Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pixel Security

security.googleblog.com

Post reply on HN
Print view View original

31–40 of 152 posts

Re: Pixel Security

#31

Post by jwtadvice »

sigmar wrote: post #8
jwtadvice wrote: post #4

Pixel/Google does not motivate a threat model under which to evaluate or understand their design and marketing promises, but we can take a hint from "protects your data if your phone falls into someone else's hands." - Namely thefts of opportunity. Unlike other phone manufacturers, Google does not promise potential customers that your data will be protected from Google, it's partners and from law enforcement and mass…

>Unlike other phone manufacturers, Google does not promise potential customers that your data will be protected from Google, it's partners and from law enforcement and mass surveillance programmes. Are you referring to Apple? Because they don't promise that either.

I used the term 'motivate' specifically because of the PR language intending for customers to evaluate the Apple product as something that could be used by those who need to use their phone for private and/or sensitive reasons.

Apple of course backdoors their phones for government surveillance access. But they do motivate a threat model that includes government surveillance.

I know parsing my comment in this way may seem difficult, but I used the terminology I did on purpose.

There are no illusions that Apple achieved the security properties that it has motivated.

Google Pixel does not even pretend to address the security concerns of journalists, politically active citizens, IT professionals, or individuals contacting attorneys.

Re: Pixel Security

#32

Post by mtgx »

Is this meant to be a sort of generic response to this issue? (which they still don't seem to be addressing here)

https://plus.google.com/u/0/+DeesTroy/posts/R7V3knn3f1s

Or perhaps to this?

http://www.theregister.co.uk/2016/11/11/google_pixel_pwned_i...

Still waiting on Google to at least match, if not surpass, Apple's long-term support in regards to updates (which is about twice as much what Google offers right now, even though the Pixel has identical prices to the iPhones, at every level).

Re: Pixel Security

#33

Post by r1ch »

Klathmon wrote: post #16
jc4p wrote: post #13

Just FYI in case anyone is considering buying a Pixel: I strongly urge you not to. http://kasrarahjerdi.com/2016/11/dont-buy-anything-made-by-g... They have no Google provided support, if you drop the phone and break it your only option (if you didn't buy the third-party warranty upsell) is to take it to a repair shop. I called the ones near me, none had seen or touched the device before. Don't spend $800 on a phone…

Is that a common thing? Being able to send your device back to the manufacturer for user inflicted issues for repair? I can't say I've ever done that with any product ever...

It's quite common. HTC even advertise it as something you can do for free: http://www.htc.com/us/uh-oh-protection/

Re: Pixel Security

#34

Post by bduerst »

jc4p wrote: post #13

Just FYI in case anyone is considering buying a Pixel: I strongly urge you not to. http://kasrarahjerdi.com/2016/11/dont-buy-anything-made-by-g... They have no Google provided support, if you drop the phone and break it your only option (if you didn't buy the third-party warranty upsell) is to take it to a repair shop. I called the ones near me, none had seen or touched the device before. Don't spend $800 on a phone…

Wait - What kind of phone manufacturer offers accident coverage right out of the box?

Re: Pixel Security

#35

Post by dehugger »

jwtadvice wrote: post #31
sigmar wrote: post #8

Earlier quoted context omitted.

>Unlike other phone manufacturers, Google does not promise potential customers that your data will be protected from Google, it's partners and from law enforcement and mass surveillance programmes. Are you referring to Apple? Because they don't promise that either.

I used the term 'motivate' specifically because of the PR language intending for customers to evaluate the Apple product as something that could be used by those who need to use their phone for private and/or sensitive reasons. Apple of course backdoors their phones for government surveillance access. But they do motivate a threat model that includes government surveillance. I know parsing my comment in this way may…

Perhaps I am not following your logic correctly, but it sounds like you are saying "Apple says government threats are an issue, but then backdoors the phones for the government anyways." which, to me, paints Apple in a very poor light.

Re: Pixel Security

#36

Post by palebluedot »

mianos wrote: post #12

I have not seen so many gotos in many many years. I guess it's the programming model in this case. I am sure this bit of code is going to be audited quite closely.

The use of goto in C for error and exception handling is good practice. It keeps the code easy to read, and also provides common code for error and/or exit handling. You'll see this paradigm used a lot in large open source C projects, such as the Linux kernel and QEMU.

In my experience, a lot of closed source C projects ban goto outright, in (IMO) an overly dogmatic adherence to the idea that all goto use is spaghetti code and therefore bad.

Re: Pixel Security

#37

Post by jwtadvice »

dehugger wrote: post #35
jwtadvice wrote: post #31

Earlier quoted context omitted.

I used the term 'motivate' specifically because of the PR language intending for customers to evaluate the Apple product as something that could be used by those who need to use their phone for private and/or sensitive reasons. Apple of course backdoors their phones for government surveillance access. But they do motivate a threat model that includes government surveillance. I know parsing my comment in this way may…

Perhaps I am not following your logic correctly, but it sounds like you are saying "Apple says government threats are an issue, but then backdoors the phones for the government anyways." which, to me, paints Apple in a very poor light.

You are following my logic correctly.

To be fair, the amount of leverage the US exerts on businesses for military purposes is astounding. This should be factored into the understanding.

Re: Pixel Security

#38

Post by infamousdutch »

unknownsavage wrote: post #22
jc4p wrote: post #13

Just FYI in case anyone is considering buying a Pixel: I strongly urge you not to. http://kasrarahjerdi.com/2016/11/dont-buy-anything-made-by-g... They have no Google provided support, if you drop the phone and break it your only option (if you didn't buy the third-party warranty upsell) is to take it to a repair shop. I called the ones near me, none had seen or touched the device before. Don't spend $800 on a phone…

It's funny, I'm this exact same boat. My pixel died a little after two week (which is the requirement to get a return). I filled out their warranty claim thing, and >48 hours finally got a response, which is a trouble shooting guide. I replied that I tried all that stuff, and had to wait another 2 days for another response (asking for information I already gave). I'm extremely disappointed. I thought with their whole…

If you bought it with a credit card, you might want to contact your card's customer service number. Most credit cards offer protection from this type of manufacturer "weaknesses".

Re: Pixel Security

#39

Post by Veratyr »

Klathmon wrote: post #6
Veratyr wrote: post #2

Encryption is all well and good but I feel like Google's handling of root causes a lot of issues. There are a lot of pretty basic things (like ad blocking or monitoring battery usage) that require root, which severely impacts the security of the device. EDIT: Okay, I stand corrected on ad blocking. Access to detailed battery stats however is locked behind the BATTERY_STATS permission which isn't accessible to anythin…

Not true for either of them. Apps can use the VPN API to do ad blocking without root, and there are tons of ways to do more battery monitoring without root, like the built in battery monitoring...

> there are tons of ways to do more battery monitoring without root

Sorry, I mean more than the built in monitor, which is largely useless.

There is no API through which I can enumerate wakelocks, CPU usage, GPS usage, mobile radio traffic and activity, wifi radio traffic and activity or screen on/off time without system level permissions (i.e. built into the ROM). Therefore, there's no way for these things to be exposed to me as a user.

There used to be a permission called BATTERY_STATS but it was removed years ago and Google has been utterly unreceptive to reinstating it: https://code.google.com/p/android/issues/detail?id=61975

And of course there's a bunch of apps on my device (Pixel) that have that permission such as Qualcomm's CNE app, Play Services (com.android.vending), another Qualcomm package (com.qualcomm.qti.auth.secureextauthservice) and a bunch of other Qualcomm packages.

Re: Pixel Security

#40

Post by wilg »

r1ch wrote: post #33
Klathmon wrote: post #16

Earlier quoted context omitted.

Is that a common thing? Being able to send your device back to the manufacturer for user inflicted issues for repair? I can't say I've ever done that with any product ever...

It's quite common. HTC even advertise it as something you can do for free: http://www.htc.com/us/uh-oh-protection/

They also advertise it as "hassel"-free, which is funny.
Post reply on HN