Taterr
Joined 2 years ago
Joined 2 years ago
Google claims this to be a very common or majority attack vector.
"The Global Scam Report also found that scams were most often initiated by sending scam links via various messaging platforms to get users to install malicious apps and very often paired with a phone call posing to be from a valid entity."
https://security.googleblog.com/2024/02/piloting-new-ways-to...
> If you're first attaching your account to the device, you simply check a box that says this is an advanced user's phone.
I completely agree this is a perfectly valid solution but what about those who already setup their device? The security of the checkbox only works if you click it before someone attempts to scam you.
"The Global Scam Report also found that scams were most often initiated by sending scam links via various messaging platforms to get users to install malicious apps and very often paired with a phone call posing to be from a valid entity."
https://security.googleblog.com/2023/10/enhanced-google-play... https://security.googleblog.com/2024/02/piloting-new-ways-to... https://blog.google/intl/en-in/products/launching-enhanced-f...
They're also growing rapidly, so those numbers might already be double in 2026
1. https://www.theguardian.com/technology/2025/dec/02/scam-stat...
The scammers will find some other way to abuse the very generous permissions allowed by an android app if you prevent the notification attack.
Do you have a better idea?
https://security.googleblog.com/2026/02/strengthening-androi... https://blog.google/innovation-and-ai/technology/safety-secu...
For more context, the the "reason" they're increasing the friction in sideloading is to prevent one extremely specific scam where someone instructs you over the phone to download a malicious android app, which then steals your banks 2 factor verification code from your notifications and sends it to the scammers. The 24 hour limitation does seem specifically designed to prevent that so I'm inclined to believe them.
If you look at the rate of growth of the call/text scam industry I think it's entirely possible that android owners are getting scammed out of more money than google themselves makes on the android platform as a whole. It's at least not that far off. Which doesn't even account for the humanitarian issues which they probably feel partially responsible for.
https://web.archive.org/web/20210430091013/https://www.shade...
"To be honest with you. {talked over} you decide to change lane. How come you, did you think to change lanes or you just kinda froze up in that moment?"
He clearly thought they had plenty of time to react to it.
One of my most vivid memories of a poor experience with an LLM was trying to get the web version of GPT 5.3 or 5.2 to help me figure out why I was unable to register for a tournament on start.gg
After trying several things it became apparent that the behavior could only be explained as the result of a bug with the start.gg site, chatgpt refused to consider that it could be anything other than user error on my part, despite the failure I was seeing making no logical sense.
Eventually I opened the firefox dev tools and noticed that the post request parameters to complete the registration were being incorrectly filled out and realized it was because of the metadata in the url that came from clicking the complete registration link I was emailed. Removing the url paramater added by the email link fixed the issue.
There was roughly a 0% chance that the LLM was going to trust me enough to consider it was a real bug.