6 ms·

Tell that to all those assholes that are making malware and scamming society on billions. Most of users are not able to keep themselves safe in the internet -

• fimdomeio 1y ago
  You don't have to prevent root access. You just have to inform user of the risks, void warranties if you want but let users do whatever they want with the hardware that they own.
  • ZiiS 1y ago
    Yes, very clear warnings; I could live with a small permanent icon in the status bar (via the GPU firmware) etc. But absolutely should not void warranties (overclocking might but never just root).
    • Cthulhu_ 1y ago
      If you can't destroy your own hardware by rooting, do you have true root access?
      • ZiiS 1y ago
        Easy enough to have an efuse blow if you overvolt; then an dificult conversion on a warrenty claim. Whilst ideologically this is ceeding some control I can accept it.
  • perihelions 1y ago
    > "void warranties if you want " Please don't push the Overton Window any further. Installing my own software on my own PC should never void the hardware vendor's warranty. That delegitimizes the core concept of a PC. (A horrific possible dystopia just flashed through my mind: "I'd love to throw out Chrome and install Firefox so that I could block ads, but, the laptop is expensive, and I can't afford voiding the warranty". I bet Google would *love* that world. Or, a UK version: "I'd love to use a VPN, but, regulation banned them from the approved software markets, and anything else would permanently set the WARRANTY_VIOLATED flag in the TPM").
    • avhception 1y ago
      This is where it's heading, and I see this as the real driving force behind secure boot on x86_64.
    • Cthulhu_ 1y ago
      It depends on what your software does; if it removes hardware protections then your warranty should be voided. Of course, those protections are either hardware or impossible to remove, like emergency cooling / lowering voltage when stuff overheats.
  • bzzzt 1y ago
    Even if it's illegal? (like transmitting on forbidden frequencies) It's not always the user who's installing software. Lots of people depend on other people to manage their devices. Manufacturers like the hardware they delivered to be trusted so users trust it regardless of who handled it.
    • AshamedCaptain 1y ago
      I always hear as the excuse but it is ridiculous. If the user wants to transmit on "illegal" frequencies, all he has to do is to change the country setting in their Wi-Fi router, et voilà, illegal transmissions. The entire Android OS has about as much access to radios than your average PC, if not less. In fact, even on recent android devices, wireless modems still tend to show up to the OS as serial devices speaking AT (hayes) (even if the underlying transport isn't, or even if the baseband is in the same chip). Getting them to transmit illegal frequencies is as much easy or hard as is getting a 4G USB adapter to do it.
    • sam_lowry_ 1y ago
      At least in EU, transmitting is illegal, having hardware to transmit is not. That's why people can buy TX/RX SDRs and Yaesu transceivers without a license. AFAIK the radioamateur world, serious violations of frequency plans are rare and are usually quickly handled by regulators. OTOH, everyone is slightly illegal, e.g. transmitting encrypted texts or overpowering their rigs, but that's part of the fun.
      • jjkaczor 1y ago
        And in some locations, quickly handled by the local amateur community, with foxhunts and community outreach to frequency violators - only getting regulators involved when just talking to the offenders fails.
    • goku12 1y ago
      > Even if it's illegal? (like transmitting on forbidden frequencies) That's not relevant here. If frequencies are illegal, it should be impossible to program it in such a way. But even otherwise, it's the responsibility of the user to follow local laws. If I have a PTT phone, it's not legal for me to use forbidden frequencies just because it's possible. Why do these manufacturers care about what doesn't concern them when they violate even bigger laws all the time? > It's not always the user who's installing software. Lots of people depend on other people to manage their devices. That should be up to the user. Here we are talking about users who want to decide for themselves what their device does. You're talking as if giving the user that choice is the injustice. Nope. Taking away the choice is. > Manufacturers like the hardware they delivered to be trusted so users trust it regardless of who handled it. I see what you did here. But here is the thing. Securing a device is not antithetical to the user's freedom. That was what secure boot chain was originally supposed to accomplish until Microsoft managed to corrupt it into a tool for usurping control from the user. Manufacturer trust is a farce. They should be deligating that trust to the user upon the sale of the device, through well proven concepts as explained above. They chose to distrust the user instead. Why? Greed!
  • deleted 1y ago
    [deleted]
  • CraigRood 1y ago
    I don't think users understand the risks. I'm broadly accepting of the protection of end users through mechanisms. Peoples entire lives are managed through these small devices. We need much better sandboxing to almost create a separate 'VM' for critical apps such as banking and messaging.
  • mhast 1y ago
    The problem is Dunning Kruger effect. The people who shouldn't disable these security features tend to be the first to do so. And then complain the loudest when the enter the "find out" phase.
  • scott_w 1y ago
    > You just have to inform user of the risks Warnings aren't always enough, sometimes we have to lock people down and physically prevent them from harming themselves. It's not always people being stupid. I recall reading an article by someone who got scammed who seemed generally quite knowledgeable about the type of scam he fell for. As he put it, he was tired, distracted, and caught at the right time. Outside of that, a lot of the general public have a base assumption of "if the device lets me do it, it's not wrong," and just ignore the warnings. We get so many stupid pop-ups, seemingly silly warning signs (peanuts "may contain nuts") that it's easy to dismiss this as just one example of the nanny state gone mad.
    • alexvitkov 1y ago
      Please read again the sentence you just typed. > We have to lock people down and physically prevent them from harming themselves. You can apply this argument to literally anything, and taken to its logical conclusion, this is exactly what will happen.
      • scott_w 1y ago
        > sometimes we have to lock people down and physically prevent them from harming themselves I highlighted the word you missed, deliberately in my opinion, as it completely changes the meaning to exclude your frankly idiotic assertion.
        • alexvitkov 1y ago
          The idiotic statement is yours. If the "sometimes" is important to you, you can have it - you're not the first person on the internet to play word games. But unless you can come up with a very detailed list of when it's acceptable "to lock people down and physically prevent them from harming themselves" and when it's not acceptable (it never is, it's a crazy statement), and I don't think you have such a list, your "sometimes" just means "whenever I, as the person writing the software judge", rendering it completely meaningless.
    • Y_Y 1y ago
• epolanski 1y ago
  I know literally 0, 0 people who have installed malwares or had their smartphones hacked in their life times. The very few I know that have had this happen where all computer users, and virtually all victims of social hacking such as "hey, I'm from IT department, sending you an email, could you please...". A friend of mine exposed sensible data of thousands of customers of her bank like this.
  • d1sxeyes 1y ago
    … who know about it.
    • jack_pp 1y ago
      > scamming society on billions so somehow my friends and family got hacked, lost money but don't know about it? actually i know of one case where my mom got billed for airbnb even tho she didn't book the ticket but pretty sure I had her password in a text file so might've been me that got hacked on my PC. Airbnb refunded her and then had no more issues. So 1 case in my entire life and it probably wasn't on a mobile device.
      • victorbjorklund 1y ago
        You can get hacked without losing money. If you devices gets used in a bot net, if your computer gets used to mine crypto, etc. Your work files gets stolen by hackers and sold to competitors in china, etc. All those are things normal people wont notice.
        • jack_pp 1y ago
          > bot net Fair enough, but besides mail spam which is filterable and DDos for which there are counter services, does it really impose that big of an issue to justify such a strict lockdown? > mine crypto Considering how little mining power mobile devices have and how anyone would figure out pretty fast there's a problem with heat / battery issues from it idk if that's really realistic these days. Hard to keep this one hidden while also profitable > work files gets stolen I think this has already been solved by corporations on PCs, there are already solutions for locking down a work issues laptop as for phone I think that's rarely an issue since people mostly use it for communications so probably rare for really sensitive info to be on there. Overall those issues don't really hit me as that critical to impose such measures and there are ways to severely limit impact for people that care about security
• nisegami 1y ago
  I think we should actively make the web more hostile again.
• thecupisblue 1y ago
  This is not related to malware or scams, and using that is nothing but a PR smoke screen. While Android is vulnerable, especially to user stupidity, people mostly get scammed by fake credit card charges or by giving access to their notifications and contacts allowing for spam. And yes, while there are "infected" APK's for popular apps , this again isn't the case here. The real case here is money. Apple earns $27B from commision on apps, while Google earns about $3B. Why? Because Android users are "less willing to pay", which includes pirated APK's and "unlocked" app versions. Eliminating the possibility of using these for 99% of the people will be enough to force them to pay for that app/service in the end, raising the Play store revenues. Do not trust Google when it comes to "doing it for the user" - their mission is to establish as strong of a monopoly on the platforms and extract as much value as possible. They spent more money on lawyers & policy lobbyists in the last 10 years trying to keep Android closed than some S&P500 companies are worth.
  • cft 1y ago
    Their incentive is even stronger: most users of ReVanced for example unlock YouTube, which belongs to Google. In that case we are talking about 100% revenue loss, not 30% app commission. This goes for NewPipe, etc. I wonder if OsmAnd, Termux, F-Droid would survive this or will be casualties. Who will authenticate for a decentralized open source app that has 100 active contributors?
    • Belphemur 1y ago
      Exactly, especially when Google can revoke your account or keys at anytime. Basically this give Google the way to blacklist any app you release now, in or out the play store for the sake of "security". It's just about control and finally squashing the app that aren't to Google taste.
    • V__ 1y ago
      I can't image that ad blockers or ReVanced has any real impact on YouTube. I'm the only one I know using either. So that's 1 in about 300 maybe?
• mouse_ 1y ago
  Take away all these freedoms and users will still get scammed. It doesn't help and it's not the real point.
• goku12 1y ago
  > Tell that to all those assholes that are making malware and scamming society on billions. And then? I don't know how many times I've downloaded APKs, including obviously malicious ones by accident. But not once has it ever been installed - not even when it was deliberate. The only way I ever 'sideloaded' anything is using 3rd party stores (just fdroid and aurora in my case), which themselves had to be installed via ADB after enabling developer mode. If you have that much skill, you're almost surely skilled enough to understand the security implications of sideloading and choose wisely. And there are far worse malware available on play store than anything on fdroid repositories, if anything at all - anonymous or not. I hope you remember the SimpleMobileApps fiasco. People who installed it from fdroid were safe from the malicious update, but those who did it from play store were not, when the entire suite was turned into a spyware overnight. Not to mention the tea and boxscore apps scandal. Neither would have made it into fdroid. Google cares the least bit about security, if that isn't clear from the spyware tht each new android phone comes bundled with. In all, Google's claim of security here is deceptive and farcical. The actual target is going to be the patched apps like revanced, root access software and anything else similar that allows the savvy user to escape the unfair and arbitrary limitations imposed by Google. The ultimate target is the users' pockets. This entire discussion is full of people reaffirming that conclusion. But scapegoats will be found and sacrificed regardless. Let's just not for once. Google deserves the atmost and undiluted contempt and condemnation for their greed and their willingness to erode consumer rights that underlie such dishonestly worded hostile and unilateral decisions.
• account42 1y ago
  > Tell that to all those assholes that are making malware and scamming society on billions. So like Google? Software that acts against the wishes of the user is malware, let's not forget that.
  • Pentamerous 1y ago
    Completely agree. We seem to have forgotten the word "spyware", I don't see it used anymore because it became the norm. But let's call things by what they are.
• const_cast 1y ago
  Google themselves promotes malware - take a look at the play store. Adware, adware, adware, name meant to confuse people, more adware, probably has a keyloggers, adware adware, probably steals your data, adware adware. For fucks sake, Meta is at the point they're pulling malware tactics to sell ads. Circumventing permissions for app to browser talking? Really? FOR ADS? Thats where we're at? I'm over it. Anyone who thinks this has even the faintest thing to do with malware is legitimately delusional. Not misinformed, delusional.
• Intermernet 1y ago
  To install 3rd party APKs on Android involves deliberately removing some guard rails. You need to allow it in settings, you need to enable developer mode, you need to agree to each individual source as a trusted source. If people are still blaming malware on this, when malware exists in the actual Play store, then they're delusional. Right now, the average Joe can't click a link and install a 3rd party app. Meanwhile, you can install malware from the actual authorised sources, or even just come across a vulnerablity in chrome. Keeping your devices up to date with security patches will save orders of magnitude more people from malicious software than stopping 3rd party app installation. I occasionally develop Android apps for myself (mostly out of curiosity and experimentation, but sometimes out of a need for some particular functionality). I'm not going to apply for some developer permit and verification just to do this. I may as well buy a damn iPhone.
  • tadfisher 1y ago
    > You need to allow it in settings, you need to enable developer mode, you need to agree to each individual source as a trusted source. If people are still blaming malware on this, when malware exists in the actual Play store, then they're delusional. To be fair to the security folks at Google, people will follow these steps like clockwork. The only thing they care about is getting the app on their device. The root cause of all of this: banking/finance/payment apps figure they can trust your device, because no one has regulated a universal trust root into existence. Google encouraged this with SafetyNet/Play Integrity, and convincing Visa/MasterCard that devices can be trusted for contactless payments. Now there's one gaping hole left: you can still install unverified software from anywhere, and said software will use all tricks possible to convince users to grant accessibility permissions and give up the keys to the kingdom. There have been many attempts over the years to make this harder, but malicious apps are getting even more sophisticated, to the point of installing shortcuts to entire fake versions of your banking app on the home screen. So Google is being pressured by governments and markets to make it harder to produce installable malware, when a better way to prevent malware while protecting user freedom is already here: passkeys. You cannot steal passkeys with a third-party app, no matter what tricks you try, because they are tied to domains and APK signatures. Stop trusting stealable credentials and you stop needing to trust the entire hardware and software stack behind the app calling your backend.
• Cthulhu_ 1y ago
  Exactly this; the vast majority of people cannot be trusted with root access. And for those that can, the majority won't need or want it. While I do believe root access should be possible, it shouldn't be easy. Because I'm confident my dad who wants to pirate F1 instead of pay for whichever overpriced premium streaming platform bought the rights this year would root his ipad and install a dodgy stream player if it was easy.
  • buyucu 1y ago
    My 75 year old mother has root access, and she is perfectly fine.
• buyucu 1y ago
  Malware is not a huge problem that requires restructuring the entire ecosystem to be closed and authoritarian. Nobody I know has ever had problems with malware or scams on Android. This has nothing to do with malware, and has everything to do with locking down the Android ecosystem to keep out competitors to Google's services.