Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android may soon restrict on-device ADB

kitsumed.github.io

Post reply on HN
Print view View original

501–510 of 536 posts

Re: Android may soon restrict on-device ADB

#501

Post by inigyou »

ryandrake wrote: post #418
inigyou wrote: post #351

Earlier quoted context omitted.

It used to be common knowledge that downloading stuff could be dangerous. That went away when vendors tried to make it safe.

Many software vendors have deliberately blurred the lines between "on your computer" and "on the internet". When you save something in Application A, is it really being saved on your computer, or is it in the cloud? It used to be obvious, but now you kind of don't know until you do some digging in your filesystem. And, now we actually run some apps from the web! The phrase "the user doesn't have to know if this is on…

I don't think that's the real problem. The point was that opening something you don't know what it does == bad, not that internet == bad

Re: Android may soon restrict on-device ADB

#502

Post by createful »

zzril wrote: post #336
createful wrote: post #254

Earlier quoted context omitted.

Linux phones exist but work on a limited number of devices (see PostMarketOS) or Linux primary devices like Purism or Pinephone (which I've heard are expensive). That's the primary issue, you either need to buy an expensive and potentially underpowered phone OR have one that is supported most of the way with PostMarketOS (Wifi, SIM card, GPU, etc. sometimes may not work even though the phone can boot PostMarketOS). I…

I've paid 200€ for my PinePhone. It is underpowered, but at least it doesn't have to waste its resources on rendering ads. Where Android/iPhone users have "apps", I mostly end up writing small shell scripts around existing linux tools. My alarm clock "app" is realized via cron jobs; my TOTP "app" is a one-liner around `oathtool`. Messenger apps are a bit tricky; I'll probably end up hosting my own matrix homeserver a…

I'm not saying Linux phones are junk, but if you want more people to adopt these phones you do need "easier" solutions. Not everyone will want a cron job alarm.

Because if we leave linux phones in their current state then getting hardware for them will be difficult and the software will end up being a pain.

Adoption of Linux phones is kind of the only way that hardware for them will get more mainstream and will allow more people to use Linux phones. And adoption is partly helped by ease of use.

Re: Android may soon restrict on-device ADB

#504

Post by spjt »

fragmede wrote: post #439
Terr_ wrote: post #417

Earlier quoted context omitted.

Right, and that leads us back to the more-generalized (but very classic) cui bono ? Who gets the benefits?

In Apple's case, I don't know. I'm making macOS software, and the number of roadblocks I keep running into in the name of security is past merely annoying, it's costing real time and money to deal with it. Unfortunately that's where the users are so we have to spend the resources on it so it's an Apple tax on doing things on their platform. We have to spend more money on Apple development, so that ecosystem benefits?…

Yeah we were trying to develop an internal corporate MacOS desktop app and the amount of shit I had to go through just to get it to the point where someone who isn't a developer was able to run it was absolutely insane. In the end a lot of this is probably even counterproductive as people get used to these sort of things coming with instructions to disable all security and paste these sudo commands into a terminal to get it running...

Re: Android may soon restrict on-device ADB

#505

Post by AnthonyMouse »

spjt wrote: post #504
fragmede wrote: post #439

Earlier quoted context omitted.

In Apple's case, I don't know. I'm making macOS software, and the number of roadblocks I keep running into in the name of security is past merely annoying, it's costing real time and money to deal with it. Unfortunately that's where the users are so we have to spend the resources on it so it's an Apple tax on doing things on their platform. We have to spend more money on Apple development, so that ecosystem benefits?…

Yeah we were trying to develop an internal corporate MacOS desktop app and the amount of shit I had to go through just to get it to the point where someone who isn't a developer was able to run it was absolutely insane. In the end a lot of this is probably even counterproductive as people get used to these sort of things coming with instructions to disable all security and paste these sudo commands into a terminal to…

It has been a known thing in security for what has to be decades now that taking a security/usability trade off in favor of "security" is the fast way to train users to mash the "allow all" button from muscle memory, thereby severely impairing security.

The premise of the scary banner has to be that the first time the user has ever seen it is when there is actually something wrong.

This is, of course, fully incompatible with the corporate incentive to present the scary banner whenever an honest third party hasn't paid them the danegeld or satisfied a bureaucratic process documented by Franz Kafka. If the thing you care about is actually security.

Re: Android may soon restrict on-device ADB

#506

Post by BoxwoodSeed »

wolvoleo wrote: post #464
Tade0 wrote: post #142

Earlier quoted context omitted.

ING supports hardware keys in some markets, so there's no reason not to.

Every bank here had that. Now they all require apps. For the banks I understand. Now they don't have to supply millions of code calculator devices. And they force their apps which they can stuff full of tracking to mine their customers for data they can sell. It's sad but part of the usual enshittification cycle

They provided you with one? My bank made me buy my own device. It's an online bank, so I'm not sure if using the app allows for better tracking than simply using their normal website. So far I haven't been forced to use an app, so I guess not.

Re: Android may soon restrict on-device ADB

#507

Post by TeMPOraL »

pdpi wrote: post #484
TeMPOraL wrote: post #482

Earlier quoted context omitted.

I'll repeat what GP wrote: > Seriously, many web admins need to hear this message: "Chill. Your site is not that important."

No site is important until it is, but by then it's too late to overhaul your security architecture.

No, the site doesn't become important if it wasn't from the start. This is not conditioned on individual use cases. Government sites, your bank, your healthcare provider - they have the important sites. Your e-mail provider is important too, because by accident of Internet history, your e-mail is your backup key to everything in your digital life.

Beyond those, nothing is that important. Your random e-commerce site or discussion board are not that important. Neither is your ISP or the service where you fix your appliances (or phones). And especially not the random fly-by-night startups that want you to register before you test their "game changing" SaaS.

The sad irony is, the smaller and less important the site, the more stringent security measures they tend to deploy, because security theater is trendy nowadays. 2FA is so 2025, if you're not demanding passkeys, you're a dinosaur.

(A good heuristic to use: if your site has harder security than your government's core services, especially when it comes to recovering access, it's worth asking whether there's any actually sensible reason for it.)

Re: Android may soon restrict on-device ADB

#508

Post by TeMPOraL »

wolvoleo wrote: post #492
dotancohen wrote: post #472

Earlier quoted context omitted.

That's why I mentioned "and also enabling authorised access to that same resource". Passkeys are great at preventing unauthorized access. But that comes at the expense of preventing authorised access. For example, using another device or even moving to another device. Replacing a stolen or damaged device is also nearly impossible with a reasonable quantity of Passkeys.

Well that's why they can sync between devices. I don't really see the problem. Even if you don't like to rely on big tech (google/apple), I don't either, there are many options now for full FOSS implementations like bitwarden and KeepassXC. If you use a yubikey as a passkey then yes, that's not a great option also because most services don't allow you to enroll more than one passkey. But with bitwarden that doesn't m…

> Well that's why they can sync between devices. I don't really see the problem.

How do you sync passkeys to someone else's phone to authorize them to act in your name?

This is the basic use case, very common in the physical world, that security industry refuses to accept exists.

Passwords have this capability by nature.

> because most services don't allow you to enroll more than one passkey

Which is dumb and part of what makes passkeys not just useless, but dangerously so. Same story with 2FA, and the many services that only allow you to have one registered authenticator app at the time.

Re: Android may soon restrict on-device ADB

#509

Post by Gormo »

cyanydeez wrote: post #488
Gormo wrote: post #441

Earlier quoted context omitted.

Security is also increasingly being used as a pretext for usurpation of end-user control over their own devices, which the situation in this very article seems to be a case of. The industry, and society at large, are today overrun with fiduciaries who've convinced themselves that they are the principals.

hard not to believe them given the regulatory degradation. The orange menance also has a hug ego cause shit just keeps sliding his way. Without regulations, billion dollar, multi continent countries can do as they want because their owners, citizens, etc arn't considered targets even when they make these decisions in concert if not in colusion, if not in conspiracy.

Regulations are principally a vehicle for these very sort of intrusive behaviors, given that their main effects are to create barriers to entry that entrench established business models and block competition, create a nexus of effectively legalized collusion between entrenched oligopolists in a given market, via influencing regulation, and replace general common-law liability with rules that can be manipulated by industry players. This pattern is found throughout the regulatory landscape.

Re: Android may soon restrict on-device ADB

#510

Post by thetbw »

KludgeShySir wrote: post #451
zaptheimpaler wrote: post #325

Earlier quoted context omitted.

"Security" is just a scourge on software at this point. It means 2FA on every trivial site, being logged out every few hours for no good reason, having to fuck with settings and type "disable sandbox" to run an agent in YOLO mode which still won't work over mobile, being unable to install an unsigned extension at all in firefox (not behind a setting, literally impossible - you have to get Firefox Developer Edition),…

I'm begging, please let me use password "asdfasdf" on throwaway accounts. I accept full responsibility for the fallout. Seriously, many web admins need to hear this message: "Chill. Your site is not that important."

Sometimes companies assume my password has been leaked and keep making me change it over and over again. Eventually, I end up forgetting my own password. It’s really frustrating.
Post reply on HN