
Google starts blocking “uncertified” Android devices from logging in - AndrewDucker
https://arstechnica.com/gadgets/2018/03/google-starts-blocking-uncertified-android-devices-from-logging-in/
======
merb
Well this is neither bad nor good. Because custom Roms will have a hatch out
of it.

This is against something the article itself describes:

> We've actually been unknowing victims of illicit Google app distribution
> here at Ars before. We once imported a Xiaomi Redmi 3 smartphone from China
> to review, and, upon booting it up, we were very surprised to find it came
> with the Google apps pre-installed. As a device from China, this should not
> have happened. After we posted the review, Xiaomi contacted us with some
> very scary news: "The Redmi 3 should not come with Google Play pre-installed
> because it is a China-only product." Xiaomi told Ars. "It is very likely
> that the Play Store you saw was preinstalled by the importer/seller. This is
> a very common practice with the unauthorised importers."

> This would mean the reseller opened our phone, unlocked the bootloader,
> flashed on a new ROM with Google Play, re-locked the bootloader, and stuck
> the phone back in the box. There was no obvious evidence that our device had
> been tampered with, and, while hopefully the seller only installed Google
> apps, they could have just as easily loaded malware onto the device. A
> message like this during setup would have been a big red flag that something
> was wrong.

Which I find quite disturbing. That a seller (even on Amazon) could import
cheaper "china" only phones and sell it to me as the EU/US version. (it's
basically incorrectly labeled)

Edit: formatting

~~~
derefr
Wow, I never realized that it's effectively impossible to tell if an Android
device has a custom ROM intentionally set up to not look like a custom ROM.

Is there any chance of Android gaining a "Secure Boot" logic—not in the sense
of desktop PCs, but in the sense of ChromeOS devices? (i.e. not that you can't
boot custom ROMs, but that you'd get a click-through warning each boot from
the hardware boot loader that the OS signature check has failed.)

~~~
cyphar
> but in the sense of ChromeOS devices?

You can fairly easily flash a custom ROM onto a ChromeOS device and remove the
boot-up warning. It does require taking apart the device quite significantly,
and then flashing different u-boot firmware using a firmware flasher. But it's
definitely possible. The problem with ChromeOS devices' "secure boot" is that
it is disabled if you want to boot something not trusted in the firmware, so
if you have a custom OS you have to disable one of the main security features
of the device (unless you flash different firmware onto the device).

Oh, and Android already has this feature. But as with ChromeOS you can disable
the warning if you re-lock the bootloader. However, each time you unlock (or
relock in the case of Pixel devices) the bootloader, the device will be reset
to factory defaults.

~~~
derefr
> Oh, and Android already has this feature. But as with ChromeOS you can
> disable the warning if you re-lock the bootloader.

Ah, I was basically imagining that there was some separate "bootloader" stage
sitting on a chip that _can 't_ be user-flashed (and is hopefully even fully
WORM, like old school OTP-NVM PROMs) which would handle the secure-boot logic.

So I guess I should rephrase my hypothetical technology as "like Secure Boot
in x64-platform PCs—where the CPU checks the BIOS signature and then the BIOS
checks the boot loader signature and then the boot loader checks the OS
signature—and where the CPU and BIOS can't be tampered with after the factory,
thus guaranteeing the sanctity of the bootloader—but where a failure of the
boot loader to verify the OS just results in a click-through boot warning."

~~~
kogepathic
What you are describing is Intel BootGuard. [1]

There is a signature burned into efuses in the CPU that is used as a root of
trust for the BIOS, which implements SecureBoot.

In _theory_ this protects the boot chain from tampering. In practice vendor
BIOS implementations are usually buggy garbage, so while you cannot replace
the BIOS (because then the signature would fail and the platform won't boot)
it may be possible to circumvent the security features by exploiting some bug
in the IBV code or in their UEFI implementation.

[1] [https://patrick.georgi.family/2015/02/17/intel-boot-
guard/](https://patrick.georgi.family/2015/02/17/intel-boot-guard/)

------
ktta
While people think this is a move to curl illicit app activity(which is the
cover issue), I think there's a much bigger motive. It's the fight against
Amazon.

Depending on how strictly this is enforced, now Amazon Fire Tablet users won't
be able to use Google Play store (they were able to with an apk till now)
which cuts off access to the app ecosystem on the Google Play Store.

Now there are quite a few apps on Amazon's App store[1], but obviously many
users will feel the pain.

So now they will not have access to the following - Google Assistant, Google
Home and Google Maps which will hurt the most.

[1]: [https://www.amazon.com/mobile-
apps/b/ref=topnav_storetab_mas...](https://www.amazon.com/mobile-
apps/b/ref=topnav_storetab_mas?ie=UTF8&node=2350149011)

~~~
yorby
Amazon doesn't want their tablets to have the Play Store (they don't come with
it pre-installed), I don't really get your point.

~~~
ktta
>Amazon doesn't want their tablets to have the Play Store

Sure, but their customers do. It will be a lot less attractive option for some
people if Google comes out with its own tablet, since it will have Google
_and_ Amazon's apps (setting aside the possibility of price difference)

I also partly agree with what habura said.

I think Amazon _does_ care about the Google Play at bit because the developer
fees on the apps go to Amazon rather than Google.

On the other hand it is also more about the services ecosystem that Amazon and
Google are offering.

Take the following:

1\. Cloud storage - Google Drive vs Amazon Drive

2\. Digital content stores(books, movies, etc)

3\. Music Subscription. (this came later, but still helps my point)

Amazon might've weighted the above and thought that if it has a monopoly of
these services, people would go with Amazon rather than Google's services,
since it will be available on more devices.

Note: This is all speculation, and even maybe as another user called it, a
'baseless conspiracy theory' so take it with a grain of salt. Longterm
corporate decisions are hard to decode with confidence.

~~~
pas
> if Google comes out with its own tablet

Yes, I get that Google is not really pressed in the tablet space (as it seems
to be dead in the water, no new shiny tables for ages), but this
interpretation reads too much into Google's tablet strategy. (Which is so far
to concentrate on mobiles, and pay lip service to the tablet line by simply
allowing Acer et al. to use a/the Google brand.)

> developer fees

??? So far Google Play dev account is free, of course Firebase is expensive as
fuck.

~~~
ktta
>reads too much into Google's tablet strategy

It does, but sure puts Google in a good position if it needs to. Even right
now even if Google doesnt make tablets, it would rather have other companies
which are cooperative (get the Android CTS) get the edge. I assume you've
heard of the passive aggressive fight between then.

>Google Play dev account is free

I was talking about the 30% store cut that Google gets for paid apps. Also you
need to pay $25 to have a developer account, so that's not free either

~~~
pas
Hm, we have a published app, and continue to pay $0 for it. But looking at
search results the 25 was already there in 2014, so ... maybe it's just for
new accounts?

> strategy

Agreed! The embrace extend and E-something always works wonders, even if you
don't do it, you just have to be in the position to be able to do it.

------
aaomidi
Google has slowly but surely started approaching the walled garden approach
put forth by Apple.

It is totally within their right to do this. I understand why they're doing
this. I'm not happy with it.

~~~
ksk
Shouldn't the customer _also_ have a right to do whatever they want with the
device they paid good money for? Google is intentionally disabling the device
without providing any evidence of breach of terms. I don't agree that this is
their right.

~~~
joshuamorton
This gives a consumer the ability to do whatever they want with a device[1].
Its a change aimed at stopping OEMs from providing unlicensed devices. (Edit:
or really from providing official Google apps on those devices. There's
nothing wrong with forking Android for your device, but Google does want to
control whether or not Gmail runs on it, especially if that device doesn't
meet certain standards.)

[1]: See the "custom ROM" thing at the bottom. There's a caveat that the
current implementation has a limit of 100 device ids. There's some
discussion/debate about what that will end up meaning. If it ends up meaning
100 devices, that's fine for any consumer use pattern. It may in practice end
up meaning 100 flashes, which is/could be problematic for certain users
(custom ROM developers, as an example).

~~~
ksk
In cases where users' freedoms for legitimate uses are curtailed I believe we
should be siding with the end users. Maybe in time we will see microsoft
banning chrome, firefox, steam etc from running on devices not certified by
MS. Its "their OS" so "its their right".

~~~
joshuamorton
But the end user can do whatever they want. The end user is free to install a
custom ROM and use GApps. They have to jump through an extra hoop.

This would be like Microsoft banning Lenovo from sticking unlicensed copies of
windows on Lenovo laptops. Something which Microsoft already does.

~~~
ksk
Well my analogy was that the 'service' MS provides is the OS Platform API, and
its blocking applications from executing on their platform. Which would be
ridiculous. A user should be able to run any software they want.

Similarly, as a user (paid or otherwise) of Google's services, unless specific
evidence is given that the user is abusing their services, Google is in the
wrong here of blocking someone preemptively.

~~~
joshuamorton
What end user do you feel is being blocked from using what software? I have a
feeling you misunderstand what's actually happening here.

------
hanbura
I'm glad to see they left a door open for users of custom ROMs. While
inconvenient, it will end up as just another item on the already complicated
guides for installing custom ROMs. Let's just hope this option doesn't
disappear one day

~~~
ocdtrekkie
Note that it appears there is a 100 registration limit per Google account. And
each factory reset changes the ID the phone is registered under. For a lot of
ROM folks, this is probably not going to last very long.

~~~
sesutton
Is it possible to deactivate old IDs?

~~~
kuschku
No – it’s 100 times of installing ROMs per lifetime, then you’re EOL.

~~~
rorosaurus
Wow, if that's true, that changes the whole tone of this. Hopefully this is
just a temporary oversight, and Google allows the opportunity to delete and
reuse these 100 slots.

~~~
ocdtrekkie
I suspect if they were intended to be "reusable slots", it would be a
drastically smaller number, like... five.

~~~
nstart
Which is actually fine. 5 is restrictive but 15 is just fine.

------
pmlnr
An open source implementation of the to google services layer exists already:
the microG project[^1]. Combine it with f-droid, and apps like Yalp store[^2],
and the phone functions perfectly.

I've made a guide a little while ago on how to do this on a Nomu S10, one of
the cheap, MediaTek based, rugged phones[^3].

[^1]: [https://microg.org/](https://microg.org/)

[^2]:
[https://f-droid.org/packages/com.github.yeriomin.yalpstore/](https://f-droid.org/packages/com.github.yeriomin.yalpstore/)

[^3]: [https://petermolnar.net/odexed-android-6-marshmallow-with-
mi...](https://petermolnar.net/odexed-android-6-marshmallow-with-microg/)

~~~
agentdrtran
> the phone functions perfectly

I guarantee it doesn't.

~~~
pmlnr
I can send text, email, call someone.

Travel apps, say, Ryanair, Easyjet, Booking, are working without a single
glitch, including push notifications.

Version 8 of Google Maps and version 3 of translate (the one with the 200+MB
language packs that people actually understood, unlike the AI-powered 30MB
ones in the new versions) don't need Google Services Framework, neither does
Osmand.

Netflix, Spotify, amazon videos work fine, amazon anything works fine.

Even whatapps (which I sadly had to install due to the lack of other channels
with a few groups) functions as expected.

The only app I'm using and has problems is Monzo: most of the push
notifications don't come through, only sometimes one of them, and you have to
- gasp! - manually refresh by pulling the screen down.

I'm really curious about your "guarantee".

------
userbinator
_An Android ID is 64-bit hex string set at first boot and regenerated every
time a factory reset is performed._

...and likely quite easy to set to any value you want on the "unoficially
open" Mediatek platforms. This is the little-known secret amongst the Chinese
Android community --- cheap and featureful devices with no locked bootloaders
or other anti-user crap, easy "unbrickable" recovery, and plenty of leaked
documentation from the hardware level up. Roughly equivalent to a PC, in that
while a lot of them come with preloaded software you might not want, it's also
not hard to remove that and customise to your heart's content, and join in the
community of others doing the same.

I give it at most a month before this block is cracked. Unless there's some
insanely crazy DRM-esque things Google is doing, it doesn't seem so difficult
to bypass; and even then, the Android hacking community is full of people who
love a challenge. See the constant cat-and-mouse game of detecting and hiding
root, for example.

~~~
shawndellysse
> cheap and featureful devices with no locked bootloaders

would you mind providing links to such devices, and the roms that go on them?
I'd be very interested in this when my Moto Z eventually dies

------
cornholio
How can this be legal? Google is effectively using it's dominant market
position in mobile apps stores, mapping and search to remove from the market
other compatible operating systems. Derived from the same open source core as
it's own, but that is irrelevant for this discussion, they are not licensed
Android versions, therefore they are compatible competitors.

~~~
bitmapbrother
Perhaps you should first start off by answering in what world is it legal for
shady OEM's and middlemen to pre-install proprietary Google Play Services on
devices that weren't certified by Google.

~~~
cornholio
I'm not entirely sure you are following my point: it's illegal to install that
software precisely because Google has restricted their use on competitor
platforms. In the general case, there is nothing wrong with licensing your
code as you see fit, however when you have a market dominant position things
change dramatically from a regulatory perspective. See the repeated run-ins
Microsoft had with competition regulators on both sides of the Atlantic.

The point to debate is whether Google has a dominat position in say search.
Not if "this world" grants a right to unfettered anticompetitve and monopolist
business practices - it does not.

------
marssaxman
Having always been careful about ensuring that my Android phones don't
accidentally get logged into any Google account, I'm all for this change and
glad that Google is actually making life easier for once.

~~~
Tharkun
I find this very hard to do. Which Android devices do you use? Most of the
ones I've touched don't have an obvious way to opt out of google crapware and
google accounts.

~~~
marssaxman
I currently have a Moto G; I previously used a Moto X, and before that a
Galaxy Nexus. Of course the google apps nag me to log in or create an account,
if I happen to launch one by accident, but the phone itself works fine without
one.

For one of the phones I couldn't find a way to get through setup without
creating a google account, so I just entered a bunch of garbage info, then
deleted or froze all the google related services and reset the accounts
database. Its sole entry after that was my Signal login.

------
thaumasiotes
Slightly off-topic, but I see this complaint a lot:

> Android distributions that don't pass Google's compatibility requirements
> aren't allowed to be called "Android" (which is a registered trademark of
> Google)

This is supposed to be a straitjacket that prevents everyone except Amazon
from deviating from Google's Master Plan.

It reminds me of what happened with personal computers, where, amid a field of
slightly different hardware from different manufacturers, devices started to
be sold as "IBM PC-compatible", which eventually just shortened to "PC"
because nobody cares whether their computer has official IBM branding or not.

What's stopping people from releasing phones with an "Android-compatible" OS?
Who would care?

~~~
bitmapbrother
>This is supposed to be a straitjacket that prevents everyone except Amazon
from deviating from Google's Master Plan.

Chinese OEM's that sell smartphones in China without Google Play Services
would disagree.

------
rocky1138
We need a FOSS phone yesterday. What are the options?

~~~
mmel
I've seen this idea proposed countless times, but they always seem to either
fail to deliver in terms of "FOSS" or turn out to be a kickstarter phantom
project that never ships.

The latest phone I see people pinning their hopes on is
[https://puri.sm/shop/librem-5/](https://puri.sm/shop/librem-5/)

~~~
petecox
There was a post today, by one of the KDE developers who has been involved
with the postmarketOS crew in getting mainline kernel support, i.e 4.16 and
not with whatever fork Android ships on, for an off-the-shelf device (Nexus 5)

[https://news.ycombinator.com/item?id=16678400](https://news.ycombinator.com/item?id=16678400)

------
hbosch
The biggest group of victims here is most probably those with Amazon devices
that have Gapps sideloaded. Are there any other large segments this would
affect, seeing has how custom ROM users are (for now) spared?

~~~
zokier
I imagine that the body of (non-western) people who have gotten their phones
from less scrupulous vendors would be significantly larger than the relatively
small number of Amazon sideloaders.

------
jmarinez
Considering the state of affairs regarding transparency and privacy, one would
think that they would define what “certified” actually means.

~~~
ocdtrekkie
"Certified" means they have signed Google's Mobile Applications Distribution
Agreement, a confidential contract where Google permits access to Google Apps
in exchange for the manufacturer agreeing to load up all of Google's required
bloatware, set Google Search as default, comply with all of their
compatibility requirements, and agree to not release any devices running
alternative versions of Android.

We don't have a current version of the MADA public, but you can see some old
ones from 2011 here:
[http://www.benedelman.org/news-021314/](http://www.benedelman.org/news-021314/)

------
dotancohen
Users of custom ROMs can register their devices per-user here:
[https://www.google.com/android/uncertified/](https://www.google.com/android/uncertified/)

It is limited to 100 devices per user, not a problem for real end users.

------
amaccuish
Is anyone else getting a "something went wrong" when trying to register your
id?

~~~
nstart
yep. Been trying for the past 30 minutes. Not sure if there's a surge of
people trying to register devices suddenly.

------
Markoff
well as custom ROM user for 7 years all I can say it's I survived without
gapps for years in China and I was fine, I will be fine if they won't allow me
to sign in as well outside China, after all only two Google apps (with UI)
left on my phone are Play store (Yalp store covers that) and Photos (well,
there is no real alternative for unlimited backup but Flickr would do it and
sharing through some messenger)

only thing they will accomplish by locking their ecosystem it's they will have
two less users when I will remove gapps from wife's phone as well

------
Animats
Great! Does this mean Google will stop installing PlayStore crap on my Android
phone that doesn't have a Google account? I deleted all that stuff, but it
came back with an update.

~~~
makomk
No, it means the exact opposite. This is another escalation of Google's
efforts to ensure that all of their apps are installed on every Android phone
sold whether users want them or not. Previously, some companies were working
around the requirement that every device they sold had Google apps if they
wanted the right to include them on any device by illicitly sideloading the
apps; this makes that impossible.

------
codedokode
I don't see any problem here. If you use custom ROM you probably don't want to
give information about yourself to Google anyway.

It would be even better if Google reviewed ROMs before certification. I have a
noname chinese phone that sends data about the phone including a phone number
to China (but Google is not much better - every time you enable geolocation it
displays an annoying popup asking to agree to send GPS data to Google. Well,
at least they ask for permission).

~~~
txsh
Kindle tablets

------
mehrdadn
How do you find if a particular distro is blessed by Google? Is there a list
I'm not aware of?

~~~
morsch
The _hardware_ is either certified or it isn't; the distro (as in custom ROM
version) isn't a factor.

~~~
mehrdadn
Ohh, interesting, okay thank you. In that case is there a list for the
certified phones?

EDIT: Actually, wait, are you sure this is correct? Didn't the article say _"
Users of custom Android ROMs—which wipe out the stock software and load a
modified version of Android—will start seeing this message, too"_? I was
trying to figure out which ROMs that included.

~~~
morsch
Sort of:
[https://www.android.com/certified/partners](https://www.android.com/certified/partners)

~~~
mehrdadn
Hm, then what was that story about Xiaomi? It's listed there as a certified
partner.

~~~
morsch
Xiaomi has started releasing Google certified hardware late last year[1][2].
AFAIK they still release non-certified hardware as well.

[1]
[https://en.wikipedia.org/wiki/Xiaomi_Mi_A1](https://en.wikipedia.org/wiki/Xiaomi_Mi_A1)
"a re-branded Xiaomi Mi 5X"

[2] [https://arstechnica.com/gadgets/2018/03/xiaomi-
mi-a1-review-...](https://arstechnica.com/gadgets/2018/03/xiaomi-
mi-a1-review-a-220-iphone-clone-with-stock-android-sign-us-up/)

------
pishpash
Good. Let Google force open source replacements to their nosey apps. In the
long run, this is shooting themselves in the foot. At this juncture, people
don't _really_ need Google apps other than perhaps Gmail, which has an IMAP
endpoint.

~~~
blablabla123
I think so too. There is so much adware and spyware in the Play Store, it's
better for everyone to try alternatives from FDroid and other App Stores.

Also it's a nice strategy so people forget that you cannot update most Android
phones anyways. And IMHO their Google Apps Suite is actually far creepier than
Facebook because it's literally with you all the time.

