Hacker News Reader

Comment by Mikeb85 | Hacker News Reader

There's nothing insecure about Android. It just gives a few more ways to install apps (side loading for example) which clever social engineers/scammers use to their advantage. It's like saying your credit card is insecure because you gave it to the homeless guy on the street when he promised to only buy a sandwich...

View on HN

Android security is typically horrible when you consider that most phones ship with software that never gets updated throughout their life and has been put together in a quite haphazard way. It's not a fault of Android per-se but it's the case in pretty much anything that isn't a Nexus.

> It's not a fault of Android per-se

And that's pretty much the answer...

BTW, I've found Samsung to be decent with updates as well.

> And that's pretty much the answer...

Not really. Android got big because OEMs can do as they like with it. And what OEMs like doing, apparently, is not updating the OS on their device. An Android OS that, from the start, controlled OEMs in some way (by e.g. forcing them to ship updates on a certain schedule) would likely not have become a viable contender in the market.

It's not the fault of Android that OEMs are stupid, but Android was created specifically to cater to OEMs and their stupidity. Android's existence is itself the problem.

(It'd be great if their licensing model up until now was just a bootstrapping strategy, though, and they began requiring things of their OEMs.)

It would be nice if they forced OEMs to use stock Android and update regularly, but they're already under government investigation for requiring Android branded phones to use certain Google services like Play...

To a certain degree, they're forced to either be open as they are now, or sell devices. Given absurd government rulings, forcing stock Android on OEMs would probably bring an antitrust suit against them.

Wait how is Google under investigation when they are even more open than Apple, regardless of what they ask of OEMs?

Apple's market share is fairly small compared to Android, on a world-wide basis. And because Apple is closed and proprietary, it can do what it likes. No other companies are installing iOS or Mac OS X on devices, so Apple has nobody to mess around.

Apple isn't forcing anything on OEMs. Google is, similar to how Microsoft was forcing things on PC OEMs back in the day.

> An Android OS that, from the start, controlled OEMs in some way would likely not have become a viable contender in the market.

I'm not sure... From the start, Android was the only viable contender for OEMs. Their choices were create their own OS (good luck catching up to iOS) or take Android with whatever restrictions it had.

Don't forget that were alternatives and I'm sure the large manufacturers were playing Google off against Microsoft, Nokia (Maemo), Samsung (Bada), Palm (WebOS), etc. Those were bigger names in mobile than Google and it wasn't obvious that Apple was going to steamroller the entire industry so quickly.

As we saw, the established companies wasted years and billions trying to play their same games with customer neglect, pointless restrictions and marketing deals, etc. Android became big precisely because Google was desperate to get into the market and agreed to all of it.

My S4 still stuck on a broken 5.0 update has something to say about Samsung being "good about updates".

Thank XDA for CM, because otherwise I'd have to get a new phone not for hardware but because the software is unsupported.

Maybe it's a carrier problem? The 5.1.1 update does exist for the S4... And I guess good is relative, and has degrees from 'shitty budget Chinese/Indian no-name OEM' to 'HTC/LG/Moto/Samsung' to 'Nexus brand'.

As a counterpoint, I have a Samsung S3 that hasn't been updated at all since I bought it in 2012. It's still running Android 4.1.2.

Next phone I buy will be a Nexus for this reason.

Samsung? You sure? How about my Samsung P605 stuck in the past with no announcement or roadmap for updates?

Just like the Motorola before it, and the Sony before that, and the HTC before that. It's getting tiresome.

> BTW, I've found Samsung to be decent with updates as well.

My S3 is stuck with 4.3

Android's attack surface is much higher than Chrome OS's. On CrOS I can usually get away with running questionable NaCl code because the NaCl runtime sandboxes what it can do, and on top of that, the browser itself is sandboxed by the kernel. On Android, questionable apps have direct access to the entire kernel system call interface, as well as to other OS features.

Personally, I'm not so much upset because Android is uncommonly bad (it's like any other system that gives untrusted users non-root access to Linux: you can probably get away with it, but eh), but because CrOS is uncommonly good.

> (it's like any other system that gives untrusted users non-root access to Linux: you can probably get away with it, but eh)

This is far from true. Android has always had a ton of sandboxing. Every app is its own user, unable to interact arbitrarily with other apps, things like that.

You won't find any desktop OS that comes anywhere close to the security design of Android. But the thorn in Android's security side remains updates, or lack thereof.

> Android's attack surface is much higher than Chrome OS's.

Not really. All you have to do in CrOS is compromise Chrome (which has happened plenty of times), and you have owned the user. You've won. Game over. And Chrome's attack surface is huge, just like any other browser's. The kernel syscall interface is relatively tiny, and SELinux clamps that down even further.

>On Android, questionable apps have direct access to the entire kernel system call interface, as well as to other OS features.

Doesn't seem correct: https://source.android.com/devices/tech/security/overview/ke...

Apps have direct access to the entire kernel system call interface. They don't run as root, and in particular they run as different UIDs (which is, to be clear, fantastic in its own right) and with SELinux policies. But their "Application Sandbox" is nothing more than that. Apps have as much access as, say, a well-run public shell server gives to their users. That's a lot more attack surface than JS in my browser has.

The update problem is Androids greatest security flaw. Around 80% of Android devices out there run with known security related bugs: http://androidvulnerabilities.org

That many phone manufactures don't update their software is not an Android problem. Would Lenovo update their devices more often when their operating system was not based on Android? Would Apple update less often when iOS was based on Android?

Lenovo, Samsung, Apple and Google are all in complete control of the devices they sell: they all control hardware, software and services themselves.

If the software is based on Android or not has nothing to do with how often these devices get updates.

It's more like every single business, from ice cream store to accountant, habitually requests the same information from you. It's not exactly an Android problem, but somehow I feel it's less on iOS.

Reply on news.ycombinator.com