System Hardening in Android 11 • Hacker News Board

Re: System Hardening in Android 11

#11

Post by danudey » Tue, Jun 30, 2020, 5:59 PM UTC

jhalstead wrote: post #8

stephc_int13 wrote: post #4

"In Android 11, Scudo [1] replaces jemalloc as the default native allocator for Android. Scudo is a hardened memory allocator designed to help detect and mitigate memory corruption bugs in the heap" I am curious about the performance impact of this change. [1] https://source.android.com/devices/tech/debug/scudo

I found this [0] 2019 blog post from what looks to be one of the people credited in the blog post (Kostya). It's not directly comparing Android+jemalloc vs Android+Scudo, but it does compare the two allocators and others. [0] http://expertmiami.blogspot.com/2019/05/what-is-scudo-harden...

So according to these figures, scudo is the best allocator out of all the options tested? That's pretty decent.

Re: System Hardening in Android 11

#12

Post by sitic » Tue, Jun 30, 2020, 6:10 PM UTC

In addition on Android 11 API

* apps can't simply access the "external" storage (enforces scoped storage)

* apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query)

These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocked [1]. When this is enforced for all devices some apps, like the eBay app, won't run on unlocked devices anymore. I've always trusted CyanogenMod/LineageOS more then than a device manufacturer, but after >10 years of using Android I think it's finally time for me to switch to an iPhone.

[1] https://groups.google.com/forum/#!topic/safetynet-api-client...

Re: System Hardening in Android 11

#13

Post by j88439h84 » Tue, Jun 30, 2020, 6:17 PM UTC

sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

What does external mean? SD card? or anything outside the app's own directory?

Re: System Hardening in Android 11

#14

Post by hddherman » Tue, Jun 30, 2020, 6:22 PM UTC

sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

I switched recently to an iPhone after 6 years on Android, including messing around with Cyanogenmod/LineageOS. It's not that bad, especially considering that Android is reaching the same level of lockdown that Apple has enforced, so you might as well use something that is reasonably secure and has official software update support for 5+ years.

Re: System Hardening in Android 11

#15

Post by chaostheory » Tue, Jun 30, 2020, 6:24 PM UTC

This is nice and all, but bigger issue is when will Android phones reach Android 11? Has fragmentation gotten better? Do most phone manufacturers support upgrading to major versions of Android (it does not seem to be in their interest)?

Re: System Hardening in Android 11

#16

Post by igorstellar » Tue, Jun 30, 2020, 6:25 PM UTC

j88439h84 wrote: post #13

sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

What does external mean? SD card? or anything outside the app's own directory?

External storage used to be a shared storage for apps outside of it's sandbox. Files are retained after app is uninstalled. [1]

[1] https://developer.android.com/training/data-storage

Re: System Hardening in Android 11

#17

Post by Vespasian » Tue, Jun 30, 2020, 6:26 PM UTC

sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

The security changes are nice and needed so well done.

Enforcing SafetyNet is probably also a net positive change, and you (and I) are a minority among the general user base. Sadly this was always coming, it was nice while it lasted, I guess.

I'm not quite sure what I will do once my current phone dies. I don't see myself investing in the Apple ecosphere, so either go with the time (do nothing) or have a second phone for "secure" apps (Banking, Netflix) etc.

Re: System Hardening in Android 11

#18

Post by [deleted] » Tue, Jun 30, 2020, 6:30 PM UTC

danudey wrote: post #11

jhalstead wrote: post #8

Earlier quoted context omitted.

I found this [0] 2019 blog post from what looks to be one of the people credited in the blog post (Kostya). It's not directly comparing Android+jemalloc vs Android+Scudo, but it does compare the two allocators and others. [0] http://expertmiami.blogspot.com/2019/05/what-is-scudo-harden...

So according to these figures, scudo is the best allocator out of all the options tested? That's pretty decent.

[deleted]

Re: System Hardening in Android 11

#19

Post by tjoff » Tue, Jun 30, 2020, 6:32 PM UTC

I'm mostly worried about Termux. I can't imagine a phone without a decent terminal and I feel my options are going to be severely limited.

Re: System Hardening in Android 11

#20

Post by freedomben » Tue, Jun 30, 2020, 6:36 PM UTC

sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

You're upset about them requiring hardware attestation in SafetyNet (I am too) so you move to a platform that is way less flexible and way more closed?

Not a troll, I'm really curious.