IdeaWell

Project ideas from Hacker News discussions.

Android Developer Verification

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

1.Mandatory verification & surveillance of sideloaded apps

"so they're rolling out a system app that will call home to check whether any sideloaded apps have been “verified” with the developer's government ID?" — bstsb

2. Push for truly open, decentralized alternatives

"I really want to like the concept of Jolla / a European mobile alternative but I see no reason why they're closed source SW in 2026. Open source everything, let the community help develop, and sell your hardware (and support/deals for B2B)."
— birdsongs

3. Security concerns are a pretext for further lock‑in

"The security seems more an excuse to become more closed. Like iOS."
— fc417fc802

4. Calls for public regulation as the only viable solution

"I don't see a way out of this except government regulation."
— amarant

🚀 Project Ideas

VeriStore: Community‑Curated Verified App Repository

Summary

  • A decentralized app store that hosts only apps whose developers undergo a lightweight, government‑agnostic identity verification and whose binaries are built on publicly auditable CI pipelines.
  • Solves the friction of “advanced flow” verification and protects users from unverified sideloaded malware while keeping the ecosystem open.

Details

Key Value
Target Audience Android power users, F‑Droid/Obstainium enthusiasts, privacy‑focused developers
Core Feature One‑click install of apps vetted for cryptographic signatures, reproducible builds, and a simple developer ID verification (email + optional government ID)
Tech Stack Web frontend (React/Next.js), backend (Go + PostgreSQL), CI (GitHub Actions with Reproducible Builds), IPFS for asset distribution, Auth0‑compatible ID provider
Difficulty Medium
Monetization Revenue-ready: Subscription (monthly $3 for “Premium Verification” tier)

Notes

  • HN commenters repeatedly called for a “real alternative to Google Play” and expressed frustration with “mandatory ID verification” while still wanting open distribution.
  • This project directly addresses that demand by providing a transparent, community‑governed verification layer that can be adopted by existing open‑source repos.

PrivacyGuard Dashboard: Real‑Time App Permission & Data‑Flow Monitor

Summary

  • A browser‑based dashboard that continuously monitors installed apps (including side‑loaded ones) for permission usage, network connections, and data exfiltration indicators, alerting users to suspicious behavior.
  • Tackles the fear that side‑loading (or even Play Store apps) might silently harvest data, especially for users who cannot afford to switch devices.

Details| Key | Value |

|-----|-------| | Target Audience | Everyday Android users, privacy‑conscious individuals, seniors, and non‑technical device owners worried about hidden surveillance | | Core Feature | Continuous overlay that shows real‑time permission activation, API calls to Google services, and a “risk score” per app; one‑tap revocation UI | | Tech Stack | Progressive Web App (Vue.js + Vite), Service Workers for background monitoring, Android Accessibility Service API, Firebase Cloud Messaging for alerts | | Difficulty | High | | Monetization | Revenue-ready: One‑time purchase ($9.99) for “Pro” version with advanced analytics and custom alerts |

Notes

  • Users like “birdsongs” lamented the lack of visibility into what apps do after installing them on GrapheneOS. This tool gives immediate feedback, turning vague concerns into actionable data.
  • Could spark discussion on Hacker News about privacy‑by‑design and user empowerment.

GranularOS: Lightweight, Isolated OS for Banking & 2FA on Re‑Use Devices

Summary

  • A stripped‑down Linux‑based OS image (based on Alpine Linux) that runs in a sandboxed container on any Android phone, providing an isolated environment for high‑risk apps such as banking, 2FA, or password managers.
  • Eliminates reliance on Google Play Services while granting users full control over their sensitive data.

Details

Key Value
Target Audience Users of GrapheneOS, LineageOS, or any custom ROM who want a “clean room” for financial apps; also useful for refugees or low‑trust contexts
Core Feature Containerized environment with separate network namespace, no Google Play dependencies, and a simple QR‑code based app launcher for verified APKs
Tech Stack Docker‑compatible container engine (LXC), Alpine Linux base, Anbox for GUI bridging, Flutter for UI overlay, TLS‑only networking
Difficulty High
Monetization Hobby

Notes

  • Echoes comments from “subscribed” and “kevin_thibedeau” who want to stay free from Google while still using a secure banking experience.
  • Appeals to the “last Android phone” crowd looking for a practical alternative without abandoning Android hardware entirely.

DeterministicAPKs.org: Automated Build‑and‑Sign Pipeline for Open‑Source Android Apps

Summary

  • A hosted service that automatically compiles, signs, and publishes reproducible Android APKs from open‑source repositories, providing users with cryptographically guaranteed builds and a community‑verified verification badge.
  • Reduces the barrier for developers to offer side‑loaded apps without fearing malicious tampering, and gives users confidence to install from sources other than Google Play.

Details

Key Value
Target Audience Open‑source Android developers, FOSS enthusiasts, power users who build their own ROMs or custom apps
Core Feature CI pipeline that pushes deterministic builds to a public index, generates signed attestations (Sigstore), and embeds reproducible‑build metadata in each APK
Tech Stack GitHub Actions, Reproducible Builds framework, Sigstore Cosign, Docker, PostgreSQL for metadata, Web UI (SvelteKit)
Difficulty Medium
Monetization Revenue-ready: One‑time purchase ($19.99) for “Verified Publisher” badge subscription

Notes

  • Directly responds to “fc417fc802” and “realusername” who argued for a higher‑assurance tier and deterministic builds, and to “zoobab” who wants stricter regulation of app stores.
  • Provides a concrete, community‑driven answer to the “malware in sideloaded sources” debate, making it an attractive project for Hacker News participants.

Read Later