Mission Improbable: Hardening Android for Security and Privacy

https://blog.torproject.org/blog/mission-improbable-hardening-android-security-and-privacy

by conductor • 10 years ago

149 16 10 years ago

blog.torproject.org

necessity2• 10 years ago

Interesting, I had never heard of that project before. I'm currently using CM13 without Gapps. The "privacy guard" and other app permission configs are absolutely terrible ui-wise. There's several places (hidden in nested "Advanced" menus) you need to go to set app permissions (some permissions can be set from two different places and I'm not sure which one has the final say) and it still requires you to manually set permissions for new apps, theres no way to set for instance no internet access as a default for new apps.

deep_attention2• 10 years ago

You can use a firewall like AFWall+ to deny every app internet by default.

secfirstmd• 10 years ago

Yeh Copperhead, Guardian Project and Tor is definitely the way to go for a locked down Android. Though only supported on the Nexus and Pixel devices I think.

bsilvereagle• 10 years ago

You are correct.

The hardware for this prototype is the Google Nexus 6P. While we would prefer to support lower end models for low income demographics, only the Nexus and Pixel lines support Verified Boot with user-controlled keys. We are not aware of any other models that allow this, but we would love to hear if there are any that do.

cmdrfred• 10 years ago

There is a "on by default" option on my CM13 privacy guard. It would suck for an unsavy user to use though I admit.

necessity2• 10 years ago

Yes there is this option but it does nothing, since the default permissions privacy guard allows when "on by default" seem to be the permissions the app requires, I.e. you have to manually set them either way.

emsy• 10 years ago

I'm in the market for a new phone, and I feel like I'm between a rock and a hard place. Android is a privacy disaster, but Apple's latest pricing and product decision make it unlikely to buy another iPhone.

viraptor• 10 years ago

Android is what you configure it to be. Sure, there are some switches to flip if you want to be google-free. But you can replace pretty much every privacy-impacting function on the phone.

cesnja• 10 years ago

When it's pwned at firmware [1] and/or hardware level, all those actions are in vain.

[1] http://www.kryptowire.com/adups_security_analysis.html

throwaway98237• 10 years ago

The new Blackberry DTEK60 is based on Android but supposedly hardened and has much longer term security updates. You can still use the Play store. I know, Blackberry? But seriously, it's not a bad looking phone and has good hardware specs.

All the same, I'm in the same boat as you. Thinking about switching to land-line and buying a separate camera and GPS navigation device. Hello 1990's! Idk. Not liking my options.

pawadu2• 10 years ago

The DTEK60 sounds interesting. If Blackberry can get this to market for a realistic price (300-400 is okay, 700 is not) I will probably get one of those.

dandelion_lover• 10 years ago

Previous answers to the same question:

https://news.ycombinator.com/item?id=12957435

subway• 10 years ago

As long as we keep seeing modems on the same silicon as our application processors, attempting to secure a device against even a relatively incompetent state actor is mostly pointless.

Mission Improbable: Hardening Android for Security and Privacy

Related Stories