4 ms·

With more users 'jailbreaking' or 'rooting' their phones, it's not as 'secure' as before. The point of doing those things is to break the phone's security and

by jim_h 16y ago

With more users 'jailbreaking' or 'rooting' their phones, it's not as 'secure' as before. The point of doing those things is to break the phone's security and allow you to do more things. What if the creator decided to put in a little extra code.. or it introduced more vulnerabilities.. * I'm not trying to make you guys paranoid. Just wondering about the possibilities and playing devil advocate.

drdaeman 16y ago
Well, not exactly, "jailbreaking" is about user gaining access to a phone, not applications. I don't know the details (I don't own iPhone or Android device, and N900 comes with root access almost out-of-box), but I believe pure jailbreaking shouldn't hurt OS security mechanisms too much. I may be wrong, though. However, you have a point: classic "dancing bunnies" problem[1] is certainly out there. Promise average user nice things, ask him to do some cryptic actions, and he'll happily follow your instructions without really understanding any consequences. [1]: http://en.wikipedia.org/wiki/Dancing_bunnies http://en.wikipedia.org/wiki/Dancing_bunnies
drivebyacct2 16y ago
Drdaeman, it opens up the possibility of such "hostile" data access. For an application to simply start accessing random data in such a way that it could "access" financial details or actually interact with a payment provider... it would have to explicitly be given root permission. I give very few applications root. Terminal gets it, Rom Manager gets it. That's it. A random app from the Market? Hell no, it's not getting root and it's not getting access to my data. The thing is, this vector already exists. Download the Paypal app. Login. Now download drivebyacct2's malicious app on the Market. If you grant it root access through SuperUser, it could theoretically read out your Paypal credentials and do all kinds of stuff. Personally, I consider it to be very low risk.

by jim_h 16y ago

drdaeman 16y ago

Well, not exactly, "jailbreaking" is about user gaining access to a phone, not applications. I don't know the details (I don't own iPhone or Android device, and N900 comes with root access almost out-of-box), but I believe pure jailbreaking shouldn't hurt OS security mechanisms too much. I may be wrong, though. However, you have a point: classic "dancing bunnies" problem[1] is certainly out there. Promise average user nice things, ask him to do some cryptic actions, and he'll happily follow your instructions without really understanding any consequences. [1]: http://en.wikipedia.org/wiki/Dancing_bunnies http://en.wikipedia.org/wiki/Dancing_bunnies

drivebyacct2 16y ago

Drdaeman, it opens up the possibility of such "hostile" data access. For an application to simply start accessing random data in such a way that it could "access" financial details or actually interact with a payment provider... it would have to explicitly be given root permission. I give very few applications root. Terminal gets it, Rom Manager gets it. That's it. A random app from the Market? Hell no, it's not getting root and it's not getting access to my data. The thing is, this vector already exists. Download the Paypal app. Login. Now download drivebyacct2's malicious app on the Market. If you grant it root access through SuperUser, it could theoretically read out your Paypal credentials and do all kinds of stuff. Personally, I consider it to be very low risk.