4 ms·

> It will be grandma getting fleeced. Not just grandma. We need to move away from the idea that just a handful of digital illiterate seniors will get screwed.

> It will be grandma getting fleeced. Not just grandma. We need to move away from the idea that just a handful of digital illiterate seniors will get screwed. Android has been the main target for malware for a while now. Nokia’s Threat Intelligence Report in 2021[0] reported that Android makes up more than half of all the infected systems, in the recent 2023 report this had dipped to 49%[1]. But as they’ve done in prior reports, this year they again highlight that most Android malware is a trojanized version of legitimate apps distributed via alternative means: > Android based devices are not inherently insecure. However, most smartphone malware is distributed as trojanized applications and since Android users can load application from just about anywhere, it’s much easier to trick them into installing applications that are infected with malware. Android users can protect themselves by only installing applications from secure app stores like Google Play and installing a mobile anti-virus product on their device. 0: https://pages.nokia.com/T006US-Threat-Intelligence-Report-2021.html https://pages.nokia.com/T006US-Threat-Intelligence-Report-20... 1: https://www.nokia.com/networks/security-portfolio/threat-intelligence-report/ https://www.nokia.com/networks/security-portfolio/threat-int...

g-b-r 3y ago
Uh installing from just about anywhere that's unheard of in the history of computing!!!
- turquoisevar 3y ago
  And nothing ever went wrong with that in the history of mankind, right?
  - g-b-r 3y ago
    It went so wrong that a history of computing exists!!! Anyhow, I don't argue that the security of most current computers is poor, but turning them into appsfromonestore-downloading devices is not the answer. (there are plenty of systems safer than Android)
g-b-r 3y ago
Whether those numbers are true, malware on Android can generally do a lot less damage than on other systems (first of all because Android is not used for servers and workstations).
- ceejayoz 3y ago
  A lot of very sensitive data is on phones, often including password managers and VPNs that might give quite a bit of access to said servers and workstations.
  - g-b-r 3y ago
    A lot of very sensitive data is on other computers, but they remain useful and safe enough despite allowing software not signed by Google. Meanwhile, for a lot of people around the world the only affordable computers are smartphones; and if they are so dumbed down, those people are enormously more limited than they'd need to in their capabilities.
    - scarface_74 3y ago
      They are not “safe enough” - ransomware, viruses, etc
      - g-b-r 3y ago
        If they're used they're safe enough..! Of course they -often- should be a lot safer, but not by turning them into Android or an iPhone
        deleted 3y ago
        [deleted]
- turquoisevar 3y ago
  > Whether those numbers are true Wow, hold on cowboy. If you’re going to insinuate stuff, you better come packing with some sources. > malware on Android can generally do a lot less damage than on other systems (first of all because Android is not used for servers and workstations). I suppose that depends on your definition of damage. Considering most of the trojanized apps consist of banking apps that subsequently drain their victims’ accounts, I’d say that’s pretty damaging.
Aunche 3y ago
Android is also the most popular OS in the world right now. There billions of people who developing countries who use a cheap Android phone as their only computing device. I'm sure a lot of them come bundled with rather questionable apps and app stores. https://en.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...
factormeta 3y ago
>Android users can protect themselves by only installing applications from secure app stores like Google Play and installing a mobile anti-virus product on their device. F-Droid is a much better option for consumers. If I download an app that runs on my hardware and uses my mobile data, then it would be dame good idea that NOT ONLY the source is available, but there is build-able from the available source.
- turquoisevar 3y ago
  I love going through source code and make my own build as much as the next geek here on HN, but let’s be honest here, to the average consumer both your comment and mine reads as gibberish. The threat report is written with the average consumer in mind, not a consumer who can read source code well enough to understand if there’s funny business going on.
  - g-b-r 3y ago
    That's why using F-Droid, which distributes apps *already built* by them, is such a good idea (albeit with a few risks of its own).
g-b-r 3y ago
Ok I just noticed that you called the play store a "secure app store". That's ludicrous.
- carstenhag 3y ago
  Comparing the play to the f-droid store, the f-droid store is not secure at all. You add your entry and have it built. After that, no one takes a look at your codebase. Only if it doesn't compile for weeks. F-Droid does not have restrictions based upon sensitive permissions, such as background location, phone & messaging, etc. The Play Store has seen a lot of shit and has adapted policies to get that blocked.
  - commoner 3y ago
    I find F-Droid more trustworthy than the Google Play Store because the F-Droid maintainers are much more transparent and communicative than Google is. The Play Store review process doesn't do a thorough job of checking apps for privacy or security issues and doesn't require apps to disclose anything other than their permissions. F-Droid reviews every app before accepting it into the main repository, and labels apps with tracking or other potential issues with "Anti-Features" labels.[1] Any user can inspect the source code of any app in F-Droid, while that's not even an option for proprietary apps in the Play Store. When someone notices an issue and reports it to F-Droid, the maintainers listen and either change or remove the app listing, with these removals being logged in their weekly updates.[2] For Google Play apps with issues that you happen to notice despite most of the apps being closed source, unless they get media coverage, you'd be lucky to get anything other than canned responses from Google when you report them. F-Droid also has some great apps that depend on sensitive permissions that are forbidden by Google Play, such as the AdAway[3] ad blocker which uses either the Android VPN interface or system hosts file. AdAway enhances user privacy and security by blocking trackers and malware hosts, so Google did not improve Android by removing AdAway from the Play Store. [1] Anti-Features on F-Droid: https://f-droid.org/docs/Anti-Features/ https://f-droid.org/docs/Anti-Features/ [2] F-Droid weekly updates: https://f-droid.org/en/news/ https://f-droid.org/en/news/ [3] AdAway: https://f-droid.org/packages/org.adaway/ https://f-droid.org/packages/org.adaway/

g-b-r 3y ago

Uh installing from just about anywhere that's unheard of in the history of computing!!!

turquoisevar 3y ago
And nothing ever went wrong with that in the history of mankind, right?
- g-b-r 3y ago
  It went so wrong that a history of computing exists!!! Anyhow, I don't argue that the security of most current computers is poor, but turning them into appsfromonestore-downloading devices is not the answer. (there are plenty of systems safer than Android)

g-b-r 3y ago

Whether those numbers are true, malware on Android can generally do a lot less damage than on other systems (first of all because Android is not used for servers and workstations).

ceejayoz 3y ago
A lot of very sensitive data is on phones, often including password managers and VPNs that might give quite a bit of access to said servers and workstations.
- g-b-r 3y ago
  A lot of very sensitive data is on other computers, but they remain useful and safe enough despite allowing software not signed by Google. Meanwhile, for a lot of people around the world the only affordable computers are smartphones; and if they are so dumbed down, those people are enormously more limited than they'd need to in their capabilities.
  - scarface_74 3y ago
    They are not “safe enough” - ransomware, viruses, etc
    - g-b-r 3y ago
      If they're used they're safe enough..! Of course they -often- should be a lot safer, but not by turning them into Android or an iPhone
      - deleted 3y ago
        [deleted]
turquoisevar 3y ago
> Whether those numbers are true Wow, hold on cowboy. If you’re going to insinuate stuff, you better come packing with some sources. > malware on Android can generally do a lot less damage than on other systems (first of all because Android is not used for servers and workstations). I suppose that depends on your definition of damage. Considering most of the trojanized apps consist of banking apps that subsequently drain their victims’ accounts, I’d say that’s pretty damaging.

Aunche 3y ago

Android is also the most popular OS in the world right now. There billions of people who developing countries who use a cheap Android phone as their only computing device. I'm sure a lot of them come bundled with rather questionable apps and app stores. https://en.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...

factormeta 3y ago

>Android users can protect themselves by only installing applications from secure app stores like Google Play and installing a mobile anti-virus product on their device. F-Droid is a much better option for consumers. If I download an app that runs on my hardware and uses my mobile data, then it would be dame good idea that NOT ONLY the source is available, but there is build-able from the available source.

turquoisevar 3y ago
I love going through source code and make my own build as much as the next geek here on HN, but let’s be honest here, to the average consumer both your comment and mine reads as gibberish. The threat report is written with the average consumer in mind, not a consumer who can read source code well enough to understand if there’s funny business going on.
- g-b-r 3y ago
  That's why using F-Droid, which distributes apps *already built* by them, is such a good idea (albeit with a few risks of its own).

g-b-r 3y ago

Ok I just noticed that you called the play store a "secure app store". That's ludicrous.

carstenhag 3y ago
Comparing the play to the f-droid store, the f-droid store is not secure at all. You add your entry and have it built. After that, no one takes a look at your codebase. Only if it doesn't compile for weeks. F-Droid does not have restrictions based upon sensitive permissions, such as background location, phone & messaging, etc. The Play Store has seen a lot of shit and has adapted policies to get that blocked.
- commoner 3y ago
  I find F-Droid more trustworthy than the Google Play Store because the F-Droid maintainers are much more transparent and communicative than Google is. The Play Store review process doesn't do a thorough job of checking apps for privacy or security issues and doesn't require apps to disclose anything other than their permissions. F-Droid reviews every app before accepting it into the main repository, and labels apps with tracking or other potential issues with "Anti-Features" labels.[1] Any user can inspect the source code of any app in F-Droid, while that's not even an option for proprietary apps in the Play Store. When someone notices an issue and reports it to F-Droid, the maintainers listen and either change or remove the app listing, with these removals being logged in their weekly updates.[2] For Google Play apps with issues that you happen to notice despite most of the apps being closed source, unless they get media coverage, you'd be lucky to get anything other than canned responses from Google when you report them. F-Droid also has some great apps that depend on sensitive permissions that are forbidden by Google Play, such as the AdAway[3] ad blocker which uses either the Android VPN interface or system hosts file. AdAway enhances user privacy and security by blocking trackers and malware hosts, so Google did not improve Android by removing AdAway from the Play Store. [1] Anti-Features on F-Droid: https://f-droid.org/docs/Anti-Features/ https://f-droid.org/docs/Anti-Features/ [2] F-Droid weekly updates: https://f-droid.org/en/news/ https://f-droid.org/en/news/ [3] AdAway: https://f-droid.org/packages/org.adaway/ https://f-droid.org/packages/org.adaway/