Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Virtual Machine as a core Android Primitive

android-developers.googleblog.com

Post reply on HN
Print view View original

31–40 of 177 posts

Re: Virtual Machine as a core Android Primitive

#31

Post by saagarjha »

heavyset_go wrote: post #13
ForkMeOnTinder wrote: post #12

So on desktop, if I spin up a VM with networking disabled I feel pretty confident I can run anything safely, even malware is not going to escape. What's the current state of the art for Android virtualization? Let's assume we're talking about the newest Pixel and newest Android version. Is there any way to safely run malware or the Facebook app in some sort of air-gapped container and throw it away when you're done?

Pretty sure Android already uses Linux containers/namespaces for app isolation.

It uses separate UIDs mostly.

Re: Virtual Machine as a core Android Primitive

#32

Post by somanytta »

saagarjha wrote: post #29
nl wrote: post #16

Earlier quoted context omitted.

This is such a bad take. I'd love the easy ability to run confidential computing loads with fine grained control over the data it gets access to. You can do this now on the desktop using SGX (etc) but on mobile it's really hard. As a specific example of this, it'd be great to be able to run Whisper continually and have strong, system level guarantees about what can read the data.

The threat model you have in your head seems to imply that you don't trust your OS to not peek into what Whisper is doing? There are very few workloads that need or can operate under that model.

It's not really a matter of need, more a matter of good hygiene.

Do you trust any modern OS not to accidently include sensitive information when it generates a crash report for an app and sends it off the some remote server in the background?

Isolation is a useful tool. In an ideal world it can be done perfectly at the OS level, but we don't live in that world.

Re: Virtual Machine as a core Android Primitive

#34

Post by saagarjha »

somanytta wrote: post #32
saagarjha wrote: post #29

Earlier quoted context omitted.

The threat model you have in your head seems to imply that you don't trust your OS to not peek into what Whisper is doing? There are very few workloads that need or can operate under that model.

It's not really a matter of need, more a matter of good hygiene. Do you trust any modern OS not to accidently include sensitive information when it generates a crash report for an app and sends it off the some remote server in the background? Isolation is a useful tool. In an ideal world it can be done perfectly at the OS level, but we don't live in that world.

I agree that being able to isolate things that have different security domains is a useful tool. That said, I am not really seeing how pKVM provides useful primitives for much other than DRM, which has historically been the primary usecase for trusted execution that isolated VMs seem to provide.

Re: Virtual Machine as a core Android Primitive

#35

Post by treyd »

heavyset_go wrote: post #11
treyd wrote: post #8

Earlier quoted context omitted.

This nonsense means I just use them in the browser. There is no functionality the apps would provide me that makes it worth fighting with their superstitious nonsense.

Some banks already require you to install and use apps to approve of transactions made outside of the app. When I traveled, this is how I was able to spend money without having to call my bank every time I tried to use my card in person.

What are you supposed to do if you don't have a smartphone? My bank simply texts me if there's suspicious purposes and you reply "YES".

Re: Virtual Machine as a core Android Primitive

#36

Post by somanytta »

kiririn wrote: post #18
josephcsible wrote: post #2

Two-way isolation seems like it'd only be useful for DRM and Treacherous Computing.

Yep, you need only look at the number of server providers offering confidential computing (pretty much only the big 3) and the premium they charge for it (10x, except AWS “trust me bro” Nitro) Confidential computing is cool and useful when you’re the one controlling the VM, but scary when you’re the one blindly running it on your hardware Hopefully this gets (publicly!) backdoored like SEV, SGX, etc

> Confidential computing is cool and useful when you’re the one controlling the VM, but scary when you’re the one blindly running it on your hardware

Important point.

> Hopefully this gets (publicly!) backdoored like SEV, SGX, etc

From my reading this doesn't need to be backdoored, if you have the ability to unlock the bootloader, you are not reliant on googles root of trust to be able to use this feature, you can go ahead and become your own "vendor", by signing your own images, or use your choice of vendor, then relock the bootloader and have the same security guarantees.

I'll admit this only from a cursory glance over the documentation and a vague understanding, happy to be corrected, but seems a lot of the arguments in this thread are about your first point, who has control over the OS.

I'll also add that the EU is being quite proactive in people having control over their own device, and who is their 'choice of vendor' so while I understand concerns people bring up, I'm a bit more optimistic that it can be a more useful tool than not.

Re: Virtual Machine as a core Android Primitive

#37

Post by monocasa »

fleventynine wrote: post #22
ForkMeOnTinder wrote: post #12

So on desktop, if I spin up a VM with networking disabled I feel pretty confident I can run anything safely, even malware is not going to escape. What's the current state of the art for Android virtualization? Let's assume we're talking about the newest Pixel and newest Android version. Is there any way to safely run malware or the Facebook app in some sort of air-gapped container and throw it away when you're done?

> if I spin up a VM with networking disabled I feel pretty confident I can run anything safely, even malware is not going to escape. You are putting too much faith in your VM monitor to keep you safe. There's a lot of attack surface in (for example) QEMU peripherals, and there's plenty of examples of VM escape [1]. CrosVM is probably the only publicly available VMM I'd be willing to trust, and even then I'd be nervou…

I'd probably trust firecracker too since it was designed specifically to avoid qemu's attack surface and runs in production for Amazon.

Re: Virtual Machine as a core Android Primitive

#40

Post by fuomag9 »

nl wrote: post #16
josephcsible wrote: post #2

Two-way isolation seems like it'd only be useful for DRM and Treacherous Computing.

This is such a bad take. I'd love the easy ability to run confidential computing loads with fine grained control over the data it gets access to. You can do this now on the desktop using SGX (etc) but on mobile it's really hard. As a specific example of this, it'd be great to be able to run Whisper continually and have strong, system level guarantees about what can read the data.

Btw SGX has been removed from 11th gen desktop CPUs and onwards https://www.bleepingcomputer.com/news/security/new-intel-chi...
Post reply on HN