7 ms·

Dumb question (maybe OT): why is rooting phones so hard in the first place? Shouldn't root permissions be part of device ownership (akin to fair use)? Why do I

by beambot 10y ago

Dumb question (maybe OT): why is rooting phones so hard in the first place? Shouldn't root permissions be part of device ownership (akin to fair use)? Why do I have to hack my own phone to get unfettered access?

grawlinson 10y ago
Most likely related to strict FCC regulations regarding the mobile transceivers. And it's always been done this way, old "dumb phones" have always been closed proprietary blobs.
- askvictor 10y ago
  That doesn't explain phones with easily and officially supported unlockable bootloaders (eg Nexus). The transceiver is, in any case, a seperate processor (the baseband) which is much more locked down. The real reason is that hardware manufacturers like control.
  - Jonnax 10y ago
    Well there's also the part where root access fundamentally breaks the security model of the device. I'd say it's a better way of running a consumer device for the typical user. For example, any application you run on a Windows PC even without administrator access could access and upload your web browser profiles. The average user doesn't expect this. But a lot of manufactures do give you the choice to run your own firmwares which can have the root user access. It'll require a bootloader unlock which removes the signature checking. For example: HTC: http://www.htcdev.com/bootloader http://www.htcdev.com/bootloader Motorolla: https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a https://motorola-global-portal.custhelp.com/app/standalone/b... Sony: http://developer.sonymobile.com/unlockbootloader/unlock-yourboot-loader/ http://developer.sonymobile.com/unlockbootloader/unlock-your... LG: https://developer.lge.com/resource/mobile/RetrieveBootloader.dev?categoryTypeCode=ANRS https://developer.lge.com/resource/mobile/RetrieveBootloader... Huawei: https://emui.huawei.com/en/plugin/unlock/index https://emui.huawei.com/en/plugin/unlock/index Couldn't find an official page for Samsung but it looks like it's a matter of running fastboot after enabling OEM unlock in developer settings. The other side of this is that there are quite a few devices that are carrier branded. And usually what happens is that carrier requests that the phone's bootloader is not unlockable. Sadly unlike how Apple can sell their phone without any carrier modifications, Android manufacturers have to accept these kinds of changes otherwise they won't be able to sell their phone.
    - swiley 10y ago
      A security model that locks the user out of their own device sounds fundamentally broken.
    - tdkl 10y ago
      > Well there's also the part where root access fundamentally breaks the security model of the device. Good thing we're still admin/root on our personal computers. Seeing what MS/Google are doing, perhaps not for too long.
      - firethief 10y ago
        Are we really? https://en.m.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.m.wikipedia.org/wiki/Intel_Active_Management_Tech...
- deleted 10y ago
  [deleted]
zigzigzag 10y ago
You don't, if you care enough to buy a phone where that's possible. Any Nexus device can be reflashed to a custom Android build for example. Of course you void your warranty that way. What you're really asking is why is there no root shell by default on all phones, and simply posing the question also answers it - it's a phone, there's zero demand for messing about with terminal emulators on a phone. If you say, but I'd like to install apps as root, the problem is such apps could break the phone in arbitrary ways like by infecting it with malware/adware/spyware that then can't be uninstalled. Modern operating systems are very much designed to limit what apps can do to avoid the nightmare that desktop OS's turned into, where people are afraid of installing apps in case something goes wrong. For better or worse you can install apps on Android/iOS without much fear, which is one reason people do it so much: you can always remove the app again if it's trouble. Android is pretty customisable and has lots of permissions anyway. There are very few things you can't do if you don't have a carrier-locked phone. So supporting apps with root access would vastly worsen the malware situation in order to satisfy a tiny number of geeks who like editing config files: a very bad tradeoff. But hey, Android is open source, so if you think I'm wrong go ahead and make money selling phones with root access.
- chx 10y ago
  Of course we shouldn't forget little niceties like YouTube not being able to play background music. Only the paid YouTube Red service can do that which is simply not available in many countries -- but even in those YT won't play in the background. Unless, of course, you have xposed installed... So, as usual, controlling what you can do with your own device results in a) perceived gains for the rightholder b) pain for ordinary users c) nothing at all for the informed. If this resembles the DRM situation, it is.
  - tokenizerrr 10y ago
    > Only the paid YouTube Red service can do that which is simply not available in many countries Oh yes, this. I pay for Google Music which is supposed to include that, but I do now have it by virtue of living on the wrong side of some border.
  - 10y ago
startling 10y ago
This isn't about you, the consumer, getting root access. It's about a piece of code running on your phone (i.e. maybe part of an app with restricted permissions) getting root access.
josephg 10y ago
Because the trust model on phones is different. On old UNIX mainframes the trust model had 2 kinds of actors: - System administrators - Users The biggest security concern was one user getting access to the files of another user on the same system. The sysadmin decided which applications to trust (and most of them were either opensource or made by big companies, so we didn't have to worry about application developers doing nasty things). As a result, applications just ran with all the permissions of the user who started them. They could do anything that the user themselves were allowed to do, like read all your files, open a network connection and send your secrets out over the internet. But so long as users didn't run any dodgy programs it was (mostly) fine. All modern desktop operating systems inherit that system. But over the last couple decades three things have changed: - Computers got so cheap that now everyone has their own - There are more apps than ever, and some of them are malicious - There aren't enough sysadmins to save grandma Modern phones we have a much better security model, which they inherited from the web. There are two changes: - Multiuser support is gone at an application level. - Apps are sandboxed from one another to protect you and your data from malicious apps. The way they do that is by isolating each app on the phone so no app can read&write to any of the data owned by another app. For example, if you use google docs then by necessity you have to trust the docs app with your documents. But thats it! The google docs app doesn't get to access to your facebook login information. And the facebook app doesn't have access to your google account. If you had equivalent native apps on your desktop, these apps would be able to read one another's files! But rooting your phone (at least partially) ruins all that! Rooting (by definition!) gives some 3rd party apps the capacity to access data stored by other apps on your device, which ruins the phone's security model. The reason why some manufacturers (like apple) take a hardline stance against rooting is that if rooting your phone was easy, some app developers would undoubtably decide they'll only function on rooted devices. (This happens on android today for wifi sniffers and stuff like that.) If enough apps do that, the manufacturers will feel pressure to make it easy to disable app sandboxing, which will result in more and more apps wanting "Full permissions on your phone". People will mash "yes" on the install box (nobody reads that stuff anyway) and before you know it there'll be malware on your phone reading your email and threatening to send porn to your boss on your behalf if you don't pay up. DDoS attacks will come from phones, and will cripple the mobile network. And to fix all that norton will release an android version which will start scanning your phone for viruses at the worst possible moment of that show you like on netflix. And that is why rooting your phone is hard.

by beambot 10y ago

grawlinson 10y ago

Most likely related to strict FCC regulations regarding the mobile transceivers. And it's always been done this way, old "dumb phones" have always been closed proprietary blobs.

askvictor 10y ago
That doesn't explain phones with easily and officially supported unlockable bootloaders (eg Nexus). The transceiver is, in any case, a seperate processor (the baseband) which is much more locked down. The real reason is that hardware manufacturers like control.
- Jonnax 10y ago
  Well there's also the part where root access fundamentally breaks the security model of the device. I'd say it's a better way of running a consumer device for the typical user. For example, any application you run on a Windows PC even without administrator access could access and upload your web browser profiles. The average user doesn't expect this. But a lot of manufactures do give you the choice to run your own firmwares which can have the root user access. It'll require a bootloader unlock which removes the signature checking. For example: HTC: http://www.htcdev.com/bootloader http://www.htcdev.com/bootloader Motorolla: https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a https://motorola-global-portal.custhelp.com/app/standalone/b... Sony: http://developer.sonymobile.com/unlockbootloader/unlock-yourboot-loader/ http://developer.sonymobile.com/unlockbootloader/unlock-your... LG: https://developer.lge.com/resource/mobile/RetrieveBootloader.dev?categoryTypeCode=ANRS https://developer.lge.com/resource/mobile/RetrieveBootloader... Huawei: https://emui.huawei.com/en/plugin/unlock/index https://emui.huawei.com/en/plugin/unlock/index Couldn't find an official page for Samsung but it looks like it's a matter of running fastboot after enabling OEM unlock in developer settings. The other side of this is that there are quite a few devices that are carrier branded. And usually what happens is that carrier requests that the phone's bootloader is not unlockable. Sadly unlike how Apple can sell their phone without any carrier modifications, Android manufacturers have to accept these kinds of changes otherwise they won't be able to sell their phone.
  - swiley 10y ago
    A security model that locks the user out of their own device sounds fundamentally broken.
  - tdkl 10y ago
    > Well there's also the part where root access fundamentally breaks the security model of the device. Good thing we're still admin/root on our personal computers. Seeing what MS/Google are doing, perhaps not for too long.
    - firethief 10y ago
      Are we really? https://en.m.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.m.wikipedia.org/wiki/Intel_Active_Management_Tech...
deleted 10y ago
[deleted]

zigzigzag 10y ago

You don't, if you care enough to buy a phone where that's possible. Any Nexus device can be reflashed to a custom Android build for example. Of course you void your warranty that way. What you're really asking is why is there no root shell by default on all phones, and simply posing the question also answers it - it's a phone, there's zero demand for messing about with terminal emulators on a phone. If you say, but I'd like to install apps as root, the problem is such apps could break the phone in arbitrary ways like by infecting it with malware/adware/spyware that then can't be uninstalled. Modern operating systems are very much designed to limit what apps can do to avoid the nightmare that desktop OS's turned into, where people are afraid of installing apps in case something goes wrong. For better or worse you can install apps on Android/iOS without much fear, which is one reason people do it so much: you can always remove the app again if it's trouble. Android is pretty customisable and has lots of permissions anyway. There are very few things you can't do if you don't have a carrier-locked phone. So supporting apps with root access would vastly worsen the malware situation in order to satisfy a tiny number of geeks who like editing config files: a very bad tradeoff. But hey, Android is open source, so if you think I'm wrong go ahead and make money selling phones with root access.

chx 10y ago
Of course we shouldn't forget little niceties like YouTube not being able to play background music. Only the paid YouTube Red service can do that which is simply not available in many countries -- but even in those YT won't play in the background. Unless, of course, you have xposed installed... So, as usual, controlling what you can do with your own device results in a) perceived gains for the rightholder b) pain for ordinary users c) nothing at all for the informed. If this resembles the DRM situation, it is.
- tokenizerrr 10y ago
  > Only the paid YouTube Red service can do that which is simply not available in many countries Oh yes, this. I pay for Google Music which is supposed to include that, but I do now have it by virtue of living on the wrong side of some border.
- 10y ago

startling 10y ago

This isn't about you, the consumer, getting root access. It's about a piece of code running on your phone (i.e. maybe part of an app with restricted permissions) getting root access.

josephg 10y ago

Because the trust model on phones is different. On old UNIX mainframes the trust model had 2 kinds of actors: - System administrators - Users The biggest security concern was one user getting access to the files of another user on the same system. The sysadmin decided which applications to trust (and most of them were either opensource or made by big companies, so we didn't have to worry about application developers doing nasty things). As a result, applications just ran with all the permissions of the user who started them. They could do anything that the user themselves were allowed to do, like read all your files, open a network connection and send your secrets out over the internet. But so long as users didn't run any dodgy programs it was (mostly) fine. All modern desktop operating systems inherit that system. But over the last couple decades three things have changed: - Computers got so cheap that now everyone has their own - There are more apps than ever, and some of them are malicious - There aren't enough sysadmins to save grandma Modern phones we have a much better security model, which they inherited from the web. There are two changes: - Multiuser support is gone at an application level. - Apps are sandboxed from one another to protect you and your data from malicious apps. The way they do that is by isolating each app on the phone so no app can read&write to any of the data owned by another app. For example, if you use google docs then by necessity you have to trust the docs app with your documents. But thats it! The google docs app doesn't get to access to your facebook login information. And the facebook app doesn't have access to your google account. If you had equivalent native apps on your desktop, these apps would be able to read one another's files! But rooting your phone (at least partially) ruins all that! Rooting (by definition!) gives some 3rd party apps the capacity to access data stored by other apps on your device, which ruins the phone's security model. The reason why some manufacturers (like apple) take a hardline stance against rooting is that if rooting your phone was easy, some app developers would undoubtably decide they'll only function on rooted devices. (This happens on android today for wifi sniffers and stuff like that.) If enough apps do that, the manufacturers will feel pressure to make it easy to disable app sandboxing, which will result in more and more apps wanting "Full permissions on your phone". People will mash "yes" on the install box (nobody reads that stuff anyway) and before you know it there'll be malware on your phone reading your email and threatening to send porn to your boss on your behalf if you don't pay up. DDoS attacks will come from phones, and will cripple the mobile network. And to fix all that norton will release an android version which will start scanning your phone for viruses at the worst possible moment of that show you like on netflix. And that is why rooting your phone is hard.