Android and Security

http://googlemobile.blogspot.com/2012/02/android-and-security.html

by bond • 14 years ago

58 17 14 years ago

googlemobile.blogspot.com

I'm actually a little surprised that this wasn't in place from the start.

_ea1k• 14 years ago

I believe that they have been running (and refining) this process since at least early 2011. It is surprising that they didn't do it from earlier than that, though.

shareme• 14 years ago

not early 2011, was summer GSOC project 2011 though

jessa• 14 years ago

yeah, right. they should have done it earlier. sigh

barista• 14 years ago

This moment is akin to Microsoft creating a free antivirus (security essentials or something) for Windows users. An acknowledgement that a real problem exists. But good that google took a step before this was blown out of proportions.

r00fus• 14 years ago

Well, aside from the fact that a) Antivirus was already a thriving market and b) No one but Google could create "bouncer" for Google's Android Market.

It is a further admission that Google needs to apply some more order and curation to their marketplace.

Macha• 14 years ago

I am a bit worried about the amount of false positives from these type of scans over the years (see antivirus scans) , and google`s lack of support or accountability in disputes. "We have found you to be guilty. We will not say what of. Goodbye" type attitudes from Google have shown up in a number of blog posts. I hope this system doesn't lead to more incorrect bans.

Steko• 14 years ago

"The service has been looking for malicious apps in Market for a while now, and between the first and second halves of 2011, we saw a 40% decrease in the number of potentially-malicious downloads from Android Market."

I'm not sure how to read this. They detect an App is malware and leave it in the market? Or they didn't detect it until after it had been downloaded many times? The former is unfathomable while the latter indicates a gaping hole in the system.

"This drop occurred at the same time that companies who market and sell anti-malware and security software have been reporting that malicious applications are on the rise."

Don't believe all the charts showing a malware explosion on Android, they have a conflict of interest. We at the Official Google Android Blog continue our 100% neutrality however.

"While it’s not possible to prevent bad people from building malware, the most important measurement is whether those bad applications are being installed from Android Market"

Not if you're going to advertise side-loading as a feature the competition lacks.

mindslight3• 14 years ago

If they want to improve security, they should switch from the current offer-you-can't-refuse approach to a capability/interface system. An application should always be able to successfully "list my contacts". Whether it gets the complete list, an empty list, or a less-sensitive subset should be up to me (and unknown to the app).

wmf• 14 years ago

This would probably destroy many ad-supported apps, since users would just choose to not allow them to access the network.

mindslight3• 14 years ago

So then Google doesn't have to make that an option on stock android (although droidwall currently takes care of that quite nicely). The restrictive option for internet access could be a low quota for people concerned with data usage.

The open source android distributions would hopefully go further and empower their users with control over their devices.

Maxious2• 14 years ago

Many ad-supported apps check that they can access their ad servers and won't start otherwise. I flashed a new ROM that had adblocking without me knowing and SSHDroid (which I'm happy to have ads for) didn't work.

zmmmmm• 14 years ago

Which is also why I think Google needs to make a special category for advertisers, with a group of whitelisted advertising companies that have signed privacy policy documents with Google. Then the (mandatory) permission becomes "Show me ads relevant to my interests and location" instead of 6 different permissions relating to internet, phone identity, etc. Right now you can't tell the difference between an app that innocently wants to show you some ads and an app that is about to upload the entire contents of your phone to a random ip address in china.

I would say about 80% of the permissions requested by apps are just to show ads. If they could all be wiped away with a single permission then there would be enormously less confusion and more effort could be put on highlighting the truly dangerous permissions.

casca• 14 years ago

Google have decided that the app maker is best equipped to decide what access the app should be allowed. This makes perfect sense if you assume that your average user will not install the app if it requests too much privilege. The reality is that most people don't check and install it anyway because they're given a binary choice.

Would a better model be to allow the user to choose the allowed permissions? In some cases this would cause an app to fail, but as someone who firewalls outgoing IOS requests, this is unlikely.

However, it still becomes a user interface issue. Any security system that requires the user to make knowledgeable security decisions in unfair and usually just a way to offer plausible deniability.

keeperofdakeys• 14 years ago

The only truly revocable permission for applications is internet access. Each application runs as its own user (although some from the same publisher do use the same user), and this can be combined with the linux kernel's firewall to prevent internet connections to specific applications. To do this you need root access, and an application like DroidWall. By default, DroidWall only allows applications you select to have internet access. Since DroidWall is using the kernel's firewall, it doesn't need to do anything in the background, so doesn't impact battery life.

Android and Security

Related Stories