4 ms·

> Figuring out what "easier sandboxing solutions" are actually secure and aren't just snake oil is a much taller order. It shouldn't be for a tech savvy user.

> Figuring out what "easier sandboxing solutions" are actually secure and aren't just snake oil is a much taller order. It shouldn't be for a tech savvy user. I'm sure there are plenty of articles covering this from reputable sources.

mindslight 3y ago
> It shouldn't be for a tech savvy user. I'm sure there are plenty of articles covering this from reputable sources. I'm sorry, but this reads as straight up Dunning-Kruger. Care to suggest any articles about these "easier sandboxing solutions" ? Popular articles on Android security are just as likely to rot your brain as they are to inform you. Remember that trend of "task killers" ? If you were referring to your earlier link to Island - using Android Work Profiles on its own adds some security properties, but it's nowhere near comprehensive enough to assume your device now represents you. The problem is that security is essentially a prove-a-negative endeavor. You can add "solutions" and configure things all day long for a simulation of making things more secure (see also: "antivirus"). But it's only by moving up to a higher context can you see/fix the holes. Witness that even with Graphene on Pixel, you still have the baseband processor doing who-knows-what behind the scenes, and the application processor likely has vulnerabilities to it (this is seemingly a step up from the legacy Qualcomm standard where the AP completely trusts the BB, but it's still a black box). It's just one of the best answers we've got right now for a secureish solution that fits in your pocket with a long battery life, and so it's appropriate to recommend it in a consumer security context. (You also haven't responded to the larger initial point I made, where adoption of these things are really not to the point where we can take them for granted in a societal context)
- PrimeMcFly 3y ago
  > I'm sorry, but this reads as straight up Dunning-Kruger. No offense, but I'm not sure you understand what Dunning-Kruger is if you think that. > Care to suggest any articles about these "easier sandboxing solutions" Did you even try searching? > Popular articles on Android security are just as likely to rot your brain as they are to inform you. Key words in my original statement: reputable. sources. I'm sorry, but you seem like you want to argue just for the sake of arguing. You also give off the vibe of being an armchair security expert, and as someone that does security professional as has for my entire career, I'm not really finding you to be credible. Same as someone screaming that security by obscurity doesn't work because they read it somewhere an heard other people say it. The point was simply that there are decent sandboxing solutions that are easy to find, and will protect you sufficiently from untrusted third party apps that are not trying to root your phone, but trying to exfil as much data as possible. That's it. And that remains true. Not really interested in discussing this further though, since I don't think this is a productive discussion. Cheers.
  - mindslight 3y ago
    I said Dunning-Kruger because you seem to be advocating doing Internet Research and following "reputable" pop suggestions of security solutions. This is the equivalent to rolling your own crypto - anyone can create a system that they themselves are satisfied is secure, and that's effectively what you're doing by mashing up random security apps with a proprietary Android distribution. These "decent sandboxing solutions" are all just front ends to Android Work Profiles. Trusting Work Profiles on a proprietary distribution is similar to just trusting the proprietary distribution as is - especially when most distributions have blobbed "Play Services" with backdoors into the OS. So in my opinion this isn't a particularly good path to go down to achieve trustable security, just as adding a bunch of band-aids to Microsoft Windows won't get you something trustable. And really, my overarching point is that the current state of secure user-representing Android is nowhere advanced enough in capabilities, auditing, or adoption to say that anyone can "just" do some things to be protected from the surveillance industry.
    - PrimeMcFly 3y ago
      > "reputable" pop suggestions Do you know what reputable means? Then why are you so obviously twisting the meaning of what I am saying to fit your argument?
      - mindslight 3y ago
        No, I don't. The word has many meanings, especially these days. And it's doing a lot of work in your argument.
        PrimeMcFly 3y ago
        Reputable simply means of good repute. Having good reputation. I.E. being credible and having credibility. In the context of tech savvy users, it wouldn't refer to the 'pop' articles you refer to.
        mindslight 3y ago

mindslight 3y ago

> It shouldn't be for a tech savvy user. I'm sure there are plenty of articles covering this from reputable sources. I'm sorry, but this reads as straight up Dunning-Kruger. Care to suggest any articles about these "easier sandboxing solutions" ? Popular articles on Android security are just as likely to rot your brain as they are to inform you. Remember that trend of "task killers" ? If you were referring to your earlier link to Island - using Android Work Profiles on its own adds some security properties, but it's nowhere near comprehensive enough to assume your device now represents you. The problem is that security is essentially a prove-a-negative endeavor. You can add "solutions" and configure things all day long for a simulation of making things more secure (see also: "antivirus"). But it's only by moving up to a higher context can you see/fix the holes. Witness that even with Graphene on Pixel, you still have the baseband processor doing who-knows-what behind the scenes, and the application processor likely has vulnerabilities to it (this is seemingly a step up from the legacy Qualcomm standard where the AP completely trusts the BB, but it's still a black box). It's just one of the best answers we've got right now for a secureish solution that fits in your pocket with a long battery life, and so it's appropriate to recommend it in a consumer security context. (You also haven't responded to the larger initial point I made, where adoption of these things are really not to the point where we can take them for granted in a societal context)

PrimeMcFly 3y ago
> I'm sorry, but this reads as straight up Dunning-Kruger. No offense, but I'm not sure you understand what Dunning-Kruger is if you think that. > Care to suggest any articles about these "easier sandboxing solutions" Did you even try searching? > Popular articles on Android security are just as likely to rot your brain as they are to inform you. Key words in my original statement: reputable. sources. I'm sorry, but you seem like you want to argue just for the sake of arguing. You also give off the vibe of being an armchair security expert, and as someone that does security professional as has for my entire career, I'm not really finding you to be credible. Same as someone screaming that security by obscurity doesn't work because they read it somewhere an heard other people say it. The point was simply that there are decent sandboxing solutions that are easy to find, and will protect you sufficiently from untrusted third party apps that are not trying to root your phone, but trying to exfil as much data as possible. That's it. And that remains true. Not really interested in discussing this further though, since I don't think this is a productive discussion. Cheers.
- mindslight 3y ago
  I said Dunning-Kruger because you seem to be advocating doing Internet Research and following "reputable" pop suggestions of security solutions. This is the equivalent to rolling your own crypto - anyone can create a system that they themselves are satisfied is secure, and that's effectively what you're doing by mashing up random security apps with a proprietary Android distribution. These "decent sandboxing solutions" are all just front ends to Android Work Profiles. Trusting Work Profiles on a proprietary distribution is similar to just trusting the proprietary distribution as is - especially when most distributions have blobbed "Play Services" with backdoors into the OS. So in my opinion this isn't a particularly good path to go down to achieve trustable security, just as adding a bunch of band-aids to Microsoft Windows won't get you something trustable. And really, my overarching point is that the current state of secure user-representing Android is nowhere advanced enough in capabilities, auditing, or adoption to say that anyone can "just" do some things to be protected from the surveillance industry.
  - PrimeMcFly 3y ago
    > "reputable" pop suggestions Do you know what reputable means? Then why are you so obviously twisting the meaning of what I am saying to fit your argument?
    - mindslight 3y ago
      No, I don't. The word has many meanings, especially these days. And it's doing a lot of work in your argument.
      - PrimeMcFly 3y ago
        Reputable simply means of good repute. Having good reputation. I.E. being credible and having credibility. In the context of tech savvy users, it wouldn't refer to the 'pop' articles you refer to.
        mindslight 3y ago