7 ms·

In the Android security model, this is not a capability that should have ever been provided to apps to begin with. It allows for apps to have almost free reign

In the Android security model, this is not a capability that should have ever been provided to apps to begin with. It allows for apps to have almost free reign over the filesystem of other apps (read, write, modify), among other powerful capabilities. No flagship Android phones on the market allow this. It would be like if the Facebook app on your iOS device could read all of the files of your banking app, or notes app. It's just not something that is enabled in any Android system claiming to have some level of security.

PEDRO0147 3y ago
It is heartbreaking and very disappointing to feel not loved and appreciated enough because if you are loved and appreciated enough by your partner there will be no need for her to cheat and give any attention to any man other than yourself, I felt this way for so many years without knowing what to do and I couldn't leave her because there was no concrete evidence to back up the feelings I had and none of my families believed me when I told them I think my wife was seeing someone else so I was determined to prove it, I went searching online on how to hack or spy my wife phone without her knowing then I saw a lot of people recommending Marie as the best in the game well I wasted no time in contacting via on (MARIECONSULTANCYOZ@GMAIL.COM and INSTAGRAM :MARIE_CONSULTANCY) and she gave me full access to her phone I was able to get the evidence needed
oefrha 3y ago
Yeah, it’s amusing that the author simultaneously claims that (a) it’s a “core OS capability”; (b) it’s a developer debugging capability gated behind so many hoops that it can’t be abused (which is of course nonsense because even though each connection needs to be approved, the app allegedly only clearing other apps’ cache could be doing any number of evil things after the approval). These are incompatible claims. You can fundamentally disagree with the Android security and isolation model, but if you were okay with it before this update, then the arguments presented are just an incoherent mess.
barnabee 3y ago
With my permission an app should be able to read all the files on the device, even those created by other apps. It’s my device not the OS or app manufacturer’s! I’m totally onboard with per-app segregated storage as a default, but this feature is clearly gated behind user permission.
- throw0101b 3y ago
  > With my permission […] And as we've seen in the PC space, this will absolutely destroy security as the general population will simply hit "Ok" or "Allow" on any (security) prompt so they can get to their desired goal.
  - kevincox 3y ago
    I hate to say it but at some point it is their device and they can install malware if they want to. I think it is good to put up some warnings and make particularly dangerous permissions particularly hard to give. But at some point it is my device and you need to get out of my way.
    - growse 3y ago
      If them installing malware had zero impact on the rest of us, sure. Meanwhile, in the real world, externalities exist.
      - TeMPOraL 3y ago
        Yes, but one of the major externalities in this context is security industry smothering every computing platform, turning it from a bicycle for the mind into a TV for the mind.
  - PhilipRoman 3y ago
    Need to hide it behind a terminal with scary monospace letters.
    - 3y ago
barrkel 3y ago
This "feature" is what prevents my backup app backing up my WhatsApp photos. It's not a feature I want. I want to enable this on demand.
- roneythomas6 3y ago
  In WhatsApp you can enable save photos and videos to your phone gallery and then any backup app can do backups. Google Photos and numerous other apps are able backup WhatsApp photos.
  - barrkel 3y ago
    Unfortunately rsync can't see the galleries populated by WhatsApp. I basically paused my backup efforts until I have the energy to configure a harder to use system like syncthing or similar.
bakugo 3y ago
>It allows for apps to have almost free reign over the filesystem of other apps (read, write, modify), among other powerful capabilities What went so wrong with personal computing that allowing an application to have access to the files on the device with the user's permission is now considered an unthinkable crime? Is the average smartphone user so clueless about the capabilities of their device beyond scrolling through tiktok that the use cases for this are beyond them? It's because of people like you that I can't even load up an FTP app to backup the files on my android phone to my PC anymore.
- philistine 3y ago
  Let’s never blame the corporations hoovering all the data to carelessly resell it to marketers and who-knows-who. Instead let’s blame people on a forum.
  - bakugo 3y ago
    Yes, I will blame people on a forum for falling for such a dumb trick. The corporations "hoovering all the data" (such as Google themselves) are the same ones providing you with a convenient "solution" to the problem they caused: restricting your own access over the devices you supposedly own.
- pushedx 3y ago
  Here's the scenario in question. Your average person with a smartphone, who is not so technically inclined, downloads a game of some sort. The game upon first launch pops up a dialog which says "to provide you with the best experience, we need to clean up temporary files on your device, when prompted by the dialog (screenshot of system dialog), please press 'OK'." The user is then presented with the relatively scary system dialog which says "Allow this app to use system debugging features?", which they have seen 100 times and never understood, decides that this time they will press 'OK'. The game then proceeds to send all of their photos to a malicious actor for whatever purposes. The average person simply isn't cognizant of the dire security and privacy consequences of many of the things that they do when interacting with a computer. Note that I am NOT advocated for the removal of ADB. As an Android developer, I once used adb on a daily basis. I also love the idea of using adb to ftp my filesystem to my local machine for the sake of backups and whatever other useful purposes. In the case of the FireTV, I believe that if the device is put into developer mode, ADB can still be accessed over a USB cable. I think this great, and necessary for development and other use cases. The point here is about making a system less likely to cause incomprehensible harm to the average person. Android and iOS were an opportunity to rethink the security model of computing (for computers that most people carry with them and use every few minutes), and I think that's great.

PEDRO0147 3y ago

It is heartbreaking and very disappointing to feel not loved and appreciated enough because if you are loved and appreciated enough by your partner there will be no need for her to cheat and give any attention to any man other than yourself, I felt this way for so many years without knowing what to do and I couldn't leave her because there was no concrete evidence to back up the feelings I had and none of my families believed me when I told them I think my wife was seeing someone else so I was determined to prove it, I went searching online on how to hack or spy my wife phone without her knowing then I saw a lot of people recommending Marie as the best in the game well I wasted no time in contacting via on (MARIECONSULTANCYOZ@GMAIL.COM and INSTAGRAM :MARIE_CONSULTANCY) and she gave me full access to her phone I was able to get the evidence needed

oefrha 3y ago

Yeah, it’s amusing that the author simultaneously claims that (a) it’s a “core OS capability”; (b) it’s a developer debugging capability gated behind so many hoops that it can’t be abused (which is of course nonsense because even though each connection needs to be approved, the app allegedly only clearing other apps’ cache could be doing any number of evil things after the approval). These are incompatible claims. You can fundamentally disagree with the Android security and isolation model, but if you were okay with it before this update, then the arguments presented are just an incoherent mess.

barnabee 3y ago

With my permission an app should be able to read all the files on the device, even those created by other apps. It’s my device not the OS or app manufacturer’s! I’m totally onboard with per-app segregated storage as a default, but this feature is clearly gated behind user permission.

throw0101b 3y ago
> With my permission […] And as we've seen in the PC space, this will absolutely destroy security as the general population will simply hit "Ok" or "Allow" on any (security) prompt so they can get to their desired goal.
- kevincox 3y ago
  I hate to say it but at some point it is their device and they can install malware if they want to. I think it is good to put up some warnings and make particularly dangerous permissions particularly hard to give. But at some point it is my device and you need to get out of my way.
  - growse 3y ago
    If them installing malware had zero impact on the rest of us, sure. Meanwhile, in the real world, externalities exist.
    - TeMPOraL 3y ago
      Yes, but one of the major externalities in this context is security industry smothering every computing platform, turning it from a bicycle for the mind into a TV for the mind.
- PhilipRoman 3y ago
  Need to hide it behind a terminal with scary monospace letters.
  - 3y ago

barrkel 3y ago

This "feature" is what prevents my backup app backing up my WhatsApp photos. It's not a feature I want. I want to enable this on demand.

roneythomas6 3y ago
In WhatsApp you can enable save photos and videos to your phone gallery and then any backup app can do backups. Google Photos and numerous other apps are able backup WhatsApp photos.
- barrkel 3y ago
  Unfortunately rsync can't see the galleries populated by WhatsApp. I basically paused my backup efforts until I have the energy to configure a harder to use system like syncthing or similar.

bakugo 3y ago

>It allows for apps to have almost free reign over the filesystem of other apps (read, write, modify), among other powerful capabilities What went so wrong with personal computing that allowing an application to have access to the files on the device with the user's permission is now considered an unthinkable crime? Is the average smartphone user so clueless about the capabilities of their device beyond scrolling through tiktok that the use cases for this are beyond them? It's because of people like you that I can't even load up an FTP app to backup the files on my android phone to my PC anymore.

philistine 3y ago
Let’s never blame the corporations hoovering all the data to carelessly resell it to marketers and who-knows-who. Instead let’s blame people on a forum.
- bakugo 3y ago
  Yes, I will blame people on a forum for falling for such a dumb trick. The corporations "hoovering all the data" (such as Google themselves) are the same ones providing you with a convenient "solution" to the problem they caused: restricting your own access over the devices you supposedly own.
pushedx 3y ago
Here's the scenario in question. Your average person with a smartphone, who is not so technically inclined, downloads a game of some sort. The game upon first launch pops up a dialog which says "to provide you with the best experience, we need to clean up temporary files on your device, when prompted by the dialog (screenshot of system dialog), please press 'OK'." The user is then presented with the relatively scary system dialog which says "Allow this app to use system debugging features?", which they have seen 100 times and never understood, decides that this time they will press 'OK'. The game then proceeds to send all of their photos to a malicious actor for whatever purposes. The average person simply isn't cognizant of the dire security and privacy consequences of many of the things that they do when interacting with a computer. Note that I am NOT advocated for the removal of ADB. As an Android developer, I once used adb on a daily basis. I also love the idea of using adb to ftp my filesystem to my local machine for the sake of backups and whatever other useful purposes. In the case of the FireTV, I believe that if the device is put into developer mode, ADB can still be accessed over a USB cable. I think this great, and necessary for development and other use cases. The point here is about making a system less likely to cause incomprehensible harm to the average person. Android and iOS were an opportunity to rethink the security model of computing (for computers that most people carry with them and use every few minutes), and I think that's great.