Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

forbes.com

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#61

Post by squiggleblaz »

bscphil wrote: post #36
userbinator wrote: post #34

Earlier quoted context omitted.

Indeed. On the desktop, this is also known as a firewall. All apps practically think they have "network permissions", but if they actually try to make a connection, it will either time out or return errors.

What operating systems have built in support for firewalling specific applications?

Having moved from Windows to Linux partially because Windows was about as secure as a flyscreen door, I've recently switched back to Windows.

Whenever a version of an app wants to provide a network service, Windows first asks if this specific app can provide network services on this class of network (public connection or private connection). So it is not just builtin, but for a particular class of restriction even easy to use. Blocking consumption of resources is an advanced feature though.

I used to use a program called "firestarter" on Linux, which provided a way to block specific apps. Long time since I've done that though, since most of the untrusted apps on Linux are Chrome and the ones you run in Firefox.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#62

Post by discreditable »

jm4 wrote: post #31
izacus wrote: post #22

This headline is grossly misleading - Android 10 has fixed those 193 vulnerabilities. The title as it is, implies they still need to be fixed. This kind of content is usually never worded like this for other products, can the moderators fix it?

Another crap Forbes contributor article. The fix is to ban these posts. These articles have basically zero credibility because they are written by ordinary dopes who pay to have their blogs published on forbes.com. There is no fact checking, no verification of the author’s background and expertise, nothing. You pay and get published and people get the impression it’s “news” because of the Forbes name.

Forbes articles are pretty clickbait. I blocked them in Google News because their headlines are bonkers. It's always a formula like

Microsoft issues update warning to 10 gorillion PCs (some super minor problem in the last patch cycle)

10 bazillion Android phones have spyware (some malware app was removed from the play store)

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#63

Post by shakna »

UncleMeat wrote: post #43
panpanna wrote: post #19

Earlier quoted context omitted.

This would make things so much safer for everyone but Google has so far refused to do this. (Android DOES have a network permission, but at some point Google decided it should always be allowed)

Something like 75% of code in apps nowadays are part of SDKs. Even if an app itself doesn't need network, you need the network for ads and analytics.

So why not have a network interface that supplies a more fine-grained access, like CSP? (Except hopefully without the godawful syntax).

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#64

Post by surak »

panpanna wrote: post #18
surak wrote: post #7

We can still not sandbox apps access to data by default. Numerous academic projects have show how this can be implemented, e.g. by fudging data when details are not needed. Also, in order to get these security fixes I have to buy a new device from one of their partners.. Google has failed society by advancing surveillance capitalism to the extreme.

I don't think you have really used Android lately. 1. Google has added API to access resources without getting full unconditional access 2. They are enforcing use of correct APIs on their store 3. Most of the system is now updated from the store. This is significantly faster than any of their competitors 4. Most vendors are now providing timely security updates. Some even have an Enterprise program with 4-5 years of…

I use it every day. Regarding P1, if an app ask for permission access to e.g. images or location, and you use the app, how would you limit what the app can send home or even review it? See discussion in the other comments if you're not an Andriod developer.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#65

Post by surak »

Already__Taken wrote: post #10
surak wrote: post #7

We can still not sandbox apps access to data by default. Numerous academic projects have show how this can be implemented, e.g. by fudging data when details are not needed. Also, in order to get these security fixes I have to buy a new device from one of their partners.. Google has failed society by advancing surveillance capitalism to the extreme.

my android one branded Nokia has had a decent amount of updates and my partner's last few Motos. it's getting better for Android slowly

Going after a subset of low end devices seems a bit off-putting to me. A-One should be mandatory, but most manufacturers are hooked on adding bloatware to track you.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#66

Post by kevin_thibedeau »

torben-friis wrote: post #50
kevin_thibedeau wrote: post #32

Earlier quoted context omitted.

LineageOS has the solution to this problem. You can revoke fine grained capabilities while letting the app still think it has the permissions.

It's still an action the user has to perform, which most people won't bother doing (or know how to do it). I don't think the user of an app should be left to its own devices to ensure its own privacy by outmanoeuvring developers, and giving them tools to do it it's just not good enough.

That is simply a result of grafting in the revocation mechanism to an OS whose controller doesn't want to enable such freedoms.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#67

Post by decoyworker »

kevin_thibedeau wrote: post #32
torben-friis wrote: post #29

Earlier quoted context omitted.

The problem is when an app finds a bullshit excuse to refuse to work unless they're provided all wanted permissions. even if they don't hard block their content that way, in practice, people are just going to flip the switch that makes the app work or make a dialog go away without reading. I just don't think pushing the choice of permissions to the end user is a good idea, not by itself. UX teaches us that people are…

LineageOS has the solution to this problem. You can revoke fine grained capabilities while letting the app still think it has the permissions.

There should me a method of taking this further. Like having the real radio, sensor, etc information but also having a mocked version of these interfaces. The user can toggle mocked or real interface and the app has no idea which it is receiving. Each one can be faked in its own specific way (spoofed GPS looks different than spoofed accelerometer, etc).

Edit: Disclaimer I have almost 0 knowledge of Android development.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#68

Post by vetinari »

surak wrote: post #64
panpanna wrote: post #18

Earlier quoted context omitted.

I don't think you have really used Android lately. 1. Google has added API to access resources without getting full unconditional access 2. They are enforcing use of correct APIs on their store 3. Most of the system is now updated from the store. This is significantly faster than any of their competitors 4. Most vendors are now providing timely security updates. Some even have an Enterprise program with 4-5 years of…

I use it every day. Regarding P1, if an app ask for permission access to e.g. images or location, and you use the app, how would you limit what the app can send home or even review it? See discussion in the other comments if you're not an Andriod developer.

Since Android v1, it offers APIs (intents) for picking items belonging to other apps or doing an action on behalf of other apps.

Applications do not need access to gallery; they can ask the gallery to let the user pick the pictures he wants to work with; the app does not need the access to camera, it can ask the default camera app to let the user make the photo and get the result. The app does not need access to telephony; it can ask dialer to dial a number on it's behalf. Etc, etc.

The developers didn't use these APIs because users were asking for iOS style integrations, where any apps does everything for itself, instead of using system components. So they got it.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#69

Post by UncleMeat »

shakna wrote: post #63
UncleMeat wrote: post #43

Earlier quoted context omitted.

Something like 75% of code in apps nowadays are part of SDKs. Even if an app itself doesn't need network, you need the network for ads and analytics.

So why not have a network interface that supplies a more fine-grained access, like CSP? (Except hopefully without the godawful syntax).

Because people have also done science to demonstrate that fine grain permissions don't work for the huge majority of users.

Re: Android 10: Google Confirms 193 Security Vulnerabilities Need Fixing

#70

Post by shakna »

UncleMeat wrote: post #69
shakna wrote: post #63

Earlier quoted context omitted.

So why not have a network interface that supplies a more fine-grained access, like CSP? (Except hopefully without the godawful syntax).

Because people have also done science to demonstrate that fine grain permissions don't work for the huge majority of users.

That fine-grained permission isn't handled by the user. You as a user don't employ CSP.

Rather, when requesting the permission from the OS, the developer has to supply a list of approved scopes and domains, and anything outside of that gets automatically blocked.

No involvement from the user.

Post reply on HN