🤖 AI Summary
Googleは2026年からAndroidデバイス全体のセキュリティ強化に向けて新規則を導入すると発表しました。アプリケーションのサイドロード（未公開や非公式ストアからインストール）に対し、只有来自外部开发者验证的来源才允许安装。这将要求开发人员提供身份证明，上传签名密钥，并支付25美元的费用。
ただし、多くの開発者はGoogleの介入を嫌っています。为此，谷歌计划推出一种高级流程，用户可以在开发者设置中激活以跳过验证。但这一过程需要24小时才能完成，无法即刻进行。这主要是为了防止高压社会工程学攻击，让黑客难以持续施加威胁。
此外，用户可以选择“无限期”选项，允许随时进行未验证的应用安装。同为，谷歌强调平台的安全性至关重要，因为这对所有用户和开发者都有利。
この変更は、全体的なセキュリティ強化とユーザーのプライバシー保護を目的としており、Googleはそのプラットフォームが安全でなければ人々が利用しなくなる可能性があると警告しています。
An anonymous reader quotes a report from Ars Technica: Google is planning big changes for Android in 2026 aimed at combating malware across the entire device ecosystem. Starting in September, Google will begin restricting application sideloading with its developer verification program, but not everyone is on board. Android Ecosystem President Sameer Samat tells Ars that the company has been listening to feedback, and the result is the newly unveiled advanced flow, which will allow power users to skip app verification. With its new limits on sideloading, Android phones will only install apps that come from verified developers. To verify, devs releasing apps outside of Google Play will have to provide identification, upload a copy of their signing keys, and pay a $25 fee. It all seems rather onerous for people who just want to make apps without Google's intervention.
Apps that come from unverified developers won't be installable on Android phones -- unless you use the new advanced flow, which will be buried in the developer settings. When sideloading apps today, Android phones alert the user to the "unknown sources" toggle in the settings, and there's a flow to help you turn it on. The verification bypass is different and will not be revealed to users. You have to know where this is and proactively turn it on yourself, and it's not a quick process. [...] The actual legwork to activate this feature only takes a few seconds, but the 24-hour countdown makes it something you cannot do spur of the moment.
But why 24 hours? According to Samat, this is designed to combat the rising use of high-pressure social engineering attacks, in which the scammer convinces the victim they have to install an app immediately to avoid severe consequences. "In that 24-hour period, we think it becomes much harder for attackers to persist their attack," said Samat. "In that time, you can probably find out that your loved one isn't really being held in jail or that your bank account isn't really under attack." But for people who are sure they don't want Google's verification system to get in the way of sideloading any old APK they come across, they don't have to wait until they encounter an unverified app to get started. You only have to select the "indefinitely" option once on a phone, and you can turn dev options off again afterward. "For a lot of people in the world, their phone is their only computer, and it stores some of their most private information," Samat said. "Over the years, we've evolved the platform to keep it open while also keeping it safe. And I want to emphasize, if the platform isn't safe, people aren't going to use it, and that's a lose-lose situation for everyone, including developers."
Read more of this story at Slashdot.
ログイン
