Third-Party App Stores Won’t Install on Android? Check Screen Dimmers

I mostly use the Google Play Store on my phone, but I have a few apps from the Amazon App Store. I recently found that I couldn’t update them – or the store itself. I could tell it to download the app, but at the point that I was ready to review the permissions and click on Install, the Install button wouldn’t respond. At all. Nothing. Cancel worked. Everything else worked. But not that one.

A forum thread pointed me to screen management apps. Lux, Twilight, etc. – the kind of apps that will alter your screen to red-shift it at night, or adjust brightness below the range of the screen’s backlight.

Sure enough, I disabled Lux from the pull-down, and the Install button worked. Once the update was done, I re-enabled it. Just an extra two seconds of work before and after.

It probably happens on other third-party app stores and stand-alone installers as well.

The cause wasn’t completely clear from the discussion thread, but reading between the lines and adding my knowledge of software and web development suggests that it’s a security issue: Apps like Lux and Twilight work by altering the appearance of the screen (“draw over other apps” permissions). It makes sense that Android would prevent installation (outside of its own privileged update system, anyway) actions when it can’t be sure that what the user sees is actually an Install button.

Imagine a malicious app that overwrites the screen to hide an Install button under something more benign. In web development, we call this clickjacking.

The same problem would likely happen with other app stores like F-Droid, and with other apps that require the “draw over other apps” permission like Facebook with chat heads visible.

Anyway, that’s the issue and the workaround, and why I think it hasn’t been fixed in all this time: Fixing it would open up a security vulnerability.

Fortunately, the workaround is pretty easy!