Looking at recent Samsung devices, is Google Services Framework really that integral to the security of my device that I must be forbidden from disabling that package? Isn't there an alternative way to achieve a comparable level of security, but without slurping up my personal data?
The consequence of security does not have to be a complete loss of control, nor the inability to prevent in a practical way the collection of our personal data.
Not to mention the whole security argument falls apart when perfectly fine Android devices are left without security updates 2-3 years after purchase.
I’m still on the fence about whether that justifies their protocols. I think I actually lean toward “no”, but I’ve also lately become keenly aware of the difficulty of even simple things like keeping everything up to date, and my lack of real insight into what those updates include. If I’m effectively trusting them anyway, might as well trust them to get it to me ASAP, right?
I’m also enough of a realist to assume there’s a Fight Club style “A times B times C > X” reputational/financial risk logic going on here. If there’s few enough of the devices out there, it’s probably cheaper to apologize (legally, as in settle).
They create products, which they offer for sale. People can freely choose to purchase those products or not.
Apple has opinions about how to make products, which are embodied in the products they offer for sale. Other companies have different opinions. This is how a market is supposed to work.
I don’t think we should talk about Apple as if they are a government taking away freedoms. It confers too much authority upon Apple and too much victimhood upon customers.
We shouldn't be talking about Apple like a government, but the government should probably be regulating this a bit better;
They patently did contribute to the erosion of freedoms that people fundamentally used to have with their hardware.
And the problem with a single signature authority, as we're seeing in China, is being murdered by an illicit state, or undergoing active discrimination in many other ways even in most western countries.
It's like saying "Why should we have knives? It's only a matter of time until $popular_social_media comes along and tells people to cut off their index fingers and before long there's a significant proportion of users who can't point anymore".
That's not the case for smartphone (etc) users.
If a knive could be built which allows to cut food, and protects you from cutting off your index finger, wouldn't that be great?
Most users will leave the default settings if they don't have an active need to change them. Easily usable (and understandable) tools and interfaces prevent most needs from arising in the first place.
Concrete example: The root account on many Linux distros is disabled by default. I've never felt the need to enable it, because sudo does everything I need. Secure default, useful tools, unlockable system.
Historically we haven't had either of those things. Poor design and implementation led to bad choices by clueless users. The resulting mess is used as an excuse to restrict freedoms. The cure is arguably worse than the poison.
Now what? Millions of users have to wipe and restore their phones or throw them away and buy new ones because someone's app trashed the phone? That would cripple Apple
It's about owning your hardware, not safety. A person that's willing to go through the hassle knows the consequences of such actions and how to deal with them.
Do "normal people" need to do that? Absolutely not. Should it be easy to do that? Absolutely not. But for those of us that really want to own our hardware, there should be a way of doing so without relying on exploits.
As far as I'm concerned, I actually read the popups and having to click okay about five or six times in a row would make me second-guess my decision. Would that work for everyone? Most of the people? Some of the people? I don't know that answer.
> I'm not even sure if such a barrier should be technological or legal.
My answer would be both. I highly doubt it's in hardware manufacturer's interest to figure out a technological solution, but if there's some legal incentive for them to at least try, they'll figure out a technological solution.
The first step on Android is usually to unlock the device boot loader in order to flash a recovery that will allow to erase partitions and install a tarball of the system. I saw no tutorial suggesting to re-lock the device boot and I bet people rarely do it.
This means anyone can take the device, boot it into recovery, plug it into USB and throw some adb/fastboot commands to do anything they want. Device encryption becomes moot because neither the recovery nor the bootloader can be trusted.
The general population uses macOS just fine.
The exact same goes for regular computers and operating systems. And we still have those. Shouldn't we at least have the option on mobile?
You have computer form factors and OS'es invented in the 80's and 90s for desktop. The only reason they still work that way is because of legacy/inertia.
The exception is the ChromeBook and CromeOS and that works similar to a smartphone. For a reason.
That's not the point. The point is that the community will be able to do it and auditors' lives will be much easier, which benefits everyone because it vastly increases the likelihood of an issue being found.
> The idea that ROMs from questionable sources make your device safer sounds very strange to me.
On Android by default most vendors ship a lot of bloatware and have demonstrated almost infinite incompetence or malice of both. While the developers "custom ROMs from questionable sources" (XDA forum threads) may not be experts in their fields at all and are quite likely to misconfigure the software possible creating some new holes, at least those images are compiled from open sources and are not the terrible manufacturer OS (I wouldn't onlike bank on stock Xiaomi software).
Don't use it then. By shielding the stupid we are creating more stupid.
The whole of civilization has been a process of shielding people from having to know stuff.
The same way you don't know how to make fire from first principles, fix your car, make a CPU, or whatever...
Even someone with a Ph.D in computer hardware is shielded from tons of complexities and never has to know the whole process end to end.
How? Serious, genuine question. How can they give you “the right to do so”, but prevent “mom” from accidentally doing so or worse, having someone do it to their phone without them knowing?
It could even be as involved as getting an official image from apple/google that allows root access. I don’t think a “mom” would accidentally download an image and flash their telephones.
Who says “mom” flashed her phone?
How does “mom” know the shady place they took their phone to repair a broken screen didn’t do it? (P.S. many documented cases of this)
How does “mom” know their jealous/cheating/whatever spouse/bf/gf/whatever didn’t do it? (P.S. many documented cases of this)
How does “mom” know the phone they bought off someone didn’t do this? (P.S. many documented cases of this)
How does “mom” know their kid didn’t do this so they could install stolen games? (P.S. many documented cases of this)
The list goes on and on.
In order for any of those threats to work it would require physical access and access to passwords and accounts (for example reconnecting to cloud services, restoring backups or even just unlocking the phone to perform a flash). At that point I don’t think it’s having or not having root access that is the issue.
Of course they do, hence my comment.
> At that point I don’t think it’s having or not having root access that is the issue.
That’s the most naive thing I’ve seen said all week.
My coffee grinder won't turn on without the lid locked in place. Is that anti consumer?
The idea that ROMs from questionable sources make your device safer sounds very strange to me.
Basically every electronic device has countless security issues. Some of them are found of which some are published of which most are eventually fixed (by rather large teams of professionals). In that regard, Apple could and should do better.
But the burden of making such a complex device secure simply can't be put on the end user.
While I would welcome deeper access for technically inclined people, I'm not sure that option can really be given by Apple/Google without the risk of becoming a disadvantage for many users.