Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

System Hardening in Android 11

security.googleblog.com

Post reply on HN
Print view View original

21–30 of 211 posts

Re: System Hardening in Android 11

#21

Post by vorpalhex »

igorstellar wrote: post #16
j88439h84 wrote: post #13

Earlier quoted context omitted.

What does external mean? SD card? or anything outside the app's own directory?

External storage used to be a shared storage for apps outside of it's sandbox. Files are retained after app is uninstalled. [1] [1] https://developer.android.com/training/data-storage

This was abused by several apps to allow locating and identifying users illicitly. One app, say, WeChat, would ask for broad permissions for location and unique identifiers and then leave unique tracking identifiers in a shared file location. Than another app, say, a mobile game, could pick up on those shared identifiers and link you back.

Why this would be a useful benefit worth setting up in an SDK across multiple companies and apps, I'll leave to your own imagination.

Re: System Hardening in Android 11

#22

Post by freedomben »

tjoff wrote: post #19

I'm mostly worried about Termux. I can't imagine a phone without a decent terminal and I feel my options are going to be severely limited.

Likewise. Termux is the killer feature for me. This needs to wait a year or two so a FLOSS phone is ready for daily driving D-:

Re: System Hardening in Android 11

#23

Post by chinhodado »

sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

> apps can't simply access the "external" storage (enforces scoped storage)

So how will perfectly valid use cases like file manager or backup manager work now?

Re: System Hardening in Android 11

#24

Post by CameronNemo »

igorstellar wrote: post #16
j88439h84 wrote: post #13

Earlier quoted context omitted.

What does external mean? SD card? or anything outside the app's own directory?

External storage used to be a shared storage for apps outside of it's sandbox. Files are retained after app is uninstalled. [1] [1] https://developer.android.com/training/data-storage

I wonder how this will impact my externally stored music library, which is accessed by two open source apps (Vanilla Music and Alarm Klock) but not managed by those apps or tied to their lifetimes.

Re: System Hardening in Android 11

#25

Post by Noluris »

sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

Scoped storage is going to kill all the most useful apps that I use that require full access to storage (such as SyncThing). I'm going to keep using Android 10 until I die. Or just switch to Apple, since if they're going to lock everything down, I might as well go with the company that supports their phones longer than two years.

Re: System Hardening in Android 11

#26

Post by Mindwipe »

chinhodado wrote: post #23
sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

> apps can't simply access the "external" storage (enforces scoped storage) So how will perfectly valid use cases like file manager or backup manager work now?

A File Manager can ask for root folder access permission but Google will closely control which applications in the Play Store can do so (but if you think that sounds good this is also the same policy they have for SMS access, and Google's enforcement of that has been disastrous as review on the Play Store is a dismal mess).

However, this will no longer get you access to Application's own folders, and so backing things up on Android gets even harder and the OS gets more anti-user.

(To be clear, this should absolutely be behind a Permission barrier. But to block off user access entirely is a toxic and unhelpful move that makes the platform less useful).

Re: System Hardening in Android 11

#27

Post by saagarjha »

danudey wrote: post #7
saagarjha wrote: post #5

> In Android 11, Scudo replaces jemalloc as the default native allocator for Android. Scudo is a hardened memory allocator designed to help detect and mitigate memory corruption bugs in the heap This comment of mine did not age well: https://news.ycombinator.com/item?id=23560040 . I'm curious what the performance impact of the change was?

I think it aged fine. I certainly hadn't heard of it, and I bet most people were in the same boat. Really, you just asked a legitimate question, and now today you have a legitimate answer. I'd call that a win!

Not knowing about the memory allocator in an upcoming release of an operating system used by over a billion people is a bit of a lapse on my part ;)

Re: System Hardening in Android 11

#28

Post by kevin_thibedeau »

vorpalhex wrote: post #21
igorstellar wrote: post #16

Earlier quoted context omitted.

External storage used to be a shared storage for apps outside of it's sandbox. Files are retained after app is uninstalled. [1] [1] https://developer.android.com/training/data-storage

This was abused by several apps to allow locating and identifying users illicitly. One app, say, WeChat, would ask for broad permissions for location and unique identifiers and then leave unique tracking identifiers in a shared file location. Than another app, say, a mobile game, could pick up on those shared identifiers and link you back. Why this would be a useful benefit worth setting up in an SDK across multiple…

This would be solved if they just ported over the revokable permissions that LineageOS implements. You get real security and the app is none the wiser.

Re: System Hardening in Android 11

#29

Post by worried1872 »

This dumbing down and locking down on phones and computers, is really worring me. I'm a power user which have been using computers as a tool which I have been in control of (more or less), but now things are really turning. Todays phones are in control of us as we lose more or more power of them. Living in Sweden, I am almost forced to use proprietary phones and software, just to live here. Any idea for what a free software enthusiast should do now that things I've loved to use are slowly being taken away from me, and being replaced by these devices contolled by these monopolies and governments?

Re: System Hardening in Android 11

#30

Post by sitic »

freedomben wrote: post #20
sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

You're upset about them requiring hardware attestation in SafetyNet (I am too) so you move to a platform that is way less flexible and way more closed? Not a troll, I'm really curious.

If my phone has to be a walled garden, Apple's seems more enticing to me for the moment. I would want to give it a try at least. I might very well regret it and switch back to an Android phone which won't get updates after two years.

I also have to say that to me, even if apps that require SafetyNet don't work anymore after unlocking, it certainly doesn't make the phone certainly useless. But I don't want to live with the inconvenience of not being able to use some random apps.

Post reply on HN