16 ms·

Android security in 2016 is a mess

295 points by iuguy 10y ago

myowncrapulence 10y ago
I brought this up in r/ProjectFi (a google/android subreddit) and was wholly ridiculed and dismissed "for not knowing anything". It seems brand loyalty has become similar to American politics with little-to-no middle ground or room for unbiased opinion. I'm glad to see a realistic approach to mobile security. We need more scrutiny in this area.
- wheelerwj 10y ago
  polarized is a good way to describe it. because a lot of the time, when you criticize a particular component, people assume your automatically promoting the alternative as opposed to having a discussion/wanting to improve the qaulity of the thing you are talking about. its unfortunate.
- Someone1234 10y ago
  ProjectFi only works with Nexus (and Pixel) devices, which aren't impacted by this. So posting complaints about manufacturers which aren't Fi compatible on the Fi subreddit seems unusual and may have resulted in some of the negative feedback you received.
  - lvs 10y ago
    That may not be true. Fi works with (and was marketed with) the Nexus 6 which is EOL as of this month (Oct 2016). That means the OS version will be halted at Android 7, as I understand it. They may still receive security updates, but I don't believe Google has said how long they'll be doing that for.
    - kevincox 10y ago
      It will get no more version upgrades, but it still has at least a year of security updates (depending on when it went out of the play store). I'm not saying new versions wouldn't be nice but personally that seems like a minor advantage.
- gdulli 10y ago
  Extrapolating a reddit community to the whole population is like saying all Republicans are deplorable.
  - myowncrapulence 10y ago
    That's not the only place I've experienced mass bias about android vs. mac. Also, to say that I'm extrapolating to the whole population is assuming. I was simply pointing out the state of small communities I've been exposed to.
djsumdog 10y ago
One of the major major major issues is the hardware itself. Let's jump back to the late 90s. You want to try Linux. You might partition your disk, or build a different machine and get a KVM or use an old laptop or add a second hard drive. In all cases, you can just install a Linux distro and see if it works. Maybe Ethernet or sound or something doesn't work. You could try a different distro with a newer kernel, maybe compile your own kernel with the modules you need, etc. But no matter what, it would at least boot (usually). Intel x86/64 is a standard architecture. EFI makes the booting process even easier (although some motherboards still fuck this up; but for the most part fiddling with efibootmgr and turning off TPM will work. If not you can always turn on legacy BIOS and use the MBR). ARM is not a standard architecture. It's a spec that is sold to companies who all make their own SoC templates. There are things like Device Tree Config that make some of this more standard, but it's still far from x86/64. Just read Torvalds rants on ARM to learn more. Even if you make some standard Android builds with all the drivers for all phones in a massive 20MB initrd, a lot of kernels are fundamentally different with the way bus connections are defined. Manufactures take forever to release their kernel code, often under threats by people for GPL violations, and even then they are filled with tons of binary blobs and shims that connect their .o files so kernel calls. Stuff like Plasma looks amazing. It only has like two phones it supports. If you look at any android rom project, you see totally different builds for every single device. If Intel had been like this, Linux would have died off in the 90s, for both servers and desktops. Device manufactures depend on you buying new phones. They cannot support phones after two years or else it kills their profit margins. Planned obsolescence like this leads to waste (don't kid yourself, e-waste recycling gets shipping to Africa where kids remove components. A small percentage of phones actually get recycled). TL;DR Mobile phones are based on unmaintainable and non-standard hardware (intentionally). I wrote a post on this a while back: http://penguindreams.org/blog/android-fragmentation/ http://penguindreams.org/blog/android-fragmentation/
- mtgx 10y ago
  > If Intel had been like this, Linux would have died off in the 90s, for both servers and desktops. That's the thing. You said "Intel". Intel is not an architecture. It's a company - that happens to dominate the x86 market. Do you think the situation would be the same if there were 10 different x86 chip companies with at least 5% market share each? If we wanted everything to just work, as it does on "Intel", then we should probably wish for a Qualcomm monopoly with 90% of the market. And hope it's profitable enough that they can support their own chips for more than 18 months. I can only describe Intel's chips as a rip-off for the most part (and it's only gotten worse in recent years). I mean, they're now selling Atom chips for $160 (about 4-5x more than a similar performance ARM chip) to notebook manufacturers, with very little difference in performance between them and the older Atom for smartphones. So I would certainly hope Intel's chips would be better supported. Although I actually don't think its Atom chips are as well supported as its Core chips. Now, not having a single company completely dominate the ARM ecosystem is certainly a "problem" from this point of view. However, I still mostly blame Google, who mainly just wants its ads to run well on these devices, which seem to do that rather well in the current situation, as well as OEMs who want to be "different" and are probably even hostile to the idea of allowing say an LG ROM run on a Samsung phone. I would try to fix this Google/OEM situation first and aim my complaints at them.
loudmax 10y ago
My 1st gen Moto G stopped receiving updates a while ago, but Cyanogenmod is still putting out new ROMs. It takes some level of understanding to put Cyanogenmod on a device, but nothing too challenging for the HN crowd. If your phone has stopped receiving updates and you're not ready to buy a replacement yet, you can check if it's supported. It's a great thing that this project exists.
- greenshackle2 10y ago
  I was considering buying a new phone but I installed CM on my 2nd gen Moto E and that solved most of performance issues (so far, remains to be seen if it holds up.) CyanogenMod has less bloat, and more actually useful core functionality, which means I need fewer apps. (For example, no need for something like Twilight since it has adaptive brightness/hue built-in.)
  - busterarm 10y ago
    And runs default root so essentially is a security nightmare waiting to happen.
    - mordocai 10y ago
      Mine certainly doesn't. I use an official CM build for my phone and I still had to root it if I wanted that (which I did). Then, barring exploits of which I'm sure there are many, I have to approve each app that wants root access. No "default root".
    - amaranth 10y ago
      Their stock configuration doesn't even have root available unless you enable it in the hidden developer settings menu. Even then it works like SuperSU and such, non-root by default and popups to prompt for root access when an app requests it.
  - CountSessine 10y ago
    CyanogenMod is fantastic, but even then, the devs have to work with what they've got. Support for Exynos SOCs has traditionally been sketchy because Samsung plays games with xda devs and is slow to push kernel patches. And even with snapdragon SOCs I've had stuff happen like LTE and wifi 802.11n stop working after flashing with CyanogenMod. CyanogenMod is a very high-quality android distro, but sometimes they're really stuck doing the near-impossible.
gregmac 10y ago
This article also linked to a post about Android disk encryption [0] that I found pretty interesting. It goes through Apple vs Android encryption implementations, and talks about per-file vs full-disk. Android has only just now implemented per-file, but haven't made it granular enough to handle some very valid use cases and thus it has some pretty big holes. The worst part is fixing it means breaking 3rd party apps. [0] https://blog.cryptographyengineering.com/2016/11/24/android-n-encryption/ https://blog.cryptographyengineering.com/2016/11/24/android-...
- Watabou 10y ago
  There was some discussion about this on HN [1]. Pretty interesting that it only got 183 votes. Usually when people talk about Apple's security holes, it generates much more discussion (criticism) and votes. [1] https://news.ycombinator.com/item?id=13031012 https://news.ycombinator.com/item?id=13031012
  - macintux 10y ago
    Pointing out that Android is insecure is about as newsworthy as pointing out that the sun will rise tomorrow.
isliiiive 10y ago
My 2c: After 3+ years of android (moto g w/ cyanogenmod, then project fi), I finally made the switch back to iOS. I'm beyond happy so far, and have the benefit of google not tracking my every step and key press. It is good when the manufacturer of a product you pay for has interests in line with your own.
- aviraldg 10y ago
  I am happy for you, but please stop spreading FUD about Google/Android. I would like you to point out a single practical example of tracking in Android that you can't opt out of.
  - oneplane 10y ago
    It's not the opt in/out, it's the Intention that matters. It is known that a company built on advertising will want as much data to profile and target you as possible. If you can disable all/most of the telemetry that's nice, but doesn't change the intent of the vendor, nor does it change the way you are perceived as a customer/data source. This is the same for most vendors; with Apple, they want to make you a happy customer with the hopes that you'll buy whatever they release next, with Microsoft it's more like an ecosystem idea where they'd like you to connect as many services, software suites and devices with their software as possible, connecting home, work, private, and entertainment. It doesn't need to be the best in quality, but definitely in quantity. With Google, they want as much data about you, and as much exposure to ads as possible, with a free opt-out for data gathering, and a paid opt-out for ad serving (i.e. paid apps vs. free apps as other vendors put them in their play store). Nothing new here, but it's not FUD about Google/Android, it's just the way they work, and there's nothing wrong with that.
  - ocdtrekkie 10y ago
    The problem isn't that you can't opt out of it. The problem is that Google cripples your phone if you opt out of it. Because Google's software is not designed to function properly without tracking. (For instance, your local Google Maps install won't even remember where you live or your last location search if you turn search history off in the cloud.) Not having basic local-only functionality is silly, unless you're specifically trying to push people to stay in your tracking system.
rogerbinns 10y ago
Apple does have an iPhone in the traditional Nexus pricing zone. For $400 you get the iPhone SE - https://www.apple.com/iphone-se/ https://www.apple.com/iphone-se/ - which could be acceptable.
- richardwhiuk 10y ago
  The problem is in the sub Nexus pricing zone. If you get a Nexus, the story isn't too bad for 18 months. The iPhone SE is likely to have a shorter security lifetime than the flagship devices, as you are effectively buying 1/2 year old hardware.
  - illumin8 10y ago
    From the article: > Apple is still shipping security updates, albeit on iOS 9, for the iPhone 4s which was released in 2011 (5 years ago). The iPhone 5 is still being kept up to date with iOS 10. Apple has a very good track record here. Based on past experience, it's likely that the iPhone SE will continue to receive security updates well past 2020.
    - pm90 10y ago
      This is exactly why I switched. My Nexus 5 which worked perfectly for a couple of years, suddenly crashed. And I looked up the new Nexus/Pixel phone and decided it was much better to switch to iPhone SE for a smallish phone which would be cheap, dependable, reliable and supported for a longer time.
      - 0xFFC 10y ago
        My Nexus 5 glass broke last week, I am in exact position as you, after looking at market I thought there is no way I am buying another phone from Google(let alone other manufacturers). Now I am happily switching to iPhone SE which I am 100% sure will get supported more than pixel phones.
    - zanny 10y ago
      Meanwhile, Windows 7 is supported until 2020, and was released in 2009, and could run on hardware up to about ~7 years old at the time. That means an effective support period of about 18 years. The entire cellphone ecosystem is toxic because of how it treats hardware as disposable in an effort to coerce money from users. I find that phones of the Galaxy S3 / Moto G first gen era are sufficient for 80% of use cases, but since the software stops working and depends on Cyanogenmod for long term usability it is a PITA and lets the hardware manufacturers off the hook for gross mistreatment of users.
wahsd 10y ago
Not trying to be flippant, but when the heck was Android security not a mess?
emsy 10y ago
>What can we do? Buy an iPhone. No really. I was looking to switch to Android, but even after briefly reading up on security/privacy on Android, I came to the same conclusion. It's too bad iPhones are pricey and/or despised among a subset of customers. I'm sure more users would vote with their wallets if they were aware of this.
- B1FF_PSUVM 10y ago
  Well, there once was a very nice mobile platform called Metro Design, but it got stuffed. It's a very rare industry that does not have at least three players. Two, just Android and iOS, is a strange number.
- coldpie 10y ago
  I'd consider switching to an iPhone, but lots of my music is just MP3 files and I'd hate to lose the ability to play them on my phone. Using iTunes is not an option.
  - deleted 10y ago
    [deleted]
  - mcgrath_sh 10y ago
    There are several 3rd party options for playing audio files on iPhone without iTunes. The two I use most often are Plex and CloudBeats. Recently, I have been giving Bound a try for audiobooks instead of CloudBeats. I really want Plex to support some basic Audiobook features so I can use just the one app. The audio I listen to is stored either on my home server (Plex) or a cloud service of my choice (CloudBeats and Bound). I don't touch iTunes. Disclaimer: I rarely listen to music. I'd wager 85-90% of my aduio listening is podcasts and I do that with Overcast. This may lead me to have the false belief that not using iTunes for music is easy/not a hassle on the iPhone.
    - coldpie 10y ago
      Yeah, yeah, yeah. Or I can use Android and just have a filesystem and any application can access that filesystem and play my files.
willtim 10y ago
I think this article is spot on. We should vote with our feet. Since Samsung do not wish to keep my phone secure, and so far they are averaging one update per year, my next phone is likely to be a pixel.
chinathrow 10y ago
I'm in the market for a new android these days. Looking at the too tightly with Google coupled Pixel, the Samsungs S6/S7 (Samsung led me down without updates once), the Fairfone 2 (thick and ugly) and others. It's a mess.
dispose13432 10y ago
What's frustrating is that People/Google keeps on blaming the OS nature of Android. What they forget is that to put Android on a phone, practically you need Google's permission. If Google cared, they could have made it part of the terms and conditions that it has to have security updates for five years. They obviously don't
- bitmapbrother 10y ago
  When has Google blamed the OS nature of Android? >What they forget is that to put Android on a phone, practically you need Google's permission. I think you're forgetting the hundreds of millions of users that use Android without any Google services. >If Google cared, they could have made it part of the terms and conditions that it has to have security updates for five years. Wouldn't it be nice if it was as simple as that? You seem to think Google has the ability to do whatever they want and have the OEM's fall in line one by one. >They obviously don't In that case they should probably stop investing millions into improving Android security every year and stop releasing security updates each month.
  - dispose13432 10y ago
    >I think you're forgetting the hundreds of millions of users that use Android without any Google services. If only the problem was with those phones. Anything in the US except for Amazon is under Google's thumb >Wouldn't it be nice if it was as simple as that? You seem to think Google has the ability to do whatever they want and have the OEM's fall in line one by one. They put their foot down about other things, like branding, app choices. This should be more important. You don't want to port Android 7 to a three year old phone, fine. But to refuse to patch against stagefright?
    - bitmapbrother 10y ago
      >If only the problem was with those phones. Anything in the US except for Amazon is under Google's thumb So you've now qualified it to only phones in the US and devices not from Amazon? >They put their foot down about other things, like branding, app choices. This should be more important. It's a balancing act to keep everyone happy. When it comes to things like creating patches and paying for carrier certification these all cost money and shave off even more margin. Support the OEM's that provide timely OS updates and patches and disregard the rest.
grandalf 10y ago
Google decided to take on IOS by loosening the quality controls that help make the ecosystem secure. Google could easily require code signing and auditing for all non-google OS components, but it chooses not to because doing so would hinder phone sales. The vulnerability in BLU phones was due to third party code packaged in the Android build for BLU phones. This was discovered because it sent texts back to china. Imagine if a slightly more sophisticated attack were included, how easy would it be to spot? I'd estimate that there may be over 20 stuxnet level malwares lurking in the Android ecosystem, leveraging it to spread opportunistically deeper into infrastructure and onto higher value targets, etc. And this doesn't even consider hardware level malware which could be included in bulk via alternative ASIC designs that end up on millions of phones.
remir 10y ago
Could this be one of the reason why Google is working on Fuchsia, their new OS with a micro-kernel (Magenta)?
- ocdtrekkie 10y ago
  It's hard to tell. There's indications it's meant to work on any form factor, but at least initially their focus seemed to be on desktop-esque hardware like the Intel NUC, an Acer slate tablet that runs x64, etc. and then with the Raspberry Pi for ARM support. There hasn't yet been a clear indication that they're working on phone support for it, or when that would be. It's still super early for Fuchsia though, so it's anyone's guess.
  - remir 10y ago
    I agree, it's still early and there's not much info at the moment. Still, in the maxwell repo, there's mentions of "GPS acquirers" and in the SysUI repo, there's icons for battery, airplane mode, screen rotation and cellular signal. Nothing really specific for phones since these things can be found in some tablets and laptops, but apps in Fuchsia are made with Flutter, so it's interesting since it was made to make cross-platform mobile dev easier on Android/iOS.
pimeys 10y ago
I'm still using my over two years old OnePlus One with the Cyanogen that came pre-installed and I've been installing all the ota updates, being in security patch September now and QuadRooter showed no vulnerabilities. Pretty near for such a cheap phone. What stops me from using iPhone is my opus music collection I want to carry with me, Rocket player and my pure hate towards iTunes.
- deleted 10y ago
  [deleted]
ansible 10y ago
So, as others have mentioned, the ARM chips out there don't really follow any common set of standards. Some IP blocks, like USB controllers, can operate using a standard driver, but that's about it. Even for the bits that are migrating from PC land like PCIe and SATA, they aren't uniformly available or have standard driver interfaces across vendors. And it gets worse. There's not even a standard means of discovering what all of the hardware is on the ARM System-on-Chip (SoC). You've just got to learn that this GPIO register is at this physical memory address from the reference manual. And it gets even worse. There's no standard for hooking up the hardware peripherals either. You could have two phones with the same (for example Qualcomm Snapdragon 820 SoC) but they might have chosen to connect up different sets of peripherals, to different sets of ports. There might be three display output ports, which one did vendor X use? And don't even get me started about power management. ARM Ltd doesn't do this, so every chip vendor has their own. Which is completely different. There is nothing close to what is available in laptop land. What we need is a widely accepted standard for describing the on-chip peripherals, which can be read by the software. And we need a separate description for how the hardware is connected. And even all that isn't nearly enough. This situation will not get better any time soon, IMHO.
- swiley 10y ago
  Device tree is actually a reasonably flexible and precise way to describe all of that, the problem is that many vendors just don't use it.
hackuser 10y ago
The IT industry's lack of attention to security (including confidentiality and system integrity) has enabled mass surveillance, by both businesses and government, and that problem now combines with the political situation to create a serious risk to people's rights. Google has a very serious responsibility to implement effective security for Android, and it needs to be done urgently. They've known about it for years and put it off. The EFF has some basic specs here: https://www.eff.org/deeplinks/2016/11/tech-companies-fix-these-technical-issues-its-too-late https://www.eff.org/deeplinks/2016/11/tech-companies-fix-the...
- qwertyuiop924 10y ago
  Irritatingly, as much as Android security sucks, it's effective enough that it's hard to root most phones.
  - hackuser 10y ago
    Secure against, but not for, end-users.
- soft_dev_person 10y ago
  When I worked in the mobile industry (modems), blatant security holes to monitor all sorts of things was a requirement from the biggest operators (like AT&T).
hackuser 10y ago
Can anyone comment on the Blackberry Priv? The article mentioned it, and I know their security goes down to hardware level and what they claim is a secure manufacturing process, but all I know is what they claim ...
- jevinskie 10y ago
  I purchased one used, mostly to see what it is like but also to have as a backup phone Just In Case. The hardware is a mixed bag: the screen is gorgeous, the keyboard is a bit narrow but allows for very accurate typing, the back of the case is flimsy, and the CPU is underwhelming. The software is great though! You get a very up to date (second only to Google brand phones w.r.t. security updates) OS and the Blackberry software (like Hub) is an actual improvement over the stock Android experience. Basically, if you want a secure Android phone and wouldn't mind trading older hardware for a physical keyboard, it is the phone for you. Otherwise, you might want to look at a Pixel device. As to security at the hardware level, I'm not aware of the PRIV featuring anything special outside of the TrustZone TEE stuff that most recent Android phones have.
  - hackuser 10y ago
    I found some notes from when I was looking into the Priv at the end of last year. They lack detail, but maybe are a good starting point for someone. * Root of trust: unique crypto keys at the hardware level: Somehow implemented in way that guarantees Blackberry through supply chain, they claim. Maybe Blackerry supplies own chipset, w/ key included? * Verified Boot and Secure Bootchain: Verifies integrity of all layers, from hardware to software. Uses hashes, crypto signatures * hardened Linux kernel with numerous patches and configuration changes to improve security * FIPS 140-2 compliant full disk encryption for data and applications * Monthly updates through the Google Play store (only?) * DTEK: "a single dashboard to monitor and control application access to your microphone, camera, location and personal information." * Can customize each app's privacy settings, like in Android 6 Also of potential interest, from a competitor: * http://www.tomshardware.com/news/copperhead-nexus-more-secure-priv,30565.html http://www.tomshardware.com/news/copperhead-nexus-more-secur... ---- Sources: * http://blogs.blackberry.com/2015/10/priv-is-for-private-how-blackberry-secures-the-android-platform/ http://blogs.blackberry.com/2015/10/priv-is-for-private-how-... * http://www.zdnet.com/article/the-many-ways-blackberry-beefs-up-android-security-on-the-priv/ http://www.zdnet.com/article/the-many-ways-blackberry-beefs-...
raspasov 10y ago
"Vendors (LG, Samsung, Xiaomi, etc.), after selling you their phone, have no incentive to keep your phone’s software up to date with Google’s fixes" - that means that they have no concept of long-term (long term = more than a month) customer satisfaction. If that is the case (and that very well might be), the future is very bright for Apple.
- Tempest1981 10y ago
  However, people will endure much pain and problems to save a few dollars. Reminds me a bit of the "inexpensive footwear" Dilbert cartoon: http://dilbert.com/strip/2007-05-01 http://dilbert.com/strip/2007-05-01
  - raspasov 10y ago
    Fair point!
ensiferum 10y ago
Simple, don't buy this crap.
NiekvdMaas 10y ago
Actually Xiaomi (a Chinese vendor) has one of the best update models I have seen. They update MIUI weekly, every Thursday a new update with small changes/security fixes. If only more companies would adopt such a model we'd have a different situation.
- mads 10y ago
  Small problem with this model, if you want your devices to be Google certified. Google requires that every official software needs to be certified with Google (CTS and GTS verification need to be passed at a Google certified lab). This might not be a big problem once you are rolling after your first certification, but it does create some overhead every time you need to release a software. I don't think MIUI is Google certified.
  - STRML 10y ago
    Practically, what good is Google certification, if a majority of the devices in the wild are months or even years behind on security updates?
    - mads 10y ago
      Well, if you are not certified, you are not allowed to pre install the whole suite of Google binaries and Google Market along with Google Pay and probably other services are not going to work on your device (at least you wont be able to make purchases).
      - anilgulecha 10y ago
        Xiaomi phones come with the full google ecosystem of apps, so they are certified.
        mads 10y ago
        Oh okay, I didn't know that. Thanks.
aq3cn 10y ago
Has anyone here given a shot to NoPhone? https://www.thenophone.com/ https://www.thenophone.com/ https://www.thenophone.com/products/the-nophone https://www.thenophone.com/products/the-nophone
WhiteHat1 10y ago
Security for so many elements end up being seen of as an afterthought. For Android, there are so many different moving parts - from hardware, as others have mentioned - to multiple libraries, poor malware and antiviruses and other protections, and so many different libraries.

295 points by iuguy 10y ago

I brought this up in r/ProjectFi (a google/android subreddit) and was wholly ridiculed and dismissed "for not knowing anything". It seems brand loyalty has become similar to American politics with little-to-no middle ground or room for unbiased opinion. I'm glad to see a realistic approach to mobile security. We need more scrutiny in this area.

wheelerwj 10y ago
polarized is a good way to describe it. because a lot of the time, when you criticize a particular component, people assume your automatically promoting the alternative as opposed to having a discussion/wanting to improve the qaulity of the thing you are talking about. its unfortunate.
Someone1234 10y ago
ProjectFi only works with Nexus (and Pixel) devices, which aren't impacted by this. So posting complaints about manufacturers which aren't Fi compatible on the Fi subreddit seems unusual and may have resulted in some of the negative feedback you received.
- lvs 10y ago
  That may not be true. Fi works with (and was marketed with) the Nexus 6 which is EOL as of this month (Oct 2016). That means the OS version will be halted at Android 7, as I understand it. They may still receive security updates, but I don't believe Google has said how long they'll be doing that for.
  - kevincox 10y ago
    It will get no more version upgrades, but it still has at least a year of security updates (depending on when it went out of the play store). I'm not saying new versions wouldn't be nice but personally that seems like a minor advantage.
gdulli 10y ago
Extrapolating a reddit community to the whole population is like saying all Republicans are deplorable.
- myowncrapulence 10y ago
  That's not the only place I've experienced mass bias about android vs. mac. Also, to say that I'm extrapolating to the whole population is assuming. I was simply pointing out the state of small communities I've been exposed to.

djsumdog 10y ago

One of the major major major issues is the hardware itself. Let's jump back to the late 90s. You want to try Linux. You might partition your disk, or build a different machine and get a KVM or use an old laptop or add a second hard drive. In all cases, you can just install a Linux distro and see if it works. Maybe Ethernet or sound or something doesn't work. You could try a different distro with a newer kernel, maybe compile your own kernel with the modules you need, etc. But no matter what, it would at least boot (usually). Intel x86/64 is a standard architecture. EFI makes the booting process even easier (although some motherboards still fuck this up; but for the most part fiddling with efibootmgr and turning off TPM will work. If not you can always turn on legacy BIOS and use the MBR). ARM is not a standard architecture. It's a spec that is sold to companies who all make their own SoC templates. There are things like Device Tree Config that make some of this more standard, but it's still far from x86/64. Just read Torvalds rants on ARM to learn more. Even if you make some standard Android builds with all the drivers for all phones in a massive 20MB initrd, a lot of kernels are fundamentally different with the way bus connections are defined. Manufactures take forever to release their kernel code, often under threats by people for GPL violations, and even then they are filled with tons of binary blobs and shims that connect their .o files so kernel calls. Stuff like Plasma looks amazing. It only has like two phones it supports. If you look at any android rom project, you see totally different builds for every single device. If Intel had been like this, Linux would have died off in the 90s, for both servers and desktops. Device manufactures depend on you buying new phones. They cannot support phones after two years or else it kills their profit margins. Planned obsolescence like this leads to waste (don't kid yourself, e-waste recycling gets shipping to Africa where kids remove components. A small percentage of phones actually get recycled). TL;DR Mobile phones are based on unmaintainable and non-standard hardware (intentionally). I wrote a post on this a while back: http://penguindreams.org/blog/android-fragmentation/ http://penguindreams.org/blog/android-fragmentation/

mtgx 10y ago
> If Intel had been like this, Linux would have died off in the 90s, for both servers and desktops. That's the thing. You said "Intel". Intel is not an architecture. It's a company - that happens to dominate the x86 market. Do you think the situation would be the same if there were 10 different x86 chip companies with at least 5% market share each? If we wanted everything to just work, as it does on "Intel", then we should probably wish for a Qualcomm monopoly with 90% of the market. And hope it's profitable enough that they can support their own chips for more than 18 months. I can only describe Intel's chips as a rip-off for the most part (and it's only gotten worse in recent years). I mean, they're now selling Atom chips for $160 (about 4-5x more than a similar performance ARM chip) to notebook manufacturers, with very little difference in performance between them and the older Atom for smartphones. So I would certainly hope Intel's chips would be better supported. Although I actually don't think its Atom chips are as well supported as its Core chips. Now, not having a single company completely dominate the ARM ecosystem is certainly a "problem" from this point of view. However, I still mostly blame Google, who mainly just wants its ads to run well on these devices, which seem to do that rather well in the current situation, as well as OEMs who want to be "different" and are probably even hostile to the idea of allowing say an LG ROM run on a Samsung phone. I would try to fix this Google/OEM situation first and aim my complaints at them.

loudmax 10y ago

My 1st gen Moto G stopped receiving updates a while ago, but Cyanogenmod is still putting out new ROMs. It takes some level of understanding to put Cyanogenmod on a device, but nothing too challenging for the HN crowd. If your phone has stopped receiving updates and you're not ready to buy a replacement yet, you can check if it's supported. It's a great thing that this project exists.

greenshackle2 10y ago
I was considering buying a new phone but I installed CM on my 2nd gen Moto E and that solved most of performance issues (so far, remains to be seen if it holds up.) CyanogenMod has less bloat, and more actually useful core functionality, which means I need fewer apps. (For example, no need for something like Twilight since it has adaptive brightness/hue built-in.)
- busterarm 10y ago
  And runs default root so essentially is a security nightmare waiting to happen.
  - mordocai 10y ago
    Mine certainly doesn't. I use an official CM build for my phone and I still had to root it if I wanted that (which I did). Then, barring exploits of which I'm sure there are many, I have to approve each app that wants root access. No "default root".
  - amaranth 10y ago
    Their stock configuration doesn't even have root available unless you enable it in the hidden developer settings menu. Even then it works like SuperSU and such, non-root by default and popups to prompt for root access when an app requests it.
- CountSessine 10y ago
  CyanogenMod is fantastic, but even then, the devs have to work with what they've got. Support for Exynos SOCs has traditionally been sketchy because Samsung plays games with xda devs and is slow to push kernel patches. And even with snapdragon SOCs I've had stuff happen like LTE and wifi 802.11n stop working after flashing with CyanogenMod. CyanogenMod is a very high-quality android distro, but sometimes they're really stuck doing the near-impossible.

gregmac 10y ago

This article also linked to a post about Android disk encryption [0] that I found pretty interesting. It goes through Apple vs Android encryption implementations, and talks about per-file vs full-disk. Android has only just now implemented per-file, but haven't made it granular enough to handle some very valid use cases and thus it has some pretty big holes. The worst part is fixing it means breaking 3rd party apps. [0] https://blog.cryptographyengineering.com/2016/11/24/android-n-encryption/ https://blog.cryptographyengineering.com/2016/11/24/android-...

Watabou 10y ago
There was some discussion about this on HN [1]. Pretty interesting that it only got 183 votes. Usually when people talk about Apple's security holes, it generates much more discussion (criticism) and votes. [1] https://news.ycombinator.com/item?id=13031012 https://news.ycombinator.com/item?id=13031012
- macintux 10y ago
  Pointing out that Android is insecure is about as newsworthy as pointing out that the sun will rise tomorrow.

isliiiive 10y ago

My 2c: After 3+ years of android (moto g w/ cyanogenmod, then project fi), I finally made the switch back to iOS. I'm beyond happy so far, and have the benefit of google not tracking my every step and key press. It is good when the manufacturer of a product you pay for has interests in line with your own.

aviraldg 10y ago
I am happy for you, but please stop spreading FUD about Google/Android. I would like you to point out a single practical example of tracking in Android that you can't opt out of.
- oneplane 10y ago
  It's not the opt in/out, it's the Intention that matters. It is known that a company built on advertising will want as much data to profile and target you as possible. If you can disable all/most of the telemetry that's nice, but doesn't change the intent of the vendor, nor does it change the way you are perceived as a customer/data source. This is the same for most vendors; with Apple, they want to make you a happy customer with the hopes that you'll buy whatever they release next, with Microsoft it's more like an ecosystem idea where they'd like you to connect as many services, software suites and devices with their software as possible, connecting home, work, private, and entertainment. It doesn't need to be the best in quality, but definitely in quantity. With Google, they want as much data about you, and as much exposure to ads as possible, with a free opt-out for data gathering, and a paid opt-out for ad serving (i.e. paid apps vs. free apps as other vendors put them in their play store). Nothing new here, but it's not FUD about Google/Android, it's just the way they work, and there's nothing wrong with that.
- ocdtrekkie 10y ago
  The problem isn't that you can't opt out of it. The problem is that Google cripples your phone if you opt out of it. Because Google's software is not designed to function properly without tracking. (For instance, your local Google Maps install won't even remember where you live or your last location search if you turn search history off in the cloud.) Not having basic local-only functionality is silly, unless you're specifically trying to push people to stay in your tracking system.

rogerbinns 10y ago

Apple does have an iPhone in the traditional Nexus pricing zone. For $400 you get the iPhone SE - https://www.apple.com/iphone-se/ https://www.apple.com/iphone-se/ - which could be acceptable.

richardwhiuk 10y ago
The problem is in the sub Nexus pricing zone. If you get a Nexus, the story isn't too bad for 18 months. The iPhone SE is likely to have a shorter security lifetime than the flagship devices, as you are effectively buying 1/2 year old hardware.
- illumin8 10y ago
  From the article: > Apple is still shipping security updates, albeit on iOS 9, for the iPhone 4s which was released in 2011 (5 years ago). The iPhone 5 is still being kept up to date with iOS 10. Apple has a very good track record here. Based on past experience, it's likely that the iPhone SE will continue to receive security updates well past 2020.
  - pm90 10y ago
    This is exactly why I switched. My Nexus 5 which worked perfectly for a couple of years, suddenly crashed. And I looked up the new Nexus/Pixel phone and decided it was much better to switch to iPhone SE for a smallish phone which would be cheap, dependable, reliable and supported for a longer time.
    - 0xFFC 10y ago
      My Nexus 5 glass broke last week, I am in exact position as you, after looking at market I thought there is no way I am buying another phone from Google(let alone other manufacturers). Now I am happily switching to iPhone SE which I am 100% sure will get supported more than pixel phones.
  - zanny 10y ago
    Meanwhile, Windows 7 is supported until 2020, and was released in 2009, and could run on hardware up to about ~7 years old at the time. That means an effective support period of about 18 years. The entire cellphone ecosystem is toxic because of how it treats hardware as disposable in an effort to coerce money from users. I find that phones of the Galaxy S3 / Moto G first gen era are sufficient for 80% of use cases, but since the software stops working and depends on Cyanogenmod for long term usability it is a PITA and lets the hardware manufacturers off the hook for gross mistreatment of users.

wahsd 10y ago

Not trying to be flippant, but when the heck was Android security not a mess?

emsy 10y ago

>What can we do? Buy an iPhone. No really. I was looking to switch to Android, but even after briefly reading up on security/privacy on Android, I came to the same conclusion. It's too bad iPhones are pricey and/or despised among a subset of customers. I'm sure more users would vote with their wallets if they were aware of this.

B1FF_PSUVM 10y ago
Well, there once was a very nice mobile platform called Metro Design, but it got stuffed. It's a very rare industry that does not have at least three players. Two, just Android and iOS, is a strange number.
coldpie 10y ago
I'd consider switching to an iPhone, but lots of my music is just MP3 files and I'd hate to lose the ability to play them on my phone. Using iTunes is not an option.
- deleted 10y ago
  [deleted]
- mcgrath_sh 10y ago
  There are several 3rd party options for playing audio files on iPhone without iTunes. The two I use most often are Plex and CloudBeats. Recently, I have been giving Bound a try for audiobooks instead of CloudBeats. I really want Plex to support some basic Audiobook features so I can use just the one app. The audio I listen to is stored either on my home server (Plex) or a cloud service of my choice (CloudBeats and Bound). I don't touch iTunes. Disclaimer: I rarely listen to music. I'd wager 85-90% of my aduio listening is podcasts and I do that with Overcast. This may lead me to have the false belief that not using iTunes for music is easy/not a hassle on the iPhone.
  - coldpie 10y ago
    Yeah, yeah, yeah. Or I can use Android and just have a filesystem and any application can access that filesystem and play my files.

willtim 10y ago

I think this article is spot on. We should vote with our feet. Since Samsung do not wish to keep my phone secure, and so far they are averaging one update per year, my next phone is likely to be a pixel.

chinathrow 10y ago

I'm in the market for a new android these days. Looking at the too tightly with Google coupled Pixel, the Samsungs S6/S7 (Samsung led me down without updates once), the Fairfone 2 (thick and ugly) and others. It's a mess.

dispose13432 10y ago

What's frustrating is that People/Google keeps on blaming the OS nature of Android. What they forget is that to put Android on a phone, practically you need Google's permission. If Google cared, they could have made it part of the terms and conditions that it has to have security updates for five years. They obviously don't

bitmapbrother 10y ago
When has Google blamed the OS nature of Android? >What they forget is that to put Android on a phone, practically you need Google's permission. I think you're forgetting the hundreds of millions of users that use Android without any Google services. >If Google cared, they could have made it part of the terms and conditions that it has to have security updates for five years. Wouldn't it be nice if it was as simple as that? You seem to think Google has the ability to do whatever they want and have the OEM's fall in line one by one. >They obviously don't In that case they should probably stop investing millions into improving Android security every year and stop releasing security updates each month.
- dispose13432 10y ago
  >I think you're forgetting the hundreds of millions of users that use Android without any Google services. If only the problem was with those phones. Anything in the US except for Amazon is under Google's thumb >Wouldn't it be nice if it was as simple as that? You seem to think Google has the ability to do whatever they want and have the OEM's fall in line one by one. They put their foot down about other things, like branding, app choices. This should be more important. You don't want to port Android 7 to a three year old phone, fine. But to refuse to patch against stagefright?
  - bitmapbrother 10y ago
    >If only the problem was with those phones. Anything in the US except for Amazon is under Google's thumb So you've now qualified it to only phones in the US and devices not from Amazon? >They put their foot down about other things, like branding, app choices. This should be more important. It's a balancing act to keep everyone happy. When it comes to things like creating patches and paying for carrier certification these all cost money and shave off even more margin. Support the OEM's that provide timely OS updates and patches and disregard the rest.

grandalf 10y ago

Google decided to take on IOS by loosening the quality controls that help make the ecosystem secure. Google could easily require code signing and auditing for all non-google OS components, but it chooses not to because doing so would hinder phone sales. The vulnerability in BLU phones was due to third party code packaged in the Android build for BLU phones. This was discovered because it sent texts back to china. Imagine if a slightly more sophisticated attack were included, how easy would it be to spot? I'd estimate that there may be over 20 stuxnet level malwares lurking in the Android ecosystem, leveraging it to spread opportunistically deeper into infrastructure and onto higher value targets, etc. And this doesn't even consider hardware level malware which could be included in bulk via alternative ASIC designs that end up on millions of phones.

remir 10y ago

Could this be one of the reason why Google is working on Fuchsia, their new OS with a micro-kernel (Magenta)?

ocdtrekkie 10y ago
It's hard to tell. There's indications it's meant to work on any form factor, but at least initially their focus seemed to be on desktop-esque hardware like the Intel NUC, an Acer slate tablet that runs x64, etc. and then with the Raspberry Pi for ARM support. There hasn't yet been a clear indication that they're working on phone support for it, or when that would be. It's still super early for Fuchsia though, so it's anyone's guess.
- remir 10y ago
  I agree, it's still early and there's not much info at the moment. Still, in the maxwell repo, there's mentions of "GPS acquirers" and in the SysUI repo, there's icons for battery, airplane mode, screen rotation and cellular signal. Nothing really specific for phones since these things can be found in some tablets and laptops, but apps in Fuchsia are made with Flutter, so it's interesting since it was made to make cross-platform mobile dev easier on Android/iOS.

pimeys 10y ago

I'm still using my over two years old OnePlus One with the Cyanogen that came pre-installed and I've been installing all the ota updates, being in security patch September now and QuadRooter showed no vulnerabilities. Pretty near for such a cheap phone. What stops me from using iPhone is my opus music collection I want to carry with me, Rocket player and my pure hate towards iTunes.

deleted 10y ago
[deleted]

ansible 10y ago

So, as others have mentioned, the ARM chips out there don't really follow any common set of standards. Some IP blocks, like USB controllers, can operate using a standard driver, but that's about it. Even for the bits that are migrating from PC land like PCIe and SATA, they aren't uniformly available or have standard driver interfaces across vendors. And it gets worse. There's not even a standard means of discovering what all of the hardware is on the ARM System-on-Chip (SoC). You've just got to learn that this GPIO register is at this physical memory address from the reference manual. And it gets even worse. There's no standard for hooking up the hardware peripherals either. You could have two phones with the same (for example Qualcomm Snapdragon 820 SoC) but they might have chosen to connect up different sets of peripherals, to different sets of ports. There might be three display output ports, which one did vendor X use? And don't even get me started about power management. ARM Ltd doesn't do this, so every chip vendor has their own. Which is completely different. There is nothing close to what is available in laptop land. What we need is a widely accepted standard for describing the on-chip peripherals, which can be read by the software. And we need a separate description for how the hardware is connected. And even all that isn't nearly enough. This situation will not get better any time soon, IMHO.

swiley 10y ago
Device tree is actually a reasonably flexible and precise way to describe all of that, the problem is that many vendors just don't use it.

hackuser 10y ago

The IT industry's lack of attention to security (including confidentiality and system integrity) has enabled mass surveillance, by both businesses and government, and that problem now combines with the political situation to create a serious risk to people's rights. Google has a very serious responsibility to implement effective security for Android, and it needs to be done urgently. They've known about it for years and put it off. The EFF has some basic specs here: https://www.eff.org/deeplinks/2016/11/tech-companies-fix-these-technical-issues-its-too-late https://www.eff.org/deeplinks/2016/11/tech-companies-fix-the...

qwertyuiop924 10y ago
Irritatingly, as much as Android security sucks, it's effective enough that it's hard to root most phones.
- hackuser 10y ago
  Secure against, but not for, end-users.
soft_dev_person 10y ago
When I worked in the mobile industry (modems), blatant security holes to monitor all sorts of things was a requirement from the biggest operators (like AT&T).

hackuser 10y ago

Can anyone comment on the Blackberry Priv? The article mentioned it, and I know their security goes down to hardware level and what they claim is a secure manufacturing process, but all I know is what they claim ...

jevinskie 10y ago
I purchased one used, mostly to see what it is like but also to have as a backup phone Just In Case. The hardware is a mixed bag: the screen is gorgeous, the keyboard is a bit narrow but allows for very accurate typing, the back of the case is flimsy, and the CPU is underwhelming. The software is great though! You get a very up to date (second only to Google brand phones w.r.t. security updates) OS and the Blackberry software (like Hub) is an actual improvement over the stock Android experience. Basically, if you want a secure Android phone and wouldn't mind trading older hardware for a physical keyboard, it is the phone for you. Otherwise, you might want to look at a Pixel device. As to security at the hardware level, I'm not aware of the PRIV featuring anything special outside of the TrustZone TEE stuff that most recent Android phones have.
- hackuser 10y ago
  I found some notes from when I was looking into the Priv at the end of last year. They lack detail, but maybe are a good starting point for someone. * Root of trust: unique crypto keys at the hardware level: Somehow implemented in way that guarantees Blackberry through supply chain, they claim. Maybe Blackerry supplies own chipset, w/ key included? * Verified Boot and Secure Bootchain: Verifies integrity of all layers, from hardware to software. Uses hashes, crypto signatures * hardened Linux kernel with numerous patches and configuration changes to improve security * FIPS 140-2 compliant full disk encryption for data and applications * Monthly updates through the Google Play store (only?) * DTEK: "a single dashboard to monitor and control application access to your microphone, camera, location and personal information." * Can customize each app's privacy settings, like in Android 6 Also of potential interest, from a competitor: * http://www.tomshardware.com/news/copperhead-nexus-more-secure-priv,30565.html http://www.tomshardware.com/news/copperhead-nexus-more-secur... ---- Sources: * http://blogs.blackberry.com/2015/10/priv-is-for-private-how-blackberry-secures-the-android-platform/ http://blogs.blackberry.com/2015/10/priv-is-for-private-how-... * http://www.zdnet.com/article/the-many-ways-blackberry-beefs-up-android-security-on-the-priv/ http://www.zdnet.com/article/the-many-ways-blackberry-beefs-...

raspasov 10y ago

"Vendors (LG, Samsung, Xiaomi, etc.), after selling you their phone, have no incentive to keep your phone’s software up to date with Google’s fixes" - that means that they have no concept of long-term (long term = more than a month) customer satisfaction. If that is the case (and that very well might be), the future is very bright for Apple.

Tempest1981 10y ago
However, people will endure much pain and problems to save a few dollars. Reminds me a bit of the "inexpensive footwear" Dilbert cartoon: http://dilbert.com/strip/2007-05-01 http://dilbert.com/strip/2007-05-01
- raspasov 10y ago
  Fair point!

ensiferum 10y ago

Simple, don't buy this crap.

NiekvdMaas 10y ago

Actually Xiaomi (a Chinese vendor) has one of the best update models I have seen. They update MIUI weekly, every Thursday a new update with small changes/security fixes. If only more companies would adopt such a model we'd have a different situation.

mads 10y ago
Small problem with this model, if you want your devices to be Google certified. Google requires that every official software needs to be certified with Google (CTS and GTS verification need to be passed at a Google certified lab). This might not be a big problem once you are rolling after your first certification, but it does create some overhead every time you need to release a software. I don't think MIUI is Google certified.
- STRML 10y ago
  Practically, what good is Google certification, if a majority of the devices in the wild are months or even years behind on security updates?
  - mads 10y ago
    Well, if you are not certified, you are not allowed to pre install the whole suite of Google binaries and Google Market along with Google Pay and probably other services are not going to work on your device (at least you wont be able to make purchases).
    - anilgulecha 10y ago
      Xiaomi phones come with the full google ecosystem of apps, so they are certified.
      - mads 10y ago
        Oh okay, I didn't know that. Thanks.

aq3cn 10y ago

Has anyone here given a shot to NoPhone? https://www.thenophone.com/ https://www.thenophone.com/ https://www.thenophone.com/products/the-nophone https://www.thenophone.com/products/the-nophone

WhiteHat1 10y ago

Security for so many elements end up being seen of as an afterthought. For Android, there are so many different moving parts - from hardware, as others have mentioned - to multiple libraries, poor malware and antiviruses and other protections, and so many different libraries.