7 ms·

Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

81 points by kerng 7y ago

kinow 7y ago
>The top changes include "scoped storage" to give users more control over files by only allowing Android 10 apps a filtered view of their app-specific directory and specific types of media. A great change. I don't mind having to spend some time going over each time, making sure the right settings are in place for security and privacy. The other changes for location and camera access by apps are good too. Just hope the update will include my old-ish device.
saagarjha 7y ago
> Google will now require developers to use resettable identifiers to keep track of users. That way, if these digital fingerprints are ever compromised, or if you want to wipe your digital slate clean, there's a mechanism to do that. Does this mean device fingerprinting will no longer be allowed?
- olliej 7y ago
  Alas not allowed != not happening. Just look at the eternal grindstone Apple has to go through.
- cameronbrown 7y ago
  It's very difficult to prevent fingerprinting. Google's had the Android advertising ID for ages (which is a unique user resettable identifier) but it's entirely possible to ignore it. I'm not sure if Admob does allow you to set your own custom IDs with your own fingerprinting, but preventing that would go a long way.
close04 7y ago
Google is really doubling down on privacy right on the heels of repeated scandals. Wonder if i will last longer than customer's memory of said scandals before they go back to the business model that brings them the money.
- WilTimSon 7y ago
  As long as we get to reap the benefits at least for a bit - I'm happy. Plus, I always find that a bad company/product trying to do better often spurs on superior competitors. WhatsApp has been rubbish for a while now and so better messengers like Wire, Telegram, Signal etc. have appeared. Maybe someone will use Google's new privacy-related advances to improve their service as well.
xchaotic 7y ago
Google fixing vulnerabilities even before the release can only be good news, but one does have to be wonder why a whole class of such vulnerabilities are even allowed after so many releases?
- zsrxx 7y ago
  ...maybe because they were not discovered before or have been introduced recently?
- saagarjha 7y ago
  Because software has bugs?
surak 7y ago
We can still not sandbox apps access to data by default. Numerous academic projects have show how this can be implemented, e.g. by fudging data when details are not needed. Also, in order to get these security fixes I have to buy a new device from one of their partners.. Google has failed society by advancing surveillance capitalism to the extreme.
- Already__Taken 7y ago
  my android one branded Nokia has had a decent amount of updates and my partner's last few Motos. it's getting better for Android slowly
  - surak 7y ago
    Going after a subset of low end devices seems a bit off-putting to me. A-One should be mandatory, but most manufacturers are hooked on adding bloatware to track you.
- panpanna 7y ago
  I don't think you have really used Android lately. 1. Google has added API to access resources without getting full unconditional access 2. They are enforcing use of correct APIs on their store 3. Most of the system is now updated from the store. This is significantly faster than any of their competitors 4. Most vendors are now providing timely security updates. Some even have an Enterprise program with 4-5 years of updates.
  - surak 7y ago
    I use it every day. Regarding P1, if an app ask for permission access to e.g. images or location, and you use the app, how would you limit what the app can send home or even review it? See discussion in the other comments if you're not an Andriod developer.
    - vetinari 7y ago
      Since Android v1, it offers APIs (intents) for picking items belonging to other apps or doing an action on behalf of other apps. Applications do not need access to gallery; they can ask the gallery to let the user pick the pictures he wants to work with; the app does not need the access to camera, it can ask the default camera app to let the user make the photo and get the result. The app does not need access to telephony; it can ask dialer to dial a number on it's behalf. Etc, etc. The developers didn't use these APIs because users were asking for iOS style integrations, where any apps does everything for itself, instead of using system components. So they got it.
ezequiel-garzon 7y ago
Do previous Android versions have these vulnerabilities?
- tssva 7y ago
  The headline is misleading. These vulnerabilities are not in Android 10 but are fixed by Android 10. Which of course means they exist in versions prior to Android 10. Google provides security updates for prior versions so what is not clear from the article is whether these are only fixed by upgrading to Android 10 or whether they were identified during the Android 10 development process but fixes will also be available for prior versions.
  - hn_throwaway_99 7y ago
    > These vulnerabilities are not in Android 10 but are fixed by Android 10. Which of course means they exist in versions prior to Android 10. That's not accurate. Android 10 is still in beta, so many of these vulnerabilities (just like many other bugs you'll see in a beta) are likely new to Android 10, and will be fixed before the final release.
  - HillaryBriss 7y ago
    my take on the headline is that Q fixes vulnerabilities that exist in pre-Q versions. this means that those vulnerabilities are still in effect for the vast majority of current users, and will be for some time since it will take years before Q is actually being run by the majority of android devices. the vulnerabilities are very much alive.
dessant 7y ago
A revocable permission for network access on Android would be a great step towards giving users more control over which apps can transmit their personal data. An entire class of apps could be rendered safe by disallowing network access, especially the ones that do work offline, but are keen to phone home.
- kerng 7y ago
  Right on! Those are the very features that I'm missing! It seems super simple to provide that basic level of control to the end user. I also want shadow/fake address books and location information as a feature.
- llarsson 7y ago
  A cheap Huawei phone I had let me do that, right from its Settings! Now I have to use NetGuard for that (no root required). And this is how I have learned that Google's Calc app apparently wants network access. No thanks!
- ignoramous 7y ago
  This has been possible since Android 8, if not before. You could, per app, from the App Info page: 1. Disallow bg internet access. 2. Disallow fg internet access over wifi. 3. Disallow fg internet access over mobile network. I've been building an app that exposes privacy features like bouncing permissions when apps are in bg (remember AppOps?), firewalling apps by disallowing data usage, setting DNS over TLS to servers that blackhole ads and trackers, show log of network activity, kill bg processes and activities and so on. Hopefully, would be done in a month or so. You could do all of the above, today, but mostly, manually, by navigating through nested menus and what-not. Android 10 would make some parts of what I'm building obsolete, and that's a good thing.
  - deleted 7y ago
    [deleted]
  - dessant 7y ago
    Is it possible that some of the controls for these network permissions you list are not in AOSP, but in a ROM made by the manufacturer of your device? The ones I've seen had a setting only for restricting background data usage.
izacus 7y ago
This headline is grossly misleading - Android 10 has fixed those 193 vulnerabilities. The title as it is, implies they still need to be fixed. This kind of content is usually never worded like this for other products, can the moderators fix it?
- jm4 7y ago
  Another crap Forbes contributor article. The fix is to ban these posts. These articles have basically zero credibility because they are written by ordinary dopes who pay to have their blogs published on forbes.com. There is no fact checking, no verification of the author’s background and expertise, nothing. You pay and get published and people get the impression it’s “news” because of the Forbes name.
  - microcolonel 7y ago
    The writing is extremely clumsy, I had to go to the linked post from Google to find out that the author meant that Android releases will no longer be named after desserts.
  - discreditable 7y ago
    Forbes articles are pretty clickbait. I blocked them in Google News because their headlines are bonkers. It's always a formula like Microsoft issues update warning to 10 gorillion PCs (some super minor problem in the last patch cycle) 10 bazillion Android phones have spyware (some malware app was removed from the play store)
- _asummers 7y ago
  Changing Need --> Needed should be enough.
panpanna 7y ago
Seriously, why is this news? Android 10 is still being worked on, if it was ready it would have been released.
microcolonel 7y ago
The move to a joyless, bland release naming scheme in order to appease a perceived mass of illiterate rubes who somehow care about their Android version but can't read past the name of a dessert... To me it is another signal of the erasure of cultural flavour at the company; the pivot to a base, power-chasing, stifling corporatist death march toward nowhere of interest.
kerng 7y ago
Google refuses to do something about arbitrary network connections, most likely due to their ads business model. Their ads require network connections to work!

81 points by kerng 7y ago

>The top changes include "scoped storage" to give users more control over files by only allowing Android 10 apps a filtered view of their app-specific directory and specific types of media. A great change. I don't mind having to spend some time going over each time, making sure the right settings are in place for security and privacy. The other changes for location and camera access by apps are good too. Just hope the update will include my old-ish device.

saagarjha 7y ago

> Google will now require developers to use resettable identifiers to keep track of users. That way, if these digital fingerprints are ever compromised, or if you want to wipe your digital slate clean, there's a mechanism to do that. Does this mean device fingerprinting will no longer be allowed?

olliej 7y ago
Alas not allowed != not happening. Just look at the eternal grindstone Apple has to go through.
cameronbrown 7y ago
It's very difficult to prevent fingerprinting. Google's had the Android advertising ID for ages (which is a unique user resettable identifier) but it's entirely possible to ignore it. I'm not sure if Admob does allow you to set your own custom IDs with your own fingerprinting, but preventing that would go a long way.

close04 7y ago

Google is really doubling down on privacy right on the heels of repeated scandals. Wonder if i will last longer than customer's memory of said scandals before they go back to the business model that brings them the money.

WilTimSon 7y ago
As long as we get to reap the benefits at least for a bit - I'm happy. Plus, I always find that a bad company/product trying to do better often spurs on superior competitors. WhatsApp has been rubbish for a while now and so better messengers like Wire, Telegram, Signal etc. have appeared. Maybe someone will use Google's new privacy-related advances to improve their service as well.

xchaotic 7y ago

Google fixing vulnerabilities even before the release can only be good news, but one does have to be wonder why a whole class of such vulnerabilities are even allowed after so many releases?

zsrxx 7y ago
...maybe because they were not discovered before or have been introduced recently?
saagarjha 7y ago
Because software has bugs?

surak 7y ago

We can still not sandbox apps access to data by default. Numerous academic projects have show how this can be implemented, e.g. by fudging data when details are not needed. Also, in order to get these security fixes I have to buy a new device from one of their partners.. Google has failed society by advancing surveillance capitalism to the extreme.

Already__Taken 7y ago
my android one branded Nokia has had a decent amount of updates and my partner's last few Motos. it's getting better for Android slowly
- surak 7y ago
  Going after a subset of low end devices seems a bit off-putting to me. A-One should be mandatory, but most manufacturers are hooked on adding bloatware to track you.
panpanna 7y ago
I don't think you have really used Android lately. 1. Google has added API to access resources without getting full unconditional access 2. They are enforcing use of correct APIs on their store 3. Most of the system is now updated from the store. This is significantly faster than any of their competitors 4. Most vendors are now providing timely security updates. Some even have an Enterprise program with 4-5 years of updates.
- surak 7y ago
  I use it every day. Regarding P1, if an app ask for permission access to e.g. images or location, and you use the app, how would you limit what the app can send home or even review it? See discussion in the other comments if you're not an Andriod developer.
  - vetinari 7y ago
    Since Android v1, it offers APIs (intents) for picking items belonging to other apps or doing an action on behalf of other apps. Applications do not need access to gallery; they can ask the gallery to let the user pick the pictures he wants to work with; the app does not need the access to camera, it can ask the default camera app to let the user make the photo and get the result. The app does not need access to telephony; it can ask dialer to dial a number on it's behalf. Etc, etc. The developers didn't use these APIs because users were asking for iOS style integrations, where any apps does everything for itself, instead of using system components. So they got it.

ezequiel-garzon 7y ago

Do previous Android versions have these vulnerabilities?

tssva 7y ago
The headline is misleading. These vulnerabilities are not in Android 10 but are fixed by Android 10. Which of course means they exist in versions prior to Android 10. Google provides security updates for prior versions so what is not clear from the article is whether these are only fixed by upgrading to Android 10 or whether they were identified during the Android 10 development process but fixes will also be available for prior versions.
- hn_throwaway_99 7y ago
  > These vulnerabilities are not in Android 10 but are fixed by Android 10. Which of course means they exist in versions prior to Android 10. That's not accurate. Android 10 is still in beta, so many of these vulnerabilities (just like many other bugs you'll see in a beta) are likely new to Android 10, and will be fixed before the final release.
- HillaryBriss 7y ago
  my take on the headline is that Q fixes vulnerabilities that exist in pre-Q versions. this means that those vulnerabilities are still in effect for the vast majority of current users, and will be for some time since it will take years before Q is actually being run by the majority of android devices. the vulnerabilities are very much alive.

dessant 7y ago

A revocable permission for network access on Android would be a great step towards giving users more control over which apps can transmit their personal data. An entire class of apps could be rendered safe by disallowing network access, especially the ones that do work offline, but are keen to phone home.

kerng 7y ago
Right on! Those are the very features that I'm missing! It seems super simple to provide that basic level of control to the end user. I also want shadow/fake address books and location information as a feature.
llarsson 7y ago
A cheap Huawei phone I had let me do that, right from its Settings! Now I have to use NetGuard for that (no root required). And this is how I have learned that Google's Calc app apparently wants network access. No thanks!
ignoramous 7y ago
This has been possible since Android 8, if not before. You could, per app, from the App Info page: 1. Disallow bg internet access. 2. Disallow fg internet access over wifi. 3. Disallow fg internet access over mobile network. I've been building an app that exposes privacy features like bouncing permissions when apps are in bg (remember AppOps?), firewalling apps by disallowing data usage, setting DNS over TLS to servers that blackhole ads and trackers, show log of network activity, kill bg processes and activities and so on. Hopefully, would be done in a month or so. You could do all of the above, today, but mostly, manually, by navigating through nested menus and what-not. Android 10 would make some parts of what I'm building obsolete, and that's a good thing.
- deleted 7y ago
  [deleted]
- dessant 7y ago
  Is it possible that some of the controls for these network permissions you list are not in AOSP, but in a ROM made by the manufacturer of your device? The ones I've seen had a setting only for restricting background data usage.

izacus 7y ago

This headline is grossly misleading - Android 10 has fixed those 193 vulnerabilities. The title as it is, implies they still need to be fixed. This kind of content is usually never worded like this for other products, can the moderators fix it?

jm4 7y ago
Another crap Forbes contributor article. The fix is to ban these posts. These articles have basically zero credibility because they are written by ordinary dopes who pay to have their blogs published on forbes.com. There is no fact checking, no verification of the author’s background and expertise, nothing. You pay and get published and people get the impression it’s “news” because of the Forbes name.
- microcolonel 7y ago
  The writing is extremely clumsy, I had to go to the linked post from Google to find out that the author meant that Android releases will no longer be named after desserts.
- discreditable 7y ago
  Forbes articles are pretty clickbait. I blocked them in Google News because their headlines are bonkers. It's always a formula like Microsoft issues update warning to 10 gorillion PCs (some super minor problem in the last patch cycle) 10 bazillion Android phones have spyware (some malware app was removed from the play store)
_asummers 7y ago
Changing Need --> Needed should be enough.

panpanna 7y ago

Seriously, why is this news? Android 10 is still being worked on, if it was ready it would have been released.

microcolonel 7y ago

The move to a joyless, bland release naming scheme in order to appease a perceived mass of illiterate rubes who somehow care about their Android version but can't read past the name of a dessert... To me it is another signal of the erasure of cultural flavour at the company; the pivot to a base, power-chasing, stifling corporatist death march toward nowhere of interest.

kerng 7y ago

Google refuses to do something about arbitrary network connections, most likely due to their ads business model. Their ads require network connections to work!