Why does the tutorial for creating a demo app, https://source.android.com/docs/core/virtualization/writeavf..., only work on Cuttlefish (emulator)?
Nevermind, only the demo app, not the tutorial, so who knows what its doing.
Virtual Machine as a core Android Primitive
21–30 of 177 posts
Re: Virtual Machine as a core Android Primitive
#22So on desktop, if I spin up a VM with networking disabled I feel pretty confident I can run anything safely, even malware is not going to escape. What's the current state of the art for Android virtualization? Let's assume we're talking about the newest Pixel and newest Android version. Is there any way to safely run malware or the Facebook app in some sort of air-gapped container and throw it away when you're done?
> if I spin up a VM with networking disabled I feel pretty confident I can run anything safely, even malware is not going to escape.
You are putting too much faith in your VM monitor to keep you safe. There's a lot of attack surface in (for example) QEMU peripherals, and there's plenty of examples of VM escape [1]. CrosVM is probably the only publicly available VMM I'd be willing to trust, and even then I'd be nervous running state-sponsored malware on a machine with important data.
Re: Virtual Machine as a core Android Primitive
#23Earlier quoted context omitted.
Websites will require digital ID just to use them, along with remote attestation. They will also be able to ban or block you in an actually effective and comprehensive way. There will be a chilling effect because people won't want to upset their Google/Microsoft/Apple/Meta etc overlords by saying or doing the wrong thing, and then get locked out of services they need to exist in society, do their job, spend money, et…
Digital ID exists and is widely used, yet I only need to use my digital ID to authenticate with government services. Remote attestation is the norm for many types of apps already yet I can use my bank app on my rooted phone just fine, or use my phone to authenticate with my government's SSO system. I'm no fan of the modern dependence on Play Services or Google's attempts to kill adblockers through remote attestation,…
I'm not worried about the government, I'm more worried about inscrutable decisions made by companies like Google, where their automated systems decide that you're an anomaly, and thus malicious, and choose to ban you.
Instead of just losing your account, you (or at least both your machine and your digital ID) are banned for good. This already happens with phones, where the entire device gets banned by apps for good, adding a layer of digital ID on top of it worsens the consequences of such decisions by platform owners against users.
> Remote attestation is the norm for many types of apps already yet I can use my bank app on my rooted phone just fine,
Many people can't on their rooted phones, and this cat-and-mouse game will eventually be won by the parties with million/billions to throw at it.
Re: Virtual Machine as a core Android Primitive
#24Earlier quoted context omitted.
This is such a bad take. I'd love the easy ability to run confidential computing loads with fine grained control over the data it gets access to. You can do this now on the desktop using SGX (etc) but on mobile it's really hard. As a specific example of this, it'd be great to be able to run Whisper continually and have strong, system level guarantees about what can read the data.
is it really? wasn't that the whole point of ARM TZ/SEP?
Not really. ARM TZ has been repeatedly blown open, in part because it’s not really a separate core or virtualized workload, but a different “mode of operation” that the standard CPU cores switch into temporarily. Basically going back-and-forth between TZ and your OS if I understand correctly. Turns out that’s a side-channel attack nightmare.
Re: Virtual Machine as a core Android Primitive
#25Earlier quoted context omitted.
This is such a bad take. I'd love the easy ability to run confidential computing loads with fine grained control over the data it gets access to. You can do this now on the desktop using SGX (etc) but on mobile it's really hard. As a specific example of this, it'd be great to be able to run Whisper continually and have strong, system level guarantees about what can read the data.
I used to work at Google adjacent to this stuff and A) you wouldn't boot up a whole VM for this, on a phone, that'd be very wasteful B) there's much simpler ways to provide the same guarantee. So in general, just would avoid labeling the quality of other people's takes. You never know who is reading yours
I agree there are currently better ways of doing this (because as you mention the resource/protection trade off for this technology on this application is sub-optimal), but the context here is as an example on HN where the data privacy is obvious so I didn't have to write a whole paper explaining it.
Re: Virtual Machine as a core Android Primitive
#26Why does the tutorial for creating a demo app, https://source.android.com/docs/core/virtualization/writeavf... , only work on Cuttlefish (emulator)? Nevermind, only the demo app, not the tutorial, so who knows what its doing.
Maybe because it requires a platform signature to use?
Re: Virtual Machine as a core Android Primitive
#27Earlier quoted context omitted.
This is such a bad take. I'd love the easy ability to run confidential computing loads with fine grained control over the data it gets access to. You can do this now on the desktop using SGX (etc) but on mobile it's really hard. As a specific example of this, it'd be great to be able to run Whisper continually and have strong, system level guarantees about what can read the data.
is it really? wasn't that the whole point of ARM TZ/SEP?
This is supposed to be a replacement to TrustZone applets.
Re: Virtual Machine as a core Android Primitive
#28Earlier quoted context omitted.
This is such a bad take. I'd love the easy ability to run confidential computing loads with fine grained control over the data it gets access to. You can do this now on the desktop using SGX (etc) but on mobile it's really hard. As a specific example of this, it'd be great to be able to run Whisper continually and have strong, system level guarantees about what can read the data.
is it really? wasn't that the whole point of ARM TZ/SEP?
Trusted computing can be used for DRM. I'm much more interested in it as a privacy enhancing technology: the fact that you can have strong guarantees about what can be done with data in the enclave is useful for a lot of applications where you have sensitive data.
(Putting aside the fact for the moment that most - if not all - trusted computing platforms have some security vulnerabilities. Obviously this is bad, but doesn't preclude their utility)
Re: Virtual Machine as a core Android Primitive
#29Two-way isolation seems like it'd only be useful for DRM and Treacherous Computing.
This is such a bad take. I'd love the easy ability to run confidential computing loads with fine grained control over the data it gets access to. You can do this now on the desktop using SGX (etc) but on mobile it's really hard. As a specific example of this, it'd be great to be able to run Whisper continually and have strong, system level guarantees about what can read the data.
The threat model you have in your head seems to imply that you don't trust your OS to not peek into what Whisper is doing? There are very few workloads that need or can operate under that model.
Re: Virtual Machine as a core Android Primitive
#30Will this allow running linux VMs on any Android device ? Via something like nestbox: https://www.patreon.com/posts/74333551 ?
AVF supports this, people have used it to boot Linux and Windows. See for example https://twitter.com/kdrag0n/status/1493089098944237568