5 ms·

Android: unsafe at any speed, apparently.

tptacek 9y ago
Specialists with carefully chosen phones can achieve security that is asymptotically as good as a recent iPhone. We can spare ourselves the world's dumbest HN thread if we stipulate that by far the largest problem with Android is that it means a zillion different things. Campaign workers (or NGO employees) with "Android phones" are people that have every conceivable random phone that happens to be running some variant of Android.
- arca_vorago 9y ago
  Not to mention even with a better android OS (I've finally switched to lineage from cyagenomod) is the thousand random applications users install. The best thing iOS and the Foss androids did was give more granular app permission control. In general my suggestion is people uninstall every app they don't "need" and to pay carefully attention to permissions. Even when I was an iOS user, all I needed was a terminal, from ssh, emacs, gnus, screen, etc.
- marcoperaza 9y ago
  >Specialists with carefully chosen phones can achieve security that is asymptotically as good as a recent iPhone. Who cares? Security conditional on expertise, extraordinary caution, and time investment is WORTHLESS. Security is more about guiding (or forcing) human beings to the right behavior than it is about making technical mechanisms available for the willing and able. Your security model should assume that the user is stupid, grossly negligent, and in the case they are the employee or other agent of an organization, somewhat hostile to the interests of the organization.
  - idlewords 9y ago
    I believe tqbf is just trying to head off unproductive Android vs. iOS arguments, and agrees with you.
- ameliaquining 9y ago
  The security advice I give the non-tech people in my life is to get either an iPhone or a Pixel (or older phone made by Google). Is there any reason this isn't good enough? I vaguely recall that recent iPhones have a few useful crypto features that the Pixel still doesn't, but I'm not sure how much of a difference this makes. Certainly, I view the update situation as the primary reason not to use third-party Android phones, and the Pixel doesn't have that problem.
  - tptacek 9y ago
    Yes, there are reasons that's not good enough. It's not simply that you have to be careful what phone you pick, but also that you have to do things differently on Android phones, including Google's phones. At-risk nonspecialists should avoid all Android phones, and standardize on iPhones.
    - Anderkent 9y ago
      I'd be very interested in reading a longer-form blog / comment on this, if you ever feel like writing one.
- Bromskloss 9y ago
  > We can spare ourselves the world's dumbest HN thread if we stipulate that by far the largest problem with Android is that it means a zillion different things. Does that mean that there are other specific Android phones that one could have required instead? Or are you keeping silent about the real reason?

Specialists with carefully chosen phones can achieve security that is asymptotically as good as a recent iPhone. We can spare ourselves the world's dumbest HN thread if we stipulate that by far the largest problem with Android is that it means a zillion different things. Campaign workers (or NGO employees) with "Android phones" are people that have every conceivable random phone that happens to be running some variant of Android.

arca_vorago 9y ago
Not to mention even with a better android OS (I've finally switched to lineage from cyagenomod) is the thousand random applications users install. The best thing iOS and the Foss androids did was give more granular app permission control. In general my suggestion is people uninstall every app they don't "need" and to pay carefully attention to permissions. Even when I was an iOS user, all I needed was a terminal, from ssh, emacs, gnus, screen, etc.
marcoperaza 9y ago
>Specialists with carefully chosen phones can achieve security that is asymptotically as good as a recent iPhone. Who cares? Security conditional on expertise, extraordinary caution, and time investment is WORTHLESS. Security is more about guiding (or forcing) human beings to the right behavior than it is about making technical mechanisms available for the willing and able. Your security model should assume that the user is stupid, grossly negligent, and in the case they are the employee or other agent of an organization, somewhat hostile to the interests of the organization.
- idlewords 9y ago
  I believe tqbf is just trying to head off unproductive Android vs. iOS arguments, and agrees with you.
ameliaquining 9y ago
The security advice I give the non-tech people in my life is to get either an iPhone or a Pixel (or older phone made by Google). Is there any reason this isn't good enough? I vaguely recall that recent iPhones have a few useful crypto features that the Pixel still doesn't, but I'm not sure how much of a difference this makes. Certainly, I view the update situation as the primary reason not to use third-party Android phones, and the Pixel doesn't have that problem.
- tptacek 9y ago
  Yes, there are reasons that's not good enough. It's not simply that you have to be careful what phone you pick, but also that you have to do things differently on Android phones, including Google's phones. At-risk nonspecialists should avoid all Android phones, and standardize on iPhones.
  - Anderkent 9y ago
    I'd be very interested in reading a longer-form blog / comment on this, if you ever feel like writing one.
Bromskloss 9y ago
> We can spare ourselves the world's dumbest HN thread if we stipulate that by far the largest problem with Android is that it means a zillion different things. Does that mean that there are other specific Android phones that one could have required instead? Or are you keeping silent about the real reason?