4 ms·

Mission Improbable: Hardening Android for Security and Privacy

149 points by conductor 10y ago

necessity 10y ago
Interesting, I had never heard of that project before. I'm currently using CM13 without Gapps. The "privacy guard" and other app permission configs are absolutely terrible ui-wise. There's several places (hidden in nested "Advanced" menus) you need to go to set app permissions (some permissions can be set from two different places and I'm not sure which one has the final say) and it still requires you to manually set permissions for new apps, theres no way to set for instance no internet access as a default for new apps.
- deep_attention 10y ago
  You can use a firewall like AFWall+ to deny every app internet by default.
  - deleted 10y ago
    [deleted]
- secfirstmd 10y ago
  Yeh Copperhead, Guardian Project and Tor is definitely the way to go for a locked down Android. Though only supported on the Nexus and Pixel devices I think.
  - bsilvereagle 10y ago
    You are correct. > The hardware for this prototype is the Google Nexus 6P. While we would prefer to support lower end models for low income demographics, only the Nexus and Pixel lines support Verified Boot with user-controlled keys. We are not aware of any other models that allow this, but we would love to hear if there are any that do.
    - mtgx 10y ago
      I'm hoping that as the Pixel line turns into more of a real business for Google, they will actually start making phones that cost half as much or even 1/4 as much as the current Pixel devices. Google raised the (pricing) entry bar for secure Android devices to the level of iPhones, and that leaves most people without any real options for secure phones especially when most Chinese phones seem to come with backdoors by default. I also think Google needs to increase OS update time to at least 3 years, and security updates to 4 or 5 years. The entire life cycle of a device should be taken into account when support is considered for devices. And no, two years is not the lifetime of a smartphone. That's a lie, mostly pushed by carriers (and of course manufacturers). A smartphone can easily last 4+ years, and it doesn't have to have the same owner during this period.
- cmdrfred 10y ago
  There is a "on by default" option on my CM13 privacy guard. It would suck for an unsavy user to use though I admit.
  - necessity 10y ago
    Yes there is this option but it does nothing, since the default permissions privacy guard allows when "on by default" seem to be the permissions the app requires, I.e. you have to manually set them either way.
emsy 10y ago
I'm in the market for a new phone, and I feel like I'm between a rock and a hard place. Android is a privacy disaster, but Apple's latest pricing and product decision make it unlikely to buy another iPhone.
- viraptor 10y ago
  Android is what you configure it to be. Sure, there are some switches to flip if you want to be google-free. But you can replace pretty much every privacy-impacting function on the phone.
  - cesnja 10y ago
    When it's pwned at firmware [1] and/or hardware level, all those actions are in vain. [1] http://www.kryptowire.com/adups_security_analysis.html http://www.kryptowire.com/adups_security_analysis.html
    - pawadu 10y ago
      Android is also what you pay for. If you buy a $99 phone from China, don't be surprised if there is Chinese government spy code in the firmware. For the record, companies like Apple and Xiaomi provide methods to verify the integrity of your phones software if you bought it in China. But then we are not talking about $99 phones anymore.
    - deep_attention 10y ago
      I find this project interesting: https://neo900.org/ https://neo900.org/ Everything will be open-source, apart from the modem. But they do disconnect the modem from any direct input like audio. Have a look at this presentation: https://neo900.org/stuff/cccamp15/ccc2015talk/talk.pdf https://neo900.org/stuff/cccamp15/ccc2015talk/talk.pdf
- throwaway98237 10y ago
  The new Blackberry DTEK60 is based on Android but supposedly hardened and has much longer term security updates. You can still use the Play store. I know, Blackberry? But seriously, it's not a bad looking phone and has good hardware specs. All the same, I'm in the same boat as you. Thinking about switching to land-line and buying a separate camera and GPS navigation device. Hello 1990's! Idk. Not liking my options.
deleted 10y ago
[deleted]
subway 10y ago
As long as we keep seeing modems on the same silicon as our application processors, attempting to secure a device against even a relatively incompetent state actor is mostly pointless.

149 points by conductor 10y ago

Interesting, I had never heard of that project before. I'm currently using CM13 without Gapps. The "privacy guard" and other app permission configs are absolutely terrible ui-wise. There's several places (hidden in nested "Advanced" menus) you need to go to set app permissions (some permissions can be set from two different places and I'm not sure which one has the final say) and it still requires you to manually set permissions for new apps, theres no way to set for instance no internet access as a default for new apps.

deep_attention 10y ago
You can use a firewall like AFWall+ to deny every app internet by default.
- deleted 10y ago
  [deleted]
secfirstmd 10y ago
Yeh Copperhead, Guardian Project and Tor is definitely the way to go for a locked down Android. Though only supported on the Nexus and Pixel devices I think.
- bsilvereagle 10y ago
  You are correct. > The hardware for this prototype is the Google Nexus 6P. While we would prefer to support lower end models for low income demographics, only the Nexus and Pixel lines support Verified Boot with user-controlled keys. We are not aware of any other models that allow this, but we would love to hear if there are any that do.
  - mtgx 10y ago
    I'm hoping that as the Pixel line turns into more of a real business for Google, they will actually start making phones that cost half as much or even 1/4 as much as the current Pixel devices. Google raised the (pricing) entry bar for secure Android devices to the level of iPhones, and that leaves most people without any real options for secure phones especially when most Chinese phones seem to come with backdoors by default. I also think Google needs to increase OS update time to at least 3 years, and security updates to 4 or 5 years. The entire life cycle of a device should be taken into account when support is considered for devices. And no, two years is not the lifetime of a smartphone. That's a lie, mostly pushed by carriers (and of course manufacturers). A smartphone can easily last 4+ years, and it doesn't have to have the same owner during this period.
cmdrfred 10y ago
There is a "on by default" option on my CM13 privacy guard. It would suck for an unsavy user to use though I admit.
- necessity 10y ago
  Yes there is this option but it does nothing, since the default permissions privacy guard allows when "on by default" seem to be the permissions the app requires, I.e. you have to manually set them either way.

emsy 10y ago

I'm in the market for a new phone, and I feel like I'm between a rock and a hard place. Android is a privacy disaster, but Apple's latest pricing and product decision make it unlikely to buy another iPhone.

viraptor 10y ago
Android is what you configure it to be. Sure, there are some switches to flip if you want to be google-free. But you can replace pretty much every privacy-impacting function on the phone.
- cesnja 10y ago
  When it's pwned at firmware [1] and/or hardware level, all those actions are in vain. [1] http://www.kryptowire.com/adups_security_analysis.html http://www.kryptowire.com/adups_security_analysis.html
  - pawadu 10y ago
    Android is also what you pay for. If you buy a $99 phone from China, don't be surprised if there is Chinese government spy code in the firmware. For the record, companies like Apple and Xiaomi provide methods to verify the integrity of your phones software if you bought it in China. But then we are not talking about $99 phones anymore.
  - deep_attention 10y ago
    I find this project interesting: https://neo900.org/ https://neo900.org/ Everything will be open-source, apart from the modem. But they do disconnect the modem from any direct input like audio. Have a look at this presentation: https://neo900.org/stuff/cccamp15/ccc2015talk/talk.pdf https://neo900.org/stuff/cccamp15/ccc2015talk/talk.pdf
throwaway98237 10y ago
The new Blackberry DTEK60 is based on Android but supposedly hardened and has much longer term security updates. You can still use the Play store. I know, Blackberry? But seriously, it's not a bad looking phone and has good hardware specs. All the same, I'm in the same boat as you. Thinking about switching to land-line and buying a separate camera and GPS navigation device. Hello 1990's! Idk. Not liking my options.

deleted 10y ago

[deleted]

subway 10y ago

As long as we keep seeing modems on the same silicon as our application processors, attempting to secure a device against even a relatively incompetent state actor is mostly pointless.