Improving app security and performance on Google Play for years to come

http://android-developers.googleblog.com/2017/12/improving-app-security-and-performance.html

by ingve • 9 years ago

81 33 9 years ago

android-developers.googleblog.com

yegle• 9 years ago

I'm curious why the first required version is Android 8.0 (API version 26), instead of Android 8.1 (API version 27)...

Skunkleton• 9 years ago

Probably because they are reaching backwards by some internally defined amount of time.

on_and_off2• 9 years ago

From what I remember, 27 does not change the security model in any way, it just adds a couple of small features.

Their point is that you should target the latest major release. Ideally you should target the latest release, period.

I don't really care if an app targets 26 instead of 27 though. if an app targets 20 though, I definitely resent that a lot.

stevenwoo2• 9 years ago

Android Studio tells me API 20 targets about 70 percent of android devices. API 26 targets less than one percent of android devices. What apps are you using that target API 26? I had to develop an app for a customer in Mexico two years ago and the customer made us target API 15 because they wanted to maximize app compatibility.

izacus3• 9 years ago

The important part of context here:

If you targeted APIs before Android 6.0 (e.g. you targeted API Level 21 - Lollipop), you didn't have to ask users for permissions to access contacts, sms, SD card and other data. Which made all the new security improvements in Android rather moot - scummy apps (like Snapchat :P) just didn't update their API levels, kept collecting personal data without asking for permission... AND didn't implement improvements of new OSes because they wanted to keep collecting data without restriction.

This is finally great news for Android security.

codinghorror• 9 years ago

Yeah this is definitely the biggest point of the article, thanks for highlighting that!

snaky• 9 years ago

That's good, but it's almost a year ahead (November 2018), and I wonder how many Snapchat users care about permissions at all.

richdougherty2• 9 years ago

Actually really big news.

Apart from the security implications it will also decrease fragmentation of Android versions and encourage manufacturers to update their OS versions.

orb_yt• 9 years ago

you didn't have to ask users for permissions to access contacts, sms, SD card and other data

This isn't true. Android 6.0 introduced runtime permissions, where permissions could be granted in the context of the application. Previously, the permissions still had to be granted, but they were granted before the application was installed.

fatwa• 9 years ago

You get asked when you install the app but nobody looks at that huge list of permissions, especially if not accepting means you don't get to use the app

craftyguy2• 9 years ago

This is finally great news for Android security

Yea, now only Google is collecting an absurd amount of information on you. They don't like competition, so I'm surprised it took this long for them to implement this.

kiallmacinnes• 9 years ago

This just seems unnecessarily harsh on Google. Just because they haven't solved security / privacy in its entirety, they shouldn't be lambasted for taking a step forward!

candiodari• 9 years ago

Technically snapchat and scummy apps can keep collecting private data indefinitely. Demands for API levels only apply for either new apps or new updates to existing apps. They could simply leave a version in the app store, use that for collecting, and have new versions have their own play entry like an unlocker app currently does it.

Not even the August 2019 deadline prevents that.

So really, there's nothing in here that stops personal data collection.

yjftsjthsd-h2• 9 years ago

Anyone know what the "security metadata" is? Just Google signing the APK in addition to the developer signing it? Not sure how that helps, but not sure what else it would be.

richdougherty2• 9 years ago

Improving app security and performance on Google Play for years to come

Related Stories