News for hackers. Stuff that matters.

A comment on Remote code execution on Android devices. Parent comment

Re:Remote code execution on Android devices by DCKing on Friday August 08, 2014 @05:54AM (#8152122)
1. There is an exploit that leaves complete control of your phone to anyone without you even having to look at the screen.

2. Some applications want to use too much permissions on your phone. You probably don't want to install them.

And the second is a bigger problem? Really?

Android is the most transparent and detailed about what applications can actually do on your phone from any such system I've ever seen. People make concious (stupid, but concious) decisions to still use apps and ignore the presented information. This exploit removes all control a user may have.

By making this comparison in the first place, you are confusing the discussion already. Yes, Android can and should improve when it comes to user control. But this is a problem that leaves hundreds of millions devices exploitable even without depending on user ignorance. This exploit and the issue you mention are not even related.

[ Parent | on HN ]
Re:Remote code execution on Android devices by aroch on Friday August 08, 2014 @09:00AM (#8152542)
>Android is the most transparent and detailed about what applications can actually do on your phone from any such system I've ever seen.

Not anymore they're not [1][2], permissions now fall into large buckets.

iOS is probably the best as far as privacy sensitive permissions go. You're prompted at request time instead of at install, so you know the context of why it needs a permission (like GPS or contacts). You can also revoke a permission after granting it. You can't do that in Android.

[1] http://www.xda-developers.com/android/play-store-permissions...

[2] https://support.google.com/googleplay/answer/6014972?p=app_p...

[ Parent | on HN ]
Re:Remote code execution on Android devices by DCKing on Friday August 08, 2014 @09:16AM (#8152603)
iOS has better usability on this, but Android's permissions are still far more detailed and fine grained. If Android adopted some of iOS user control features, which seems to be happening [1], it would be almost perfect.

I definitely agree that Android's user interface is a problem, and that transparency is hindered because of these changes. Nonetheless, a user can still know what an app can do to a degree of detail far exceeding other systems. Android's technical capability here exceeds other platforms, so let's hope they'll make it usable soon.

[1]: http://www.xda-developers.com/android/exclusive-android-l-lo...

[ Parent | on HN ]
Re:Remote code execution on Android devices by wtbob on Friday August 08, 2014 @05:03PM (#8155021)
Yeah, I'm deeply upset by the permissions-control changes. It's not so much simplifying for normal folks that I object to do much as not having an option to let me see the detail.

Google are getting worse and worse, becoming more like an Apple or Microsoft. But where else is there to turn?

[ Parent | on HN ]
Re:Remote code execution on Android devices by runjake on Friday August 08, 2014 @10:50AM (#8153009)
> Android is the most transparent and detailed about what applications can actually do on your phone from any such system I've ever seen.

So you haven't yet taken a look at iOS? iOS is pretty transparent. I would say far more so than the broad, vague permissions model Android is currently using and the even vaguer one they're moving to with their "L" release.

Additionally, with iOS, you can also go back and granularly review app privacy settings and adjust them, if desired. You can't do that on vanilla Android.

[ Parent | on HN ]
Re:Remote code execution on Android devices by wzdd on Friday August 08, 2014 @07:29AM (#8152306)
In terms of impact right now, the app permissions thing is a much bigger problem, yes. People get scammed by apps every day, whereas this doesn't appear to be being exploited in the wild at all.
[ Parent | on HN ]
Re:Remote code execution on Android devices by DCKing on Friday August 08, 2014 @07:51AM (#8152354)
That is not the point. Both are very serious issues. But one is a usability+curation problem, and this is an unpatched security exploit. Combining the discussion on these things in this thread is confusing and unhelpful to both issues.
[ Parent | on HN ]
Re:Remote code execution on Android devices by localhorse on Friday August 08, 2014 @09:23PM (#8155937)
The biggest different is that (to some extent) this vulnerability requires no user intervention (at least not in an active capacity), whereas the app permissions issue is one where the user has actively chosen to accept something.
[ Parent | on HN ]