10 ms·

My solution is to use CyanogenMod (now LineageOS) and deny access when apps request it. To applications it looks like they can access my contacts, but if I deny

by qznc 10y ago

My solution is to use CyanogenMod (now LineageOS) and deny access when apps request it. To applications it looks like they can access my contacts, but if I deny it, they only get to see an empty list.

emsy 10y ago
My solution is to buy an iPhone. I don't mean that as a snarky response, as I'd very much like to use an Android phone (And if it's just to be able to use Tasker). But I simply don't have time to bother with this stuff anymore, so I pay ~200$ more in exchange for my time (and privacy). Secondly, I don't want to give anyone money that gives a crap about my device's security and privacy. There was a similar article on HN a while ago that came to the same conclusion: https://news.ycombinator.com/item?id=13056288 https://news.ycombinator.com/item?id=13056288
- madshiva 10y ago
  Your solution for what? for privacy? Apple privacy? just nope. Antivirus software are all bloatware, they don't do money anymore then they focus on other things "to secure". Ok. your clipboard can be read by other software (like in Windows ...) then what? just don't copy password. "Yes downvote my comment but don't argue. The solution buy an iPhone is still not valid solution."
  - simonh 10y ago
    You're getting downvotes for your "LA, LA, LA I'm not listening" attitude. Android and iOS have many very different advantages and disadvantages over each other, but security on iOS is very clearly vastly superior and this has been confirmed repeatedly by top security researchers. Trying to pretend that's not true or pick and choose 'whataboutist' issues and pretend that's all that matters to make false equivalences is really going to wind people up. The expected level of discourse here is quite a bit beyond that.
    - yellowapple 10y ago
      "security on iOS is very clearly vastly superior and this has been confirmed repeatedly by top security researchers" The vast majority of this "superiority" only applies because the iOS ecosystem is a walled garden. Android devices typically allow sideloading, which obviously introduces an additional attack vector; reproducing this on iOS (i.e. by jailbreaking) brings you back to the same attack surface. The other notable difference between iOS and Android security-wise has historically been the ability to selectively accept certain privileges, but recent Android versions have introduced this as well, and even the old permissions model was (and still is) much more up-front and fine-grained about which permissions an app requires. iOS also had (and probably still has) an edge for awhile when it came to OpenBSD-style exploit mitigations IIRC, but Android is getting these too by way of projects like CopperheadOS. Other than those aspects, there are actually very few major differences (last I checked, at least; I haven't really been following the iOS world, so maybe Apple's done some crazy stuff while I wasn't looking) between their security models. Both implement some form of per-app sandboxing, both default to disallowing root access (in most cases, at least; third-party Android distros have a tendency to ship with root access, usually behind some toggle and/or some management app like SuperSU or whatever the latest hotness is), both default to a locked-down boot environment (in order to defend against rootkits), etc. Both have had their share of security-affecting bugs, too. There's no "clearly vastly superior" about it in either direction, at least on a platform level. On an ecosystem level, sure; Google doesn't do quite as good a job as Apple when it comes to screening malware (there have been quite a few notorious examples of this), and the ability to sideload apps (as well as the much easier jailbreaking/rooting situation) means that more malware is actually viable. This isn't a security problem in the sense of the platform itself, but rather in the sense of allowing users to shoot themselves in the foot by installing trojans. Like I said above, these exact same problems happen on jailbroken iOS devices, too (I reckon with a very similar frequency, too, but I don't have statistical evidence to back it up, so take that with a grain of salt).
      - jerf 10y ago
        "Android devices typically allow sideloading," In the context of this discussion, sideloading is irrelevant. We're talking about the default happen-to-everybody case. "Other than those aspects, there are actually very few major differences... between their security models" It's not just about the security model, though. We have some reason to believe that Apple phones may actually be at least partially resistant to law enforcement. I say that not as an encouragement to use them that way, but to point out that's about the highest security bar possible and we at least have some reason to think the latest iPhones get there. (And I am carefully phrasing this as "some reason to believe" and "resistant" because we do not know for sure whether this is the case, and I wouldn't bet that even if the phone can stymie a local police investigation that it would block a full-powered Federal investigation.) We have no reason to believe any Android phone meets this standard of security, nor would the fact that a particular one rose to that standard meant any other ones would. And if I'm pro-anything, I'm pro-Android in general. But that doesn't change the facts.
- ocdtrekkie 10y ago
  I intensely dislike Apple as a company, and I dislike their products, but the honest truth is there is no such thing as a reasonably secure Android device, and I can't fathom recommending one to anyone ever again. After seven years on Android, my recommendation is "literally anything else".
  - emsy 10y ago
    I've stopped liking or disliking companies altogether. I try to look if a company isn't crossing my personal moral boundaries (child workers etc.) and whether it satisfies my needs. Then I buy their product. As for the moral part, Apple is the only company I've heard of that at least acknowledges there's a problem (http://www.apple.com/supplier-responsibility/ http://www.apple.com/supplier-responsibility/).
- jmtd 10y ago
  I'm trying to determine whether iOS apps could sniff my clipboard, and i haven't proven that they can't; it doesn't seem to be a specific permission that needs to be assigned or can be denied. And thus using 1Password on my iPhone to copy and paste passwords seems to have a bit of a risk to it.
  - emsy 10y ago
    iOS Apps can read your clipboard (But only if the app is open i.e. not in the background, which was possible in earlier iOS versions). I would welcome it if they introduced a permission for clipboard handling. Personally, I use Workflow to clear my clipboard after pasting a password.
  - deleted 10y ago
    [deleted]
  - supergreg 10y ago
    But can apps sniff in what website or app you are using the password? Either for iOS or Android, if the password are just random strings unique for each site and they can't determine that then the attack vector diminishes.
    - bad_user 10y ago
      A while back you could query the apps currently active on iOS and there was a big scandal that Twitter was doing it, being reported by the media as a secret vulnerability, which was bullshit since that "vulnerability" was fairly well known already and in use by ad platforms. And at a previous company we used it for more than a year I think, before being in the news. I don't know what happened after that, Apple must have closed that loophole and Android requires a specific permission. But there are always vulnerabilities that developers can exploit and you can't trust the OS on this one. Plus it really doesn't matter, because when it comes to security, there's also the issue of the mono-culture and user technical stupidity. We know that many people use Gmail, Facebook, Twitter, etc, most of them reusing passwords across services. And logging the user's copy/pasted texts gives you such a specific dictionary that the probability of getting hacked approaches 1 fast.
- bad_user 10y ago
  I currently use an iPhone and it too isn't a good privacy solution either. For example my pet peeve is that apps like Waze or Uber are allowed to only request full location tracking, even while running in the background. As a user you cannot restrict location tracking to happen only when the app is running. This is an either-or proposition. Either the user allows location tracking while in the background, or you cannot use the app. And surely you can manually enable and disable location tracking per app, but that's way too cumbersome. Just imagine trying to start navigation while at a red light. Whereas with Android I used to be able to enable/disable location tracking globally, since you get a global shortcut that you can access in a swipe and tap. I also use 1Password as a password manager. Well, iOS has the same problem as Android where apps can read the contents of your clipboard, including copied passwords. And compared with Android it's not common to see password managers use third-party keyboards or accessibility features to side-step copy/pasting passwords. And sure, apps have an API to integrate managers like 1Password or Lastpass, which is nice when it's there and it's surely nice when it works in Safari, but too few apps use it. In other words, even though the privacy/security story is currently better for iOS, IMO it's not that good either and I hope that Apple and Google will work on improving this situation because I'm seriously thinking of going back to a dumb phone.
  - cgb_ 10y ago
    To be fair, those are app choices to require 'Always' for location tracking. You can most definitely restrict an app to use location only while using - you can't fault Apple or IOS for apps that (unnecessarily [1]) demand more. One thing I really like about IOS is the reminder that an app has been using your location in the background for a while [2] [1] http://www.theverge.com/2016/11/30/13763714/uber-location-data-tracking-app-privacy-ios-android http://www.theverge.com/2016/11/30/13763714/uber-location-da... [2] https://support.apple.com/library/content/dam/edam/applecare/images/en_US/iOS/iphone6-ios9-weather-app-using-location.jpg https://support.apple.com/library/content/dam/edam/applecare...
    - zymhan 10y ago
      But Apple makes (seemingly) no effort to encourage developers to allow limited location access. Why can't iOS be in charge of when an app uses my location when the app is backgrounded? The reminder only appears once per app, as far as I've noticed. I restored my phone recently for the first time in over a year, and had totally forgotten about the reminder feature.
cosarara97 10y ago
I thought these things were only possible with xprivacy. Which Cyanogen versions have this functionality?
- ctz 10y ago
  I think since CM10. It's called "privacy guard."
- qznc 10y ago
  I currently use CM12.1 (Android 5.1.1). No xprivacy or xposed stuff.
  - Arnt 10y ago
    Settings, privacy, privacy guard.
deleted 10y ago
[deleted]
vmateixeira 10y ago
I think I can achieve similar with an Android 6.0+ stock ROM, but still some apps refuse to work and shut down once you reject their access to some resources.
- rasz_pl 10y ago
  because Deny is an useless option, there should be return empty/dummy/configurable reply
izacus 10y ago
Android 6 and newer has this built in.
- LoSboccacc 10y ago
  app can detect if they are blocked and won't start.
  - DiabloD3 10y ago
    Then they don't start, and are uninstalled and reported as broken as a Google Play store review with 1 star, as has already happened to apps that tried that shit.
    - LoSboccacc 10y ago
      see https://play.google.com/store/apps/details?id=com.ea.gp.bej3&hl=en https://play.google.com/store/apps/details?id=com.ea.gp.bej3... doesn't seem like that at all. 150k installs and 4.5 rating.
      - LoSboccacc 10y ago
        Why is this getting downvoted? It is a perfect example of an app with scummy permission and a startup block if it cannot access contacts thriving.
      - CaptSpify 10y ago
        The average user doesn't care about permissions and probably are going to fully allow games like that to steal their data. Then they'll give it a good score in the app-store. Install number and rating aren't good indicators. I think there's an implied user-base here that the "mark as broken" response is going to be useful for, but the vast majority of people won't care.
      - rasz_pl 10y ago
        thats an ok example, but check out this one: https://play.google.com/store/apps/details?id=com.ace.cleaner&hl=en https://play.google.com/store/apps/details?id=com.ace.cleane... this is a malware with almost 200K installs and poerfect 4.5 rating. It propagates using spam/pirate sites with misleading "your phone is broken and will blow up if you dont install this" scam https://virtuallyfun.superglobalmegacorp.com/2016/12/07/holy-crap-get-annoying-trojan-attempt-ever/ https://virtuallyfun.superglobalmegacorp.com/2016/12/07/holy...
LoSboccacc 10y ago
damn this should really be in the android os, plenty users have unsupported phones (and cm being discontinued doesn't help, but let's see how lineage goes) it's extremely annoying to get a game and it wont start unless it gets access to your contact list. wtf?
baby 10y ago
I do basically the same thing when an app request some permissions on Facebook. For example if they want to post on your facebook, allow them, but only make them post to "yourself". You can do that in the permission popup when they request access.
emodendroket 10y ago
But still now you have to trust them too.
wyldfire 10y ago
Wow, that's an awesome feature. I really preferred running on the stock image but that's appealing enough for me to consider switching.

by qznc 10y ago

emsy 10y ago

My solution is to buy an iPhone. I don't mean that as a snarky response, as I'd very much like to use an Android phone (And if it's just to be able to use Tasker). But I simply don't have time to bother with this stuff anymore, so I pay ~200$ more in exchange for my time (and privacy). Secondly, I don't want to give anyone money that gives a crap about my device's security and privacy. There was a similar article on HN a while ago that came to the same conclusion: https://news.ycombinator.com/item?id=13056288 https://news.ycombinator.com/item?id=13056288

madshiva 10y ago
Your solution for what? for privacy? Apple privacy? just nope. Antivirus software are all bloatware, they don't do money anymore then they focus on other things "to secure". Ok. your clipboard can be read by other software (like in Windows ...) then what? just don't copy password. "Yes downvote my comment but don't argue. The solution buy an iPhone is still not valid solution."
- simonh 10y ago
  You're getting downvotes for your "LA, LA, LA I'm not listening" attitude. Android and iOS have many very different advantages and disadvantages over each other, but security on iOS is very clearly vastly superior and this has been confirmed repeatedly by top security researchers. Trying to pretend that's not true or pick and choose 'whataboutist' issues and pretend that's all that matters to make false equivalences is really going to wind people up. The expected level of discourse here is quite a bit beyond that.
  - yellowapple 10y ago
    "security on iOS is very clearly vastly superior and this has been confirmed repeatedly by top security researchers" The vast majority of this "superiority" only applies because the iOS ecosystem is a walled garden. Android devices typically allow sideloading, which obviously introduces an additional attack vector; reproducing this on iOS (i.e. by jailbreaking) brings you back to the same attack surface. The other notable difference between iOS and Android security-wise has historically been the ability to selectively accept certain privileges, but recent Android versions have introduced this as well, and even the old permissions model was (and still is) much more up-front and fine-grained about which permissions an app requires. iOS also had (and probably still has) an edge for awhile when it came to OpenBSD-style exploit mitigations IIRC, but Android is getting these too by way of projects like CopperheadOS. Other than those aspects, there are actually very few major differences (last I checked, at least; I haven't really been following the iOS world, so maybe Apple's done some crazy stuff while I wasn't looking) between their security models. Both implement some form of per-app sandboxing, both default to disallowing root access (in most cases, at least; third-party Android distros have a tendency to ship with root access, usually behind some toggle and/or some management app like SuperSU or whatever the latest hotness is), both default to a locked-down boot environment (in order to defend against rootkits), etc. Both have had their share of security-affecting bugs, too. There's no "clearly vastly superior" about it in either direction, at least on a platform level. On an ecosystem level, sure; Google doesn't do quite as good a job as Apple when it comes to screening malware (there have been quite a few notorious examples of this), and the ability to sideload apps (as well as the much easier jailbreaking/rooting situation) means that more malware is actually viable. This isn't a security problem in the sense of the platform itself, but rather in the sense of allowing users to shoot themselves in the foot by installing trojans. Like I said above, these exact same problems happen on jailbroken iOS devices, too (I reckon with a very similar frequency, too, but I don't have statistical evidence to back it up, so take that with a grain of salt).
    - jerf 10y ago
      "Android devices typically allow sideloading," In the context of this discussion, sideloading is irrelevant. We're talking about the default happen-to-everybody case. "Other than those aspects, there are actually very few major differences... between their security models" It's not just about the security model, though. We have some reason to believe that Apple phones may actually be at least partially resistant to law enforcement. I say that not as an encouragement to use them that way, but to point out that's about the highest security bar possible and we at least have some reason to think the latest iPhones get there. (And I am carefully phrasing this as "some reason to believe" and "resistant" because we do not know for sure whether this is the case, and I wouldn't bet that even if the phone can stymie a local police investigation that it would block a full-powered Federal investigation.) We have no reason to believe any Android phone meets this standard of security, nor would the fact that a particular one rose to that standard meant any other ones would. And if I'm pro-anything, I'm pro-Android in general. But that doesn't change the facts.
ocdtrekkie 10y ago
I intensely dislike Apple as a company, and I dislike their products, but the honest truth is there is no such thing as a reasonably secure Android device, and I can't fathom recommending one to anyone ever again. After seven years on Android, my recommendation is "literally anything else".
- emsy 10y ago
  I've stopped liking or disliking companies altogether. I try to look if a company isn't crossing my personal moral boundaries (child workers etc.) and whether it satisfies my needs. Then I buy their product. As for the moral part, Apple is the only company I've heard of that at least acknowledges there's a problem (http://www.apple.com/supplier-responsibility/ http://www.apple.com/supplier-responsibility/).
jmtd 10y ago
I'm trying to determine whether iOS apps could sniff my clipboard, and i haven't proven that they can't; it doesn't seem to be a specific permission that needs to be assigned or can be denied. And thus using 1Password on my iPhone to copy and paste passwords seems to have a bit of a risk to it.
- emsy 10y ago
  iOS Apps can read your clipboard (But only if the app is open i.e. not in the background, which was possible in earlier iOS versions). I would welcome it if they introduced a permission for clipboard handling. Personally, I use Workflow to clear my clipboard after pasting a password.
- deleted 10y ago
  [deleted]
- supergreg 10y ago
  But can apps sniff in what website or app you are using the password? Either for iOS or Android, if the password are just random strings unique for each site and they can't determine that then the attack vector diminishes.
  - bad_user 10y ago
    A while back you could query the apps currently active on iOS and there was a big scandal that Twitter was doing it, being reported by the media as a secret vulnerability, which was bullshit since that "vulnerability" was fairly well known already and in use by ad platforms. And at a previous company we used it for more than a year I think, before being in the news. I don't know what happened after that, Apple must have closed that loophole and Android requires a specific permission. But there are always vulnerabilities that developers can exploit and you can't trust the OS on this one. Plus it really doesn't matter, because when it comes to security, there's also the issue of the mono-culture and user technical stupidity. We know that many people use Gmail, Facebook, Twitter, etc, most of them reusing passwords across services. And logging the user's copy/pasted texts gives you such a specific dictionary that the probability of getting hacked approaches 1 fast.
bad_user 10y ago
I currently use an iPhone and it too isn't a good privacy solution either. For example my pet peeve is that apps like Waze or Uber are allowed to only request full location tracking, even while running in the background. As a user you cannot restrict location tracking to happen only when the app is running. This is an either-or proposition. Either the user allows location tracking while in the background, or you cannot use the app. And surely you can manually enable and disable location tracking per app, but that's way too cumbersome. Just imagine trying to start navigation while at a red light. Whereas with Android I used to be able to enable/disable location tracking globally, since you get a global shortcut that you can access in a swipe and tap. I also use 1Password as a password manager. Well, iOS has the same problem as Android where apps can read the contents of your clipboard, including copied passwords. And compared with Android it's not common to see password managers use third-party keyboards or accessibility features to side-step copy/pasting passwords. And sure, apps have an API to integrate managers like 1Password or Lastpass, which is nice when it's there and it's surely nice when it works in Safari, but too few apps use it. In other words, even though the privacy/security story is currently better for iOS, IMO it's not that good either and I hope that Apple and Google will work on improving this situation because I'm seriously thinking of going back to a dumb phone.
- cgb_ 10y ago
  To be fair, those are app choices to require 'Always' for location tracking. You can most definitely restrict an app to use location only while using - you can't fault Apple or IOS for apps that (unnecessarily [1]) demand more. One thing I really like about IOS is the reminder that an app has been using your location in the background for a while [2] [1] http://www.theverge.com/2016/11/30/13763714/uber-location-data-tracking-app-privacy-ios-android http://www.theverge.com/2016/11/30/13763714/uber-location-da... [2] https://support.apple.com/library/content/dam/edam/applecare/images/en_US/iOS/iphone6-ios9-weather-app-using-location.jpg https://support.apple.com/library/content/dam/edam/applecare...
  - zymhan 10y ago
    But Apple makes (seemingly) no effort to encourage developers to allow limited location access. Why can't iOS be in charge of when an app uses my location when the app is backgrounded? The reminder only appears once per app, as far as I've noticed. I restored my phone recently for the first time in over a year, and had totally forgotten about the reminder feature.

cosarara97 10y ago

I thought these things were only possible with xprivacy. Which Cyanogen versions have this functionality?

ctz 10y ago
I think since CM10. It's called "privacy guard."
qznc 10y ago
I currently use CM12.1 (Android 5.1.1). No xprivacy or xposed stuff.
- Arnt 10y ago
  Settings, privacy, privacy guard.

deleted 10y ago

[deleted]

vmateixeira 10y ago

I think I can achieve similar with an Android 6.0+ stock ROM, but still some apps refuse to work and shut down once you reject their access to some resources.

rasz_pl 10y ago
because Deny is an useless option, there should be return empty/dummy/configurable reply

izacus 10y ago

Android 6 and newer has this built in.

LoSboccacc 10y ago
app can detect if they are blocked and won't start.
- DiabloD3 10y ago
  Then they don't start, and are uninstalled and reported as broken as a Google Play store review with 1 star, as has already happened to apps that tried that shit.
  - LoSboccacc 10y ago
    see https://play.google.com/store/apps/details?id=com.ea.gp.bej3&hl=en https://play.google.com/store/apps/details?id=com.ea.gp.bej3... doesn't seem like that at all. 150k installs and 4.5 rating.
    - LoSboccacc 10y ago
      Why is this getting downvoted? It is a perfect example of an app with scummy permission and a startup block if it cannot access contacts thriving.
    - CaptSpify 10y ago
      The average user doesn't care about permissions and probably are going to fully allow games like that to steal their data. Then they'll give it a good score in the app-store. Install number and rating aren't good indicators. I think there's an implied user-base here that the "mark as broken" response is going to be useful for, but the vast majority of people won't care.
    - rasz_pl 10y ago
      thats an ok example, but check out this one: https://play.google.com/store/apps/details?id=com.ace.cleaner&hl=en https://play.google.com/store/apps/details?id=com.ace.cleane... this is a malware with almost 200K installs and poerfect 4.5 rating. It propagates using spam/pirate sites with misleading "your phone is broken and will blow up if you dont install this" scam https://virtuallyfun.superglobalmegacorp.com/2016/12/07/holy-crap-get-annoying-trojan-attempt-ever/ https://virtuallyfun.superglobalmegacorp.com/2016/12/07/holy...

LoSboccacc 10y ago

damn this should really be in the android os, plenty users have unsupported phones (and cm being discontinued doesn't help, but let's see how lineage goes) it's extremely annoying to get a game and it wont start unless it gets access to your contact list. wtf?

baby 10y ago

I do basically the same thing when an app request some permissions on Facebook. For example if they want to post on your facebook, allow them, but only make them post to "yourself". You can do that in the permission popup when they request access.

emodendroket 10y ago

But still now you have to trust them too.

wyldfire 10y ago

Wow, that's an awesome feature. I really preferred running on the stock image but that's appealing enough for me to consider switching.