5 ms·

> do think it will happen, however. The use case involves corporations, especially those involved in privacy sensitive fields such as health care. Wouldn’t it

> do think it will happen, however. The use case involves corporations, especially those involved in privacy sensitive fields such as health care. Wouldn’t it be cool to have a locked down “business” VM that is separate from a “personal” VM with your Facebook, games and private stuff on it. This already exists for businesses with Samsung Knox / Android for Business. No it's not a full OS but it fits all of their needs and separates data. Having one OS in a "vm" on a phone sounds horrible UX wise.

mintplant 9y ago
I'm a big fan of the "Island" app [0], which lets you set up a locally-administered Android for Work profile. It's great for, say, cloning a second copy of a messaging app for an alternate account. [0] https://forum.xda-developers.com/android/apps-games/closed-beta-test-incoming-companion-app-t3366295 https://forum.xda-developers.com/android/apps-games/closed-b...
- billpollock 9y ago
  Interesting. A step beyond Xposed and Xprivacy.
- mtgx 9y ago
  It's too bad Google itself only allows you to do that with a Gmail for Business account. I had to use a profile for my banking app to isolate it from all my personal apps, instead. But it seems that Google doesn't' even care that much about the multi-profile functionality, as it seems to crash quite often and has other issues. I imagine they don't put it through a lot of Q&A with each new Android release. Even so, having to change between profiles often just to get that kind of isolation is quite frustrating.
chisleu 9y ago
> Having one OS in a "vm" on a phone sounds horrible UX wise I believe most android people are doing this with users. Since Android is now up to the task of docker (kernel 3.10+), it would be very nice to see apps sandboxed with permissions exposed via networked APIs. Then it is impossible for an app (sans exploit) to access private data, and simple for the OS to route certain apps to certain data sets (ie, fake contacts for apps that shouldn't need your damn contact to begin with). CyanogenMod accomplished some of this through various methods, but they were detectable. If you build it this way, it should be entirely undetectable.
- floren 9y ago
  I had considered trying something like this with Hellaphone (Inferno as a replacement for Android's Java components). Because the Inferno VM is so lightweight (startup took less than a second once you were out of the bootloader), you could easily run one whole VM per application. Then just make some sort of multiplexer to swap between which VM has screen access at any one time. 9P would make a rather straightforward way to provide services for applications, too.
- izacus 9y ago
  How would your solution improve on current one, where apps are sandboxed by the permissions system and communicate via Binder which is also RPC based? You just added bunch of layers to architecture for no reason - none of serious Android exploits in years would be mitigated by your approach.
  - chisleu 9y ago
    > You just added bunch of layers to architecture for no reason The sandbox doesn't do the isolation that docker can. It uses user isolation like I mentioned. The difference is that Binder is Java on top of the kernel, while docker is isolating from the kernel itself. Without access to the service, it is impossible, sans-kernel-exploit, to escape the permissions jail, or even tell if you are in a permissions jail if someone gives your app fake contact information by routing it to a different service. Docker isn't perfect. It had a serious CVE recently. I'm certainly not saying it is absolutely better. I'm just saying that I think they are fundamentally different and that process level isolation is superior to user level isolation.
    - izacus 9y ago
      Sure, but none of serious Android exploits had anything to do with escaping from the sandbox. They were mostly in driver and HW acceleration layers, which can't be sandboxed due to performance and DRM reasons.
bhnmmhmd 9y ago
Sometimes I don't understand all the hatred toward Google having our data on their servers. Most alternative solutions offer fragmented services (as opposed to the all-in-one experience I get with Google) and are too cumbersome to setup. Yes, I know data is sort of power these days. But before bashing at Google/Apple/Microsoft... and banning their services, people should ask themselves: "What sacrifices are they making and for what?" I mean, I would totally feel convenient when my contacts are synced on my devices and I get a unified experience. Google knowing about my contacts is just the price I pay to get that service and honestly, from my experience, it's better for Google to have my data because they keep adjusting the service I get in return.
- kbenson 9y ago
  It's the competing incentives of a company that provides data services to end-user customers and a company that mines as much information about people to sell advertising to companies. Without strong controls about what they can do, we are always at the whim of what they might do. Google feels like a fairly bipolar company from the outside, because they present two faces depending on who they are dealing with, end-users or companies looking to advertise. As an end-user, Google knowing all the little details about everything I do and many places I go (because analytics JS, G+ button inclusion, etc) is disconcerting. For a company looking to advertise, them not doing this all of a sudden would be disconcerting, and they would probably look to some other company that is doing so. It isn't just Google. Facebook knows a startlingly large amount about you too. I'm increasingly convinced this is one of those places where the market is failing us because the negative externalities are mostly hidden. Those are good places for targeted regulation. I wouldn't be entirely appeased, but a law about the ability to review all information collected about you from a company and strong controls about the access, sale and use of this information would go a long way towards making me less worried about Google (or whoever) changing quite a bit in the next decade and selling off the information.[1] Because think about it, how far away are Google, Facebook and the umpteen other ad agencies with complex profiles of you from usurping the credit bureaus? 1: Maybe what we need is an interesting billionaire to buy a lot of personal information on all the U.S. politicians from one of the less public agencies and publish it. I'm sure we would get a law passed in record time.
Tijdreiziger 9y ago
Doesn't Android for Work also handle this without being tied to Samsung?

mintplant 9y ago

I'm a big fan of the "Island" app [0], which lets you set up a locally-administered Android for Work profile. It's great for, say, cloning a second copy of a messaging app for an alternate account. [0] https://forum.xda-developers.com/android/apps-games/closed-beta-test-incoming-companion-app-t3366295 https://forum.xda-developers.com/android/apps-games/closed-b...

billpollock 9y ago
Interesting. A step beyond Xposed and Xprivacy.
mtgx 9y ago
It's too bad Google itself only allows you to do that with a Gmail for Business account. I had to use a profile for my banking app to isolate it from all my personal apps, instead. But it seems that Google doesn't' even care that much about the multi-profile functionality, as it seems to crash quite often and has other issues. I imagine they don't put it through a lot of Q&A with each new Android release. Even so, having to change between profiles often just to get that kind of isolation is quite frustrating.

chisleu 9y ago

> Having one OS in a "vm" on a phone sounds horrible UX wise I believe most android people are doing this with users. Since Android is now up to the task of docker (kernel 3.10+), it would be very nice to see apps sandboxed with permissions exposed via networked APIs. Then it is impossible for an app (sans exploit) to access private data, and simple for the OS to route certain apps to certain data sets (ie, fake contacts for apps that shouldn't need your damn contact to begin with). CyanogenMod accomplished some of this through various methods, but they were detectable. If you build it this way, it should be entirely undetectable.

floren 9y ago
I had considered trying something like this with Hellaphone (Inferno as a replacement for Android's Java components). Because the Inferno VM is so lightweight (startup took less than a second once you were out of the bootloader), you could easily run one whole VM per application. Then just make some sort of multiplexer to swap between which VM has screen access at any one time. 9P would make a rather straightforward way to provide services for applications, too.
izacus 9y ago
How would your solution improve on current one, where apps are sandboxed by the permissions system and communicate via Binder which is also RPC based? You just added bunch of layers to architecture for no reason - none of serious Android exploits in years would be mitigated by your approach.
- chisleu 9y ago
  > You just added bunch of layers to architecture for no reason The sandbox doesn't do the isolation that docker can. It uses user isolation like I mentioned. The difference is that Binder is Java on top of the kernel, while docker is isolating from the kernel itself. Without access to the service, it is impossible, sans-kernel-exploit, to escape the permissions jail, or even tell if you are in a permissions jail if someone gives your app fake contact information by routing it to a different service. Docker isn't perfect. It had a serious CVE recently. I'm certainly not saying it is absolutely better. I'm just saying that I think they are fundamentally different and that process level isolation is superior to user level isolation.
  - izacus 9y ago
    Sure, but none of serious Android exploits had anything to do with escaping from the sandbox. They were mostly in driver and HW acceleration layers, which can't be sandboxed due to performance and DRM reasons.

bhnmmhmd 9y ago

Sometimes I don't understand all the hatred toward Google having our data on their servers. Most alternative solutions offer fragmented services (as opposed to the all-in-one experience I get with Google) and are too cumbersome to setup. Yes, I know data is sort of power these days. But before bashing at Google/Apple/Microsoft... and banning their services, people should ask themselves: "What sacrifices are they making and for what?" I mean, I would totally feel convenient when my contacts are synced on my devices and I get a unified experience. Google knowing about my contacts is just the price I pay to get that service and honestly, from my experience, it's better for Google to have my data because they keep adjusting the service I get in return.

kbenson 9y ago
It's the competing incentives of a company that provides data services to end-user customers and a company that mines as much information about people to sell advertising to companies. Without strong controls about what they can do, we are always at the whim of what they might do. Google feels like a fairly bipolar company from the outside, because they present two faces depending on who they are dealing with, end-users or companies looking to advertise. As an end-user, Google knowing all the little details about everything I do and many places I go (because analytics JS, G+ button inclusion, etc) is disconcerting. For a company looking to advertise, them not doing this all of a sudden would be disconcerting, and they would probably look to some other company that is doing so. It isn't just Google. Facebook knows a startlingly large amount about you too. I'm increasingly convinced this is one of those places where the market is failing us because the negative externalities are mostly hidden. Those are good places for targeted regulation. I wouldn't be entirely appeased, but a law about the ability to review all information collected about you from a company and strong controls about the access, sale and use of this information would go a long way towards making me less worried about Google (or whoever) changing quite a bit in the next decade and selling off the information.[1] Because think about it, how far away are Google, Facebook and the umpteen other ad agencies with complex profiles of you from usurping the credit bureaus? 1: Maybe what we need is an interesting billionaire to buy a lot of personal information on all the U.S. politicians from one of the less public agencies and publish it. I'm sure we would get a law passed in record time.

Tijdreiziger 9y ago

Doesn't Android for Work also handle this without being tied to Samsung?