5 ms·

Different people want different things. I can't use iOS because it doesn't meet my needs: T9 Dialer, Homescreen customization, Guest mode/Multiuser (not Guided

by jeswin 7y ago

Different people want different things. I can't use iOS because it doesn't meet my needs: T9 Dialer, Homescreen customization, Guest mode/Multiuser (not Guided Access), better notifications, real Firefox, better multi-tasking etc. Add: I also think it's unfair to compare the security capabilities of a handful of Apple phones with the countless Android phones out there. People have the option of buying Android phones from Google, which have comparable security guarantees as any iOS device (while allowing root access to people who actually desire that).

floatingatoll 7y ago
If it can be rooted by you, it can be rooted by someone close to you, at which point it can be modified to install competent spyware tooling that hides that it’s rooted. Women who have been stalked by their exes will be quite familiar with the risk this poses. So will people who need Tor Browser to keep them safe from their governments. I’d accept this as fine if I had to order it rooted from Google in hardware, so that the bootloader could show an unskippable “This is a rooted device and lacks critical security protections against malware attacks” warning. Sadly, that’s not currently on offer. While your needs are legitimate, offering rooting in software on consumer-facing devices is more dangerous than they can afford. To me, the harm that comes to others isn’t worth it.
- readams 7y ago
  Rooting your phone wipes the data on it. It's actually a very secure model and preserves the user choice.
  - floatingatoll 7y ago
    What does that have to do with whether or not the bootloader shows a clear and obvious warning of danger?
    - theamk 7y ago
      It means it cannot be secretly "rooted by someone close to you", or any one else for that matter. If you grab your phone one day, and it is completely wiped, you will notice this right away. At this point, you can investigate -- this can be as simple as looking at screen during the boot; or non-trivial key combo, as Samsung requires [0]. If indicator shows non-tripped, you can be sure the phone is not rooted. I agree that this is more complex than Apple, but in practice, it never happens -- I had a few phones slowly fail on me, and they never spontaneously self-wiped. So if your non-technical relative wants to get Android phone, just tell them: "Phone suddenly forgetting every single account is VERY BAD and a sign of EVIL HACKERS. If this happens, call me right right away from a landline, do not use this phone at all". And they will be as secure as if they had Apple. [0] https://support.samsungknox.com/hc/en-us/articles/115013562087-What-is-a-Knox-Warranty-Bit-and-how-is-it-triggered- https://support.samsungknox.com/hc/en-us/articles/1150135620...
      - floatingatoll 7y ago
        I used to regularly backup and restore an Android phone after rooting it, because I was updating carrier files and testing out different releases. I’m sure that the capability to take a backup and restore it is available to spyware software developers. If I have competent software in-hand to use the root access to copy over non-HSM internals, then this argument is void. And for non-technical folks, the same spyware devices that police use to make perfect replicas could just as easily restore them with a spyware infection. They’d lose HSM-stored things like fingerprints and NFC payment tokens, but people shrug off things like that and just go set it up again or enter their passwords when a pop up appears. If this Knox throws up an unavoidable, non-technical warning in that scenario, that openly cautions them not to enter any passwords and to take their phone to the authorities, then I will happily accept that things are better than I expected for Android today.
        Dylan16807 7y ago
        Huh. The last time I tried to take a normal backup and restore it, it got less than half the apps. I absolutely depend on Titanium Backup and without it I have to reinstall everything.
- maxsilver 7y ago
  > I'd accept this as fine if the bootloader could show an unskippable “This is a rooted device and lacks critical security protections against malware attacks” warning. Sadly, that's not currently on offer. It is on offer, that is already how Android rooting works on most phones (at least, every Nexus, Motorola, HTC, and LG I've used already does this). You already get that warning you requested and your phone shows some sort of "unlocked" icon on every single startup to remind you your phone has been rooted and your phone auto-wipes all data itself before unlocking too. Screenshot of the warning message (Motorola) -> http://androidadvices.com/wp-content/uploads/2014/11/unlockedbootloader_320-1024x1024.png http://androidadvices.com/wp-content/uploads/2014/11/unlocke... Screenshot of the warning message (HTC) -> https://img.xda-cdn.com/zgUZzE19yICj6wdJm--RJopG_-U=/http%3A%2F%2Fwww.htcdev.com%2Fimages%2Fuploads%2Fbootloader%2Fstep13.jpg https://img.xda-cdn.com/zgUZzE19yICj6wdJm--RJopG_-U=/http%3A... Screenshot of the every-single-boot reminder icon (Google/Nexus) -> https://fscl01.fonpit.de/userfiles/4774964/image/AndroidPIT-Nexus-5-boot-unlocked-w628.JPG https://fscl01.fonpit.de/userfiles/4774964/image/AndroidPIT-... We can argue over the particular clarity of the wording and icons and such. But generally speaking, the functionality you are asking for has already been Android standard default for many years now.
  - floatingatoll 7y ago
    The Motorola one is partially acceptable. I had no idea, thank you! It’s unfortunate they fail to mention the threat of spyware, since that would make more sense to a typical consumer than “you’ll shoot your eye out, kid” as shown here. More work to do here, Motorola. Do all manufacturers offer that sort of clear warning text, or just Motorola? The unlock icon alone is meaningless.
    - cannonedhamster 7y ago
      Samsung phones also warn you if there security features of Knox (their security platform) have been bypassed or turned off in red letters at boot.
      - floatingatoll 7y ago
- lone_haxx0r 7y ago
  If they can root it, then they: (1) Have physical control of the device AND (2) Have the OS-level password. So, you're pwned anyway, it doesn't matter that your phone is unrootable.
  - deleted 7y ago
    [deleted]
  - floatingatoll 7y ago
    It does, because the only way to infect an iOS device is to install a profile, which is immediately apparent upon a three tap inspection, and can be then removed with no technical skills at all. However - in light of the Motorola approach I think Apple should forcefully notify users that there are profiles installed at every boot, which will be once a month or so on their usual update cycles. That would be perfect. I’ll open a bug for them now.
- blendergeek 7y ago
  > offering rooting in software on consumer-facing devices is more dangerous than they can afford Mac books have offered "rooting in software" for years and years. And it has not been "more dangerous than [consumers] can afford". > So will people who need Tor Browser to keep them safe from their governments. Remember the Apple vs. FBI saga from a few years ago? There, a "non-rootable" device protected someone (briefly) from a government. But remember, that a "non-rootable" device is actually a device that only the manufacturer and their authorized agents can root. In other words, the device is secure against the user to prevent the user from doing as he pleases and for the manufacturer. This is exactly what a malevolent governement would need to spy on people.

by jeswin 7y ago

floatingatoll 7y ago

If it can be rooted by you, it can be rooted by someone close to you, at which point it can be modified to install competent spyware tooling that hides that it’s rooted. Women who have been stalked by their exes will be quite familiar with the risk this poses. So will people who need Tor Browser to keep them safe from their governments. I’d accept this as fine if I had to order it rooted from Google in hardware, so that the bootloader could show an unskippable “This is a rooted device and lacks critical security protections against malware attacks” warning. Sadly, that’s not currently on offer. While your needs are legitimate, offering rooting in software on consumer-facing devices is more dangerous than they can afford. To me, the harm that comes to others isn’t worth it.

readams 7y ago
Rooting your phone wipes the data on it. It's actually a very secure model and preserves the user choice.
- floatingatoll 7y ago
  What does that have to do with whether or not the bootloader shows a clear and obvious warning of danger?
  - theamk 7y ago
    It means it cannot be secretly "rooted by someone close to you", or any one else for that matter. If you grab your phone one day, and it is completely wiped, you will notice this right away. At this point, you can investigate -- this can be as simple as looking at screen during the boot; or non-trivial key combo, as Samsung requires [0]. If indicator shows non-tripped, you can be sure the phone is not rooted. I agree that this is more complex than Apple, but in practice, it never happens -- I had a few phones slowly fail on me, and they never spontaneously self-wiped. So if your non-technical relative wants to get Android phone, just tell them: "Phone suddenly forgetting every single account is VERY BAD and a sign of EVIL HACKERS. If this happens, call me right right away from a landline, do not use this phone at all". And they will be as secure as if they had Apple. [0] https://support.samsungknox.com/hc/en-us/articles/115013562087-What-is-a-Knox-Warranty-Bit-and-how-is-it-triggered- https://support.samsungknox.com/hc/en-us/articles/1150135620...
    - floatingatoll 7y ago
      I used to regularly backup and restore an Android phone after rooting it, because I was updating carrier files and testing out different releases. I’m sure that the capability to take a backup and restore it is available to spyware software developers. If I have competent software in-hand to use the root access to copy over non-HSM internals, then this argument is void. And for non-technical folks, the same spyware devices that police use to make perfect replicas could just as easily restore them with a spyware infection. They’d lose HSM-stored things like fingerprints and NFC payment tokens, but people shrug off things like that and just go set it up again or enter their passwords when a pop up appears. If this Knox throws up an unavoidable, non-technical warning in that scenario, that openly cautions them not to enter any passwords and to take their phone to the authorities, then I will happily accept that things are better than I expected for Android today.
      - Dylan16807 7y ago
        Huh. The last time I tried to take a normal backup and restore it, it got less than half the apps. I absolutely depend on Titanium Backup and without it I have to reinstall everything.
maxsilver 7y ago
> I'd accept this as fine if the bootloader could show an unskippable “This is a rooted device and lacks critical security protections against malware attacks” warning. Sadly, that's not currently on offer. It is on offer, that is already how Android rooting works on most phones (at least, every Nexus, Motorola, HTC, and LG I've used already does this). You already get that warning you requested and your phone shows some sort of "unlocked" icon on every single startup to remind you your phone has been rooted and your phone auto-wipes all data itself before unlocking too. Screenshot of the warning message (Motorola) -> http://androidadvices.com/wp-content/uploads/2014/11/unlockedbootloader_320-1024x1024.png http://androidadvices.com/wp-content/uploads/2014/11/unlocke... Screenshot of the warning message (HTC) -> https://img.xda-cdn.com/zgUZzE19yICj6wdJm--RJopG_-U=/http%3A%2F%2Fwww.htcdev.com%2Fimages%2Fuploads%2Fbootloader%2Fstep13.jpg https://img.xda-cdn.com/zgUZzE19yICj6wdJm--RJopG_-U=/http%3A... Screenshot of the every-single-boot reminder icon (Google/Nexus) -> https://fscl01.fonpit.de/userfiles/4774964/image/AndroidPIT-Nexus-5-boot-unlocked-w628.JPG https://fscl01.fonpit.de/userfiles/4774964/image/AndroidPIT-... We can argue over the particular clarity of the wording and icons and such. But generally speaking, the functionality you are asking for has already been Android standard default for many years now.
- floatingatoll 7y ago
  The Motorola one is partially acceptable. I had no idea, thank you! It’s unfortunate they fail to mention the threat of spyware, since that would make more sense to a typical consumer than “you’ll shoot your eye out, kid” as shown here. More work to do here, Motorola. Do all manufacturers offer that sort of clear warning text, or just Motorola? The unlock icon alone is meaningless.
  - cannonedhamster 7y ago
    Samsung phones also warn you if there security features of Knox (their security platform) have been bypassed or turned off in red letters at boot.
    - floatingatoll 7y ago
lone_haxx0r 7y ago
If they can root it, then they: (1) Have physical control of the device AND (2) Have the OS-level password. So, you're pwned anyway, it doesn't matter that your phone is unrootable.
- deleted 7y ago
  [deleted]
- floatingatoll 7y ago
  It does, because the only way to infect an iOS device is to install a profile, which is immediately apparent upon a three tap inspection, and can be then removed with no technical skills at all. However - in light of the Motorola approach I think Apple should forcefully notify users that there are profiles installed at every boot, which will be once a month or so on their usual update cycles. That would be perfect. I’ll open a bug for them now.
blendergeek 7y ago
> offering rooting in software on consumer-facing devices is more dangerous than they can afford Mac books have offered "rooting in software" for years and years. And it has not been "more dangerous than [consumers] can afford". > So will people who need Tor Browser to keep them safe from their governments. Remember the Apple vs. FBI saga from a few years ago? There, a "non-rootable" device protected someone (briefly) from a government. But remember, that a "non-rootable" device is actually a device that only the manufacturer and their authorized agents can root. In other words, the device is secure against the user to prevent the user from doing as he pleases and for the manufacturer. This is exactly what a malevolent governement would need to spy on people.