3 ms·
The story for security on Android is really, really sad. Google should be pressing really hard on the secure enclave button. Even game consoles have better secu
by kabdib 10y ago
The story for security on Android is really, really sad. Google should be pressing really hard on the secure enclave button. Even game consoles have better security [here I wanted to add: "... than the most secure Android device", but that would be untrue, since I don't know all the Android devices out there. Let's just say the situation is sad, verging on terrible because it's Google, full of smart people who almost certainly know better].
Google probably can't get away with just trusting TrustZone, given the number of manufacturers of SOCs and the opportunity for the folks doing chip-level cut-and-paste of features to get things wrong.
I imagine there are patents in the way. Solve that with the realization that a united front against adversaries (crackers, state-level actors) is better than a fragmented one.
Solve the technical issues by getting the right 20 engineers in a room for a week or two, to set a proper direction. Android could have great security in a large set of phones inside of 18-24 months, with the right management.
Sigh.
- tadfisher 10y agoWhile I agree with you, they do in fact have hardware-backed key storage these days; it's just only available (and reliably useful) in recent Android versions (namely those devices with fingerprint sensors). Since we're on the subject, OP was talking about a perceived vulnerability with rooted Android devices. I highly suspect that even a decent secure enclave solution would warrant some skepticism if the system around it is wide open. For example, timing attacks or even plotting voltage draw on an oscilloscope could leak some key information. If you're rooting your device anyway, you should probably invest in a hardware security key.
- kuschku 10y agoDepends on where you live. If you assume that the US government is not trustworthy, and a possible enemy of you (possible if you're a journalist in these days), then an unrooted phone might be less trustworthy than a rooted one with custom software (such as a custom build of CooperheadOS)
- tornadoboy55 10y agoOr just use an iPhone. The amount of marketshare Apple would lose if there was even a hint of a US-intelligence backdoor in their systems keeps them with a very, very vested interest to actively fight that.
- Godel_unicode 10y ago> Solve the technical issues by getting the right 20 engineers in a room for a week or two Oh man, I haven't laughed that hard in a while.
- hvidgaard 10y agoWhat do you mean we cannot fix the human factor?