Live data from Hacker News

System Hardening in Android 11

security.googleblog.com

81–90 of 211 posts

Re: System Hardening in Android 11

#81

I suppose this will kill multi-emulators like RetroArch. No-longer will they be able to load arbitrary ROMs from a microSD card or other generic storage.

I am not sure they are dead.

I haven't toyed with files in 11 yet but looks like the MediaStore api covers such an use case :

https://developer.android.com/reference/android/provider/Med...

Re: System Hardening in Android 11

#82
post #51
post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

Wouldn't the solution be to allow people who have legitimately unlocked their boot loader to also install a custom attestation root so that safety net can still say “the software running on this phone is the software the user intended and not a malicious 3rd party”? Or maybe safety net is not so much about user safety as it is about platform lockdown and vendor safety. The number of times I’ve been laughed out of a p…

> Or maybe safety net is not so much about user safety as it is about platform lockdown and vendor safety.

Sadly, it's exactly this. It's not for your safety at all. It's for keeping stuff on your phone safe from you.

Re: System Hardening in Android 11

#83

This dumbing down and locking down on phones and computers, is really worring me. I'm a power user which have been using computers as a tool which I have been in control of (more or less), but now things are really turning. Todays phones are in control of us as we lose more or more power of them. Living in Sweden, I am almost forced to use proprietary phones and software, just to live here. Any idea for what a free s…

> forced to use proprietary phones and software, just to live here

That sounds doubtful. What kind of "phones" and what kind of software does the Swedish government require you to use?

Note that I agree with your general point of locking people and power users out of the hardware they are supposed to be the owners of, it's just that part that kind of detracts from the point (I'm going to go ahead and assume phones and software are not actually required).

Re: System Hardening in Android 11

#84

Earlier quoted context omitted.

> apps can't simply access the "external" storage (enforces scoped storage) So how will perfectly valid use cases like file manager or backup manager work now?

Or the One Android App That Does Not Suck: Termux?

Media players are also a big deal for this. I put a lot of audio and sometimes video on my sd card and expect to be able to browse and play it. I am actually doing that right now as I type this.

Re: System Hardening in Android 11

#85
post #35

Earlier quoted context omitted.

The option is simple although tiresome, reimplement it in Android Java or Kotlin, instead of trying to pretend Android is Linux, given that POSIX or Linux specific calls aren't even part of NDK Stable APIs documentation. Any app that access the Linux features directly just works out of luck, given that there are no compatibility guarantees.

I managed to get VS Code (as code-server) running natively and dotnet running on my Android tablet. It makes it a nice little development machine. Basically anything Android native is horrible for developers; you can't even get a decent IDE or text editor. You still don't have source control, web servers, programming languages, etc. Termux with a few addons gives you all that. I wish Google would recognize the value…

I am happy with Shader Editor and C# Shell, though. For anything better I use a proper laptop.

Re: System Hardening in Android 11

#86

I suppose this will kill multi-emulators like RetroArch. No-longer will they be able to load arbitrary ROMs from a microSD card or other generic storage.

Sure they will, they just have to request a file picker for the user to select the file on their own.

Re: System Hardening in Android 11

#87
post #31

> Prior to the Release of Android 10 we announced a new constrained sandbox for software codecs. We’re really pleased with the results. Thus far, Android 10 is the first Android release since the infamous stagefright vulnerabilities in Android 5.0 with zero critical-severity vulnerabilities in the media frameworks. It wasn't mediatized, but there must have been like a new stagefright-like media library bug every 2-3…

Modern ARM chips are required for Android 11 versions.

https://security.googleblog.com/2019/08/adopting-arm-memory-...

https://source.android.com/devices/tech/debug/tagged-pointer...

Re: System Hardening in Android 11

#88
post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

The security changes are nice and needed so well done. Enforcing SafetyNet is probably also a net positive change, and you (and I) are a minority among the general user base. Sadly this was always coming, it was nice while it lasted, I guess. I'm not quite sure what I will do once my current phone dies. I don't see myself investing in the Apple ecosphere, so either go with the time (do nothing) or have a second phone…

> Enforcing SafetyNet is probably also a net positive change

How so? How does SafetyNet make any end-user even slightly more secure?

Re: System Hardening in Android 11

#89

Earlier quoted context omitted.

You're upset about them requiring hardware attestation in SafetyNet (I am too) so you move to a platform that is way less flexible and way more closed? Not a troll, I'm really curious.

I can give an anecdote. I love most things about iOS design more than Android, and I've used both, but have stuck with Android over the last 7-8ish years. Mainly because of the amount that I could customize things, freely make little app projects, install custom ROMs, etc. Over the last few years, it's gotten inconvenient to tinker, and I just don't find myself bothering with it anymore. I've run into issues where ce…

> Especially with the upcoming change to allow iOS to use a different default (finally).

Did you leave a word out here?

I assume you were going to write default keyboard?

Re: System Hardening in Android 11

#90
post #25
post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

Scoped storage is going to kill all the most useful apps that I use that require full access to storage (such as SyncThing). I'm going to keep using Android 10 until I die. Or just switch to Apple, since if they're going to lock everything down, I might as well go with the company that supports their phones longer than two years.

An application can require MANAGE_EXTERNAL_STORAGE permission to access all files.
Post reply on HN