NewApp Digest
search bot

signing keys

Google expands Android Binary Transparency to counter supply chain attacks
AppWizard
May 6, 2026

Google expands Android Binary Transparency to counter supply chain attacks

Supply chain attacks targeting mobile software have increased due to the reliance on smartphones for essential functions. In response, Google has launched an enhanced Binary Transparency program for Android, which includes a public ledger that records cryptographic entries for production applications. This program initially covers two software layers: Google Applications and Mainline Modules. For Pixel device owners, it complements the Pixel System Image Transparency feature introduced in 2023, allowing users to verify the authenticity of system images and Google applications. The program aims to address the gap in software trust by distinguishing between digital signatures, which confirm the identity of the binary's creator, and binary transparency, which indicates the intent for public release. If a Google-signed application released after May 1, 2026, is not listed in the ledger, it means Google did not authorize it as production software. Verification tools are available on GitHub for assessing software against the ledger. Google employs "defense-in-depth" protocols to mitigate insider risks, ensuring that no single individual can publish a binary without triggering cryptographic verification. The ledger acts as a public record to deter unauthorized modifications. Google is also working to extend Binary Transparency to third-party developers to enhance the security of the global software supply chain.
Google's got a new tool for making sure your phone is running the Android apps it should
AppWizard
May 4, 2026

Google’s got a new tool for making sure your phone is running the Android apps it should

Google is expanding its Binary Transparency initiative, originally focused on verifying Pixel firmware, to include its Android applications and Mainline updates. This initiative aims to enhance user trust by providing a publicly auditable record of all official app and Mainline updates, ensuring that only certified Google-approved releases are documented. The updated system began implementation in May, allowing users to track every officially published Google Android app and Mainline module.
Google adds 24-hour waiting period to Android app sideloading: Here's what changes
AppWizard
March 20, 2026

Google adds 24-hour waiting period to Android app sideloading: Here’s what changes

Google is set to implement a new protocol for sideloading applications on Android devices in August 2026, featuring a multi-step process that enhances security. Users will need to activate developer mode and confirm their independent action, followed by a device restart and a mandatory 24-hour waiting period before installing any APK. After this period, users must authenticate their identity and choose between a seven-day or indefinite access for unverified installations, with a warning displayed for each unverified app. This 24-hour cooldown aims to reduce scams, as 57% of surveyed adults reported experiencing scams in the past year, leading to significant financial losses. Additionally, a developer verification process will begin in September in select countries, requiring identification and a fee, while verified developers will be exempt from the new sideloading steps. Google will also offer free limited distribution accounts for students and hobbyists to share apps with up to 20 devices.
Google's new rules could wipe out sideloading and alternative app stores, F-Droid warns
AppWizard
September 29, 2025

Google’s new rules could wipe out sideloading and alternative app stores, F-Droid warns

F-Droid has raised concerns about Google's upcoming developer verification rules, which require all Android apps to be linked to verified developer identities, including personal information and app identifiers. F-Droid argues that these regulations could threaten the existence of alternative app stores by preventing them from offering apps directly, as they cannot control the necessary keys or IDs. The platform emphasizes that it cannot compel open-source developers to register with Google, stating that the new rules would effectively end the F-Droid project and similar sources for free/open-source app distribution. While Google claims the verification process will enhance security, F-Droid points out that malicious apps have still appeared on the Play Store despite existing protections. The platform advocates for user autonomy in running any programs on their devices and is urging regulators to examine Google's plans, which they view as monopolistic. Google plans to implement these verification requirements in phases starting in September 2026, but asserts that developers can still distribute apps directly through sideloading or other app stores.
How Pixel and Android are bringing a new level of trust to your images with C2PA Content Credentials
AppWizard
September 11, 2025

How Pixel and Android are bringing a new level of trust to your images with C2PA Content Credentials

The Google Pixel 10 phones incorporate C2PA Content Credentials in their camera and Google Photos, marking them as the first to attach these credentials to every photograph taken. The Pixel Camera app has achieved Assurance Level 2, the highest security rating from the C2PA Conformance Program, ensuring a secure environment for digital content. The integration employs a private-by-design strategy for certificate management, preventing traceability back to the creator. On-device trusted time-stamps allow users to trust images even after the certificate expires. The technology is supported by the Google Tensor G5 and Titan M2 security chip, enhancing hardware-backed security features. Content Credentials provide detailed information about the creation and protection of media files, helping users identify AI-generated or altered content. Google is a steering committee member of the Coalition for Content Provenance and Authenticity (C2PA), which aims to establish industry standards for digital content verification. The Pixel 10 categorizes digital content based on verifiable proof of its creation process. Each JPEG photo captured includes Content Credentials, and Google Photos validates these credentials for edited images. The implementation architecture is designed to be secure, verifiable, and usable offline. Google employs a unique certificate management strategy to enhance user privacy, ensuring that each key and certificate is used for only one image. An on-device offline time-stamping authority allows for the generation of trusted time-stamps without requiring internet connectivity.
By 2026, no more "ghost" apps: Android will only accept verified developers.
AppWizard
August 27, 2025

By 2026, no more “ghost” apps: Android will only accept verified developers.

Beginning in 2026, only applications from verified developers will be allowed for installation on certified Android devices. This requirement will apply to all certified Android devices equipped with Play Protect and pre-installed Google applications, including apps from third-party app stores and those sideloaded by users. Google will implement a verification process that confirms the developer's identity without scrutinizing the app's content. Apps installed from third-party sources via sideloading have a malware rate 50 times higher than those from the Google Play Store. Developers can still distribute apps through various channels but must verify their identity and register their app's package name and signing keys. The verification system will begin testing in October 2023, with full availability expected by March 2026. The initial rollout will target Brazil, Indonesia, Singapore, and Thailand in September 2026, followed by global implementation in 2027.
Google to Block Unverified Android Apps Starting 2026: A Big Push for Safer Sideloading
AppWizard
August 26, 2025

Google to Block Unverified Android Apps Starting 2026: A Big Push for Safer Sideloading

Google will prohibit the installation of apps from unverified developers on certified Android devices starting September 2026. All developers must verify their identities before their applications can be installed, with requirements including legal name, address, phone number, email, and for organizations, a D-U-N-S number and official website. The verification process involves registering apps by submitting package names and app signing keys. The rollout will begin with early access for selected developers in October 2025, global access in March 2026, and enforcement in Brazil, Indonesia, Singapore, and Thailand in September 2026, with expansion to other regions in 2027. Personal data collected during verification will not be made public.
Search