Android security is almost a joke. Consider the "read phone state and identity" permission - this is nearly always used by apps to send your phone details to advertisers so they can target ads at you (and earn a little revenue by the app maker). Does the app really need access to all your sensitive data on the phone just to get a unique id off you? Apparently so!

Then there's the way that the permissions are used, currently there's been a bit of malware on the App Store where an legitimate app requested some permission, and subsequently updated the app to add some malware that exploited that permission - and no-one noticed as the permission was already granted.

I think the Android security model, that means you have to give permission to various settings up-front, and in such coarse-grained ways, means that no-one really looks at what the apps requires, you have to accept all security permissions to use the app.

I'd say all users don;t know how Android apps work either - once you've given an app network and file access, it can send all your files to a 3rd party without needing to trouble you for permission - you do have a file manager app on your phone what already has been given these permissions don't you?

You can;t build security in in a way that stops all bad things without also stopping all the good things - security is more about run-time permissions and restricting apps from accessing parts of the system that it shouldn't have access to. Now Linux security is mainly based around filesystem security in that you prevent 1 user's running apps from accessing another user's files (as a multi-user system, this is important, and even for a single-user system, you don't want a rogue app from accessing sensitive 'root' system files).

BTW, Linux has iptables - a 'built in' firewall, and if the standard security system isn't good enough, you can set SELinux going, which was designed by the NSA.

Android security is almost a joke. Consider the "read phone state and identity" permission - this is nearly always used by apps to send your phone details to advertisers so they can target ads at you (and earn a little revenue by the app maker). Does the app really need access to all your sensitive data on the phone just to get a unique id off you? Apparently so!

Then there's the way that the permissions are used, currently there's been a bit of malware on the App Store where an legitimate app requested some permission, and subsequently updated the app to add some malware that exploited that permission - and no-one noticed as the permission was already granted.

I think the Android security model, that means you have to give permission to various settings up-front, and in such coarse-grained ways, means that no-one really looks at what the apps requires, you have to accept all security permissions to use the app.

I'd say all users don't know how Android apps work either - once you've given an app network and file access, it can send all your files to a 3rd party without needing to trouble you for permission - you do have a file manager app on your phone what already has been given these permissions don't you?

You can't build security in in a way that stops all bad things without also stopping all the good things - security is more about run-time permissions and restricting apps from accessing parts of the system that it shouldn't have access to. Now Linux security is mainly based around filesystem security in that you prevent 1 user's running apps from accessing another user's files (as a multi-user system, this is important, and even for a single-user system, you don't want a rogue app from accessing sensitive 'root' system files).

BTW, Linux has iptables - a 'built in' firewall, and if the standard security system isn't good enough, you can set SELinux going, which was designed by the NSA.

Android security is almost a joke. Consider the "read phone state and identity" permission - this is nearly always used by apps to send your phone details to advertisers so they can target ads at you (and earn a little revenue by the app maker). Does the app really need access to all your sensitive data on the phone just to get a unique id off you? Apparently so!

Then there's the way that the permissions are used, currently there's been a bit of malware on the App Store where an legitimate app requested some permission, and subsequently updated the app to add some malware that exploited that permission - and no-one noticed as the permission was already granted.

I think the Android security model, that means you have to give permission to various settings up-front, and in such coarse-grained ways, means that no-one really looks at what the apps requires, you have to accept all security permissions to use the app.

I'd say all users don;t know how Android apps work either - once you've given an app network and file access, it can send all your files to a 3rd party without needing to trouble you for permission - you do have a file manager app on your phone what already has been given these permissions don't you?

You can;t build security in in a way that stops all bad things without also stopping all the good things - security is more about run-time permissions and restricting apps from accessing parts of the system that it shouldn't have access to. Now Linux security is mainly based around filesystem security in that you prevent 1 user's running apps from accessing another user's files (as a multi-user system, this is important, and even for a single-user system, you don't want a rogue app from accessing sensitive 'root' system files).

BTW, Linus has iptables - a 'built in' firewall, and if the standard security system isn't good enough, you can set SELinux going, which was designed by the NSA.

Android security is almost a joke. Consider the "read phone state and identity" permission - this is nearly always used by apps to send your phone details to advertisers so they can target ads at you (and earn a little revenue by the app maker). Does the app really need access to all your sensitive data on the phone just to get a unique id off you? Apparently so!

Then there's the way that the permissions are used, currently there's been a bit of malware on the App Store where an legitimate app requested some permission, and subsequently updated the app to add some malware that exploited that permission - and no-one noticed as the permission was already granted.

I think the Android security model, that means you have to give permission to various settings up-front, and in such coarse-grained ways, means that no-one really looks at what the apps requires, you have to accept all security permissions to use the app.

I'd say all users don;t know how Android apps work either - once you've given an app network and file access, it can send all your files to a 3rd party without needing to trouble you for permission - you do have a file manager app on your phone what already has been given these permissions don't you?

You can;t build security in in a way that stops all bad things without also stopping all the good things - security is more about run-time permissions and restricting apps from accessing parts of the system that it shouldn't have access to. Now Linux security is mainly based around filesystem security in that you prevent 1 user's running apps from accessing another user's files (as a multi-user system, this is important, and even for a single-user system, you don't want a rogue app from accessing sensitive 'root' system files).

BTW, Linux has iptables - a 'built in' firewall, and if the standard security system isn't good enough, you can set SELinux going, which was designed by the NSA.