4 ms·

But it still shouldn't be Google's choice, but the OEM's.

Aunche 6y ago
It's partially Google's choice because they have their own deals with OEMs. Google doesn't want its reputation to be tarnished by OEMs making decisions that compromise Android's security. It's one thing if an informed user accepts these risks. It's another if Grandma gets hacked due to an avoidable attack vector.
- nsomaru 6y ago
  You must be living in another world. Have you seen the kind of useless uninstallable bloatware that comes on many Android phones? Google let’s all that crap slip but this is a security issue? Nah.
  - Aunche 6y ago
    How much of the uninstallable bloatware lets you sideload apps?
    - pmontra 6y ago
      The Samsung Store but we can argue if thats bloatware.
    - 2Gkashmiri 6y ago
      Have you checked a xiaomi or even a realme phone? Those phones have literal cancer as apps and uninstallable shit. Xiaomi even "recommends" apps in their launcher as some sort of light color and clicking just installs them. I have attempted to use adb to remove apps but many apps refuse because rom has locked them down. Besides, why should a phone have ads anyways? Arent users paying for a physical product at once? The same Samsung TV ads bullshit. Besides f-droid, do you know of any store that has respected curated or non curated list of apps?
- FractalParadigm 6y ago
  And yet, Google seems to have absolutely no problem allowing malware on the Play Store, in fact if I Google search "Play Store malware" the first four results are four separate articles, in four different months, from this year alone. If people are hardly batting an eye at that, and if Google continues to do little more than remove the offending apps, it's clear their reputation over the Play Store and app ecosystem is solidified and will not change, short of catastrophe. I just don't buy your answer. In fact, I don't even buy that most people know what Android actually is or that it's owned by Google in the first place; I know a frightening number number of people who still refer to their OnePlus or Pixel as a "Samsung." If the OEMs want to make that choice, they should absolutely be allowed to, and if one of the pre-installed apps becomes an attack vector it's more than easy enough for Google to say "we don't have control over that, take it up with [OEM] or [app dev]"
  - Aunche 6y ago
    IIRC, malware on Android apps generally fakes clicks to get free ad revenue and perform other operations technically allowed by the Android APIs. They don't compromise the security of the device because the apps are sandboxed. If the deal between Fortnite and Oneplus wouldn't cost Google any money, there's a good chance Google would let it slide, but that doesn't change that their concerns are legitimate. If a grassroots effort stopped this deal, we would all be cheering.
    - nodamage 6y ago
      It's not uncommon for Android malware to exploit system vulnerabilities to break out of the sandbox. - Agent Smith abused an installation vulnerability in order to inject malicious code into other installed APKs on the device. (https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/ https://research.checkpoint.com/2019/agent-smith-a-new-speci...) - HummingBad used multiple root exploits to auto-root 10 million devices. (https://arstechnica.com/information-technology/2016/07/virulent-auto-rooting-malware-takes-control-of-10-million-android-devices/ https://arstechnica.com/information-technology/2016/07/virul...) - xHelper similarly buried itself deep in the system partition in order to survive device resets, and went so far as rewriting libc.so to prevent you from mounting the system partition to remove it. (https://arstechnica.com/information-technology/2020/04/solved-how-android-backdoor-called-xhelper-survives-factory-resets/ https://arstechnica.com/information-technology/2020/04/solve...) You are also underestimating the amount of damage malware can cause even within the sandbox. - The CryCryptor ransomware abuses file access APIs to encrypt photos and videos on external storage and hold them hostage. (https://threatpost.com/emerging-ransomware-photos-videos-android/156893/ https://threatpost.com/emerging-ransomware-photos-videos-and...) - The DEFENSOR ID banking trojan abuses accessibility APIs to steal login credentials, text messages, and 2FA codes. (https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/0/ https://www.welivesecurity.com/2020/05/22/insidious-android-...) Even the majority of the adware you describe abuses system APIs to hide their own icons and draw their own ads on top of other apps. (Why Android even has an API that allows this, I have no idea...) (https://news.sophos.com/en-us/2019/10/08/icon-hiding-android-adware-returns-to-the-play-market/ https://news.sophos.com/en-us/2019/10/08/icon-hiding-android...) When it comes to malware, sandboxing is far from the panacea that some people seem to believe.
- stale2002 6y ago
  > Google's choice because they have their own deals with OEMs. You are describe textbook anti-competitive behavior. Using certain deals, to enforce exclusivity in this way, is a text book anti-trust violation (if it is determined that google has significant market power). If a company has significant market power, then just can't do what you are suggesting. In fact, I believe that Microsoft lost their anti-trust case, for doing almost the exact same behavior, of preventing preloading of other browser.
- mschuster91 6y ago
  > Google doesn't want its reputation to be tarnished by OEMs making decisions that compromise Android's security. If they were serious about that they would mandate and enforce open source along the entire Android stack that has root privileges on any Play-store certified phone. Ensure you have large quantities of alcohol at hand, then search for kernel leaks of a manufacturer that starts with M and ends with ediatek, and then look at the code "quality". And they are only the worst offenders...
- m4rtink 6y ago
  You mean those anticompetitive deals that basically prevent manufacturers from building competing mobile devices or else Google will block their access to Google Apps - the scheme called Open Headset Aliance?

It's partially Google's choice because they have their own deals with OEMs. Google doesn't want its reputation to be tarnished by OEMs making decisions that compromise Android's security. It's one thing if an informed user accepts these risks. It's another if Grandma gets hacked due to an avoidable attack vector.

nsomaru 6y ago
You must be living in another world. Have you seen the kind of useless uninstallable bloatware that comes on many Android phones? Google let’s all that crap slip but this is a security issue? Nah.
- Aunche 6y ago
  How much of the uninstallable bloatware lets you sideload apps?
  - pmontra 6y ago
    The Samsung Store but we can argue if thats bloatware.
  - 2Gkashmiri 6y ago
    Have you checked a xiaomi or even a realme phone? Those phones have literal cancer as apps and uninstallable shit. Xiaomi even "recommends" apps in their launcher as some sort of light color and clicking just installs them. I have attempted to use adb to remove apps but many apps refuse because rom has locked them down. Besides, why should a phone have ads anyways? Arent users paying for a physical product at once? The same Samsung TV ads bullshit. Besides f-droid, do you know of any store that has respected curated or non curated list of apps?
FractalParadigm 6y ago
And yet, Google seems to have absolutely no problem allowing malware on the Play Store, in fact if I Google search "Play Store malware" the first four results are four separate articles, in four different months, from this year alone. If people are hardly batting an eye at that, and if Google continues to do little more than remove the offending apps, it's clear their reputation over the Play Store and app ecosystem is solidified and will not change, short of catastrophe. I just don't buy your answer. In fact, I don't even buy that most people know what Android actually is or that it's owned by Google in the first place; I know a frightening number number of people who still refer to their OnePlus or Pixel as a "Samsung." If the OEMs want to make that choice, they should absolutely be allowed to, and if one of the pre-installed apps becomes an attack vector it's more than easy enough for Google to say "we don't have control over that, take it up with [OEM] or [app dev]"
- Aunche 6y ago
  IIRC, malware on Android apps generally fakes clicks to get free ad revenue and perform other operations technically allowed by the Android APIs. They don't compromise the security of the device because the apps are sandboxed. If the deal between Fortnite and Oneplus wouldn't cost Google any money, there's a good chance Google would let it slide, but that doesn't change that their concerns are legitimate. If a grassroots effort stopped this deal, we would all be cheering.
  - nodamage 6y ago
    It's not uncommon for Android malware to exploit system vulnerabilities to break out of the sandbox. - Agent Smith abused an installation vulnerability in order to inject malicious code into other installed APKs on the device. (https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/ https://research.checkpoint.com/2019/agent-smith-a-new-speci...) - HummingBad used multiple root exploits to auto-root 10 million devices. (https://arstechnica.com/information-technology/2016/07/virulent-auto-rooting-malware-takes-control-of-10-million-android-devices/ https://arstechnica.com/information-technology/2016/07/virul...) - xHelper similarly buried itself deep in the system partition in order to survive device resets, and went so far as rewriting libc.so to prevent you from mounting the system partition to remove it. (https://arstechnica.com/information-technology/2020/04/solved-how-android-backdoor-called-xhelper-survives-factory-resets/ https://arstechnica.com/information-technology/2020/04/solve...) You are also underestimating the amount of damage malware can cause even within the sandbox. - The CryCryptor ransomware abuses file access APIs to encrypt photos and videos on external storage and hold them hostage. (https://threatpost.com/emerging-ransomware-photos-videos-android/156893/ https://threatpost.com/emerging-ransomware-photos-videos-and...) - The DEFENSOR ID banking trojan abuses accessibility APIs to steal login credentials, text messages, and 2FA codes. (https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/0/ https://www.welivesecurity.com/2020/05/22/insidious-android-...) Even the majority of the adware you describe abuses system APIs to hide their own icons and draw their own ads on top of other apps. (Why Android even has an API that allows this, I have no idea...) (https://news.sophos.com/en-us/2019/10/08/icon-hiding-android-adware-returns-to-the-play-market/ https://news.sophos.com/en-us/2019/10/08/icon-hiding-android...) When it comes to malware, sandboxing is far from the panacea that some people seem to believe.
stale2002 6y ago
> Google's choice because they have their own deals with OEMs. You are describe textbook anti-competitive behavior. Using certain deals, to enforce exclusivity in this way, is a text book anti-trust violation (if it is determined that google has significant market power). If a company has significant market power, then just can't do what you are suggesting. In fact, I believe that Microsoft lost their anti-trust case, for doing almost the exact same behavior, of preventing preloading of other browser.
mschuster91 6y ago
> Google doesn't want its reputation to be tarnished by OEMs making decisions that compromise Android's security. If they were serious about that they would mandate and enforce open source along the entire Android stack that has root privileges on any Play-store certified phone. Ensure you have large quantities of alcohol at hand, then search for kernel leaks of a manufacturer that starts with M and ends with ediatek, and then look at the code "quality". And they are only the worst offenders...
m4rtink 6y ago
You mean those anticompetitive deals that basically prevent manufacturers from building competing mobile devices or else Google will block their access to Google Apps - the scheme called Open Headset Aliance?