Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

forbes.com

Post reply on HN
Print view View original

21–30 of 70 posts

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#21

Post by dessant »

ignoramous wrote: post #16
dessant wrote: post #11

A revocable permission for network access on Android would be a great step towards giving users more control over which apps can transmit their personal data. An entire class of apps could be rendered safe by disallowing network access, especially the ones that do work offline, but are keen to phone home.

This has been possible since Android 8, if not before. You could, per app, from the App Info page: 1. Disallow bg internet access. 2. Disallow fg internet access over wifi. 3. Disallow fg internet access over mobile network. I've been building an app that exposes privacy features like bouncing permissions when apps are in bg (remember AppOps?), firewalling apps by disallowing data usage, setting DNS over TLS to serve…

Is it possible that some of the controls for these network permissions you list are not in AOSP, but in a ROM made by the manufacturer of your device?

The ones I've seen had a setting only for restricting background data usage.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#23

Post by ignoramous »

dessant wrote: post #21
ignoramous wrote: post #16

Earlier quoted context omitted.

This has been possible since Android 8, if not before. You could, per app, from the App Info page: 1. Disallow bg internet access. 2. Disallow fg internet access over wifi. 3. Disallow fg internet access over mobile network. I've been building an app that exposes privacy features like bouncing permissions when apps are in bg (remember AppOps?), firewalling apps by disallowing data usage, setting DNS over TLS to serve…

Is it possible that some of the controls for these network permissions you list are not in AOSP, but in a ROM made by the manufacturer of your device? The ones I've seen had a setting only for restricting background data usage.

I've exercised this setting in Xiaomi, Oppo phones (Realme, Vivo, One Plus included) [0]. Unsure if it is in AOSP, but a user reported that its present in their Pixel running 8.1 [0]?

You could see if NoRoot Firewall (requires VPN) or Glasswire (may or may not require VPN) help you disallow internet access per-app.

[0] https://old.reddit.com/r/oneplus/comments/79g0ue/til_oxygeno...

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#24

Post by HenryBemis »

ignoramous wrote: post #16
dessant wrote: post #11

A revocable permission for network access on Android would be a great step towards giving users more control over which apps can transmit their personal data. An entire class of apps could be rendered safe by disallowing network access, especially the ones that do work offline, but are keen to phone home.

This has been possible since Android 8, if not before. You could, per app, from the App Info page: 1. Disallow bg internet access. 2. Disallow fg internet access over wifi. 3. Disallow fg internet access over mobile network. I've been building an app that exposes privacy features like bouncing permissions when apps are in bg (remember AppOps?), firewalling apps by disallowing data usage, setting DNS over TLS to serve…

Since I never trusted iOS setup that one cannot restrict WiFi access on apps I had a firewall on my (jailbroken iOS). Now on Android I do the same (not trust the OS or the Data/WiFi switches and again I use a firewall to block either Data or WiFi or both.

I also do this for data usage, e.g. Spotify and my podcatcher use Wi-fi while email etc use both data and WiFi.

Edit: in the same spirit I block all free apps that don't require network connectivity such as health/workout apps. I kill all ads, and keep my data within.

Edit2: android firewall is called "NoRoot Firewall"

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#25

Post by saagarjha »

ignoramous wrote: post #23
dessant wrote: post #21

Earlier quoted context omitted.

Is it possible that some of the controls for these network permissions you list are not in AOSP, but in a ROM made by the manufacturer of your device? The ones I've seen had a setting only for restricting background data usage.

I've exercised this setting in Xiaomi, Oppo phones (Realme, Vivo, One Plus included) [0]. Unsure if it is in AOSP, but a user reported that its present in their Pixel running 8.1 [0]? You could see if NoRoot Firewall (requires VPN) or Glasswire (may or may not require VPN) help you disallow internet access per-app. [0] https://old.reddit.com/r/oneplus/comments/79g0ue/til_oxygeno...

This might be a Chinese thing: iPhones sold there have an option to disable apps from connecting to WLAN but I haven't seen this on any other SKU.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#26

Post by saagarjha »

xchaotic wrote: post #5

Google fixing vulnerabilities even before the release can only be good news, but one does have to be wonder why a whole class of such vulnerabilities are even allowed after so many releases?

Because software has bugs?

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#27

Post by Someone1234 »

ignoramous wrote: post #16
dessant wrote: post #11

A revocable permission for network access on Android would be a great step towards giving users more control over which apps can transmit their personal data. An entire class of apps could be rendered safe by disallowing network access, especially the ones that do work offline, but are keen to phone home.

This has been possible since Android 8, if not before. You could, per app, from the App Info page: 1. Disallow bg internet access. 2. Disallow fg internet access over wifi. 3. Disallow fg internet access over mobile network. I've been building an app that exposes privacy features like bouncing permissions when apps are in bg (remember AppOps?), firewalling apps by disallowing data usage, setting DNS over TLS to serve…

I have a Pixel 3 with the latest retail release (Android 9/August 1, 2019). I cannot do any of the things you described for any apps via the App Info page.

I have permissions sliders for Camera, Contacts, Location, Microphone, Phone, and Storage. None at all for internet access or any specific network.

The permissions you list don't appear to be part of Android (8 or otherwise) and are likely after-market extensions in your phone's ROM.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#28

Post by cameronbrown »

saagarjha wrote: post #3

> Google will now require developers to use resettable identifiers to keep track of users. That way, if these digital fingerprints are ever compromised, or if you want to wipe your digital slate clean, there's a mechanism to do that. Does this mean device fingerprinting will no longer be allowed?

It's very difficult to prevent fingerprinting. Google's had the Android advertising ID for ages (which is a unique user resettable identifier) but it's entirely possible to ignore it. I'm not sure if Admob does allow you to set your own custom IDs with your own fingerprinting, but preventing that would go a long way.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#29

Post by torben-friis »

dessant wrote: post #11

A revocable permission for network access on Android would be a great step towards giving users more control over which apps can transmit their personal data. An entire class of apps could be rendered safe by disallowing network access, especially the ones that do work offline, but are keen to phone home.

The problem is when an app finds a bullshit excuse to refuse to work unless they're provided all wanted permissions. even if they don't hard block their content that way, in practice, people are just going to flip the switch that makes the app work or make a dialog go away without reading.

I just don't think pushing the choice of permissions to the end user is a good idea, not by itself. UX teaches us that people are lazy and will go through the easiest path.

Post reply on HN