11 ms·

Modern Android is pretty secure

81 points by p410n3 6y ago

jotto 6y ago
I feel that most OS (Windows, Mac, Linux, iOS, Android) have continued to improve security but at the same time reduced privacy. If that's true, is there a TailsOS equivalent for phones?
- Synaesthesia 6y ago
  The Firefox OS but nobody is using it.
  - tapoxi 6y ago
    It lives on as a fork: https://www.kaiostech.com/ https://www.kaiostech.com/
- qurcetumMons 6y ago
  I feel as though the improvements in security lend themselves to improvements in privacy, and vice versa, in a rather linear relationship. That being said, privacy factors are primarily user-choice in that it is the optional apps and programs that compromise privacy, even if the privacy breaches are less-than-voluntary, as seen in the recent clipboard skimming scandal. Making an OS more secure by limiting unauthorized access to information like the clipboard is both more secure and more private.
- eptcyka 6y ago
  There's GrapheneOS. It's really good, but it's not really focused on not leaving a trace.
- bengalister 6y ago
  I really don't see how improving security and reducing privacy are related: like generating fingerprints of installed programs, or scanning the memory, disks for malware and reporting results to the OS provider/device manufacturer and mapping the results to a user account or an ip address ? For me improved security was more synonym to degraded performance.
- elipsey 6y ago
  Hard to do I think. Even plain old "linux but for phones" is pretty difficult at this point because: --most drivers and hardware specifications are proprietary, and probably secret under NDA --most bootloaders are cryptographically locked and controlled by vendor --necessary wifi and cellular modem hardware is the same, and are also patent minefields even in the foundational platonic ideals of design, as is mobile graphics hardware --the modems are subject to regulatory requirements that they be secured from modification by the user/owner of the device Secure in this context means secure from the user and device owner, which can arguably be for good reason -- think of an ATM kiosk, for example. So no "tails for phones" yet, but people are trying. Check out postmarketOS, lineageOS, replicant, sailfish. Last I tried things were still kind of science project, like 90's style linux.
  - makerofspoons 6y ago
    Adding ubports to the list- I have it on my Pinephone and can place and receive calls, send and receive SMS, and utilize GPS. There are some features that don't yet work on Pinephone like MMS but it's on the threshold of being daily-driver worthy.
    - elipsey 6y ago
      Sounds great. Is the battery life OK? Was it hard to get the phone? To be clear, I see some measure of compromise as totally reasonable if one's goal is to get on an open os...
      - makerofspoons 6y ago
        Users on Pine64.org have reported their devices can run 14 hours on idle and my own experience is the battery will last all day with moderate usage. Getting it on the phone is as simple as getting Raspbian on a Raspberry Pi, you just flash the image onto an SD card.
  - deleted 6y ago
    [deleted]
- devit 6y ago
  You can use the phone as an access point, and then have an additional secure wi-fi device. A wi-fi only Android tablet that doesn't require proprietary blobs to run vanilla Linux might do.
saagarjha 6y ago
I should note that these things can only keep your device secure if they’re not buggy, and most platforms offer these features. The difference is quality of implementation and which ones keep them up-to-date when problems are found.
parliament32 6y ago
Meta but having the full post in a modal feels... off.
- timw4mail 6y ago
  There's something about a SPA for a blog that feels completely wrong...
  - p410n3 6y ago
    You can happily browse the noJS version at wp.palone.blog
    - parliament32 6y ago
      This should be your default :)
      - p410n3 6y ago
        Well. Tastes are different
      - jolmg 6y ago
        The disadvantage of that one is that it doesn't seem to support links for individual posts.
- jolmg 6y ago
  Like the 2 scrollbars right next to each other. Works better than I would have expected, though.
joshstrange 6y ago
Random nitpick: I wish each post has what I'll call "full page scrolling". You have to hover your mouse over the actual post to scroll it or you end up scrolling the background.
- p410n3 6y ago
  I'll keep that in mind and will probably fix this... Someday
darklion 6y ago
HN title is misleading clickbait. The article says that modern Android security is pretty good, listing a number of Android's security features and recent improvements, but the author never tries to make the case that it's "the most secure device you own". There's also zero comparison between Android and any other operating system that would be required to support the HN title's conclusion. Also, Android isn't a device, it's an operating system. An operating system is only as good as the devices it's put on; a deeply insecure device isn't going to magically be made better just be installing Android on it.
- Synaesthesia 6y ago
  It’s the author’s own headline
  - darklion 6y ago
    The headline was updated since I wrote that comment. The original headline was "Android might be the most secure device you own".
    - p410n3 6y ago
      Yeah guess the mods did that or something. I just updated the original title :) Read here: https://news.ycombinator.com/item?id=23714416#23716962 https://news.ycombinator.com/item?id=23714416#23716962
blakesterz 6y ago
I am NOT a security export, just an observer, but saying "Contrary to popular belief, modern Android is pretty secure." (Which is how this post finishes) sounds pretty much like something I'd agree with, but saying "Your Android might be the most secure device you own" isn't really something that I'd agree with as much. I don't even know how one would really measure these things in a reliable and objective way. Do we compare it to IOS or Windows or ChromeOS or MacOS? Which version of Android and so on. The post picks out the best things about Android, nothing wrong with that, but isn't that just ignoring all the problems with Android? I agree though, Android is pretty secure, but so is everything else.
- p410n3 6y ago
  Hm guess I subconsciously chose an clickbaity title... Well in my case, I use Debian as my main operating system on my Desktop. Debian is great, but as a classical desktop OS it does not have those cool security things like app sandboxing, permissions management (camera acces etc) and stuff like that. Which makes sense, since mobile Operating Systems were designed from the ground up way later and also seem to move at a faster pace. The fact alone that almostt all ANdroid Apps run in the JVM and are written in memory safe languages is a huge plus that the GNU/Linux family does not have. (Solely speaking about security, I wouldnt want my /bin/sh to be in java) In my particular case, it suprised me to find out that my android is the most secure device I own. Thus the title (and the intention to wrote this post). So yeah, misleading title. Kinda. My Bad. Updated the title
  - zokier 6y ago
    The big difference between Debian and Android is that with Debian you don't generally want or need to run untrusted or untrustworthy 3rd party code. Instead your software comes from trusted source with maintenance promise and security updates. And I'm starting to think that is better model than trying to sandbox and lock down everything; the world needs more trust at certain places. In contrast you are no way able to trust random Android apps, neither the quality or the intentions, so you are left with actively hostile relationship between you, the OS, and the apps.
aritmo 6y ago
AS long as you do not start installing apps, and avoid using some vendor pre-installed apps.
xxpor 6y ago
Now if only I could get the Pixel (or generally clean Android) software experience on Samsung hardware....
- harpratap 6y ago
  Oneplus?
  - avgDev 6y ago
    OnePlus is a terrible company. I purchased one of their phones, I had some issues with the device within the 30 day return period. It was a popular issue, I think it was ghost touch but it has been a while. Anyway, in order to get a refund I had to do a charge back with my CC company. I am pretty confident my next phone will be an Apple device. I was an Android fan, purchased all google/nexus devices starting with the G1. I had problems with many of those devices. I have switched to Samsung, but the amount of garbage on the phone still annoys me. Therefore, it is time to try iOS.
    - panpanna 6y ago
      Oneplus had some occasional hickups in the support department but I don't think their hardware is significantly better or worse than anyone else. What I really like about OnePlus is their software. It's hands down the best Android version ever created. Love their additions to vanilla OS.
      - celsoazevedo 6y ago
        OnePlus has a history of breaking basic Android security features. For example: - https://www.xda-developers.com/oneplus-6-bootloader-protection-exploit-physical-access/ https://www.xda-developers.com/oneplus-6-bootloader-protecti... - https://www.xda-developers.com/two-critical-oneplus-33t-bootloader-security-flaws-discovered-one-patched-and-other-being-addressed/ https://www.xda-developers.com/two-critical-oneplus-33t-boot... While OxygenOS is smooth and not bloated and their phones are cheaper than other flagships (in some markets at least), their security record isn't the best.
Happpy 6y ago
Learned something today. Android is a device. I always thought it was an os by Google based on aosp(also Google..).
rock_artist 6y ago
Sadly I don't think Android as a platform is less secure. but still, in comparison to iOS (the common comparison) or desktop platforms. Most phones stops getting security updates earlier than the other platforms. I had a Nexus 4, Nexus 7, Nexus 5X. All which should get top notch security updates. stopped where other platforms kept getting updates. Just a few days ago I saw on HN some great news for Android (https://news.ycombinator.com/item?id=23692257 https://news.ycombinator.com/item?id=23692257). but again, this isn't a security update. It a broader security improvement equivalent to a major update on other platform. While my 1st iPhone SE will get iOS 14, my Nexus 5X is still on Android 8.
- FirstLvR 6y ago
  this is exactly why Apple still rock at phones you may choose Android for the specs, guess what, your phone will still get deprecated in 2 years
  - BbzzbB 6y ago
    Aside from gaming, which isn't prevalent aside from casual games in NA and EU to my knowledge, I'm not sure what someone may possibly need it's phone for where something like a S7 (a bit more than 4 years old) isn't largely sufficient. Not a diss on Apple, I think the iPhone 5 is vastly better than circa-2012 Android phones, I just disagree with the premise of throwing phones every 2 years as being remotely necessary (perhaps until the next paradigm shift in computing/web/mobile usage where current tech starts to be too sluggish).
    - mrtksn 6y ago
      on Apple’s case, means good app experience for the users and the developers. for example, SwiftUI comes to iOS 13 or later. If most devices were to be left off without updates(which is the case with Android) most developers would be hesitant to pick up the newer shiniest technology. apps on android still tend to be ugly and old fashioned. sure, there’re exceptions but generally apps on iOS are fresh and consistent probably because developers can depend on the users having the latest platform.
noja 6y ago
It might be "secure", but almost every app is exfiltrating my personal information by using crashlytics, facebook and co. Who needs security when the apps do it by design. Check your firewall logs, or use a root/no-root firewall, it's frightening. Edit: click the screenshots at https://play.google.com/store/apps/details?id=eu.faircode.netguard&hl=en_US https://play.google.com/store/apps/details?id=eu.faircode.ne... to see an example. Fourth picture "Access attempts"
- xnx 6y ago
  Amen. My guess would be that 90% of Hacker News readers use a desktop browser ad blocker, but <10% have a tool like Blockada installed on their phone.
  - nickthegreek 6y ago
    On iOS I use AdGuard Pro, which offers DNS and safari protection, but I normally use chrome. On my home network, i have a pi-hole as well. Is Blockada just DNS blocking or is there more to it?
    - joecool1029 6y ago
      Looks like just DNS blocking using VPN API. I use a different method for system-level adblocking on ios. I temporarily jailbreak, supervise the device, and install easylist's pac to block connections without an external server. Jailbreak is removed after it is set in place. Guide: https://www.reddit.com/r/jailbreak/comments/dbdb8x/tutorial_blocking_ads_on_cellular_wifi_no_vpn/ https://www.reddit.com/r/jailbreak/comments/dbdb8x/tutorial_... The only downsides I have seen to this method are it's slightly annoying to initially install and if github goes down (where the pac is hosted), phone network connectivity goes down until it comes back up.
  - panpanna 6y ago
    10% seems low. On Android Firefox supports extension so a lot of people are having exact same extension on desktop and mobile.
dummydata 6y ago
The Open Source nature of Android might have something to do with it as well. It is interesting to compare iOS and Android in terms of how visible the source code is and how much vulnerable a system can be in effect. Here's an interesting article that goes in depth about the concept: https://dwheeler.com/secure-programs/Secure-Programs-HOWTO/open-source-security.html https://dwheeler.com/secure-programs/Secure-Programs-HOWTO/o...
- ghostpepper 6y ago
  Android is less open source than it used to be. I wonder what percent of the vulnerabilities in Android are in the open-source portions (kernel, system libraries) vs the framework/apps.
  - dummydata 6y ago
    I think it is all listed here: https://android.googlesource.com/ https://android.googlesource.com/ It's interesting to see how they call out repositories specifically for different manufacturers (ex. Samsung, Sony).
stefannn 6y ago
Then it should not allow apps to ask for permissions they don't need. Just a thought..
heyjupiter89 6y ago
I think people are more concerned about the data Google and apps mine from their devices than the type of encryption.
ocdtrekkie 6y ago
This article wholly misses the point. Android is not a secure OS because it enables and allows behaviors that make it leak data and protect the user poorly. Security isn't just a matter of not having memory vulnerabilities or using good encryption. That's where Google and it's advocates have failed to understand what security is. Security is keeping something safe. And with the amount of data exfiltration Google's default platform plus the apps it allows and encourages do does not do a good job securing your information. When a user installs an app that does behavior they didn't expect or intend to permit, that's a security issue, even if the platform APIs allowed it. The difference in how Apple and Google approach Web APIs discussed a couple days ago highlights this: Google added a ton of APIs that lets websites do stuff with your computer, Apple decided they are risky and chooses not to implement them. Google would say the user has to give permission for those APIs to be used, so there's no security flaw if a website uses them maliciously: The user gave permission. Whereas, Apple would recognize the benefits to the user are minimal compared to the risk when the user grants permission unintentionally, which happens all the time for other web APIs like push notifications and even extension installs. Practical security and technical security are two different things. Google does not even comprehend the former, while receiving wide accolades for their expertise at the latter, as in this article.
- entha_saava 6y ago
  > Android is not a secure OS because it enables and allows behaviors that make it leak data and protect the user poorly. I am going to bite. You are just biased. Google adds more APIs because it doesn't have much interest in limiting some features to Play store, because Play is a such small part of their revenue. Apple would benefit if things are only possible through native apps because sweet 30% rent. That said Google isn't exactly dumb but they aren't well organised in terms of Android - some areas get focus while others not. They even made it harder for external contributers of Android Open Source Project by following Google style monorepo patterns. Contrast to Apple where mobile OS is their core business and they have to do it well.
- UncleMeat 6y ago
  If this is the case, then all desktop Linux distros are unsafe as well.
lobocinza 6y ago
Maybe a pure Android phone is secure but the reality of most phones is a dozen of system and store apps deliberately spying on their users.

81 points by p410n3 6y ago

I feel that most OS (Windows, Mac, Linux, iOS, Android) have continued to improve security but at the same time reduced privacy. If that's true, is there a TailsOS equivalent for phones?

Synaesthesia 6y ago
The Firefox OS but nobody is using it.
- tapoxi 6y ago
  It lives on as a fork: https://www.kaiostech.com/ https://www.kaiostech.com/
qurcetumMons 6y ago
I feel as though the improvements in security lend themselves to improvements in privacy, and vice versa, in a rather linear relationship. That being said, privacy factors are primarily user-choice in that it is the optional apps and programs that compromise privacy, even if the privacy breaches are less-than-voluntary, as seen in the recent clipboard skimming scandal. Making an OS more secure by limiting unauthorized access to information like the clipboard is both more secure and more private.
eptcyka 6y ago
There's GrapheneOS. It's really good, but it's not really focused on not leaving a trace.
bengalister 6y ago
I really don't see how improving security and reducing privacy are related: like generating fingerprints of installed programs, or scanning the memory, disks for malware and reporting results to the OS provider/device manufacturer and mapping the results to a user account or an ip address ? For me improved security was more synonym to degraded performance.
elipsey 6y ago
Hard to do I think. Even plain old "linux but for phones" is pretty difficult at this point because: --most drivers and hardware specifications are proprietary, and probably secret under NDA --most bootloaders are cryptographically locked and controlled by vendor --necessary wifi and cellular modem hardware is the same, and are also patent minefields even in the foundational platonic ideals of design, as is mobile graphics hardware --the modems are subject to regulatory requirements that they be secured from modification by the user/owner of the device Secure in this context means secure from the user and device owner, which can arguably be for good reason -- think of an ATM kiosk, for example. So no "tails for phones" yet, but people are trying. Check out postmarketOS, lineageOS, replicant, sailfish. Last I tried things were still kind of science project, like 90's style linux.
- makerofspoons 6y ago
  Adding ubports to the list- I have it on my Pinephone and can place and receive calls, send and receive SMS, and utilize GPS. There are some features that don't yet work on Pinephone like MMS but it's on the threshold of being daily-driver worthy.
  - elipsey 6y ago
    Sounds great. Is the battery life OK? Was it hard to get the phone? To be clear, I see some measure of compromise as totally reasonable if one's goal is to get on an open os...
    - makerofspoons 6y ago
      Users on Pine64.org have reported their devices can run 14 hours on idle and my own experience is the battery will last all day with moderate usage. Getting it on the phone is as simple as getting Raspbian on a Raspberry Pi, you just flash the image onto an SD card.
- deleted 6y ago
  [deleted]
devit 6y ago
You can use the phone as an access point, and then have an additional secure wi-fi device. A wi-fi only Android tablet that doesn't require proprietary blobs to run vanilla Linux might do.

saagarjha 6y ago

I should note that these things can only keep your device secure if they’re not buggy, and most platforms offer these features. The difference is quality of implementation and which ones keep them up-to-date when problems are found.

parliament32 6y ago

Meta but having the full post in a modal feels... off.

timw4mail 6y ago
There's something about a SPA for a blog that feels completely wrong...
- p410n3 6y ago
  You can happily browse the noJS version at wp.palone.blog
  - parliament32 6y ago
    This should be your default :)
    - p410n3 6y ago
      Well. Tastes are different
    - jolmg 6y ago
      The disadvantage of that one is that it doesn't seem to support links for individual posts.
jolmg 6y ago
Like the 2 scrollbars right next to each other. Works better than I would have expected, though.

joshstrange 6y ago

Random nitpick: I wish each post has what I'll call "full page scrolling". You have to hover your mouse over the actual post to scroll it or you end up scrolling the background.

p410n3 6y ago
I'll keep that in mind and will probably fix this... Someday

darklion 6y ago

HN title is misleading clickbait. The article says that modern Android security is pretty good, listing a number of Android's security features and recent improvements, but the author never tries to make the case that it's "the most secure device you own". There's also zero comparison between Android and any other operating system that would be required to support the HN title's conclusion. Also, Android isn't a device, it's an operating system. An operating system is only as good as the devices it's put on; a deeply insecure device isn't going to magically be made better just be installing Android on it.

Synaesthesia 6y ago
It’s the author’s own headline
- darklion 6y ago
  The headline was updated since I wrote that comment. The original headline was "Android might be the most secure device you own".
  - p410n3 6y ago
    Yeah guess the mods did that or something. I just updated the original title :) Read here: https://news.ycombinator.com/item?id=23714416#23716962 https://news.ycombinator.com/item?id=23714416#23716962

blakesterz 6y ago

I am NOT a security export, just an observer, but saying "Contrary to popular belief, modern Android is pretty secure." (Which is how this post finishes) sounds pretty much like something I'd agree with, but saying "Your Android might be the most secure device you own" isn't really something that I'd agree with as much. I don't even know how one would really measure these things in a reliable and objective way. Do we compare it to IOS or Windows or ChromeOS or MacOS? Which version of Android and so on. The post picks out the best things about Android, nothing wrong with that, but isn't that just ignoring all the problems with Android? I agree though, Android is pretty secure, but so is everything else.

p410n3 6y ago
Hm guess I subconsciously chose an clickbaity title... Well in my case, I use Debian as my main operating system on my Desktop. Debian is great, but as a classical desktop OS it does not have those cool security things like app sandboxing, permissions management (camera acces etc) and stuff like that. Which makes sense, since mobile Operating Systems were designed from the ground up way later and also seem to move at a faster pace. The fact alone that almostt all ANdroid Apps run in the JVM and are written in memory safe languages is a huge plus that the GNU/Linux family does not have. (Solely speaking about security, I wouldnt want my /bin/sh to be in java) In my particular case, it suprised me to find out that my android is the most secure device I own. Thus the title (and the intention to wrote this post). So yeah, misleading title. Kinda. My Bad. Updated the title
- zokier 6y ago
  The big difference between Debian and Android is that with Debian you don't generally want or need to run untrusted or untrustworthy 3rd party code. Instead your software comes from trusted source with maintenance promise and security updates. And I'm starting to think that is better model than trying to sandbox and lock down everything; the world needs more trust at certain places. In contrast you are no way able to trust random Android apps, neither the quality or the intentions, so you are left with actively hostile relationship between you, the OS, and the apps.

aritmo 6y ago

AS long as you do not start installing apps, and avoid using some vendor pre-installed apps.

xxpor 6y ago

Now if only I could get the Pixel (or generally clean Android) software experience on Samsung hardware....

harpratap 6y ago
Oneplus?
- avgDev 6y ago
  OnePlus is a terrible company. I purchased one of their phones, I had some issues with the device within the 30 day return period. It was a popular issue, I think it was ghost touch but it has been a while. Anyway, in order to get a refund I had to do a charge back with my CC company. I am pretty confident my next phone will be an Apple device. I was an Android fan, purchased all google/nexus devices starting with the G1. I had problems with many of those devices. I have switched to Samsung, but the amount of garbage on the phone still annoys me. Therefore, it is time to try iOS.
  - panpanna 6y ago
    Oneplus had some occasional hickups in the support department but I don't think their hardware is significantly better or worse than anyone else. What I really like about OnePlus is their software. It's hands down the best Android version ever created. Love their additions to vanilla OS.
    - celsoazevedo 6y ago
      OnePlus has a history of breaking basic Android security features. For example: - https://www.xda-developers.com/oneplus-6-bootloader-protection-exploit-physical-access/ https://www.xda-developers.com/oneplus-6-bootloader-protecti... - https://www.xda-developers.com/two-critical-oneplus-33t-bootloader-security-flaws-discovered-one-patched-and-other-being-addressed/ https://www.xda-developers.com/two-critical-oneplus-33t-boot... While OxygenOS is smooth and not bloated and their phones are cheaper than other flagships (in some markets at least), their security record isn't the best.

Happpy 6y ago

Learned something today. Android is a device. I always thought it was an os by Google based on aosp(also Google..).

rock_artist 6y ago

Sadly I don't think Android as a platform is less secure. but still, in comparison to iOS (the common comparison) or desktop platforms. Most phones stops getting security updates earlier than the other platforms. I had a Nexus 4, Nexus 7, Nexus 5X. All which should get top notch security updates. stopped where other platforms kept getting updates. Just a few days ago I saw on HN some great news for Android (https://news.ycombinator.com/item?id=23692257 https://news.ycombinator.com/item?id=23692257). but again, this isn't a security update. It a broader security improvement equivalent to a major update on other platform. While my 1st iPhone SE will get iOS 14, my Nexus 5X is still on Android 8.

FirstLvR 6y ago
this is exactly why Apple still rock at phones you may choose Android for the specs, guess what, your phone will still get deprecated in 2 years
- BbzzbB 6y ago
  Aside from gaming, which isn't prevalent aside from casual games in NA and EU to my knowledge, I'm not sure what someone may possibly need it's phone for where something like a S7 (a bit more than 4 years old) isn't largely sufficient. Not a diss on Apple, I think the iPhone 5 is vastly better than circa-2012 Android phones, I just disagree with the premise of throwing phones every 2 years as being remotely necessary (perhaps until the next paradigm shift in computing/web/mobile usage where current tech starts to be too sluggish).
  - mrtksn 6y ago
    on Apple’s case, means good app experience for the users and the developers. for example, SwiftUI comes to iOS 13 or later. If most devices were to be left off without updates(which is the case with Android) most developers would be hesitant to pick up the newer shiniest technology. apps on android still tend to be ugly and old fashioned. sure, there’re exceptions but generally apps on iOS are fresh and consistent probably because developers can depend on the users having the latest platform.

noja 6y ago

It might be "secure", but almost every app is exfiltrating my personal information by using crashlytics, facebook and co. Who needs security when the apps do it by design. Check your firewall logs, or use a root/no-root firewall, it's frightening. Edit: click the screenshots at https://play.google.com/store/apps/details?id=eu.faircode.netguard&hl=en_US https://play.google.com/store/apps/details?id=eu.faircode.ne... to see an example. Fourth picture "Access attempts"

xnx 6y ago
Amen. My guess would be that 90% of Hacker News readers use a desktop browser ad blocker, but <10% have a tool like Blockada installed on their phone.
- nickthegreek 6y ago
  On iOS I use AdGuard Pro, which offers DNS and safari protection, but I normally use chrome. On my home network, i have a pi-hole as well. Is Blockada just DNS blocking or is there more to it?
  - joecool1029 6y ago
    Looks like just DNS blocking using VPN API. I use a different method for system-level adblocking on ios. I temporarily jailbreak, supervise the device, and install easylist's pac to block connections without an external server. Jailbreak is removed after it is set in place. Guide: https://www.reddit.com/r/jailbreak/comments/dbdb8x/tutorial_blocking_ads_on_cellular_wifi_no_vpn/ https://www.reddit.com/r/jailbreak/comments/dbdb8x/tutorial_... The only downsides I have seen to this method are it's slightly annoying to initially install and if github goes down (where the pac is hosted), phone network connectivity goes down until it comes back up.
- panpanna 6y ago
  10% seems low. On Android Firefox supports extension so a lot of people are having exact same extension on desktop and mobile.

dummydata 6y ago

The Open Source nature of Android might have something to do with it as well. It is interesting to compare iOS and Android in terms of how visible the source code is and how much vulnerable a system can be in effect. Here's an interesting article that goes in depth about the concept: https://dwheeler.com/secure-programs/Secure-Programs-HOWTO/open-source-security.html https://dwheeler.com/secure-programs/Secure-Programs-HOWTO/o...

ghostpepper 6y ago
Android is less open source than it used to be. I wonder what percent of the vulnerabilities in Android are in the open-source portions (kernel, system libraries) vs the framework/apps.
- dummydata 6y ago
  I think it is all listed here: https://android.googlesource.com/ https://android.googlesource.com/ It's interesting to see how they call out repositories specifically for different manufacturers (ex. Samsung, Sony).

stefannn 6y ago

Then it should not allow apps to ask for permissions they don't need. Just a thought..

heyjupiter89 6y ago

I think people are more concerned about the data Google and apps mine from their devices than the type of encryption.

ocdtrekkie 6y ago

This article wholly misses the point. Android is not a secure OS because it enables and allows behaviors that make it leak data and protect the user poorly. Security isn't just a matter of not having memory vulnerabilities or using good encryption. That's where Google and it's advocates have failed to understand what security is. Security is keeping something safe. And with the amount of data exfiltration Google's default platform plus the apps it allows and encourages do does not do a good job securing your information. When a user installs an app that does behavior they didn't expect or intend to permit, that's a security issue, even if the platform APIs allowed it. The difference in how Apple and Google approach Web APIs discussed a couple days ago highlights this: Google added a ton of APIs that lets websites do stuff with your computer, Apple decided they are risky and chooses not to implement them. Google would say the user has to give permission for those APIs to be used, so there's no security flaw if a website uses them maliciously: The user gave permission. Whereas, Apple would recognize the benefits to the user are minimal compared to the risk when the user grants permission unintentionally, which happens all the time for other web APIs like push notifications and even extension installs. Practical security and technical security are two different things. Google does not even comprehend the former, while receiving wide accolades for their expertise at the latter, as in this article.

entha_saava 6y ago
> Android is not a secure OS because it enables and allows behaviors that make it leak data and protect the user poorly. I am going to bite. You are just biased. Google adds more APIs because it doesn't have much interest in limiting some features to Play store, because Play is a such small part of their revenue. Apple would benefit if things are only possible through native apps because sweet 30% rent. That said Google isn't exactly dumb but they aren't well organised in terms of Android - some areas get focus while others not. They even made it harder for external contributers of Android Open Source Project by following Google style monorepo patterns. Contrast to Apple where mobile OS is their core business and they have to do it well.
UncleMeat 6y ago
If this is the case, then all desktop Linux distros are unsafe as well.

lobocinza 6y ago

Maybe a pure Android phone is secure but the reality of most phones is a dozen of system and store apps deliberately spying on their users.