want to run some of their apps, those apps expect to run in an environment that passed the Android certification
At this point it is more about quality control and user experience than it is creating a walled garden. I'm sure you can create a fork that is even better than Android but unless Google has tested that it's at least as good as some minimum standard you can't call it Android. I don't see how this is a big deal.
Re: Not the end of the world - It's their Trade ma (Score:2)
Gotta make sure the devices spy on you correctly. Maybe this was a condition imposed by fedgov or the Chicoms, if duh Goog wants to continue drinking that sweet sweet black budget money.
Re: (Score:2)
Gotta make sure the devices spy on you correctly
It's quite ironic that this mostly effects phones from Chinese vendors.
Re: (Score:2)
How is it ironic to ensure proper snooping of the population of a major economic power? Sounds like a reasonable thing to do, if you're enthusiastic about the whole panoptic surveillance thing.
Library (Score:2)
2) if you want to run some of their apps, those apps expect to run in an environment that passed the Android certification
The problem is that a lot of 3rd party apps end up calling API from the Google Services,
so you end up needing Google's code even if you don't want to run Google's App.
(i.e.: I don't want to run Youtube or Gmail apps, but an app I rely on needs the map displaying library from Google Services [jolla.com]).
Custom ROM users can still use GApps (Score:5, Informative)
As described in the XDA link, custom ROM users aren't shut out. Individual users can request whitelisting [google.com] of up to 100 devices, and makers of custom ROMs can also contact Google to get their standard images approved by default.
Re: (Score:3)
Every time I've tried using the whitelisting link, I get an error message that pops up, and disappears at the bottom of the webpage: "Uh oh, something went wrong. Please try again later."
Since it's been difficut to track down how to get your android device ID, here's how over ADB:
$ adb shell settings get secure android_id
214d54464e505921
The sequence of hex digits above is your android device ID.
Re: (Score:2)
Every time I've tried using the whitelisting link, I get an error message that pops up, and disappears at the bottom of the webpage: "Uh oh, something went wrong. Please try again later."
Email me details and I'll file a bug.
Re: (Score:2)
I'll just give you the details here:
From my browser's console, I see google's server throws 400 Bad Request, when the browser hits hxxps:/ /www. google. com/_ /AndroidPartnerUncertifiedRegistrationUi/mutate
Heavy redaction below, so that hopefully nobody can abuse this to mess with my google account.
Query string params:
at AN????????????????????????YM:15?????????03
f.req ["af.maf",[["af.add",14?????94,[{"14?????94":["MyAndroidDeviceIDHere"]}]]]]
Post params:
_reqid 15???60
ds.extension 14?????94
f.sid
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
I guess the main problem is that so many apps are tied deeply to the GApps/Play Store API's.
I think that will change in coming years. A lot of functionality has been added to play services rather than the platform because of the difficulty of updating the platform. If project Treble is successful and updates become easy and fast, then that trend will reverse. Not all of it, of course, because some of those play services APIs are tied to Google cloud services which are not easy to replicate.
Wrong solution (Score:2, Informative)
adb shell content query --uri content://settings/secure --where "name=\'android_id\'"
adb shell content delete --uri content://settings/secure --where "name=\'android_id\'"
adb shell content insert --uri content://settings/secure --bind name:s:android_id --bind value:s:
So there's going to be tons of apps to set your android_id. It's not going to stop many people from getting gapps, but it may well result in people having borked android_id's on previously "certified" phones.
IMO opinion would have been bette
Re: (Score:2)
Re: (Score:2)
All have the same problem of being a walled garden that makes things difficult to push you into giving up more privacy and control. I'm using a Pixel now and have bypassed the Pixel 2 to save up for a Purism phone when they become available in early 2019.
Google especially is taking every possible step to aggravate people into giving them more control. I will be root on my own devices. Period. I will back up my data locally, not to the cloud. I will block ads and other traffic that I didn't explicitly ask fo
Re: (Score:2)
Good news for F-Droid (Score:2)
Cyanogen? (Score:2)
Are they going to screw with Cyanogen Mod users?
Just wondering.
Re: (Score:2)
No, they aren't screwing any modders. Users can whitelist their device with Google and the warning notice that comes up even has a link directing you to instructions for doing so.
They aren't screwing ANY users. You can buy a Chinese pirate phone too which would never get certification to run Play apps, and white list that one too if you hate yourself that much.
I'm surprised it took this long (Score:2)
Independent devs like at XDA Developers have been sideloading gapps against the terms of its license for just about forever. The Google Services framework is Google's magic handcuffs, without which the users have no meaningful experience (because apps depend on it). So Google's desire to abandon AOSP by making it meaningless (because of insufficiency) will no longer be thwarted. (Without clever hacks. But let's face it, it's getting harder and harder to find clever hacks. Safetynet has been out there for a
Choose Android: It's FREE and OPEN SOURCE! (Score:2)
How many times have Fandroids defended Android, and Google's supposed "Inability" to Control things like Security Updates, because it is SUPPOSEDLY "Open Source" and "Google has NO CONTROL over OEMs and Carriers because Android is OPEN SOURCE"???
Riiiiiight. Seems they can shut off the spigot from EITHER end. IOW, they actually have ULTIMATE Control!
Enjoy your PSEUDO Open-Source OS, AND the built-in FaceBook spyware, while you're at it...
Time to wean (Score:2)
Hrm, been thinking it's time to start weaning myself of the free stuff online anyways.
This might the real catalyst I need.
More foot shooting? (Score:2)
After YouTube announcing they'll be disallowing certain types of videos, I gotta hand it to Google. They're becoming quite proficient at shooting themselves in the foot. This time with a shotgun. Nice work. Piss everyone off, make jail-broke phones useless on your services. Good job. Are you trying to give up market share to a new competitor to the field, or are you just pulling a Microsoft and not giving a flying f what people think, you got them trapped?
Either way, you're playing with fire here, Goo
Re: (Score:2)
Re: (Score:2)
Because it's very difficult to replace Google apps.
Re: (Score:2)
Re: (Score:2)
It means if you load a google apps package you'll have to register your device with Google. Something about a 100 activation limit though, if you do a clean wipe of the system partition - not typical if just doing a weekly ROM update over the top of the old one.
Re: (Score:2)