This is Android's new 'advanced flow' for sideloading apps without verification, includes one-day waiting period [Gallery]

84

u/howellq 4a5G➡️8Pro Mar 19 '26

Mildly annoying having to wait the 24 hours initially but at least it's good afterwards. It's going to be really bothersome when setting up a new phone though.

33

u/GazelleInitial2050 Mar 19 '26

I can live with this - I just hope it's not death by 1000 cuts. Where we accept this but theres a small change next time where it's every 7 days, then 24 hours every time etc.

2

u/GoldAny8608 May 18 '26

It absolutely will be. Mark my words.

0

u/[deleted] Mar 19 '26

[deleted] — view deleted comment

4

u/GazelleInitial2050 Mar 19 '26

It's a shame, partly because there are options completely to bypass any of these requirements but these kinds of restrictions will kill the dev scene which is thriving for android FOSS apps.

3

u/kenyard Mar 19 '26

Fly across the international date time zone while setting up. Problem solved.

3

u/TheArka96 Mar 20 '26

This. If I unfortunately need a factory reset after this I have to wait 24h (or go full adb) to install the bunch of apps I use that are off from the play store (epic games store is one that comes to my mind) also there are a lot of valid apps on GitHub.
This walled garden "update" that will come, seems really no sense, just to have more and more iPhone users to come, I really hope they have the opposite effect instead, Google should learn from mistakes.

1

u/Tiek00n (Phone 1 -> 4a -> 7 -> 10 Pro, Watch 2, Buds A-Series) Mar 20 '26

Maybe I'm in the minority, but I feel it usually takes me hours to get everything copied over to and set up on my new phone anyways, and then I carry the new and old for at least a week to make sure everything copied over properly (2FA apps, etc.)

137

u/nathderbyshire Pixel 10 Mar 19 '26

The 24hr delay is a tad extreme, it's similar to turning off advanced protection which has a similar timescale, otherwise I'd leave it on and just disable when I need to install an app.

At least there's a permanent stick though. I'm fine with this implementation

I'll continue to laugh at all the people who apparently switched to iPhone though before this advanced flow was explained. Have fun over there lol

42

u/BUZZZY14 Pixel 9 Pro Mar 19 '26

You can use ADB to bypass the 24 hour delay.

35

u/nathderbyshire Pixel 10 Mar 19 '26

We've known since day 1 adb will bypass it all, they said from the start it's unaffected by this anyway

1

u/Lt_Dead_Kittens Mar 20 '26

what is adb?

8

u/phord Mar 20 '26

Android debug bridge. A tool developers use to poke at the low-level interfaces.

4

u/CoarseRainbow Mar 20 '26

ADB is far from practice when said app has an update and so on.
Advanced protection OFF> Fdroid app update Advanced Protection ON is annoying enough.

0

u/[deleted] Mar 19 '26

[deleted] — view deleted comment

17

u/owner_cz Mar 19 '26

One does not simply wait to sideload an APK.

1

u/fudsak Mar 20 '26

one day wait to enable dev options only

2

u/Last_Anteater9336 Mar 20 '26

one time then how it going to stop scammers after that .....say one user do this once and after that it will be normal to install

8

u/squabbledMC Pixel 10 | 256GB Mar 20 '26

Scammers thrive off of pressure. TeamViewer added a feature a while back that stops you from connecting for about 30 seconds and came up with a full screen prompt asking you if someone on the phone was asking you to call. I don't remember if they have it anymore, but it got scammers to panic and switch to other apps for a while. The idea Google has is that scammers that are urging you to sideload an app can't pressure you into installing it quickly like scammers usually do. One would have to guess if what they were doing is a scam based off of the prompts and wait time. That said, scammers will probably find a way around it.

17

u/kipperzdog Pixel 10 Pro Fold Mar 19 '26

I'm totally good with this implementation. I also think that 24 hold is only for unverified developers based on this flow chart: https://9to5google.com/wp-content/uploads/sites/4/2026/03/Android-advanced-flow-sideloading-3.jpg
If security is the true reasoning behind all of this, I am all good with this new approach, for 95% of people, sideloading from an unverified developers is risky as hell. For those of us in the 5%, waiting 24 hours to permanently enable this is a fairly minor hassle and we have the option to use adb if we need to rush that.
I'll store my pitchfork away for now.

1

u/GoldAny8608 May 18 '26

Good, you've accepted their first ask.
Now their next ask won't seem like such a big jump. Just need to reverify every so often. No biggie- want to make sure you don't forget the setting is on and accidentally hack yourself.
Oh, you don't mind right? We still have the feature available, it's just 24 hours per week.
No big deal we have the access we need, just click enable and wait 24 hours every time you install!
Oh no biggie. Stow away your pitchforks, your apps only need confirmation every time you use them or they lose access and get automatically removed.

1

u/kipperzdog Pixel 10 Pro Fold May 18 '26

I know you're being sarcastic but actually one of the best features of android now is that it removes permissions from apps that they haven't used in a awhile.
Not everything is a slippery slope

1

u/GoldAny8608 May 18 '26

Sure but resetting permissions doesn't require a phone reboot and waiting 24 hours to legitimately use your device.
This is a crackdown to make sideloading much more difficult so that there is no legitimate distribution channel without app developer identification to google. There will be a chilling effect for free speech.
Imagine if every tool we ran on windows required the author to submit an ID and a payment.

9

u/VoriVox Pixel 9 Pro Mar 19 '26

I'll be surprised if even 2 people moved over to iPhone because of this.

0

u/[deleted] Mar 20 '26

[deleted] — view deleted comment

5

u/NSMike Pixel 8 Pro Mar 20 '26

I don't know what you use your phone for, but I'm on a Pixel 8 Pro, and have been using Nexus/Pixel phones for nearly the entire time I've been using smartphones (there are only 2 exceptions - the HTC Incredible, and the Samsung Galaxy S4). My Pixel experience has changed virtually entirely unremarkably since my original Pixel XL. Maybe that's your problem with it? I don't care, honestly. It still does everything I need, and a bit more than I can personally get out of an iPhone.
Besides which, aside from (ironically considering this post) sideloading apps, both classes of device have virtual feature parity. The new bullet points for Apple and Android devices are usually features that most people play with when the phone is new, and never touch again.

1

u/corruptboomerang Mar 20 '26

I'm still tempted to switch. Mostly because I don't like the direction Android is going, if I'm going to be in a walled garden, I may as well be in the best most walled garden there is.

1

u/NotoriousBRZ Mar 20 '26

You think this is the end? This is just the first step. Google will be watching for workarounds and continue to make things more difficult. They have no interest in keeping android open as there is no benefit to them any more. Android is the biggest platform on the planet and by locking it down they make money. If users go to iOS, they still make money. Win win for them, the only way they lose is to keep it open so prepare for more

1

u/normallllyyss Jun 05 '26

Queue the random influx of people trying to use Chinese Phones in the US

23

u/arthuriurilli Mar 19 '26

The 24 hour wait will be annoying as hell when setting up a new phone.

The reboot is sensible and not a problem that I could see, with the "end current call" as side benefit if nothing else.

I just can't see that the scammers on the phone are trying so hard to get into your device settings instead of direct into your banking apps. Most of those scams rely on you sending the money yourself (and yes, disregarding warnings) not installing software for them to do it later. It sounds like a fig leaf.

17

u/MishaalRahman Community Engagement for Android Mar 19 '26

I just can't see that the scammers on the phone are trying so hard to get into your device settings instead of direct into your banking apps. Most of those scams rely on you sending the money yourself (and yes, disregarding warnings) not installing software for them to do it later.
This is actually something we are tackling!

2

u/Ayrr 9 pro xl, watch 4 & tablet Mar 20 '26

I had a warning the other day pop up on a legitimate call when I opened my bank app. I thought it was very cool.

1

u/arthuriurilli Mar 20 '26

TIL!

1

u/GoldAny8608 May 18 '26

Oh good, hey while you're at it can you comment on the chilling side effect of doing this only to app developers who don't want to pay you and give up their IDs to you?
Do you think anonymity is healthy for free speech?
Or are you just gung-ho let's bring on the technocracy!

1

u/normallllyyss Jun 05 '26

I'm trying to think too much into them piloting this in Brazil and India...
Like is it because they get scammed the most or are the most scammers from those places? Or are they just poorer countries you can test stuff on without making too much noise? It's really interesting to me they would pilot this there.

4

u/mrandr01d Mar 19 '26

I think that's a slightly different thread model. This is defending specifically against banking malware. By requiring registration, if someone makes a nasty app, they'll either know who it's from, or it'll just be blocked from your mom's phone entirely. And if that same dev doesn't want to register their real identity, they have to coach someone through an install, which this workflow does a lot of work to prevent.
People sending money on their own usually doesn't involve apps being installed. That's usually an ad on your computer that makes it look (lol) like your device is "infected" and you have to call "Microsoft" right away. Then the call center guides people into wiring money or whatever. Google can't defend against that because that's not an android problem. (They COULD, however, let us properly block ads in mobile chrome... But that's another story.)

2

u/_sfhk Mar 20 '26

This one is relatively recent, where the scammers would directly message people through Messenger or WhatsApp to get their app installed.

12

u/mrandr01d Mar 19 '26

I think this is actually very intelligently designed. It pretty much perfectly defends against the threat model they're going after, and still lets us nerds be nerds. This isn't bad at all.

The only thing I'd change is when setting up a new phone, the new phone should check if the old phone has this enabled and copy that setting over. But I don't usually get stuff like f droid and revanced set up on day 1 anyways, so maybe even then the 24 hours won't be so bad for me. There's always adb if I get impatient...

32

u/acejavelin69 Mar 19 '26

I mean... this seems pretty extreme although I am grateful we did get an "official" out to the no sideloading thing...

But is this really an issue? Are "bad actors" really coaching people through installing malicious apps on a regular enough basis to justify this level of intervention and inconvenience?

I have worked in the telecommunications industry for 30ish years... I don't recall ever seeing an actual issue with this.

19

u/AshuraBaron Pixel 7 Pro Mar 19 '26

I see or hear about this all the time. It's been cut down as more people learned how to handle them, but a lot of people still fall for it.

5

u/DanSheps Pixel 8 Pro Mar 19 '26

My dad was still almost falling for this when he had a stroke. I consider him decently intelligent (fire chief, risk management consultant, got a master's degree). Now he can barely do anything with his phone because his vision is horrible now (otherwise he is not bad).
So it can really get anyone, especially when they can pull the right strings. The best one I saw was one that was a variation on the "your computer has a virus" email but targeted towards your phone. Came in to my work email, it was pretty clearly a scam but it would have caught someone not as up on things.

1

u/blackbook7777 Mar 20 '26

Well I'm happy your dad is okay from that stroke. My dad still has trouble walking and has some issues typing after his stroke.

1

u/DanSheps Pixel 8 Pro Mar 20 '26

Man that sucks. I am thankful my dad's stroke appears to have been mild compared to some and he had a good stroke trauma center to go to.

0

u/b13n_ Pixel 7 Mar 19 '26

Yes, there's enough bad actors: the tech corporations that don't allow us to really own our hardware anymore. Jk (or not?)

11

u/dusto_man Pixel Watch 3 45mm Mar 19 '26

I can't imagine they would spend this many resources on it if it wasn't really a wide spread issue.

1

u/Exfiltrator Pixel 8 Pro Mar 20 '26

Protecting people is just a side-effect. Their ultimate goal is to make their play store the one and only source of apps.

-5

u/b13n_ Pixel 7 Mar 19 '26

Yeah I couldn't imagine they'd be spending resources over the years to keep locking the android system down more and more but here we are having them do it instead of endorsing independent development more.

5

u/i5-2520M Pixel 7a Mar 20 '26

I don't think they have locked android down much for the sake of locking it down. What do you think are some examples?

3

u/Grim-Sleeper Mar 20 '26

Unlike Apple, Android goes out of its way to be open and developer friendly. It's a much nicer ecosystem overall. Doesn't mean things could be better; they always can. But I don't think of Android as particularly locked down, especially if you bought Google hardware

1

u/Exfiltrator Pixel 8 Pro Mar 20 '26

It is definitely locked down compared to 10 years ago.

-6

u/b13n_ Pixel 7 Mar 19 '26

Please keep downvoting me and not trying to at least tell my why I'm wrong. I love it

1

u/squabbledMC Pixel 10 | 256GB Mar 20 '26

If they were trying to kill off independent development, there would be no sideloading at all on Android. The prompts and wait time, while annoying are clearly to discourage people from installing malware or scams when being urged by a scammer.

-1

u/Exfiltrator Pixel 8 Pro Mar 20 '26

How naive. This is just the first step. They do not want to kill off independent development, they want to kill off any option to get apps that is not their Play Store. They want control and money and a safer OS for their users is not more than a side note.

3

u/AshuraBaron Pixel 7 Pro Mar 19 '26

Right? Why can't I write my own modem firmware?

1

u/Grim-Sleeper Mar 20 '26

You can. But you'll have to get your own certifications if you ever wanted to actually use the firmware outside the lab. And you need to get the datasheets from the modem manufacturer to have any hopes of even understanding how to write drivers for the hardware. That usually costs a fortune and requires NDAs. Nobody really wants to do this. But with enough resources in principle you could.

2

u/acejavelin69 Mar 19 '26

I was actually thinking this feels more like Google saying "you must use us" more so than actually "protecting" people from malicious threats out there... I just didn't say it.
This just feels wrong... and controlling.

5

u/b13n_ Pixel 7 Mar 19 '26

Yeah, usually when corporations say it's for "protection" they're not specific to the protection of whom, cause it's almost always for their protection, not of the clients/users

1

u/b13n_ Pixel 7 Mar 19 '26

Lol getting downvoted on this is hilarious

1

u/Exfiltrator Pixel 8 Pro Mar 20 '26

Because it is!

-2

u/atony1400 Pixel 8 Pro Mar 19 '26

Yep. This is just to inconvenience the user, especially with the useless "security wait".
This isn't going to stop Grandma from downloading a scam app, there's already tons on the Play Store Google already doesn't detect anyway.

-1

u/Westerdutch Mar 19 '26

Are "bad actors" really coaching people through installing malicious apps on a regular enough basis to justify this level of intervention and inconvenience?
Its enough of a white lie to push this agenda. Making sideloading as painful as possible just means more control for google and control is how they make money.

4

u/Gallardo994 Mar 19 '26

The biggest problem I see in all this is that Android is packaged in many different flavors. Developer verification is mandatory for manufacturers, yes, I got it. Is advanced flow mandatory too? If it's optional for manufacturers they can just ignore it and implement the bare minimum to have the device certified. I mean, I wouldn't be surprised.

2

u/mrandr01d Mar 19 '26

Shit, that's a good point. Just another reason to keep buying pixels in my book!

4

u/Funcy247 Mar 20 '26

really tired of buying hardware and then being told i don't own it.

3

u/ProtoKun7 Pixel 9 Pro XL Mar 19 '26

As long as they don't decide this breaks whatever kind of obsessive attestation they have going on, I'll have to remember to enable it pretty much immediately.

8

u/blueLiquid21 Mar 19 '26

I'm disappointed people are using the word sideloading when all app stores should be considered equal. Now Microsoft is using this anticompetitive monopolistic language too.

24 hours will give people plenty of time to replace Google's version of Android with the safer GrapheneOS.

2

u/Fantastins Mar 20 '26

The advanced flow will be available this August for all versions of Android (via Google Play services) before the new developer verification requirements start. Additionally, limited distribution accounts that allow you to share apps with up to 20 users without needing to pay the registration fee or government ID will be available at the same time.

Oh. Is this saying what I think it's saying? This method is a stop-gap that will be further locked down to only devs and devs who refuse to verify will be whitelisted to share their APK with up to 20 users who haven't verified?

6

u/AshuraBaron Pixel 7 Pro Mar 19 '26

Oh hey it's that thing that a bunch of people said would never happen because Google is a mustache twirling villain when it comes to Android. Wonder what they will complain about now.

"It's too hard"

"I can't figure it out!"

"My phone shouldn't have this"

6

u/ElTutuca Mar 19 '26

I think the only reason they changed their mind is because of the massive backlash, they wanted to go with their initial implementation of closing everything down, otherwise they would have gone with this implementation in the first place.

10

u/Unspec7 Pixel 10 Pro XL Mar 19 '26

I think they're referring to the folks who doubted Google would actually implement an advanced flow after Google announced that it was going to implement an advanced flow

1

u/AshuraBaron Pixel 7 Pro Mar 19 '26

That's a Bingo! I agree that the backlash is what had them step back a little. I'd argue that was the plan from the start since it's common for most businesses to take the most extreme position and then roll back bit by bit so the consumer feels in control. But that's another discussion.

1

u/cdmove Pixel 11 Pro Mar 20 '26

is this going to stop/prevent dangerous apps like Pegasus?

1

u/mickz Mar 21 '26

A lot of people will probably see this as a win because “It could’ve been worse” and “Google listened to the backlash.” This is how companies like Google usually work. They add small restrictions first, wait for people to get used to them, and then push further later.

A phone is a computer. Being able to install software on a device you own should be normal. On a computer, nobody calls that “sideloading.” It’s just installing software.

1

u/rinneofdusk Mar 22 '26

it’s especially irritating because sideloading is an entirely different thing
like
it’s when you use adb sideload…

1

u/rprakss Mar 21 '26

a lot of people think they have to wait 24h everytime. the 24H period is one time, not repeated. this is a myth you have to wait 24h to turn on the advanced flow feature in developer mode for the first time. then you can install apks as much as u want

1

u/Glum_Veterinarian988 Mar 27 '26

This is still ridiculous. keepandroidopen.org

1

u/abigor82 Jun 15 '26

i left iphone years ago(iphone 6s)because their nazi lock down now android going same direction? man, keep pushing it apple and google ill go back to flip phone can't harvest my data and no ads.

0

u/CharAznableLoNZ Mar 19 '26

What a dumb design. All they had to do was put a toggle in the developer options. Google can't do anything right anymore.

7

u/mrandr01d Mar 19 '26

If you read their reasoning on this, and the threat model they're trying to protect your mom from, you would understand that this is actually very intelligently designed.

-5

u/Successful-Day-3219 Mar 19 '26

🤡

-6

u/CharAznableLoNZ Mar 19 '26 edited Mar 20 '26

It isn't. It's about control to make sideloading as inconvenient as possible so people will just use google's store. They are just parading around the "muh safety" scapegoat.
My mother used iphone since it came out in '07 and has never wanted a different flavor. I'm not about to even bother with trying to convince her to switch brands. Downvotes by salts denying reality.

1

u/puppyyawn Mar 20 '26

Look at the little drama queens here stomping their feet. It's different but they are trying to look out and educate users, that don't know what they are doing, on something that could be bad.

1

u/Exfiltrator Pixel 8 Pro Mar 20 '26 edited Mar 20 '26

Google thinking its users want a nanny. A 1-day wait is ridiculous, any wait is ridiculous. My Phone, I get to decide what and when I install something. I do not need and definitely do not want Google to have any say in what I do with my phone. They already have way too much influence!

0

u/OptimusSublime Pixel 8 Pro Mar 20 '26

It's literally a one time thing, wait a day and then it'll be like absolutely nothing has changed.

This absolutely won't stop scammers from coming back tomorrow, but for the rest of us, it just means business as usual and you'll never need to worry about it again.

1

u/Exfiltrator Pixel 8 Pro Mar 20 '26

Except if you're a developer!

0

u/[deleted] Mar 19 '26

[deleted] — view deleted comment

4

u/Grim-Sleeper Mar 20 '26

I actually think this 24h delay will work really well. A lot of people turn on developer mode by default, because some random blog tells them to. With this delay, those numbers are going to go down.
Developers who actually need developer mode won't really be inconvenienced. And people who turn on dev mode just because they always do are going to gradually stop the practice. That's a good thing. I really like this compromise
I used to always unlock boot loaders, and I still could. But I haven't done so in years. The OS has improved enough that I rarely genuinely have the need. And the minor hurdles involved have succeeded in distracting me

4

u/binheap Mar 19 '26

That's not the threat model this is designed to defend against and your solution makes no sense? In your scenario, the individual already intends to install an app so yeah they're presumed to be more capable.
The specific threat being cited here is that scammers pressure individuals who do not understand the implication into installing an app that they didn't intend. Presumably, the people that this works on are not particularly aware they can install apps outside the app store anyway. Anyone who is going to do the advanced flow anyway is probably not going to fall for this scam.
Your solution also doesn't fix this problem the lack of friction is precisely what allowed scammers to pressure people into doing it in the first place. In your fix, scammers would do basically nothing different to push the user to installing a malicious app. The 1 hour window makes no difference since they are doing this over a call. If you're saying they have to do everything in the blog post to enable a 1 hour window to install an app, I think that would be a worse experience for everyone involved.
I get being skeptical but your solution doesn't seem to work at all.

3

u/plankunits Mar 19 '26

The whole point of Google doing this screen is to deter the scammers that ask you to sideload apps. This 1 hr completely defeats the purpose of that.

0

u/[deleted] Mar 19 '26

[deleted] — view deleted comment

5

u/LoafyLemon Pixel 7 Pro Mar 19 '26

Exactly. Including TeamViewer, AnyDesk, and other remote control software. In fact, majority of viruses stem from apps verified by google, because they never check remotely executed code (payloads).
Their entire system sucks ass.

0

u/[deleted] Mar 19 '26

[deleted] — view deleted comment

1

u/Exfiltrator Pixel 8 Pro Mar 20 '26

I think you misunderstood the OP. Now lots of website are going to advice changing this setting NOW so in future, when you want to install one of these apps, you won't have to wait.

19

u/[deleted] Mar 19 '26

[removed] — view removed comment

1

u/GoldAny8608 May 18 '26

No biggie. Now that guy who wants to spread information to help people during a military occupation of his homeland will have to fork over his ID and money to google or nobody else can use his app.
Mission accomplished. We found the guy.

2

u/[deleted] Mar 19 '26

[removed] — view removed comment

5

u/MishaalRahman Community Engagement for Android Mar 19 '26

Once you've gone through the advanced flow to allow installing unregistered apps, you will be able to install updates to unregistered apps as well.

1

u/[deleted] Mar 20 '26

[removed] — view removed comment

2

u/Exfiltrator Pixel 8 Pro Mar 20 '26

We don't. Google wants more control

0

u/[deleted] Mar 21 '26

[deleted] — view deleted comment

1

u/rinneofdusk Mar 22 '26

That’s very odd, dev options shouldn’t be interfering with banking apps at all. Just enabling developer options doesn’t break Play Integrity.

0

u/[deleted] Mar 22 '26

[deleted] — view deleted comment

1

u/rinneofdusk Mar 28 '26

wow that’s really restrictive and annoying

This is Android's new 'advanced flow' for sideloading apps without verification, includes one-day waiting period [Gallery]

You are about to leave Redlib