Google has announced the start of testing for a developer verification system for Android applications and is reconsidering previously announced restrictions on the installation of apps from manually uploaded APK packages created by developers who have not registered their packages with Google and have not verified their personal data. It is noted that the company has taken into account the concerns and wishes of the community and has decided to implement an option for advanced users who are willing to take risks concerning the security of their devices.
The new option will be implemented in addition to the existing ability to install applications using the 'adb' (Android Debug Bridge) utility, which requires connecting the device to an external computer, enabling developer mode, and providing a free type of accounts for enthusiasts and students that works without identity verification but requires registration of each device in the Android Developer Console on which the app may be installed.
The new option will allow users to independently install necessary unverified applications without the involvement of their developers. Details on the implementation of such a capability are still in development and will be disclosed in the coming months. It has been stated that the process of installing unverified applications will include measures to protect against coercion, which will complicate evading security checks under pressure from scammers, as well as warnings explaining the arising risks.
Components for app verification will be introduced in the Android 16 QPR2 update, which will be delivered to users in December. For users of already released Android versions, the change will be implemented through an update to the Google Play Protect component. Starting today, testing of the registration and verification interface for applications has begun in the Android Developer Console, accessible only to select invited developers. All app developers will be able to undergo verification by March 2026. In September 2026, verification will become mandatory in Brazil, Indonesia, Singapore, and Thailand. In 2027, the practice of banning software from unverified developers will gradually begin to be implemented in other countries.
To verify, the developer must register with the Android Developer Console if they have not already registered with Google Play and provide data such as full name, residential address, email, phone number, and a photo of an identification document. For limited accounts of students and enthusiasts, providing an identification document is not required. A registration fee of $25 will apply for developers. Organizations will need to confirm their website and provide an international business identifier (DUNS).
After registration, the developer must add their applications and confirm that they are the author by providing full package names and keys for digital signatures. To prevent claiming ownership of already existing third-party packages, the developer must demonstrate the ability to generate digital signatures with the same key that was used to sign existing applications. The input checks on installed applications are mandatory only for certified Android devices (most major manufacturers undergo certification).
Source: opennet.ru
