Update on Android sideloading

[Sandman]

As I understand it, Google will allow users to sideload Android apps without verification.

Android developer verification: Early access starts now as we continue to build with your feedback

News and insights on the Android platform, developer tools, and events.

android-developers.googleblog.com

 

[Cableguy]

This will allow you to distribute your creations to a limited number of devices without going through the full verification requirements

I guess this means they will limit and track the amount of devices with a specific unpublished app...

 

[hatzisn]

I guess this means they will limit and track the amount of devices with a specific unpublished app...

Correct! But this poses a security risk because an attacker could play with package name maybe (and private key also maybe) and then there is no limit in the devices... Unless they do also decompile to know that it is the same app. Of course this is valid only in account by a human proxy situation.

 

[hatzisn]

By the way, the verification file described in the video we add it in the folder [Project folder]/Objects/bin/extra/assets? And maybe make it read only?