Google has news on what you will need to do for still being able to sideload apps:

[itsfriday@toot.community]

@CalcProgrammer1 @grote For the scamer scenario, 1 day of patience I see as a workimg precaution. But why do I need to go through hidden steps to get there? Why is there not a question at the very first startup "Would you like to add F-Droid, Aurora, ... and/or the option to install any apk on your phone? Tick the ones you like and it is installed automatically."

[lumi@snug.moe]

@ryanprior sure

[oatrapado@mastodon.social]

@Frenezul0_o @grote those chinese/european phones are just obsolete and overprized, pinephone another archeological piece at a high price.

[agowa338@chaos.social]

@Li @grote

You're absolutely right. However I think you misinterpreted my initial post. That was to be seen more of the lines of "if life gives you lemons make lemonade" (and kinda ironically).

I just wanted to make readers think about all of this and the implications :)

[tedmielczarek@mastodon.social]

@grote @TimWardCam Google has a whole "Managed Google Play" as part of Enterprise Android support: https://support.google.com/work/android/answer/9495634?hl=en
I don't think companies doing such things will be fussed by this at all. A company using Android devices but not using enterprise management would already be in a pretty self-inflicted state of badness.
Edit: https://developer.android.com/developer-verification/guides/faq explicitly says this doesn't affect enterprise apps.

[itsfriday@toot.community]

@Li @CalcProgrammer1 @grote Yes, that's why I think the 24h are the only reasonable steps.

[li@tech.lgbt]

@agowa338 @grote bleh ive been seeing techbros unironically supporting this because "muh scammers" .. as if they wont just switch to using a fucking web app overnight

[hidoni@meow.social]

@grote the point about requiring biometrics is incorrect. The blog post states that you need to confirm with "biometric authentication [...] or device PIN."

[clarfonthey@toot.cat]

@grote here, "sideloading" means "installing apps from developers who have not submitted a drop of blood to Google"

the drop of blood thing is an exaggeration; we don't yet know if something more, like an entire finger, will be required

[argv_minus_one@mastodon.sdf.org]

@nazokiyoubinbou

It's also a crying shame. ARM Macs have incredible battery life. If they weren't rendered largely useless by the aforementioned OS installation restrictions, they'd probably be my favorite kind of laptop.

@FifiSch @grote

[doragasu@mastodon.sdf.org]

@grote Judging by the attached image, biometrics are not mandatory, device PIN should work. Very bad, but mandatory biometrics is what would make it terrible, at least for me.

[shivvr@mastodon.social]

@31113 @terminaltilt
Cops and goons can take your phone and hold it up to your face very easily. Thankfully it’s pretty easy to disable face for unlock, but continue to use it for everything else.

[2something@transfem.social]

@argv_minus_one@mastodon.sdf.org @grote@chaos.social That's a relief: I can't use finger prints because phones all say my fingerprints aren't clear enough, and my current phone doesn't support face ID.

Still not good to have to jump through all these hoops .

[timwardcam@c.im]

@tedmielczarek @grote I'm thinking of a small company with a dozen or so developers who have one Android app that talks to their back end, for use by a few dozen installation crews. Anything with "enterprise" in its name would be *vastly* too expensive to be of any use to a company like that.

[agowa338@chaos.social]

@Li @grote

Well I still think this approach from google is a good first draft to start a discussion.

But all of the border agent stuff was more of a "making the best out of a shitty situation".

[alvarord@framapiaf.org]

@grote

First point is:
* be evil

[karl@infosec.exchange]

@grote Google always finds new ways to give me a reason to say fuck google.

[raymaccarthy@mastodon.ie]

@CalcProgrammer1 @itsFriday @grote
And it's not even about malware. Plenty in the Playstore. It's about Google deciding they are in control of your phone. You only rented it.

[burnitdown@beige.party]

@grote

"scammers often pressure victims into disabling security measures"

gee Google, i wonder where they might find malware that would bypass those "security measures" without any pressure at all??? oh well not fucking important i guess.

[tedmielczarek@mastodon.social]

@grote buried in the FAQ, but note that they are saying that installation via ADB will not be affected by these changes: https://developer.android.com/developer-verification/guides/faq
So these sideloading changes are to cover "download an APK file from the internet and install it without using a secondary device".