3 ms·

Don't users need to confirm OTA updates?

• saurik 11y ago
  This person is talking about for applications, to which many users have "automatic updates" turned on; this is one of the places where Android is fundamentally by design more secure than iOS (though by implementation has often been weaker :/ see the Master Key family of vulnerabilities).
  • ikeboy 11y ago
    Ah. Missed that point. What's the highest permission an app can have? Wouldn't that be the limit of the vulnerability here? Also, many permissions require manual granting, e.g. contacts, camera. Edit: also, that could be mitigated partly by requiring user approval of any updates adding permissions.
    • saurik 11y ago
      The kinds of permissions that can be granted to an application by way of entitlements is pretty brutal and go well beyond the permissions that people tend to think of applications as being able to have: there are entitlements for things like "can install other applications" and "can obliterate all data stored on the device". I'm not certain if some of these are blocked to applications of certain kinds, but I know that a lot of them are available if Apple chooses to deploy them.