5 ms·

Sadly I don't think Android as a platform is less secure. but still, in comparison to iOS (the common comparison) or desktop platforms. Most phones stops gettin

Sadly I don't think Android as a platform is less secure. but still, in comparison to iOS (the common comparison) or desktop platforms. Most phones stops getting security updates earlier than the other platforms. I had a Nexus 4, Nexus 7, Nexus 5X. All which should get top notch security updates. stopped where other platforms kept getting updates. Just a few days ago I saw on HN some great news for Android (https://news.ycombinator.com/item?id=23692257 https://news.ycombinator.com/item?id=23692257). but again, this isn't a security update. It a broader security improvement equivalent to a major update on other platform. While my 1st iPhone SE will get iOS 14, my Nexus 5X is still on Android 8.

FirstLvR 6y ago
this is exactly why Apple still rock at phones you may choose Android for the specs, guess what, your phone will still get deprecated in 2 years
- BbzzbB 6y ago
  Aside from gaming, which isn't prevalent aside from casual games in NA and EU to my knowledge, I'm not sure what someone may possibly need it's phone for where something like a S7 (a bit more than 4 years old) isn't largely sufficient. Not a diss on Apple, I think the iPhone 5 is vastly better than circa-2012 Android phones, I just disagree with the premise of throwing phones every 2 years as being remotely necessary (perhaps until the next paradigm shift in computing/web/mobile usage where current tech starts to be too sluggish).
  - mrtksn 6y ago
    on Apple’s case, means good app experience for the users and the developers. for example, SwiftUI comes to iOS 13 or later. If most devices were to be left off without updates(which is the case with Android) most developers would be hesitant to pick up the newer shiniest technology. apps on android still tend to be ugly and old fashioned. sure, there’re exceptions but generally apps on iOS are fresh and consistent probably because developers can depend on the users having the latest platform.
  - dawg- 6y ago
    Yeah but in the context of security your point is moot. No more updates means no more security patches, right? Throwing phones away every two years is of course not necessary, an Android phone from 2012 is probably perfectly usable - yet horribly insecure.
    - BbzzbB 6y ago
      Yeah I could have amended about security, but I was replying to a comment about specs and Android phones being deprecated after 2 years, which I don't interpret as being security-related.
      - dawg- 6y ago
        Fair enough, I was thinking in context of the overall thread. Cheers
  - recursivecaveat 6y ago
    I had an S3 from launch for ~7 years before switching, and it was completely unusable by the end. Most websites and big-name apps halve in performance every 18 months or so. Doesn't help that your battery will be on its last legs by then. 2 years is definitely much more often than required, but until ad-tech corps and web developers call off the assault, we're stuck on the phone treadmill to some degree.
- product50 6y ago
  For a lot of folks, especially those at Hacker News, that is totally fine. It is interesting how people's perspectives change when it comes to defending their choice. So in this case, yeah Android seems secure but what happens after 2yrs - even though that point doesn't apply to them. Call out what is important to you vs. just talking about averages.
  - thebruce87m 6y ago
    I’m on hacker news and I care about the environment. I don’t want perfectly good hardware going in to landfill. Apple supporting their phones for 5+ years is good, and they should be commended for doing this, but we should be introducing laws to make sure all manufacturers are doing this to a reasonable level.
- throwaway8941 6y ago
  Hmm. My $170 phone from the middle of 2014 is still working perfectly and shows no signs of being "deprecated". Every application I use gets frequent updates, including the browser. I don't have to worry about targeted attacks (as I am not a billionaire/movie star/CEO of a large company/whatever), and a new shiny iPhone won't help with those anyway. µBlock Origin (with JS disabled on most sites) protects me from everything else.
  - jamesgeck0 6y ago
    Apps may be getting security updates, but when was the last time that the version of Android it's running was patched?
  - p410n3 6y ago
    Yeah the security patches are still worth thinking about. There was a Media Framework bug that needed nothing but a PNG on your phone to get RCE and there was a bug with the bluetooth stack this year which also could achieve RCE when your bluetooth was turned on and an attacker knew the BSSID PNGs are easy to send and in times of Contact Tracing via Bluetooth... well there are certain risks to running unpatched
  - GeekyBear 6y ago
    Didn't we recently learn that only Android 10 prevents background apps from constantly watching the contents of the clipboard?
  - simonklitj 6y ago
    Isn’t that the point though? Your phone works perfectly, shouldn’t it still receive OS updates?
- panpanna 6y ago
  > deprecated in 2 years They get security updates for 3 years (longer for enterprise devices). System libraries and builtin apps such as browser are updated via play store indefinitely. But how many people _really_ use a phone more than 3 years?
  - jamesgeck0 6y ago
    Anecdotally, most of the older folks I know will use hardware until it disintegrates because they don't use many apps and "it still works." I've seen a seven year old iPhone 5C in the wild.
- Shared404 6y ago
  Thus LineageOS (for those who want droid), or in the future postmarketOS (for those who don't care about app support). No, neither of these support all android phones, but they each support several.
  - ta17711771 6y ago
    I'm a long-time fan, but Lineage breaks the Android security model - knowingly. Other AOSP variants are more secure by an order of magnitude.
    - Shared404 6y ago
      > Lineage breaks the Android security model - knowingly. That's gonna be a big nope from me then. I was unaware of this, thank you for bringing it up. I've been mostly unsuccessful trying to find other android variants that appear to still be maintained, would you mind pointing me towards one? I'll probably still wait for the PinePhone, but I'd like to stay knowledgeable on the subject.
      - genghizkhan 6y ago
        GrapheneOS might be something you like. https://grapheneos.org https://grapheneos.org
        ta17711771 6y ago
        +1, this all day, over Linux phones with dubious security models/hardware switches that just delay exfiltration if it's going to happen on a non-verified boot device.
        Shared404 6y ago
        Thank you, this is super interesting and may well wind up being something that I wind up using in the future. I noticed that it only officially supports the Pixel devices. I've always avoided the Pixel devices because I assumed that the firmware was closed source and therefore a privacy issue, especially coming from google. However, the FAQ states "These devices meet the stringent privacy and security standards and have substantial upstream and downstream hardening specific to the devices." Am I mistaken about the Pixel drivers being closed source? If not, how is this statement verified?
Andrex 6y ago
> While my 1st iPhone SE will get iOS 14, my Nexus 5X is still on Android 8. Google has improved this in the Pixel line, with three years of updates. https://support.google.com/pixelphone/answer/4457705 https://support.google.com/pixelphone/answer/4457705 My original Pixel (2016) received Android 10 last year. That's pretty good.
- jamesgeck0 6y ago
  Three years of updates is better than it used to be, but iOS devices average around five years of support, and I'm not sure that's enough either. Hardware devices should receive security updates until they start physically failing.
  - GeekyBear 6y ago
    The original iPhone SE is about to start it's sixth year of OS and Security updates. That's less than $70 per supported year.
  - AdamJacobMuller 6y ago
    > Hardware devices should receive security updates until they start physically failing. That's just entirely unreasonable. I recently dug my original iPhone (now 13 years old) out of a box and it still works fine, but, you can't expect Apple or Android to support 13-year-old devices.
    - pabs3 6y ago
      It is reasonable to not support 13-year-old operating systems but there shouldn't be any reason current operating systems can't support old devices. Certainly Linux based operating systems manage to do that.
    - jamesgeck0 6y ago
      Consider that Windows 10 still runs on some 13 year old devices. macOS supports devices almost eight years old. That's MUCH longer than the average mobile support period. Desktop/laptop users can also switch to Linux after the support period ends to extend the life of their hardware further. If mobile vendors can't do that, then they should limit support to the expected life span of a the battery under average daily usage conditions, starting on the date that device sales are discontinued. That's certainly less than 13 years. Alternatively, the manufacturer could just unlock the boot loader after the official support period ends and provide the community with the resources they need to support the device. Some people will continue to use their device until it is no longer functional. Either they can't afford frequent upgrades, or they're trying to reduce electronic waste, or whatever. It's wrong to strand those users on an unsafe platform.
p410n3 6y ago
I totally agree. Pixels are getting better, and Samsung flagships are getting their OS updates for 2-3 years and an additional 2 for security patches. That is.. barely good enough in my eyes.

FirstLvR 6y ago

this is exactly why Apple still rock at phones you may choose Android for the specs, guess what, your phone will still get deprecated in 2 years

BbzzbB 6y ago
Aside from gaming, which isn't prevalent aside from casual games in NA and EU to my knowledge, I'm not sure what someone may possibly need it's phone for where something like a S7 (a bit more than 4 years old) isn't largely sufficient. Not a diss on Apple, I think the iPhone 5 is vastly better than circa-2012 Android phones, I just disagree with the premise of throwing phones every 2 years as being remotely necessary (perhaps until the next paradigm shift in computing/web/mobile usage where current tech starts to be too sluggish).
- mrtksn 6y ago
  on Apple’s case, means good app experience for the users and the developers. for example, SwiftUI comes to iOS 13 or later. If most devices were to be left off without updates(which is the case with Android) most developers would be hesitant to pick up the newer shiniest technology. apps on android still tend to be ugly and old fashioned. sure, there’re exceptions but generally apps on iOS are fresh and consistent probably because developers can depend on the users having the latest platform.
- dawg- 6y ago
  Yeah but in the context of security your point is moot. No more updates means no more security patches, right? Throwing phones away every two years is of course not necessary, an Android phone from 2012 is probably perfectly usable - yet horribly insecure.
  - BbzzbB 6y ago
    Yeah I could have amended about security, but I was replying to a comment about specs and Android phones being deprecated after 2 years, which I don't interpret as being security-related.
    - dawg- 6y ago
      Fair enough, I was thinking in context of the overall thread. Cheers
- recursivecaveat 6y ago
  I had an S3 from launch for ~7 years before switching, and it was completely unusable by the end. Most websites and big-name apps halve in performance every 18 months or so. Doesn't help that your battery will be on its last legs by then. 2 years is definitely much more often than required, but until ad-tech corps and web developers call off the assault, we're stuck on the phone treadmill to some degree.
product50 6y ago
For a lot of folks, especially those at Hacker News, that is totally fine. It is interesting how people's perspectives change when it comes to defending their choice. So in this case, yeah Android seems secure but what happens after 2yrs - even though that point doesn't apply to them. Call out what is important to you vs. just talking about averages.
- thebruce87m 6y ago
  I’m on hacker news and I care about the environment. I don’t want perfectly good hardware going in to landfill. Apple supporting their phones for 5+ years is good, and they should be commended for doing this, but we should be introducing laws to make sure all manufacturers are doing this to a reasonable level.
throwaway8941 6y ago
Hmm. My $170 phone from the middle of 2014 is still working perfectly and shows no signs of being "deprecated". Every application I use gets frequent updates, including the browser. I don't have to worry about targeted attacks (as I am not a billionaire/movie star/CEO of a large company/whatever), and a new shiny iPhone won't help with those anyway. µBlock Origin (with JS disabled on most sites) protects me from everything else.
- jamesgeck0 6y ago
  Apps may be getting security updates, but when was the last time that the version of Android it's running was patched?
- p410n3 6y ago
  Yeah the security patches are still worth thinking about. There was a Media Framework bug that needed nothing but a PNG on your phone to get RCE and there was a bug with the bluetooth stack this year which also could achieve RCE when your bluetooth was turned on and an attacker knew the BSSID PNGs are easy to send and in times of Contact Tracing via Bluetooth... well there are certain risks to running unpatched
- GeekyBear 6y ago
  Didn't we recently learn that only Android 10 prevents background apps from constantly watching the contents of the clipboard?
- simonklitj 6y ago
  Isn’t that the point though? Your phone works perfectly, shouldn’t it still receive OS updates?
panpanna 6y ago
> deprecated in 2 years They get security updates for 3 years (longer for enterprise devices). System libraries and builtin apps such as browser are updated via play store indefinitely. But how many people _really_ use a phone more than 3 years?
- jamesgeck0 6y ago
  Anecdotally, most of the older folks I know will use hardware until it disintegrates because they don't use many apps and "it still works." I've seen a seven year old iPhone 5C in the wild.
Shared404 6y ago
Thus LineageOS (for those who want droid), or in the future postmarketOS (for those who don't care about app support). No, neither of these support all android phones, but they each support several.
- ta17711771 6y ago
  I'm a long-time fan, but Lineage breaks the Android security model - knowingly. Other AOSP variants are more secure by an order of magnitude.
  - Shared404 6y ago
    > Lineage breaks the Android security model - knowingly. That's gonna be a big nope from me then. I was unaware of this, thank you for bringing it up. I've been mostly unsuccessful trying to find other android variants that appear to still be maintained, would you mind pointing me towards one? I'll probably still wait for the PinePhone, but I'd like to stay knowledgeable on the subject.
    - genghizkhan 6y ago
      GrapheneOS might be something you like. https://grapheneos.org https://grapheneos.org
      - ta17711771 6y ago
        +1, this all day, over Linux phones with dubious security models/hardware switches that just delay exfiltration if it's going to happen on a non-verified boot device.
      - Shared404 6y ago
        Thank you, this is super interesting and may well wind up being something that I wind up using in the future. I noticed that it only officially supports the Pixel devices. I've always avoided the Pixel devices because I assumed that the firmware was closed source and therefore a privacy issue, especially coming from google. However, the FAQ states "These devices meet the stringent privacy and security standards and have substantial upstream and downstream hardening specific to the devices." Am I mistaken about the Pixel drivers being closed source? If not, how is this statement verified?

Andrex 6y ago

> While my 1st iPhone SE will get iOS 14, my Nexus 5X is still on Android 8. Google has improved this in the Pixel line, with three years of updates. https://support.google.com/pixelphone/answer/4457705 https://support.google.com/pixelphone/answer/4457705 My original Pixel (2016) received Android 10 last year. That's pretty good.

jamesgeck0 6y ago
Three years of updates is better than it used to be, but iOS devices average around five years of support, and I'm not sure that's enough either. Hardware devices should receive security updates until they start physically failing.
- GeekyBear 6y ago
  The original iPhone SE is about to start it's sixth year of OS and Security updates. That's less than $70 per supported year.
- AdamJacobMuller 6y ago
  > Hardware devices should receive security updates until they start physically failing. That's just entirely unreasonable. I recently dug my original iPhone (now 13 years old) out of a box and it still works fine, but, you can't expect Apple or Android to support 13-year-old devices.
  - pabs3 6y ago
    It is reasonable to not support 13-year-old operating systems but there shouldn't be any reason current operating systems can't support old devices. Certainly Linux based operating systems manage to do that.
  - jamesgeck0 6y ago
    Consider that Windows 10 still runs on some 13 year old devices. macOS supports devices almost eight years old. That's MUCH longer than the average mobile support period. Desktop/laptop users can also switch to Linux after the support period ends to extend the life of their hardware further. If mobile vendors can't do that, then they should limit support to the expected life span of a the battery under average daily usage conditions, starting on the date that device sales are discontinued. That's certainly less than 13 years. Alternatively, the manufacturer could just unlock the boot loader after the official support period ends and provide the community with the resources they need to support the device. Some people will continue to use their device until it is no longer functional. Either they can't afford frequent upgrades, or they're trying to reduce electronic waste, or whatever. It's wrong to strand those users on an unsafe platform.

p410n3 6y ago

I totally agree. Pixels are getting better, and Samsung flagships are getting their OS updates for 2-3 years and an additional 2 for security patches. That is.. barely good enough in my eyes.