Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android may soon restrict on-device ADB

kitsumed.github.io

Post reply on HN
Print view View original

481–490 of 536 posts

Re: Android may soon restrict on-device ADB

#481

Post by AnthonyMouse »

TeMPOraL wrote: post #390
AnthonyMouse wrote: post #368

Earlier quoted context omitted.

There is a simple and highly accurate heuristic to tell if a security measure is reasonable: Is it an open standard that anyone can permissionlessly implement? When the answer is yes, there is a high probability that it's something reasonable, e.g. TOTP. When the answer is no, what you will find behind the curtain is either a fool or a crook.

This heuristic is not covering the dimensions of interest here, because it fails to address the key security questions (that the industry usually wants people to not even think about): Who is doing the securing, whose interests are being secured, and against who/what? Security isn't an unqualified good thing to have. It's just an instrument of control. Who wields it and how are the paramount questions. You can have a…

> You can have an "open standard that anyone can permissionlessly implement", aimed at protecting interest of third parties, by securing the device from its actual owner.

Except that you can't, because those systems require the device to come with secret keys, so an interoperable third party implementation would require keys, which requires permission, which is the exact thing "permissionless" is intended to evict.

Re: Android may soon restrict on-device ADB

#482

Post by TeMPOraL »

wartijn_ wrote: post #469
KludgeShySir wrote: post #451

Earlier quoted context omitted.

I'm begging, please let me use password "asdfasdf" on throwaway accounts. I accept full responsibility for the fallout. Seriously, many web admins need to hear this message: "Chill. Your site is not that important."

It’s always interesting to see how fast someone takes a proposal and takes it to some ridiculous extreme. Websites don’t know your account is a throwaway one, and making an exception for those accounts doesn’t make sense anyway. Saying “ I accept full responsibility for the fallout” obviously doesn’t work on a large scale and here exceptions don’t make sense either. Just use a password manager that generates and fill…

I'll repeat what GP wrote:

> Seriously, many web admins need to hear this message: "Chill. Your site is not that important."

Re: Android may soon restrict on-device ADB

#483

Post by DoctorOetker »

wolvoleo wrote: post #456
zaptheimpaler wrote: post #325

Earlier quoted context omitted.

"Security" is just a scourge on software at this point. It means 2FA on every trivial site, being logged out every few hours for no good reason, having to fuck with settings and type "disable sandbox" to run an agent in YOLO mode which still won't work over mobile, being unable to install an unsigned extension at all in firefox (not behind a setting, literally impossible - you have to get Firefox Developer Edition),…

Exactly. At work I now have to MFA and type a random code every time I want to book a desk. It kills the session after 30 minutes. It's ridiculous. If an attacker ever got hold of it, they could... book a desk at that shitty office for me. Whoopty doo what horror. The same with logging my hours in a different system. I only use those systems for those things, nothing else. Security is important for things that actual…

One insider threat actor might book a previously unbugged desk, bug it with multi-antenna keystroke logger (making and breaking resistive connections across parasitic capacitance nodes, changes the direction dependent EM scattering function). One can correlate acoustic key press detection with changes in scattering, unsupervised.

Fixed desks are way more secure than promiscuous desk multiplexing.

Re: Android may soon restrict on-device ADB

#484

Post by pdpi »

TeMPOraL wrote: post #482
wartijn_ wrote: post #469

Earlier quoted context omitted.

It’s always interesting to see how fast someone takes a proposal and takes it to some ridiculous extreme. Websites don’t know your account is a throwaway one, and making an exception for those accounts doesn’t make sense anyway. Saying “ I accept full responsibility for the fallout” obviously doesn’t work on a large scale and here exceptions don’t make sense either. Just use a password manager that generates and fill…

I'll repeat what GP wrote: > Seriously, many web admins need to hear this message: "Chill. Your site is not that important."

No site is important until it is, but by then it's too late to overhaul your security architecture.

Re: Android may soon restrict on-device ADB

#485

Post by fsflover »

kllrnohj wrote: post #201
0x_rs wrote: post #128

Limiting ADB is the obvious next step. Even if this one specific feature request does not come to pass, Google has cornered everyone into relying on a developer interface for any normal personal computing tasks, whether running on-device or through USB/wireless. It's quite clear at some point in the future you will either be required to surrender your identity to them and pay a yearly fee or be severely limited to co…

> As if you didn't need any more proof you don't own "your" devices. Can you install your own OS? If yes, you own it. And Google consistently lets you do that. It other OEMs don't then direct your outrage at them.

> Can you install your own OS? If yes, you own it.

Except all drivers and firmware are closed, so whenever the vendor decides updates are over, you have to replace the device or be insecure.

Re: Android may soon restrict on-device ADB

#486

Post by izacus »

mayama wrote: post #453
matheusmoreira wrote: post #406

Earlier quoted context omitted.

Android became a lost cause the second they introduced hardware remote attestation. Even if there was a way to install your own software, there's no point in doing so. You're "tampering" with the device. Fail attestation and you're untrusted. You get banned from everything. If you hack, you're ostracized from digital society. You're a second class citizen. Can't communicate. Can't bank. Can't stream. Can't play video…

> and only because by some miracle there are companies out there who started trusting Graphene's attestation keys. Are the bank apps trusting graphene keys or google them self? Isn't play attestation completely in the hands of google.

Play Attestation is a Google hosted database of build keys/hashes for known Android builds. Android-side of this attestation is an API which calculates and returns those hashes to the app.

There's nothing preventing the app from verifying the build itself against its own database. So they can allowlist GrapheneOS builds if they want - but of course that means that all other ROMs are still banned.

Re: Android may soon restrict on-device ADB

#488

Post by cyanydeez »

Gormo wrote: post #441
zaptheimpaler wrote: post #325

Earlier quoted context omitted.

"Security" is just a scourge on software at this point. It means 2FA on every trivial site, being logged out every few hours for no good reason, having to fuck with settings and type "disable sandbox" to run an agent in YOLO mode which still won't work over mobile, being unable to install an unsigned extension at all in firefox (not behind a setting, literally impossible - you have to get Firefox Developer Edition),…

Security is also increasingly being used as a pretext for usurpation of end-user control over their own devices, which the situation in this very article seems to be a case of. The industry, and society at large, are today overrun with fiduciaries who've convinced themselves that they are the principals.

hard not to believe them given the regulatory degradation. The orange menance also has a hug ego cause shit just keeps sliding his way.

Without regulations, billion dollar, multi continent countries can do as they want because their owners, citizens, etc arn't considered targets even when they make these decisions in concert if not in colusion, if not in conspiracy.

Re: Android may soon restrict on-device ADB

#489

Post by hnlmorg »

wolvoleo wrote: post #457
hnlmorg wrote: post #384

Earlier quoted context omitted.

IT has always been a spectrum with security at one end and convenience at the other. There is no recent trend that’s changed that. That’s just how life works.

Yes but the balance has shifted a lot. I remember working at a major company where important systems had an admin password of " 123". That was stupid. I asked to change it but the answer was no because too many people would have to be told the new password. That was too much in favour of convenience and I'm surprised they never got pwned in the worst way. These days the balance has swung way too much in favour of sec…

Given cyber attacks are more rampant than ever, it’s hard to argue that security has gone too far the other way.

Re: Android may soon restrict on-device ADB

#490

Post by chrisjj »

KludgeShySir wrote: post #451
zaptheimpaler wrote: post #325

Earlier quoted context omitted.

"Security" is just a scourge on software at this point. It means 2FA on every trivial site, being logged out every few hours for no good reason, having to fuck with settings and type "disable sandbox" to run an agent in YOLO mode which still won't work over mobile, being unable to install an unsigned extension at all in firefox (not behind a setting, literally impossible - you have to get Firefox Developer Edition),…

I'm begging, please let me use password "asdfasdf" on throwaway accounts. I accept full responsibility for the fallout. Seriously, many web admins need to hear this message: "Chill. Your site is not that important."

> I accept full responsibility for the fallout.

But you can't - when it includes damage to the provider e.g. brand tarnishing.

A lot of user-access "security" is for the benefit of the provider, not the user.

Post reply on HN