9 ms·

Security, basically. If you care about your privacy, you should care about security (can't have one with the other). You need updated phone for that.

inetknght 9y ago
On the other hand, if you care about privacy, then not updating your apps often helps too. Damned if you do, damned if you don't.
- johndoe90 9y ago
  I think if you update often enough (at least when some vulnerabilities found), you're more safe than if you don't.
  - fian 9y ago
    Except many times the update will ask to expand its access to information in your phone it shouldn't need. So you choose between explicitly granting permission for unnecessary data access or don't update and hope you don't get owned via a vulnerability in that app.
    - BEEdwards 9y ago
      So instead of finding someway to block or spoof a developer telling you they need different permissions, you'll wait around until some hacker breaks into your shit feeling like you beat the system?
      - inetknght 9y ago
        In an imperfect system, you end up with imperfect solutions. This is a tradeoff. Do I accept the developer demanding access they do not truly need, or do I accept the risk of a hacker gaining access to my phone through the developer's application? If a hacker gains access to my phone through the developer's application, what do they gain access to? At the maximum (hopefully! unless they springboard to another hack and pwn your whole phone or other applications) they have what the application has access to. Attack surface management is a lot more complex than just "always stay on the most latest shitware that the developer can shove down your throat"
    - khedoros1 9y ago
      Those are the apps that I remove from my phone. Holding my security hostage to get at more data? Deleted.
kuschku 9y ago
Well, that's not a real issue, is it? It's purely a decision from the manufacturers to be assholes to their customers. There is no technical need that'd prevent them from creating updates. Especially Samsung (which also produces the SoC in-house for all relevant markets).
- scarface74 9y ago
  Hmm. It's all Google's fault. I don't have to wait for the manufacturer to update my Windows PC. Heck I was able to install Windows 7 on a Mac Mini without any support from Apple. Not to mention I updated a 9 year old Dell Core 2 Duo to Windows 10.
  - kuschku 9y ago
    Windows has mostly kept a stable driver API. And whenever they broke that API, that actually happened — suddenly updates stopped being usable by your system. Also, be aware that ARM has nothing to enumerate devices, has no BISO or UEFI. An OS image will only ever work on a single device. As I detailed in another comment in this thread, the issue is this collision of the Linux concept of mainlining everything, short support windows, manufacturers that can't update drivers for every microchip they sell all the time, and Google and OEMs somewhere in there. It's always been a clusterfuck, Google didn't create it, but they sure made it worse.
    - colejohnson66 9y ago
      > Also, be aware that ARM has nothing to enumerate devices, ... Isn’t that the purpose of a device tree?
      - kuschku 9y ago
        Basically yes, but that's often not good enough either. Lots of third party code OEMs end up with in their kernels, unmaintainable, and often incompatible with anything.
userbinator 9y ago
I have a rooted device, so I can basically make apps do what I want and stop them from doing what I don't want. IMHO that's far better than Google's vision of "security" where they want to be in control and even consider the user an attacker.
- scarface74 9y ago
  How much of a solution is rooting a device for 1 billion users?
  - realusername 9y ago
    I think every device should ship with root by default, it's the case for computers, I don't see why phones would be any different.
    - jiggunjer 9y ago
      Because computers don't come with an app store that contains tonnes of crapware. Even if they did, people would install a smaller variety of apps.
  - khedoros1 9y ago
    Probably more feasible for some of them than buying a new phone, at least.
  - pantalaimon 9y ago
    I see phone repair shops at every street corner, I don't see why they could not offer this as a service.
- EpicEng 9y ago
  Yeah why didn't I remember to tell my mom to just root her phone? I'm sure that will work out well for both of us.
jsight 9y ago
Security isn't as big of an issue with many of these devices as you might think. Unless it is years out of date, Play Services still gets updates, the system web view still gets updated, Chrome still gets updates, and in many cases the vendor will still roll out an emergency patch if there is something serious.
- tibu 9y ago
  - Bluetooth driver does not get an update - SSL is not updated - kernel is not updated
- acdha 9y ago
  That's a huge guessing game, though - remember StageFright? You could have a phone with an up to date Chrome, up to date Play Services, and still be trivially exploited simply by viewing a standard video file. (Not to mention wondering which of your apps uses an out of date embedded web view) I would submit that the number of people qualified to safely make (and update) that risk assessment is extremely small, and all of them would recommend updating to a version which patches problems rather than hoping you can dance around them.
  - jsight 9y ago
    StageFright was patched on a LOT of devices that "no longer received updates". The concern with embedded web views is overrated, as Android actually updates those via Play Services now. For all of the talk of how awful this is, actual exploits are almost unheard of.
- Feniks 9y ago
  Whether or not security is important depends on what you do with your phone. I don't use my phone for banking or payments and there are no compromising pictures or dangerous files on it. I don't have a pressing need for Android's latest security update.
kelnos 9y ago
That shouldn't be the trade-off, though. I think your average smartphone owner doesn't understand all this anyway. They look at their 3-year-old phone and say "it works fine and does what I need it to do", look at the new ones on the market and say "I don't see anything compelling there to justify that price tag", and so they don't buy a new phone. Most people don't realize that their phone has gaping security holes in it that will never be addressed.
- ReverseCold 9y ago
  > That shouldn't be the trade-off Right, but it is the tradeoff. Of course it shouldn't be, but unfortunately it is.
gonzo41 9y ago
Not having a smart phone is probably up there with being serious about security.
- fnl 9y ago
  Fully agreed. Running a smartphone and worrying about its security seems at odds. Rather, we should treat our "phablets" like public, insecure terminals, with "spy" sensors anyone can access given sufficient effort.
- Paianni 9y ago
  I think you mean not using mobile internet through cellular or Wi-Fi networks is being serious about security.

inetknght 9y ago

On the other hand, if you care about privacy, then not updating your apps often helps too. Damned if you do, damned if you don't.

johndoe90 9y ago
I think if you update often enough (at least when some vulnerabilities found), you're more safe than if you don't.
- fian 9y ago
  Except many times the update will ask to expand its access to information in your phone it shouldn't need. So you choose between explicitly granting permission for unnecessary data access or don't update and hope you don't get owned via a vulnerability in that app.
  - BEEdwards 9y ago
    So instead of finding someway to block or spoof a developer telling you they need different permissions, you'll wait around until some hacker breaks into your shit feeling like you beat the system?
    - inetknght 9y ago
      In an imperfect system, you end up with imperfect solutions. This is a tradeoff. Do I accept the developer demanding access they do not truly need, or do I accept the risk of a hacker gaining access to my phone through the developer's application? If a hacker gains access to my phone through the developer's application, what do they gain access to? At the maximum (hopefully! unless they springboard to another hack and pwn your whole phone or other applications) they have what the application has access to. Attack surface management is a lot more complex than just "always stay on the most latest shitware that the developer can shove down your throat"
  - khedoros1 9y ago
    Those are the apps that I remove from my phone. Holding my security hostage to get at more data? Deleted.

kuschku 9y ago

Well, that's not a real issue, is it? It's purely a decision from the manufacturers to be assholes to their customers. There is no technical need that'd prevent them from creating updates. Especially Samsung (which also produces the SoC in-house for all relevant markets).

scarface74 9y ago
Hmm. It's all Google's fault. I don't have to wait for the manufacturer to update my Windows PC. Heck I was able to install Windows 7 on a Mac Mini without any support from Apple. Not to mention I updated a 9 year old Dell Core 2 Duo to Windows 10.
- kuschku 9y ago
  Windows has mostly kept a stable driver API. And whenever they broke that API, that actually happened — suddenly updates stopped being usable by your system. Also, be aware that ARM has nothing to enumerate devices, has no BISO or UEFI. An OS image will only ever work on a single device. As I detailed in another comment in this thread, the issue is this collision of the Linux concept of mainlining everything, short support windows, manufacturers that can't update drivers for every microchip they sell all the time, and Google and OEMs somewhere in there. It's always been a clusterfuck, Google didn't create it, but they sure made it worse.
  - colejohnson66 9y ago
    > Also, be aware that ARM has nothing to enumerate devices, ... Isn’t that the purpose of a device tree?
    - kuschku 9y ago
      Basically yes, but that's often not good enough either. Lots of third party code OEMs end up with in their kernels, unmaintainable, and often incompatible with anything.

userbinator 9y ago

I have a rooted device, so I can basically make apps do what I want and stop them from doing what I don't want. IMHO that's far better than Google's vision of "security" where they want to be in control and even consider the user an attacker.

scarface74 9y ago
How much of a solution is rooting a device for 1 billion users?
- realusername 9y ago
  I think every device should ship with root by default, it's the case for computers, I don't see why phones would be any different.
  - jiggunjer 9y ago
    Because computers don't come with an app store that contains tonnes of crapware. Even if they did, people would install a smaller variety of apps.
- khedoros1 9y ago
  Probably more feasible for some of them than buying a new phone, at least.
- pantalaimon 9y ago
  I see phone repair shops at every street corner, I don't see why they could not offer this as a service.
EpicEng 9y ago
Yeah why didn't I remember to tell my mom to just root her phone? I'm sure that will work out well for both of us.

jsight 9y ago

Security isn't as big of an issue with many of these devices as you might think. Unless it is years out of date, Play Services still gets updates, the system web view still gets updated, Chrome still gets updates, and in many cases the vendor will still roll out an emergency patch if there is something serious.

tibu 9y ago
- Bluetooth driver does not get an update - SSL is not updated - kernel is not updated
acdha 9y ago
That's a huge guessing game, though - remember StageFright? You could have a phone with an up to date Chrome, up to date Play Services, and still be trivially exploited simply by viewing a standard video file. (Not to mention wondering which of your apps uses an out of date embedded web view) I would submit that the number of people qualified to safely make (and update) that risk assessment is extremely small, and all of them would recommend updating to a version which patches problems rather than hoping you can dance around them.
- jsight 9y ago
  StageFright was patched on a LOT of devices that "no longer received updates". The concern with embedded web views is overrated, as Android actually updates those via Play Services now. For all of the talk of how awful this is, actual exploits are almost unheard of.
Feniks 9y ago
Whether or not security is important depends on what you do with your phone. I don't use my phone for banking or payments and there are no compromising pictures or dangerous files on it. I don't have a pressing need for Android's latest security update.

kelnos 9y ago

That shouldn't be the trade-off, though. I think your average smartphone owner doesn't understand all this anyway. They look at their 3-year-old phone and say "it works fine and does what I need it to do", look at the new ones on the market and say "I don't see anything compelling there to justify that price tag", and so they don't buy a new phone. Most people don't realize that their phone has gaping security holes in it that will never be addressed.

ReverseCold 9y ago
> That shouldn't be the trade-off Right, but it is the tradeoff. Of course it shouldn't be, but unfortunately it is.

gonzo41 9y ago

Not having a smart phone is probably up there with being serious about security.

fnl 9y ago
Fully agreed. Running a smartphone and worrying about its security seems at odds. Rather, we should treat our "phablets" like public, insecure terminals, with "spy" sensors anyone can access given sufficient effort.
Paianni 9y ago
I think you mean not using mobile internet through cellular or Wi-Fi networks is being serious about security.