Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

System Hardening in Android 11

security.googleblog.com

Post reply on HN
Print view View original

151–160 of 211 posts

Re: System Hardening in Android 11

#151

Post by fomine3 »

sangfroid_bio wrote: post #40
sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

Another duopoly that needs more competition is push notification infrastructure. Efficient push notification requires OS vendor server support due to radio usage and agreements with telecommunication companies. Everybody is obsessed with closed app stores and completely missing the net neutrality aspect of the iOS/Android duopoly.

Do you have any references about agreements or requirements?

Re: System Hardening in Android 11

#152

Post by fomine3 »

yjftsjthsd-h wrote: post #129
darksaints wrote: post #118

Earlier quoted context omitted.

What sorts of uses do you have on a phone where a terminal is useful?

* youtube-dl single-handedly would justify installing termux * rsync (backups, pulling audio files, pushing pictures) * vim * git/hg (all my notes live in a repo) * random scripts (ex. When I was losing weight, I tracked calories with some shell scripts. I also have one that uses root and /system/bin/input to automate things.)

No one made youtube-dl GUI wrapper app, is it really?

Re: System Hardening in Android 11

#153

Post by zimmerfrei »

freedomben wrote: post #20
sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

You're upset about them requiring hardware attestation in SafetyNet (I am too) so you move to a platform that is way less flexible and way more closed? Not a troll, I'm really curious.

Is it clear exactly what SafetyNet does and reports back to Google?

Is its source code available (including for any TrustZone component), maybe as part of AOSP?

I am OK with the concept and I can value it also as a protection against advanced malware, but only if it is totally transparent (to me!) what data it collects and relies upon.

Re: System Hardening in Android 11

#154

Post by robin_reala »

Abishek_Muthian wrote: post #131
sitic wrote: post #12

In addition on Android 11 API * apps can't simply access the "external" storage (enforces scoped storage) * apps can't get a list of all installed apps (package visibility, they can specify app names and intent signatures in the Manifest they want to query) These are welcome changes in my view, but unfortunately they also seem intend to fix SafetyNet and require hardware attestation that the bootloader is not unlocke…

>I've always trusted CyanogenMod/LineageOS more then than a device manufacturer, but after >10 years of using Android I think it's finally time for me to switch to an iPhone. I'm not trying to go inside Android vs iOS rabbit hole, as it's common knowledge that android's default privacy features pale in comparison to iOS. But in Android you can leverage the trust of an individual app publisher as well and not forced t…

Tasker looks interesting. Any info on how it compares to iOS Shortcuts?

(also, iOS Safari has limited PWA functionality. It’s by no means as comprehensive as Chrome / Firefox on Android, but it was enough for me to make my latest site installable.)

Re: System Hardening in Android 11

#155

Post by saagarjha »

pjmlp wrote: post #136
saagarjha wrote: post #99

Earlier quoted context omitted.

You've mentioned this before but as far as I am aware there are no chips shipping with MTE, and the links you provided don't support this point either. Even if MTE somehow starts shipping tomorrow I cannot see Google dropping support for every device that is older or cheaper than the one flagship that'll use it.

The official statement, is from Google and ARM, not from me. From my links above, the TL;DR; snippets are > Google is committed to supporting MTE throughout the Android software stack. We are working with select Arm System On Chip (SoC) partners to test MTE support and look forward to wider deployment of MTE in the Android software and hardware ecosystem. > Starting in Android R, for 64-bit processes, all heap alloca…

Right, all those seem to point to greater MTE support and hardware tagging when available. But I don’t think any claim that Android 11 requires a new chip to be supported?

Re: System Hardening in Android 11

#156

Post by pjmlp »

saagarjha wrote: post #155
pjmlp wrote: post #136

Earlier quoted context omitted.

The official statement, is from Google and ARM, not from me. From my links above, the TL;DR; snippets are > Google is committed to supporting MTE throughout the Android software stack. We are working with select Arm System On Chip (SoC) partners to test MTE support and look forward to wider deployment of MTE in the Android software and hardware ecosystem. > Starting in Android R, for 64-bit processes, all heap alloca…

Right, all those seem to point to greater MTE support and hardware tagging when available. But I don’t think any claim that Android 11 requires a new chip to be supported?

Maybe it is my lack of native English understanding, but I read sentences like this one "Only recently, Google announced that it is adopting Arm’s MTE in Android." in another way as you do.

It doesn't make sense adopting support for non-existing hardware.

Re: System Hardening in Android 11

#157

Post by copp »

pjmlp wrote: post #149
copp wrote: post #145

Earlier quoted context omitted.

What makes iOS elegant over Android in your opinion ? You seem to state it as a fact but I believe it is your opinion .

Not the OP, but I also share the same opinion. - OS Frameworks are not designed for the next year's IO, rebooting last years best practices, rather have long term roadmaps. - The build system has stayed mostly the same, instead of having had multiple reboots - C and C++ are integrated with the rest of tooling instead of feeling like an burden that has to be supported to keep game devs happy - Everything that matters…

Thanks for your perspective from a game dev. w.r.t developing apps it has been long argued that iOS is better.

Re: System Hardening in Android 11

#158

Post by saagarjha »

pjmlp wrote: post #156
saagarjha wrote: post #155

Earlier quoted context omitted.

Right, all those seem to point to greater MTE support and hardware tagging when available. But I don’t think any claim that Android 11 requires a new chip to be supported?

Maybe it is my lack of native English understanding, but I read sentences like this one "Only recently, Google announced that it is adopting Arm’s MTE in Android." in another way as you do. It doesn't make sense adopting support for non-existing hardware.

Ah, I see the confusion. I interpreted https://news.ycombinator.com/item?id=23695227 as “this is a requirement of Android 11 and as such you can’t run the OS at all if you don’t have the new hardware supporting it”.

Re: System Hardening in Android 11

#159

Post by pjmlp »

saagarjha wrote: post #158
pjmlp wrote: post #156

Earlier quoted context omitted.

Maybe it is my lack of native English understanding, but I read sentences like this one "Only recently, Google announced that it is adopting Arm’s MTE in Android." in another way as you do. It doesn't make sense adopting support for non-existing hardware.

Ah, I see the confusion. I interpreted https://news.ycombinator.com/item?id=23695227 as “this is a requirement of Android 11 and as such you can’t run the OS at all if you don’t have the new hardware supporting it”.

That as well, from Android documentation I understand this,

> GWP-ASan is enabled on some randomly-selected system applications and platform executables upon process start-up (or when the zygote forks). Enable GWP-ASan in your own app to help you find memory-related bugs, and to prepare your app for ARM Memory Tagging Extension (MTE) support. The allocation sampling mechanisms also provide reliability against queries of death.

As stop gap solution until MTE is widespread across all Android devices.

Re: System Hardening in Android 11

#160

Post by izacus »

zanny wrote: post #112
izacus wrote: post #63

Earlier quoted context omitted.

It's really no secret after all these years that you need to buy a Google phone to get best support for their OS, just like you need to buy an Apple hardware to get support for their OS.

Google still has shorter support periods than Lineage manages. The Nexus 6 was dropped by Google at Android 7 but you can install Lineage 17.1 (10.0) on it today. Same with some really old devices like the Galaxy Note 3 or S4. And even older devices got supported up to Android 9 like the S3 or Nexus 5. The real secret is to buy one of the devices the real core Lineage developers maintain because they will keep those…

The problem is that Lineage does nothing to update the device driver stack where most security issues are found. Bumping up the Android OS version doesn't make you more secure in that respect.
Post reply on HN