Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

community.rapid7.com

Post reply on HN
Print view View original

181–190 of 232 posts

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#181

Post by Pxtl »

downandout wrote: post #178

Android has its merits, but more and more I am reminded of this aptly titled article (proudly mentioned by Tim Cook during the WWDC keynote): " Android Fragmentation Turning Devices Into a Toxic Hellstew of Vulnerabilities " [1]. These kinds of incredibly serious, system level issues are a significant competitive disadvantage, and they keep happening. Google needs to build fast security update requirements into their…

Even if they do fast vuln updates, what about older devices? Even Google only offers 2y of support.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#182

Post by Pxtl »

Zigurd wrote: post #17
allegory wrote: post #10

It's this sort of thing that puts me off Android as a platform. Even my mother got sold a 2.2 handset recently (Samsung Galaxy Ace) that hasn't been patched for the best part of 3 years. You never know when you're going to end up with a lemon on your hands. Big jump to this conclusion but I'm more inclined to trust Microsoft at the moment as they have a better reputation for lifetime (unlike Android), have a very pub…

Android One is meant to make it simple for lo-end OEMs to ship high quality implementations of up-to-date Android and keep up with new releases. It's hard to migrate a huge OEM ecosystem to that kind of program quickly.

And I bet Samsung still won't use it for their terrible low-end phones because of their darned skin.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#183

Post by downandout »

Pxtl wrote: post #181
downandout wrote: post #178

Android has its merits, but more and more I am reminded of this aptly titled article (proudly mentioned by Tim Cook during the WWDC keynote): " Android Fragmentation Turning Devices Into a Toxic Hellstew of Vulnerabilities " [1]. These kinds of incredibly serious, system level issues are a significant competitive disadvantage, and they keep happening. Google needs to build fast security update requirements into their…

Even if they do fast vuln updates, what about older devices? Even Google only offers 2y of support.

I think Google needs to change that as well. Android is seen as a second class OS by a large percentage of people, and these kinds of revelations only increase that percentage. Google can do better, but for whatever reason they aren't.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#185

Post by fulafel »

kllrnohj wrote: post #131
1ris wrote: post #32

>While the AOSP has "been killed off" by Google, it... I do not follow android closely, but this refers to the browser only, right?

The author is also slightly mistaken on that. The AOSP browser is just a UI shell for WebView, and WebView has absolutely not been killed off. The WebView in KitKat sits on top of Chromium, for example, so installing an AOSP browser on KitKat will likely not have this vulnerability.

But it will still have vulnerabilities that have been fixed in current Chromium.

(In the Chromium WebView FAQ they say they're working on fixing it, but there are major difficulties. https://developer.chrome.com/multidevice/webview/overview)

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#186

Post by lambda »

downandout wrote: post #178

Android has its merits, but more and more I am reminded of this aptly titled article (proudly mentioned by Tim Cook during the WWDC keynote): " Android Fragmentation Turning Devices Into a Toxic Hellstew of Vulnerabilities " [1]. These kinds of incredibly serious, system level issues are a significant competitive disadvantage, and they keep happening. Google needs to build fast security update requirements into their…

Note that this isn't an "incredibly serious system level issue." This is an issue with a browser that Google hasn't supported for several years, since they replaced it with Chrome. It also doesn't affect alternative browsers like Firefox or Opera.

Note that if Apple had a similar vulnerability, you likely couldn't work around it by using an alternative browser, because all browsers are required to use Safari's rendering engine.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#187

Post by fulafel »

Pxtl wrote: post #181
downandout wrote: post #178

Android has its merits, but more and more I am reminded of this aptly titled article (proudly mentioned by Tim Cook during the WWDC keynote): " Android Fragmentation Turning Devices Into a Toxic Hellstew of Vulnerabilities " [1]. These kinds of incredibly serious, system level issues are a significant competitive disadvantage, and they keep happening. Google needs to build fast security update requirements into their…

Even if they do fast vuln updates, what about older devices? Even Google only offers 2y of support.

Even worse than that: They've been variously been saying "18 months from device release" and "up to 2 years" lately. So if you buy a device that's been out for a year you may be out of luck in 6 months.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#188

Post by fulafel »

lambda wrote: post #186
downandout wrote: post #178

Android has its merits, but more and more I am reminded of this aptly titled article (proudly mentioned by Tim Cook during the WWDC keynote): " Android Fragmentation Turning Devices Into a Toxic Hellstew of Vulnerabilities " [1]. These kinds of incredibly serious, system level issues are a significant competitive disadvantage, and they keep happening. Google needs to build fast security update requirements into their…

Note that this isn't an "incredibly serious system level issue." This is an issue with a browser that Google hasn't supported for several years, since they replaced it with Chrome. It also doesn't affect alternative browsers like Firefox or Opera. Note that if Apple had a similar vulnerability, you likely couldn't work around it by using an alternative browser, because all browsers are required to use Safari's render…

In addition to the Browser app that is still widely use in devices with less-than-latest Android versions, It's present in every app that uses WebView. And you only get fixes to WebView via OS updates. (x)

(x) Maybe. Assuming someone bothers to incorporate them into to the OS update for your device and they make it through the hurdles between the engineer and OTA update certification.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#189

Post by [deleted] »

lambda wrote: post #186
downandout wrote: post #178

Android has its merits, but more and more I am reminded of this aptly titled article (proudly mentioned by Tim Cook during the WWDC keynote): " Android Fragmentation Turning Devices Into a Toxic Hellstew of Vulnerabilities " [1]. These kinds of incredibly serious, system level issues are a significant competitive disadvantage, and they keep happening. Google needs to build fast security update requirements into their…

Note that this isn't an "incredibly serious system level issue." This is an issue with a browser that Google hasn't supported for several years, since they replaced it with Chrome. It also doesn't affect alternative browsers like Firefox or Opera. Note that if Apple had a similar vulnerability, you likely couldn't work around it by using an alternative browser, because all browsers are required to use Safari's render…

[deleted]

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#190

Post by downandout »

fulafel wrote: post #188
lambda wrote: post #186

Earlier quoted context omitted.

Note that this isn't an "incredibly serious system level issue." This is an issue with a browser that Google hasn't supported for several years, since they replaced it with Chrome. It also doesn't affect alternative browsers like Firefox or Opera. Note that if Apple had a similar vulnerability, you likely couldn't work around it by using an alternative browser, because all browsers are required to use Safari's render…

In addition to the Browser app that is still widely use in devices with less-than-latest Android versions, It's present in every app that uses WebView. And you only get fixes to WebView via OS updates. (x) (x) Maybe. Assuming someone bothers to incorporate them into to the OS update for your device and they make it through the hurdles between the engineer and OTA update certification.

Yes, I was referring to the WebView issue when I said "system level".
Post reply on HN