Wrong SHA-1 Fingerprint in Play Console Silently Breaks Google Sign-In on Android

·2 views

Developers using Google Sign-In on Android may find the feature works in debug builds but silently fails in production apps distributed via Google Play. The root cause is a fingerprint mismatch: Play App Signing replaces the developer's upload key with its own certificate before delivering the app to users, meaning the SHA-1 registered in Google Cloud Console must match Play's signing certificate, not the upload key. When the fingerprints don't match, Android's Credential Manager returns a generic 'cancelled' result with no error message, making the bug nearly impossible to diagnose. Developers who have opted into Google's Quantum-ready app signing beta face an added complication, as the SHA-1 buttons shown on Play Console's App Signing page no longer reflect the actual certificate signing the app. The fix requires downloading the deployment_cert.der file from Play Console, extracting its SHA-1 fingerprint, and registering it as an additional OAuth client in Google Cloud Console.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

MoE vs Edge AI: How a 35B Model Runs on an iPhone With Under 3GB RAM

A demo by a project called Edge0 showed a 35B-parameter language model running on an iPhone using just 1–2.5 GB of peak memory, sparking interest in how this is possible. The key technique is Mixture of Experts (MoE), a neural network architecture where multiple smaller sub-networks called 'experts' exist within a model, but only a few are activated for any given input token. This sparse activation means a model can have a large total parameter count while using far fewer parameters per computation, keeping active memory usage low. In Edge0's approach, the full set of expert weights is stored on the device's storage and only the required experts are loaded into RAM as needed. MoE is an architectural design choice, distinct from 'edge computing,' which refers to where computation runs — the two concepts are related in practice but solve fundamentally different problems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Clavio Builds Per-App Dictation Profiles with Smart Focus Tracking on macOS

Just Tools LTD has published a technical breakdown of how their macOS dictation app, Clavio, handles per-application voice input profiles. The app identifies target applications using bundle identifiers and tracks three distinct focus states to ensure transcribed text is always routed to the correct destination. Each app profile stores writing style, listening mode, wake phrases, and post-insertion actions as separate settings, preventing unexpected behavior when switching contexts. A layered resolver determines tone and polish intensity by checking app-specific preferences before falling back to global or built-in defaults. The system is designed to distinguish between different use cases — such as coding prompts versus professional emails — without conflating output style, capture trigger, and delivery action into a single setting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

BDD Does Not Require Gherkin: The Case for Plain-Code Acceptance Tests

Software developer and long-time BDD practitioner argues that Cucumber's Gherkin format has been conflated with BDD itself, even though the two are distinct concepts. In practice, acceptance criteria are typically written in Jira tickets and then manually copied into feature files by developers, creating redundant maintenance overhead across three artefacts instead of one. Gherkin's plain-text, regex-bound step definitions resist IDE refactoring, accumulate glue code, and produce reports that omit what the system actually did during a test run. The author contends that the constraints which made Gherkin a reasonable choice around 2008 no longer exist, while its costs remain. Modern alternatives such as Kotest BehaviorSpec, JGiven, or Yatspec can deliver Given-When-Then structure, readable output, and full refactoring support directly in code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Multi-Agent AI Framework Harvested Thousands of Credentials in Under Six Hours

Google's Threat Intelligence Group documented a financially motivated cyberattack in which an autonomous multi-agent AI framework was used to steal thousands of credentials from cloud infrastructure. The attacker first gained access to a target organization's cloud environment, then deployed the system from within it, allowing malicious requests to appear as legitimate traffic. Built using an AI coding chatbot and Markdown-based operational playbooks, the framework autonomously handled vulnerability scanning, credential collection, IP rotation, and self-correction without human intervention at each step. Mandiant's incident-response analysis confirmed the entire operation, from initial setup to mass credential compromise, was completed in under six hours. The case highlights how the same self-correcting, resilient design patterns used in legitimate AI agent tooling can be repurposed to run offensive campaigns with minimal human oversight.

0 comments Read more at DEV Community