3 ms·

As a side note: given all the security resources Google has, why Android is still not considered safer than iOS? What mistakes has Google made with Android, and

by krn 7y ago

As a side note: given all the security resources Google has, why Android is still not considered safer than iOS? What mistakes has Google made with Android, and how could they be fixed?

andrewnicolalde 7y ago
I suspect the main issue is that regardless of what Google does, manufacturers still need to make any new updates available, which most do not for anything but their most recent models.
HNcantBtrustd 7y ago
Why? 2 decades of advertising has misinformed people that Apple products are safer. The longer I live, the more I think nothing is safe.
plttn 7y ago
The compatibility definition document for Android gets it pretty secure, but realistically the only secure Android devices are Pixels in my opinion.
chickenbane 7y ago
All things considered, I'd say Apple has done an excellent job wrt security for iOS devices. All modern iOS devices are updated on a regular basis with a high uptake rate, and Apple monitors its store and is increasing its use of bug bounties. And with these exploit chains, Apple has addressed the issues quickly. The downside of Android being an open platform is that Google is limited in forcing vendors to update their devices - and most do not. That said, Android has had regular monthly security releases for years, and the Pixel devices are excellent from a security perspective. Google also monitors its app store - as well as the full Android ecosystem (as far as Google Play Services is installed) for potentially harmful applications. This is why you regularly see articles along the lines of "Google removes malware from the Play Store that has had X installs!" I'd say the biggest vulnerability for Android users given its impressive scale is a vulnerability in a vendor's supply chain. Given the complexity of devices, a vendor likely has multiple places where a malicious actor could insert malware into an Android device. I think this is why US intel has ultimately decided devices from China - Huawei in particular - are untrustworthy. If you can't validate every component of a device and trust the vendor will always audit its security, then it's hard to trust a device, even if it is safe right now.

by krn 7y ago

As a side note: given all the security resources Google has, why Android is still not considered safer than iOS? What mistakes has Google made with Android, and how could they be fixed?

andrewnicolalde 7y ago

I suspect the main issue is that regardless of what Google does, manufacturers still need to make any new updates available, which most do not for anything but their most recent models.

HNcantBtrustd 7y ago

Why? 2 decades of advertising has misinformed people that Apple products are safer. The longer I live, the more I think nothing is safe.

plttn 7y ago

The compatibility definition document for Android gets it pretty secure, but realistically the only secure Android devices are Pixels in my opinion.

chickenbane 7y ago

All things considered, I'd say Apple has done an excellent job wrt security for iOS devices. All modern iOS devices are updated on a regular basis with a high uptake rate, and Apple monitors its store and is increasing its use of bug bounties. And with these exploit chains, Apple has addressed the issues quickly. The downside of Android being an open platform is that Google is limited in forcing vendors to update their devices - and most do not. That said, Android has had regular monthly security releases for years, and the Pixel devices are excellent from a security perspective. Google also monitors its app store - as well as the full Android ecosystem (as far as Google Play Services is installed) for potentially harmful applications. This is why you regularly see articles along the lines of "Google removes malware from the Play Store that has had X installs!" I'd say the biggest vulnerability for Android users given its impressive scale is a vulnerability in a vendor's supply chain. Given the complexity of devices, a vendor likely has multiple places where a malicious actor could insert malware into an Android device. I think this is why US intel has ultimately decided devices from China - Huawei in particular - are untrustworthy. If you can't validate every component of a device and trust the vendor will always audit its security, then it's hard to trust a device, even if it is safe right now.