Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

forbes.com

Post reply on HN
Print view View original

41–50 of 70 posts

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#41

Post by dogmatism »

bscphil wrote: post #36
userbinator wrote: post #34

Earlier quoted context omitted.

Indeed. On the desktop, this is also known as a firewall. All apps practically think they have "network permissions", but if they actually try to make a connection, it will either time out or return errors.

What operating systems have built in support for firewalling specific applications?

Linux generally comes with iptables which can be used for it, but more efficiently most distributions have some system for access control like SELinux or apparmor which can also do it. Sorry not familiar if this is a thing on Windows/Mac/BSD's. In fact I think Android has SELinux built in, but not user accessible without root.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#42

Post by microcolonel »

The move to a joyless, bland release naming scheme in order to appease a perceived mass of illiterate rubes who somehow care about their Android version but can't read past the name of a dessert...

To me it is another signal of the erasure of cultural flavour at the company; the pivot to a base, power-chasing, stifling corporatist death march toward nowhere of interest.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#43

Post by UncleMeat »

panpanna wrote: post #19
dessant wrote: post #11

A revocable permission for network access on Android would be a great step towards giving users more control over which apps can transmit their personal data. An entire class of apps could be rendered safe by disallowing network access, especially the ones that do work offline, but are keen to phone home.

This would make things so much safer for everyone but Google has so far refused to do this. (Android DOES have a network permission, but at some point Google decided it should always be allowed)

Something like 75% of code in apps nowadays are part of SDKs. Even if an app itself doesn't need network, you need the network for ads and analytics.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#45

Post by AnssiH »

steve19 wrote: post #17
dessant wrote: post #11

A revocable permission for network access on Android would be a great step towards giving users more control over which apps can transmit their personal data. An entire class of apps could be rendered safe by disallowing network access, especially the ones that do work offline, but are keen to phone home.

Early versions of android did have a network permission. It was not able to be revoked but at least you knew apps that had no reason to require network access, like early flashlight apps, were not exfiltrating data. The permission may still exist (it has been a long time since I last wrote an android app) but it is no longer user visible.

It is still there and visible on both Play Store and Settings when you open the full permission list for an app.

It is called "have full network access".

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#46

Post by hnburnsy »

Someone1234 wrote: post #27
ignoramous wrote: post #16

Earlier quoted context omitted.

This has been possible since Android 8, if not before. You could, per app, from the App Info page: 1. Disallow bg internet access. 2. Disallow fg internet access over wifi. 3. Disallow fg internet access over mobile network. I've been building an app that exposes privacy features like bouncing permissions when apps are in bg (remember AppOps?), firewalling apps by disallowing data usage, setting DNS over TLS to serve…

I have a Pixel 3 with the latest retail release (Android 9/August 1, 2019). I cannot do any of the things you described for any apps via the App Info page. I have permissions sliders for Camera, Contacts, Location, Microphone, Phone, and Storage. None at all for internet access or any specific network. The permissions you list don't appear to be part of Android (8 or otherwise) and are likely after-market extensions…

You don't see it under apps & notifications - - > data usage control?

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#47

Post by jjeaff »

kevin_thibedeau wrote: post #32
torben-friis wrote: post #29

Earlier quoted context omitted.

The problem is when an app finds a bullshit excuse to refuse to work unless they're provided all wanted permissions. even if they don't hard block their content that way, in practice, people are just going to flip the switch that makes the app work or make a dialog go away without reading. I just don't think pushing the choice of permissions to the end user is a good idea, not by itself. UX teaches us that people are…

LineageOS has the solution to this problem. You can revoke fine grained capabilities while letting the app still think it has the permissions.

Sounds like a good way to cause problems that are extremely difficult to troubleshoot.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#48

Post by _asummers »

izacus wrote: post #22

This headline is grossly misleading - Android 10 has fixed those 193 vulnerabilities. The title as it is, implies they still need to be fixed. This kind of content is usually never worded like this for other products, can the moderators fix it?

Changing Need --> Needed should be enough.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#49

Post by grawprog »

hnburnsy wrote: post #46
Someone1234 wrote: post #27

Earlier quoted context omitted.

I have a Pixel 3 with the latest retail release (Android 9/August 1, 2019). I cannot do any of the things you described for any apps via the App Info page. I have permissions sliders for Camera, Contacts, Location, Microphone, Phone, and Storage. None at all for internet access or any specific network. The permissions you list don't appear to be part of Android (8 or otherwise) and are likely after-market extensions…

You don't see it under apps & notifications - - > data usage control?

I have two options on android 9 on a Motorola g7 background data usage and unrestricted data usage. On allows or disallows background data usage, the other allows full access to data when data saver mode is on. When I go to show all permissions it shows me which apps have full network access but does not allow me the option to toggle it.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#50

Post by torben-friis »

kevin_thibedeau wrote: post #32
torben-friis wrote: post #29

Earlier quoted context omitted.

The problem is when an app finds a bullshit excuse to refuse to work unless they're provided all wanted permissions. even if they don't hard block their content that way, in practice, people are just going to flip the switch that makes the app work or make a dialog go away without reading. I just don't think pushing the choice of permissions to the end user is a good idea, not by itself. UX teaches us that people are…

LineageOS has the solution to this problem. You can revoke fine grained capabilities while letting the app still think it has the permissions.

It's still an action the user has to perform, which most people won't bother doing (or know how to do it).

I don't think the user of an app should be left to its own devices to ensure its own privacy by outmanoeuvring developers, and giving them tools to do it it's just not good enough.

Post reply on HN