4 ms·

If you are using the phone for work, you shouldn't be opening up access to a local admin account. Rooting/jailbreaking is a double edged sword. You get more con

by moftz 10y ago

If you are using the phone for work, you shouldn't be opening up access to a local admin account. Rooting/jailbreaking is a double edged sword. You get more control over the device but you also open up access to malicious applications. Just because you may be smart enough to run a rooted phone without compromising it, doesn't mean everyone else is capable. Keeping the phone locked down can greatly help prevent intrusions and otherwise unwanted code from running. You can do a lot more damage as root than you can as a user. You were given that device to do work on, not take apart and do whatever you wish with it. If you want your own dev device, buy your own phone. I see plenty of coworkers who carry around two devices each day. Companies that lock down the employee computers to only allow whitelisted applications to run deal with a lot less reimaging and malware cleaning that those that give local admin access to the employee. It does result in employees having to request installation of things outside the standard core software but it still takes less time than dealing with typical malware.

problems 10y ago
> If you are using the phone for work, you shouldn't be opening up access to a local admin account. Rooting/jailbreaking is a double edged sword. You get more control over the device but you also open up access to malicious applications. It only "opens up access" to applications I allow explicitly. And I run things like XPrivacy which allow me to hook privacy compromising applications. In reality it's much better for security to be rooted if you know what you're doing. It's only a problem if you're allowing root for say, random games you download... and I don't think many people are doing that. Generally if you're rooted or jailbroken, you know what you're doing.
- Bjartr 10y ago
  > if you know what you're doing And if you don't, it's potentially much worse security. If your device is rooted, that's an attack vector that didn't previously exist. Since this tool is about informing and not enforcing, then if you really do know what you're doing then you can choose to take no action. If, however, you're not aware of the risks rooting a device exposes you too, then the tool provides an opportunity to learn that. Further, this tool wasn't made with protecting an individual so much as protecting an organization. Yeah, you know what you're doing, but are you willing to bet your organization's security on that being true for everyone now and in the future? One compromised device can be all it takes for an attacker to get in. Not everyone who roots really knows what they're doing, it's very easy to root some phones, a quick download on a PC, run an app, click a button, and tada! Also, what about the non-techie person that asks their tech-savvy friend to root because they want to be able to <any single one of the things rooting allows>? Do you trust the judgement of every person tech-savvy enough to do this to never root another's phone without them really understanding the consequences? </rambling>
  - problems 10y ago
    Rooting a device doesn't immediately expose you to risk, you must manually allow that. There's very little malware around if you stick to the standard app stores like most users will too. Ads that push malware - a major problem on Windows - practically don't exist on mobile because the impact would be so small. Especially if they're trying to target only rooted users. Phones don't seem to be very popular attack vectors and many main attack methods could be performed without the need to root the device at all. All in all, I'd be very surprised if rooting a device ever resulted in a significant compromise which couldn't have been done without root. Exploitation excluded obviously.

by moftz 10y ago

problems 10y ago

> If you are using the phone for work, you shouldn't be opening up access to a local admin account. Rooting/jailbreaking is a double edged sword. You get more control over the device but you also open up access to malicious applications. It only "opens up access" to applications I allow explicitly. And I run things like XPrivacy which allow me to hook privacy compromising applications. In reality it's much better for security to be rooted if you know what you're doing. It's only a problem if you're allowing root for say, random games you download... and I don't think many people are doing that. Generally if you're rooted or jailbroken, you know what you're doing.

Bjartr 10y ago
> if you know what you're doing And if you don't, it's potentially much worse security. If your device is rooted, that's an attack vector that didn't previously exist. Since this tool is about informing and not enforcing, then if you really do know what you're doing then you can choose to take no action. If, however, you're not aware of the risks rooting a device exposes you too, then the tool provides an opportunity to learn that. Further, this tool wasn't made with protecting an individual so much as protecting an organization. Yeah, you know what you're doing, but are you willing to bet your organization's security on that being true for everyone now and in the future? One compromised device can be all it takes for an attacker to get in. Not everyone who roots really knows what they're doing, it's very easy to root some phones, a quick download on a PC, run an app, click a button, and tada! Also, what about the non-techie person that asks their tech-savvy friend to root because they want to be able to <any single one of the things rooting allows>? Do you trust the judgement of every person tech-savvy enough to do this to never root another's phone without them really understanding the consequences? </rambling>
- problems 10y ago
  Rooting a device doesn't immediately expose you to risk, you must manually allow that. There's very little malware around if you stick to the standard app stores like most users will too. Ads that push malware - a major problem on Windows - practically don't exist on mobile because the impact would be so small. Especially if they're trying to target only rooted users. Phones don't seem to be very popular attack vectors and many main attack methods could be performed without the need to root the device at all. All in all, I'd be very surprised if rooting a device ever resulted in a significant compromise which couldn't have been done without root. Exploitation excluded obviously.