Hacker News Reader

Comment by grawprog | Hacker News Reader

>Phones have been an enormously popular computing platform in significant part because of the security model.

>and reasonably trust the apps they install.

That seems like an illusion though to me.

https://www.cvedetails.com/top-50-products.php

Android comes in at #2 for number of distinct vulnerabilities and iOs at #8 both in the top ten and both above windows of all things. Which rings in at #10 for 7 and #13 for 10. OsX sits at #4.

https://www.gnu.org/proprietary/malware-mobiles.en.html

View on HN

This kind of misses the point, which is that the user is the weak link in most personal computing security models. You don't need a CVE on Windows to get malware on the machine; you just need to trick the user into installing your nasty piece of software--perhaps by making it look like something the user wants.

The point of the single-source App Store is that the app review creates a line of defense against such trickery, on behalf of the user.

This chart is a bit misleading - MacOS is the equivalent of windows 7, 8.1, and windows 10 combined, which places Microsoft at the top where they belong. iOS has overall fewer code execution and privilege escalation vulnerabilities as well.

Android has always been a shitshow,so the gnu link is unsurprising - however I did not find an example of iOS malware.

Fair point. The ease of use is just as important to the ubiquity, and Android especially has a lot of vulnerabilities. But, vulnerabilities also come with popularity: people try harder to find them.

1. How much less secure would Android be without even the play store’s security measures?

2. How much harder would people work to find vulnerabilities on such a ubiquitous platform used by non-technical users if any app could be installed?

You would likely get more malware and more app hesitancy.

>You would likely get more malware and more app hesitancy.

More malware, possibly, though android has plenty of that even with the play store. But, app hesitancy, maybe from a small subset of people, but i feel like those same people already show app hesitancy.

Only from my own experience, but i treat apps from the app stores about the same as i do random apps from the internet and do the same thing to verify in both situations, look at reviews and information about the app and make my judgement based on those. It's the same either way. All app stores do in my mind is aggregate reviews to one place, whether it's the play store, the apple store or the steam store, etc. I trust each of them about as much as something such as apk mirror, in all cases, i'm relying on the opinions and information provided by others that have used the app, if no such information is available, i consider it suspect and avoid.

The method acquire an app isn't what invokes trust, it's other user verification, no matter whether that app came from a store, a repo, a random website or any other method software can be delivered and it always has been, since the days of floppies.

I’m less familiar with android, but on the ios side there are very real limits to what an app can do, even if it has malicious intent. And app review greatly limits apps with malicious intent. ‘

You still need to exercise caution with permissions, but an individual app itself has pretty strict limits. Most of the security flaws are tied to the OS itself.

>Most of the security flaws are tied to the OS itself.

Which was the point of my original comment, that phone OS's provide the illusion of being more secure, while being about as secure as any other platform.

From what I can tell, computers are about as secure as they've ever been, whatever the kind, which is, alright depending on the user. It's always been like that and still is.

App stores and sandboxes haven't changed that.

Eh. Unless iOS exploits are uniquely tuned to be unnoticeable... I go home to help my parents with their Macs and am always removing crap, usually from their browsers. I haven’t yet had to remove crap from their iPhones/iPad.

Is it 100% secure? No. Is the user experience that I desire available due to app stores and sandboxes? Yes.

Reply on news.ycombinator.com