

The delay makes intuitive sense especially since it will give the target a chance to complain about it to their friends and family who will hopefully stop it from there.
However, I’m not sure if it’s worth it. I imagine this would stop exfiltration apps which scan the users device to useful data and maybe passive screenshots but this pales in comparison to apps with subscription dark patterns, gambling and apps that harvest and sell your data legally already. If this was a case of apps prompting the user to enter sensitive information into a form then they could just use a browser.
I don’t know. I think this is a good measure to prevent scams. I’m just uncomfortable about Google’s motivation.



















Most effective method for me has been to use 1 e-mail address alias per service. If that address starts receiving spam then you know who is to blame for the leak, can move that service to a new e-mail address and then blackhole all e-mails sent to the old address. That obviously means having to setup a new address for every service though so I usually setup 20 at a time and hand them out as needed.