Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android: I don't need your permission

blog.danlew.net

Post reply on HN
Print view View original

71–80 of 190 posts

Re: Android: I don't need your permission

#71

Post by bch »

Fando wrote: post #62
a1369209993 wrote: post #33

Earlier quoted context omitted.

> Unless you build you computer yourself from silicon And the chip design, and the fab control software, and the tools that make the tools that make the tools. And descrete components won't help you because transistors are large enough to conceal a mircocontroler emulating a transistor and listening for high-frequency handshake signals. Relays are probably safe since you can make those yourself out of iron and copper…

To make an omelette, first you have to create the universe!

Carl Sagans Cookbook series: How to bake an apple pie from scratch -- https://www.youtube.com/watch?v=7s664NsLeFM

Re: Android: I don't need your permission

#72

Post by Someone1234 »

JohnTHaller wrote: post #31
Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

Except that it is possible to have lots of someones reliably do A through C with a defined environment and get the exact same output every time they compile it. It's referred to as 'deterministic' builds. Bitcoin and Tor are doing it, for example. Most of the people that dismiss the security advantages of open source either don't understand them or are trying to sell you some closed source code.

> Most of the people that dismiss the security advantages of open source either don't understand them or are trying to sell you some closed source code.

If you wish to imply the issue is due to my lack of understanding then go right ahead, but at least first explain why what I said is wrong.

A lot of people get their apps from the app stores on Android/iOS/etc. App stores do not provide the raw source and let you compile it last time I checked. So in order for OSS to provide a security advantage over closed source you'd have to sideload your apps after doing the inspection and compilation stages yourself (or having a trusted third party do it).

People throw the "open source so secure" justification around all the time, it is rarely justified. Really you aren't trusting OSS, you're trusting third parties who inspect the code on your behalf (e.g. distro' vendors in the Linux world). In the app world there are no third parties doing the verification step for you, unless you count Apple.

Re: Android: I don't need your permission

#73

Post by Someone1234 »

nly wrote: post #37
Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

In practice you can disassemble Java apps to pseudo source code anyway. I've done it several times to APKs to see what is going on under the covers. Deliberate obfuscation would be immediately suspicious.

That's true. But if you leave automatic updates enabled then the whole exercise is nearly pointless.

Re: Android: I don't need your permission

#74

Post by dmix »

dozy wrote: post #13
CSDude wrote: post #10

This is the another reason I use CyanogenMod. It has Privacy Guard and I can disable the nasty permissions as I please. If you have Android 4.3+, you can also install it indivudally https://play.google.com/store/apps/details?id=com.findsdk.ap... (requires root I guess) The most helpful one, even if you are not privacy/security concerned is to disable wake up/keep awake requests, which Facebook and FB Messenger used i…

I love CyanogenMod (or at least the concept...I'm over dealing with the headache in practice), but the reason I used it was certainly not for improved stability and security. Not that I particularly trust OEMs/carriers, but the only way I'd feel more secure with CyanogenMod is if I had time to audit the source and build the kernel and OS binaries myself, and that includes whatever code is used to root and unlock your…

Privacy Guard does not require rooting your phone and can easily be enabled in stock ASOP Android phones:

http://www.guidingtech.com/23409/enable-android-permissions-...

It is really a shame that Android doesn't provide this feature enabled by default anymore (as they did for at one point). It could easily be provided with a warning that this might break your apps and use with caution.

Security often has a UX trade-off, that doesn't mean it can't be handled well by good design.

As someone who is working on a (secure) Android ROM, I don't recommend trying to build the kernel from source unless you're serious about doing it, the Android repo build system is a mess and will take you hours to get working right.

Re: Android: I don't need your permission

#75

Post by pserwylo »

Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

I'm an F-Droid developer, and we do in fact do secret option D.

There is a small but passionate group of people who are very focused on deterministic builds in Android working with us as well [0]. The end goal is to be able to install fdroidserver, then run:

  fdroid verify
And it will do all of this for you (download source, compile source, verify binary against another binary).

Of course, option B) is always a problem, but I guess the best solution short of paying to audit every single open source app is to fall back to the many eyes theory and hope it holds us in good stead.

EDIT: For those interested, one of the reasons we are interested in deterministic builds is so that we can verify that our build of the source corresponds to the upstream build. If that is the case, then we will be confident distributing the upstream binary (i.e. signed by the upstream developer). It is not possible to install a .apk from upstream, and then update it with a version signed by F-Droid - for very good and legitimate reasons. Distributing builds signed by upstream alleviates this problem.

[0] - https://f-droid.org/wiki/page/Deterministic,_Reproducible_Bu...

Re: Android: I don't need your permission

#76

Post by digi_owl »

rogerbinns wrote: post #68
digi_owl wrote: post #3

Best i can tell, quite a few requested permissions do not come from the developer. Instead it is the defaults of some framework or other the developer used to handle some of the nitty gritty details, like the ads.

Another angle being missed is that Android won't auto-update apps if they have new permissions (modulo some minor details). The developers I worked with always added more permissions to their initial app versions for things they weren't using, but might in the future.

That is a Play thing, not a Android thing, iirc.

Still, with the latest change in permissions handling in Play, it will happily auto-update an app if the new permission(s) are in the same category as a previous one...

Re: Android: I don't need your permission

#77

Post by r00fus »

Nursie wrote: post #60
jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

It is totally nuts. Whoever thought to bundle all of that stuff up in one huge permission...

The same people that would prefer if you give all permissions. I still see no reason why Google doesn't implement more granular permissions models.

Has the latest Android given you the ability to restrict an apps permissions after install without resorting to trusting 3rd party tools like xPrivacy or uninstalling the app?

Re: Android: I don't need your permission

#78

Post by schoen »

pserwylo wrote: post #75
Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

I'm an F-Droid developer, and we do in fact do secret option D. There is a small but passionate group of people who are very focused on deterministic builds in Android working with us as well [0]. The end goal is to be able to install fdroidserver, then run: fdroid verify And it will do all of this for you (download source, compile source, verify binary against another binary). Of course, option B) is always a proble…

Congratulations to the F-Droid project on making this work; it's a great step.

Re: Android: I don't need your permission

#79

Post by yincrash »

jbk wrote: post #64
quantumet wrote: post #56

Earlier quoted context omitted.

So does Android: http://developer.android.com/training/managing-audio/audio-f... http://android-developers.blogspot.com/2013/08/respecting-au...

We're already doing this. It's not enough. See our source code.

Could you link to the relevant class?

Re: Android: I don't need your permission

#80

Post by mbesto »

Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

Apple's wall garden is looking a little more rosy isn't it?
Post reply on HN