Yes, this has been widely reported everywhere except for this scaremongering page. Google isn't trying to hamstring developers, they don't want your grandma installing apps that scrape her bank account credentials.
You can, but since android 7 IIRC apps don’t trust the user store by default (unless you have root and add it to the system store or patch the app to trust the user store)
Yeah, I am fine with that. What I have on there is pretty low-stakes and everything I care about on there is backed up regularly with Restic to my local server. If they decide to do murder it, that will suck, I will be annoyed for like twenty minutes, and then I shall move on. It’s not like I paid for it.
As far as I can tell, there really isn't one. I haven't paid Oracle any money since I started and the machine appears to work fine. I think they treat these things as loss-leaders in hopes that you bother your employer to get the more expensive non-free plans.
I created a tool that automatically follows ads to try to find scams.
But that was usually reserved to typosquat domain ads or ads on porn websites.
I didn't know scammers used normal page ads too.
I know tech support scams used to use google search ads, but I don't think they do that as much anymore, so maybe they have moved onto things like adsense.
These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection. That said, it shouldn't be too difficult for google to do some better checks if they actually cared.
Yep. I Agree. I believe it's a question of economics, not technical challenges.
Google is absolutely smart enough to make these attacks un-economical. IMO they are unwilling to incur the loss in revenue this would involve (false positives, banned resellers etc).
Another major issue is google safe browsing whitelists many of these subdomains that the attackers like to host their scam pages on.
As a result, even though "Enhanced" safe browsing can use Gemini Nano to do client side detection of scams and then flag it in google safe browsing for everyone, the entire domain and all subdomains are whitelisted, so that detection never seems to actually fire.
https://blog.google/security/using-ai-to-stop-tech-support-s...
I'm not sure which domains this applies to, but it seems to apply to most of the domains that these scammers actually like to use.
> These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection.
Same issue with spam sms in my country: I think they geo-locate it so submitting the link to safe browsing project takes way too long
I don’t understand this being a “national security” threat.
Besides, mobile proxies exist which work differently. All you need is a mobile data plan that you run a proxy server on. It allows for easy IP rotation and since it’s a pool shared with other customers you cannot easily block it. This is because of things like CGNAT.
IP rotation is easy because reconnecting to the network gives you a new IP address.
Static residential proxies also are a thing, even if they are less effective sometimes.
I’m not sure if you would have to re-enable it every time to sideload updates or new apps. You can also install via adb with no waiting period.