But who cares about security of your locked Android phone either?
The folks developing these security features in Android and the Linux kernel do.
No One Cares About the Security of Unlocked Android Phones
31–40 of 44 posts
Re: No One Cares About the Security of Unlocked Android Phones
#32Which is exactly why we need to fix this problem. Consumer products don't have good security at all and it's making the world a worse place
It's more complicated than that. If Google just produced a standard version of Android with a standard kernel version that all vendors would write for, refreshing and wiping phones would be as easy as Windows/Linux laptops. I wrote a post on this a while back: http://penguindreams.org/blog/android-fragmentation/ Since then, I've become more and more frustrated with other ARM boards. Android fragmentation is directly…
are you sure the problem is arm? How can google use a standard kernel version? I mean it is quite standard and only changes between major releases doesn't it? The thing is that linux being monolithic requires all the drivers baked in, which is fine like it is fine the whole flashing ROMs stuff, or maybe it was a few years a go when phones where phones and not pocket pcs so they benefited from the whole packaging. Magenta by google seems to use userspace drivers, so if that is ever gonna get used in phones it might be a solution for a more standard kernel
Re: No One Cares About the Security of Unlocked Android Phones
#33I commented about something similar two days ago, and once again there's no mention in the article or here about the fundamental problem of proprietary software:
https://news.ycombinator.com/item?id=12957927
True security and privacy cannot be had without free/libre software. It's not a solution in its own right, but it's a necessary step to mitigate issues such as these.
A commenter in the linked thread also mentioned other Android OSes working on hardening.
Re: No One Cares About the Security of Unlocked Android Phones
#34I'm flagging this article because it is making a blaming statement nobody cares about the security of my unlocked phone, which is provably false. Let's start eliminating dissonance from HN by taking the time to think about the content we are consuming and how it affects us!
If you're across the threshold for flagging, you can flag any story on the site in the sense that a link will appear and change to "unflag" when you click it.
If you expect your flag privileges to mean anything more than that, you should probably avoid using "flag" as a downvote, because your flag privileges can be quietly stripped from your account --- in fact, there's any number of heuristics that can do it by cron job, without the moderators even knowing who you are.
The "flag" feature is there to mark stories as off-topic and wholly inappropriate for HN. Nobody on HN thinks this is off-topic for the site.
Just some advice!
Re: No One Cares About the Security of Unlocked Android Phones
#35I commented about something similar two days ago, and once again there's no mention in the article or here about the fundamental problem of proprietary software: https://news.ycombinator.com/item?id=12957927 True security and privacy cannot be had without free/libre software. It's not a solution in its own right, but it's a necessary step to mitigate issues such as these. A commenter in the linked thread also mention…
It's worth elaborating on exactly why this is.
When software is Free, the end-user's relationship is inherited from the developer's relationship to the software [0]. As such, the definition of security is a completely shared one.
When software is not Free, the developer's and end-user's perspective are at odds. For starters, they're likely on opposite sides of a financial transaction [1]. The security of non-Free software is thus defined in terms of the developer's interest. Many desires will still align, like securing against most third-party attackers. But some will certainly not, like the business interests of the company and its partners (including the domestic nation-state).
[0] Indeed, a source of much complaint / usability problem.
[1] I'm certainly not rejecting the idea of trading money for software/services, but highlighting a deep-seated principle agent problem. It'd be really nice to find a way to set up a workable economy around Free software, lest we continue to lose to app stores and "open-washed" webcrapps.
Re: No One Cares About the Security of Unlocked Android Phones
#36Earlier quoted context omitted.
It's more complicated than that. If Google just produced a standard version of Android with a standard kernel version that all vendors would write for, refreshing and wiping phones would be as easy as Windows/Linux laptops. I wrote a post on this a while back: http://penguindreams.org/blog/android-fragmentation/ Since then, I've become more and more frustrated with other ARM boards. Android fragmentation is directly…
are you sure the problem is arm? How can google use a standard kernel version? I mean it is quite standard and only changes between major releases doesn't it? The thing is that linux being monolithic requires all the drivers baked in, which is fine like it is fine the whole flashing ROMs stuff, or maybe it was a few years a go when phones where phones and not pocket pcs so they benefited from the whole packaging. Mag…
I don't see what the monolithic kernel has to do with it. Kernel modules are dynamically have been loadable. Yes, they run in kernel mode, and yes their version tightly bound to the running kernel -- but how is that a problem for abstracting of varying hardware?
Re: No One Cares About the Security of Unlocked Android Phones
#37"Google eventually accepted a CTS patch to check for the ADUPS system socket. That should have solved the problem, but then Mediatek just changed the name of the socket to purposely evade Google’s CTS check."
That just left me gaping at the sheer brass required to do this, but I understand how it could happen. I'm sure there are some people who want to fix the problem, and others who say "Why bother? We may lose a few technically savvy (aka pain in the neck) end users, but the great unwashed are never going to know or care about whether this was fixed. Our customers know that their customers are the great unwashed, so they aren't going to care either as long as we're cheaper for them."
Or TL;DR, "Screw 'em, what are they going to do, organize a boycott by people who think chips are something you eat?"
Re: No One Cares About the Security of Unlocked Android Phones
#38Earlier quoted context omitted.
It's more complicated than that. If Google just produced a standard version of Android with a standard kernel version that all vendors would write for, refreshing and wiping phones would be as easy as Windows/Linux laptops. I wrote a post on this a while back: http://penguindreams.org/blog/android-fragmentation/ Since then, I've become more and more frustrated with other ARM boards. Android fragmentation is directly…
are you sure the problem is arm? How can google use a standard kernel version? I mean it is quite standard and only changes between major releases doesn't it? The thing is that linux being monolithic requires all the drivers baked in, which is fine like it is fine the whole flashing ROMs stuff, or maybe it was a few years a go when phones where phones and not pocket pcs so they benefited from the whole packaging. Mag…
Linux modules are very kernel specific. If you have modules compiled against the same kernel version, but with slightly differently flags, you won't be able to load it and will get a lot of invalid symbols.
There are thousands of kernel variants between every Linux distro. You always need to recompile drivers. nVidida and AMD/ATI get by this by providing binary blobs and a shim layer than can compile and link the two.
In the Windows/Mac world there is one version of the kernel officially maintained and distributed by their respective companies. They can keep the kernel consistent for a given release. That's what you have one set of drivers for Windows 7, one for 8 and one for 10, instead of a different set of drivers for each and every service pack.
Android could, at a minimum, standardize the kernel for every Android version. With that, binary drivers could work across devices.
Re: No One Cares About the Security of Unlocked Android Phones
#39Earlier quoted context omitted.
It's more complicated than that. If Google just produced a standard version of Android with a standard kernel version that all vendors would write for, refreshing and wiping phones would be as easy as Windows/Linux laptops. I wrote a post on this a while back: http://penguindreams.org/blog/android-fragmentation/ Since then, I've become more and more frustrated with other ARM boards. Android fragmentation is directly…
are you sure the problem is arm? How can google use a standard kernel version? I mean it is quite standard and only changes between major releases doesn't it? The thing is that linux being monolithic requires all the drivers baked in, which is fine like it is fine the whole flashing ROMs stuff, or maybe it was a few years a go when phones where phones and not pocket pcs so they benefited from the whole packaging. Mag…
Yes, the problem is ARM.
How do you want to boot your kernel? There is no BIOS or UEFI or other standardized firmware, that would initialize at least one CPU, RAM, storage and load your kernel from there. Every ARM implementation boots in different way.
After you boot up, how do you enumerate devices that your kernel can use? There is no PCIE or other plug and play bus, that can enumerate attached devices. Your OS has to know what is available. Poke a wrong port and your board freezes. This is the reason, why Device Tree is a thing.
Linux kernel does not require all drivers baked in - kernel modules existed for decades already. Monolithic does not mean that everything is one big blob. NT is also monolithic, for example.
Re: No One Cares About the Security of Unlocked Android Phones
#40Maybe we should build a new bootloader that can be locked down once installed, but with our own keys in the device.