News for hackers. Stuff that matters.

A comment on Massive data stealing vulnerability found in many HTC Android phones.

Re:Massive data stealing vulnerability found in many HTC And... by zdw on Sunday October 02, 2011 @10:08AM (#3062872)
How many of these phones are going to get a patch or updated firmware to fix this problem?

I'm going to guess either very few or none, as most people won't notice/care about this issue, and HTC isn't making any money off supplying updates.

Imagine if Microsoft forced Dell, HP, etc. to handle software security and updates on Windows for PC's they've already sold - it would either never happen or not happen correctly. Swap the players and that's where Android is today.

(yes, I know about alternate firmware - how many non-geeks are capable of using it and have devices that don't have technological blocks like signed bootloaders to prevent it?)

[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by ben1040 on Sunday October 02, 2011 @10:17AM (#3062892)
One of the affected models, the Thunderbolt, only now started getting updates to Gingerbread this week. That is, until Verizon halted it due to a major usability bug that should have been identified easily in carrier testing (voicemail notifications don't work).

Given that it took it took HTC this long to get an update to an Android version that's been available in source since December and they still managed to mess it up, I don't have high hopes for something like this getting fixed.

[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by eli on Sunday October 02, 2011 @10:23AM (#3062907)
Surely the blame there is on Verizon. My aging, carrier-free HTC Nexus One gets regular updates.
[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by zdw on Sunday October 02, 2011 @10:26AM (#3062912)
There are only two ways I recommend Android - use a Google-branded phone that Google will provide complete OS support for, or go it alone with OS updates from a 3rd party.

For non-geeks the first option is the only viable one, IMHO.

You've obviously settled on the same conclusion.

[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by pfrazee on Sunday October 02, 2011 @12:14PM (#3063168)
Could you point me in the right direction for 3rd party?
[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by ScottBurson on Sunday October 02, 2011 @12:33PM (#3063228)
I guess zdw is referring to Cyanogenmod. There might be others, I don't know.
[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by nodata on Sunday October 02, 2011 @12:07PM (#3063147)
On my (contractless) Galaxy S2 - OTA updates happen never, I have to connect to a Windows box for updates.

Do you know how OTA updates are pushed out for the non-Google Android phones that are bought without a contract?

[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by starwed on Sunday October 02, 2011 @03:41PM (#3063785)
How well they manage android version bumps has nothing to do with security updates.
[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by TallTalesOrTrue on Sunday October 02, 2011 @12:57PM (#3063309)
Thats why I love the Windows Phone and Apple model rather than android. Windows Phone has had more and frequent updates and they are delivered more consistently across carriers. Same is true for Apple.
[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by nr0mx on Sunday October 02, 2011 @01:52PM (#3063459)
Apple, yes. Windows Phone, seriously? The same Windows Phone which resulted in bricked phones after the NoDo update.

Windows Phone has the same update model as Android. You need manufacturer and carrier compliance for an update to get to a phone. Plus there is no custom ROM alternative like with Android. http://www.winsupersite.com/article/windows-7/Windows-Phone-...

Despite the brain-dead implementation that's the cause of this privacy fiasco, HTC has the best track record among Android manufacturers when it comes to releasing updates. So I would hope they address this issue, and fast.

http://androidandme.com/2011/08/news/updates-or-lack-thereof...

[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by TallTalesOrTrue on Sunday October 02, 2011 @05:23PM (#3064064)
Windows Phone is an infant platform as compared to Apple and Android. But yet look at how fast they learnt after the NoDo delays. Have you gotten the Mango update yet? It rolled out to exsting phones already. And that is not just in US but worldwide. How many updates has Android pushed so soon to its existing phones and that too so widely?
[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by jsz0 on Sunday October 02, 2011 @09:15PM (#3064595)
alternate firmware

That's fine for personal use many companies strictly prohibit employees from using unauthorized software. You're pretty much stuck with whatever they give you.

[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by mcherm on Sunday October 02, 2011 @10:15AM (#3062887)
Can we word that differently?

"Imagine if Dell, HP, etc forced Microsoft to let them handle software security and updates on Windows for PCs they've already sold..."

[ Parent | on HN ]
Re:Massive data stealing vulnerability found in many HTC And... by zdw on Sunday October 02, 2011 @10:22AM (#3062905)
Last I checked, Google isn't volunteering to manage all aspects of Android OS updates for the device vendors (as MS does for Windows), so I don't think the reversal is valid.

Google would get nothing but more work and responsibility out of such an arrangement.

Yes, it would be better for security and end users, but who cares about them? Google is in it for the ad revenue, and the HW vendors are in it to sell units, not have old models with new software compete against their new hardware.

[ Parent | on HN ]