With Android Oreo, Google is stepping up app security
App security is undeniably an issue for Android users, particularly those who choose to install apps from outside of Google Play. Even apps that are housed in the main store are not immune to security issues, but those from other sources are rather more risky.
With Android O, Google has ditched "Allow unknown sources" -- the setting that could be toggled to allow for the installation of non-Play apps. Instead, there is a new "Install unknown apps" permission, and Google thinks this offers more control and greater security.
See also:
The new permission bolsters the security features of Google Play Protect, but extends this protection beyond the confines of the Play store, helping to weed out Potentially Harmful Apps (PHAs). In the past, users who enabled the "Allow unknown sources" option opened themselves up to the risk of malicious app installations, as PHAs could be installed under false pretenses.
Edward Cunningham, product manager of Android security, explains:
A common strategy employed by PHA authors is to deliver their apps via a hostile downloader. For example, a gaming app might not contain malicious code but instead might notify the user to install a PHA that masquerades as an important security update. Users who have enabled the installation of apps from unknown sources leave themselves vulnerable to this deceptive behavior.
In Android O, the Install unknown apps permission makes it safer to install apps from unknown sources. This permission is tied to the app that prompts the install -- just like other runtime permissions -- and ensures that the user grants permission to use the install source before it can prompt the user to install an app. When used on a device running Android O and higher, hostile downloaders cannot trick the user into installing an app without having first been given the go-ahead.
Cunningham says that the new setting increases control and transparency, and it gives users the ability to revoke permissions for individual apps if they want.
To take advantage of the new option, developers need to make a few changes, and an explanation of these can be found over on the Android Developers blog.