Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

System Hardening in Android 11

security.googleblog.com

Post reply on HN
Print view View original

71–80 of 211 posts

Re: System Hardening in Android 11

#71

Post by kelnos »

zozbot234 wrote: post #66
dcow wrote: post #51

Earlier quoted context omitted.

Wouldn't the solution be to allow people who have legitimately unlocked their boot loader to also install a custom attestation root so that safety net can still say “the software running on this phone is the software the user intended and not a malicious 3rd party”? Or maybe safety net is not so much about user safety as it is about platform lockdown and vendor safety. The number of times I’ve been laughed out of a p…

Bootloader unlock is under user control by definition - it won't happen unless you're physically interacting with the device. The legitimate case for safety net is platform lockdown for things like financial apps. Banks and other financial services like to provide some form of insurance to users wrt. losing money in a security breach, and they can't do this unless the app really is being run on a pristine, locked-dow…

> Banks and other financial services like to provide some form of insurance to users wrt. losing money in a security breach, and they can't do this unless the app really is being run on a pristine, locked-down platform.

This seems like a weird policy, though. I can access my bank via a web browser on a desktop computer, which is certainly not even remotely a "pristine, locked-down platform".

Re: System Hardening in Android 11

#72

Post by bad_user »

slipheen wrote: post #45
homarp wrote: post #44

Earlier quoted context omitted.

iOS 14 does not let you use a different default browser engine. It's just the skin that change. It's still Webkit under the hood

As much as you and I may care about that, for many (most?) people the browser chrome is the most important part. Syncing bookmarks, UI, tab handling etc tend to be bigger pain points for individuals, as opposed to the more dev-focused aspects such as supporting a certain API in Javascript.

If you're technologically illiterate, this might be true. Witness however Firefox for Android (vs iOS), the most important differences for me being:

- Extensions support, so uBlock Origin, Privacy Badger, the best ad-blocking combination that far surpasses Safari's content blockers, which are pretty shitty; and extensions are useful for more than ad-blocking — e.g. I have another one on my tablet that turns all web pages to dark mode, whether they support it or not

- Web push notifications

- (Up until very recently) webp format support

On Android I wouldn't even install many apps, like Facebook, or Twitter, or Fastmail, I'd simply use them as PWAs (web apps), in Firefox with ads blocking on, because I could.

I still use Firefox on iOS for the history / bookmarks syncing, but it's a shadow of actual Firefox.

Re: System Hardening in Android 11

#73

Post by viraptor »

ocdtrekkie wrote: post #57
user5994461 wrote: post #48

Earlier quoted context omitted.

You could try one of the Chinese android phones, like Xiaomi. Make sure to get an Asian import, because some models have an US/European export edition with the normal Google ecosystem. This is an interesting experience in what a fully functional phone not from Google/Apple can be like. It may not be able to run the usual apps though, unless you install the playstore manually.

The issue is too many Android apps won't even run without Google's malware installed. Even Google's direct competitors' apps depend on it. Skype from Microsoft will not run on Android without Google Play last time I tried it. So I needed to move to a platform where the default assumption is not that users have Google's background malware enabled, and that means anything based on Android is off the table.

Microsoft phone is dead. They're not competitors. You can also use https://microg.org/ with lots of apps already as an alternative.

Re: System Hardening in Android 11

#74

Post by kelnos »

freedomben wrote: post #68
notyourday wrote: post #54

Earlier quoted context omitted.

Play Services infuriate me. I have no idea what app is triggering what kind of actions via Play because all of those actions are done by Play on behalf of the app and Play is not showing it to me in enough details

I can certainly echo this sentiment. It is maddening to see Play services as the "culprit" for the bad thing I'm investigating. Very frustrating.

If you're comfortable disclosing, what is this "bad thing"? From my understanding, Play Services provides roughly the same suite of things that are also supplied on iOS, only on iOS, it's built into the OS (location services, cloud messaging, etc.), while on Android it's a modular component that Google can push updates to without a full OS update. Is that not accurate?

Re: System Hardening in Android 11

#75

Post by viraptor »

izacus wrote: post #60
bad_user wrote: post #49

Earlier quoted context omitted.

What is wrong with Play Services, why is it malware?

It provides same services as Apple ships with iOS (iCloud, Push messaging services, Find my Friend, AppStore, Location, etc.), except that in Android that's branded "malware that calls home" and in Apple world it's called "integral part of the OS". The only difference here is that in Android you can actually separate the two.

The second difference is, you can replace it - https://microg.org/

Re: System Hardening in Android 11

#76

Post by kelnos »

Noluris wrote: post #25
sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

Scoped storage is going to kill all the most useful apps that I use that require full access to storage (such as SyncThing). I'm going to keep using Android 10 until I die. Or just switch to Apple, since if they're going to lock everything down, I might as well go with the company that supports their phones longer than two years.

My guess would be that apps that target an earlier Android version will continue to work properly, even on Android 11.

Ok, maybe that's more my hope than my guess. We'll see.

Re: System Hardening in Android 11

#77

Post by 867-5309 »

freedomben wrote: post #20
sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

You're upset about them requiring hardware attestation in SafetyNet (I am too) so you move to a platform that is way less flexible and way more closed? Not a troll, I'm really curious.

In my case I am stuck with a spare phone on android 8 since they banned wireless scanning from 9 onwards. it's a matter of functionality over perceived security. fed up with google. will check out the PinePhone

Re: System Hardening in Android 11

#78

Post by [deleted] »

chaostheory wrote: post #15

This is nice and all, but bigger issue is when will Android phones reach Android 11? Has fragmentation gotten better? Do most phone manufacturers support upgrading to major versions of Android (it does not seem to be in their interest)?

[deleted]

Re: System Hardening in Android 11

#79

Post by asveikau »

stephc_int13 wrote: post #46
pjmlp wrote: post #37

Earlier quoted context omitted.

Yes, the NDK main goal is for writing native libraries, not full blown applications. Although native memory allocations can happen via ByteBuffer, HardwareBuffer, image decoders, or native libraries.

Many games are written in C/C++ with the minimal amount of Java.

Games are usually written to allocate memory upfront and keep the per-frame allocation cost from affecting performance, by re-using buffers.

So I would expect a well written game to also not be a workload in which you can recognize a poor performing malloc.

Same with media code for similar reasons.

Re: System Hardening in Android 11

#80

Post by lucb1e »

mrbonner wrote: post #32

I don’t pretty much like Apple ecosystem but I have to say that the best decision I made technically was to switch to an iPhone 7 Plus 3 years ago after years of Android (since T-Mobile G1, first android phone ever). I said goodbye to a lot of customizations but at the same time regain my sanity from battery life, slowness and absurd support timelines

> at the same time regain my sanity from battery life, slowness and absurd support timelines

If the phone had bad battery life or was slow to begin with, don't buy it. If it doesn't and it suddenly appears while you're using it... that's user error.

Support: I'm really not sure what kind of support you're expecting, I assume not "how do I take a screenshot" kind of support. I once returned a phone for warranty but the support delay on that was the time it took me to look up a few website pages if I remember correctly. Is that what you mean? Or maybe it's about how long the warranty process takes: it took almost 2 weeks to repair it for me (from the day of dropping off until the day I could use it again), that is indeed quite long for a fairly essential device, but that seems to be the standard for any laptop or phone (unless you bought a service contract, which I guess one implicitly does with Apple given its pricing).

Post reply on HN