Rendered at 15:00:09 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
gorgmah 1 days ago [-]
Slightly unrelated: is it relatively safe to root android phones nowadays or should I stick to the unrooted standard android?
The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app).
torben-friis 1 days ago [-]
The main issue is that many apps will block rooted phones (banks, state apps and the like). Usually more trouble than it's worth.
KetoManx64 19 hours ago [-]
* some apps.
Both of my banking apps work fine with a rooted GrapheneOS phone. If you want to have full control over your phone like you would a Linux laptop, to customize it to your own preferences and maximize privacy, there is nothing else gives you the same amount of control over the device that you bought and paid for.
The fact that people pay $1000 for a device and then not be able to fully uninstall pre-installed crapware nor fully block it from the internet is depressing.
fc417fc802 1 days ago [-]
The answer really depends. Root by what means? And to what end? Permanent or only temporarily?
Personally I reject with extreme prejudice the android security model (it's my &#^@ device not the vendor's). But I don't generally want to grant any apps root. Lineage strikes a nice balance by providing root adb.
KetoManx64 19 hours ago [-]
I want the ability to grant specific apps root through Magisk. Tasker for example for tasks that change system level settings and adaway for system level adblocking, material files for accessing to root filesystem for pulling config files from apps, Swift Backups for backing up all my apps and their data.
throwa356262 1 days ago [-]
Some apps such as Aegis allow exporting the MFA secrets.
gorgmah 1 days ago [-]
I think they allow importing from Authy but only on rooted phones. I missed the train to move away from Authy in 2024 and now the only non-root option is to regenerate the seed from every provider one by one.
As other commenters said, rooting my main phone would lock me out of banking apps.
I suppose I could find an old phone, sync from authy cloud, root it, and then migrate, but then generating new seeds is probably both safer and faster at that point.
throwa356262 1 days ago [-]
Importing is usually not an issue, as you can always enter the secret manually. It is the exporting that is the problem.
The secret looks something like this:
JBSW Y3DPF QQHO ....
(usually fairly short unless its google)
shocks 1 days ago [-]
You can extract keys out of Authy using mitm-proxy. I have done it and switched to Bitwarden.
That is alarming. They have access to the plaintext? And they will hand auth secrets out? That seems extremely wrong to me.
ForHackernews 1 days ago [-]
>...data arrives as a CSV in which every token is encrypted with your backup password...
fc417fc802 1 days ago [-]
Fair enough. That seems reasonable.
LoganDark 1 days ago [-]
They always had access to the plaintext, they could do better to hand them out
gorgmah 1 days ago [-]
So there is a real solution to that problem! Thanks a lot for sharing it
exdeejay_ 1 days ago [-]
AFAIK rooting an Android phone necessitates a factory reset of the phone beforehand, so I don't think you'd be able to dump the MFA seeds before Authy is uninstalled (unless that's a hardware thing)
probablyStimmed 9 hours ago [-]
That was never the case back when I was rooting phones. Sometimes the phone would reboot immediately after getting root so that you could do something useful like installing recovery, but maybe something has changed.
izacus 1 days ago [-]
It was never particularly safe to root the phone - both because it drills a hole into the security model and because you don't have any good ways of verifying what apps asking for root actually do.
Moreover, most of root tools and ROMs are rather poorly written and glued together with other forum scripts which you have no way of checking if they're not malware. (There are exceptions.)
So no, "safe" it's not and never has been. The tradeoff might be worth it for you as a user though.
> The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app).
The way to do that is to take the hit and recreate your 2FA codes in an opensource app like Aegis or Stratum.
gorgmah 1 days ago [-]
Thanks for the summary. I agree with you about 2FA, but it's still annoying, I was hoping I would find a lazier solution.
negura 1 days ago [-]
Not sure why this is downvoted. It's accurate. A major problem is that when you root you loose assurance of the integrity of your /system partition. That means malware can now persist undetected.
FrequentLurker 1 days ago [-]
I wonder if there is a vulnerability that allows for toggling wireless adb. I have an LG with android 12 which technically should support wireless ADB but LG stripped the option from settings. Some say they stripped out the feature entirely. On top of that the USB port is damaged and doesnt accept data but still accepts power. So no wired adb either.
rickdeckard 1 days ago [-]
> On top of that the USB port is damaged and doesnt accept data but still accepts power.
Data is broken on both sides of the port? (if you rotate the plug 180° it should use the other pins on the USB-C)
FrequentLurker 1 days ago [-]
Tried both sides but no luck.
veeti 1 days ago [-]
If you can get root and a terminal emulator on the device, you could try something like "adb shell settings put global adb_wifi_enabled 1".
Gander5739 1 days ago [-]
What's stopping you from rooting it and then sshing in? You can then run the adb commands using root access.
rickdeckard 1 days ago [-]
> What's stopping you from rooting it
(probably the broken USB port)
Gander5739 1 days ago [-]
Isn't the article about obtaining root from an unprivileged app? The recent GhostLock exploit is potentially usable for this purpose, for instance.
_ZeD_ 1 days ago [-]
will the "exploit" app be available? asking for a friend :D
user_7832 1 days ago [-]
Depends on your phone, but for some qualcomm devices there was a vulnerability some time ago, iirc the OnePlus 15 has a dedicated thread on XDA. I also found this on XDA while trying to find the other exploit:
Side note, it's quite ironic, google being so heavily anti-root is forcing people to opt for root access via more hidden ways, making it easier to avoid root being detected.
yehoshuapw 1 days ago [-]
would you install such a app (without compiling from source)? I would not trust it to not come with "friends"
(but would love to verify and use)
sureglymop 1 days ago [-]
On an isolated test device for this purpose, yes. But otherwise, I would decompile it to look at it.
NoboruWataya 1 days ago [-]
Probably wishful thinking but does this get us any closer to porting postmarketOS to these devices? (Or even LineageOS, though I think LineageOS may have decent support on many of these devices already?)
tym0 1 days ago [-]
Don't really see why. The issue with PostmarketOS is that there isn't enough people working on it.
Not that the phones are locked down. Otherwise phones with open bootloader would have good support.
ArtTimeInvestor 1 days ago [-]
A good security track record must be the most valuable company asset in history.
Apple makes $200B per year from selling the iPhone alone. Plus the services they sell on it, plus deals like the one with Google, plus app store ads, plus cross-selling of other hardware ...
I have one too.
Not because I like the hardware too much. Pixel phones are much nicer, they don't wobble when you put them on a table. Not because I like the software too much. Android is much more to my liking with more freedom to customize it.
But because I have the feeling Apple takes security more seriously.
I wish there was some kind of security arena like there is LLM arena for AI. That gives hard facts about the security track record of phone manufacturers.
cromka 1 days ago [-]
It's a bit ironic to think Apple takes security seriously when they infamously delivered ridiculous bugs like 2017 High Sierra root login, which they fixed and then accidentally unfixed again.
What we're seeing is marketing/branding and a genuine for-show effort, all the while they do not audit their code outside some for-show technologies (Siri AI in the cloud).
So the point I am making is that it's all observational bias. You want actual objective security, use GrapheneOS.
And I'm saying this as an iPhone user.
kvuj 14 hours ago [-]
Funny since the GrapheneOS devs praise the iPhone for it's security.
I personally prefer seeing real advancement that integrate both hardware and software like their EMTE[1] which no other vendor has had the balls to implement.
And I say that as a GOS user! My next phone will definitely be an iPhone, mostly because I cannot deal with the terrible Tensor SOC. My G4 overheats for nothing! Shameful
The issue is that Android is open while Apple seldom talks about their security issues.
This might make Apple look like the more secure option but the reality may be different because Android is more scrutinised.
If you are sceptical consider these examples: (1) some versions of Apple silicon have unpatchable security defects, (2) Apple at one point decided to not contact up to 500M users affected by a supply chain attack in China due to "language difficulties".
close04 1 days ago [-]
> Apple seldom talks about their security issues
I didn't find about OEMpocalypse from Google talking about their security issues, I found from calif.io. Security researchers don't wait for companies to "talk about their security".
> but the reality may be different because Android is more scrutinised.
This is famously why Linux appears to be less secure than Windows, right? Because Microsoft doesn't talk about their security while Linux is more scrutinized?
> In the simplest of terms, with the bug, if you created a new APFS (Apple File System) encrypted volume on High Sierra, and set anything at all as the password hint, then your password was stored as the hint. In plain text.
ArtTimeInvestor 1 days ago [-]
I know Apple phones had bugs. Even worse bugs than the one you linked to.
But Google phones had those too.
That's why I said I "feel" like Apple takes security more seriously. And that I wish there were hard facts. Statistics of number of bugs by severity. Independently verified.
izacus 1 days ago [-]
Your post is essentially admitting that you're ignoring the bugs from the company you love and taking seriously form the company you don't.
So the difference isn't about taking things "more seriously", but in the fact that you take marketing from Apple more seriously.
That's not the same.
(Note: There's plenty of proof that Apple does take security more seriously than Samsung, Xiaomi & Co. in the article, but your feelings aren't it.)
paweladamczuk 1 days ago [-]
Good thing they never claimed their feelings were proof of anything.
izacus 1 days ago [-]
This is where reading ability comes into play.
sschueller 1 days ago [-]
Doesn't make a difference if Apple takes security more seriously if they bend like a rubber pole when the government comes asking...
spacebanana7 1 days ago [-]
That depends on your threat model.
Realistically intelligence agencies aren’t too interested in my grandma, but malware/scams/bloatware absolutely are.
ece 1 days ago [-]
You'd almost think supporting a phone for a longer amount of time might actually be better than trying to sell a new phone every year or two.
rickdeckard 1 days ago [-]
Only if you find a way to create revenue beyond the time-of-purchase, to offset the cost of development and maintenance, aka service revenue.
So far only Apple achieved this by ensuring a walled garden around their ecosystem, securing additional revenue-share for every single 3rd party app and every transaction of the user.
All other vendors are structurally prevented to properly compete in services, and have to rely on Google paying some minor revenue-share on Services, while having only limited control over the user-experience to distinguish themselves...
ece 14 hours ago [-]
This would be a bit convincing if there weren't other hardware and services providers like Fairphone, GrapheneOS and Google themselves, who do support and maintenance for longer.
rickdeckard 6 hours ago [-]
The fact that you put "Google themselves" in this list makes the conversation moot, because Google is de-facto the service-revenue recipient of the entire Android device-ecosystem and the culprit of the problem.
ece 4 hours ago [-]
Samsung and Xiaomi have bigger ecosystems than Google in some ways. If they want to fix their development and support for issues like this, they can.
rickdeckard 3 hours ago [-]
1. Fairphone actually demonstrates that it's not a matter of "want" for sustainable/repairable/longevity, the market still doesn't reward sufficiently for it.
--> If the total potential is an increase in sales of 100k units at ~450 USD/device, there is no fiscal justification for a stock-trading company to actually build such a product. That's why e.g. the EU keeps mandating more and more of this, they "artificially" create the need for it because the market doesn't do it itself.
2. They don't have a comparable service revenue-ecosystem to Google, not even remotely.
Even in sum across their entire mobile ecosystem, the majority of service-revenue their products generate is actually Google's service revenue of the Android ecosystem, of which they get a miniscule revenue-share via Google's RSA program.
The only substantial revenue is still generated at the hardware time-of-sale only, which needs to finance the lifecycle maintenance of the product. So the objective becomes to sell a critical-mass of hardware to sustain the maintenance of the device.
And then, the next level: The market-pressure for in-time software-maintenance can only be fulfilled by not deviating too much from Google's baseline (minimizing the effort of upgrading to newer Android versions). Not deviating from Google's baseline means either contributing back any disruptive changes to Google for integration in the baseline or (more likely) to not disrupt the smartphone landscape on platform-level at all.
Disrupting with hardware innovation only works either on very-large scale or on small-scale, because either you can contract a component supplier for a huge volume of a component exclusive for you, or you pick a innovative component which cannot be supplied in huge quantity yet (and is therefore out of reach for larger brands)
As result, the established players on the smartphone market don't make any more innovative leaps, because the risk/benefit ratio for the ROI is just not there.
--> Vendors ship devices based on common hardware available at that time, combined with software available at that time.
Chinese vendors changed the game a bit by announcing devices with innovative hardware which then never reached the global market, because the components were not available at-scale yet (under-display camera, wrap-around displays, new battery composition, 5G,...) --> This was a game-changer because e.g. Samsung, Apple, Motorola, LG would not announce a device they knew they can't launch at-scale. Oppo, Xiaomi et al could do a limited run for a device-launch in China, with chinese component-suppliers shipping to assembly-factories in China with low ramp-up costs.
applfanboysbgon 1 days ago [-]
> Here, I describe the one I took and why, measured against three properties I use as a yardstick throughout
Nope nope nope. LLMs helped you do something cool, great. You can still speak for yourself. Stop outsourcing your humanity to a chatbot.
> In practice the coverage of each chain is exactly the set of devices the OEM chose to ship the vulnerable component on.
Wonderful insight, Claude. "The vulnerability covers exactly the devices that are vulnerable".
1 days ago [-]
1 days ago [-]
rvz 1 days ago [-]
What a disaster for Android.
ReptileMan 1 days ago [-]
It is a feature. Every device should give root by mandate to the owner, the same way they have USB-C for phones.
la_oveja 1 days ago [-]
better see these in the open than in an israeli lab
hzwanip 1 days ago [-]
the israeli labs exist anyway
9865322689965 1 days ago [-]
[dead]
LoganDark 1 days ago [-]
End users love these for rooting! (I sure would have.)
sega_sai 1 days ago [-]
I think old Android phones not supported by their makers are so problematic in the LLM era. I would think that even before LLMs the 3 letter agencies had exploits for those, but now one should assume common criminals will...
I am happy that the pixel phone I got has 7 year of support, but it is clear that Apple is in general is much better in this than all the Android providers (including google)
bayindirh 1 days ago [-]
I keep my old iPhone X powered on as a handheld gaming device. It still gets software patches now and then. Funnily, even though the device is in its forsaken era, most of the applications I used to use daily still gets updates too.
Not being able to update an app on it is a rarity.
Both of my banking apps work fine with a rooted GrapheneOS phone. If you want to have full control over your phone like you would a Linux laptop, to customize it to your own preferences and maximize privacy, there is nothing else gives you the same amount of control over the device that you bought and paid for.
The fact that people pay $1000 for a device and then not be able to fully uninstall pre-installed crapware nor fully block it from the internet is depressing.
Personally I reject with extreme prejudice the android security model (it's my &#^@ device not the vendor's). But I don't generally want to grant any apps root. Lineage strikes a nice balance by providing root adb.
The secret looks something like this:
JBSW Y3DPF QQHO ....
(usually fairly short unless its google)
Then you can import them into Aegis or some other FLOSS solution: https://github.com/uiltondutra/authy-migrate
Moreover, most of root tools and ROMs are rather poorly written and glued together with other forum scripts which you have no way of checking if they're not malware. (There are exceptions.)
So no, "safe" it's not and never has been. The tradeoff might be worth it for you as a user though.
> The reason I'm asking is that I'm stuck with authy as a MFA code app, and would like to move to something that has both desktop and phone support, and my conclusion is I'd need to root my phone to get access to the actual MFA seeds (they don't allow exports to keep you stuck in their app).
The way to do that is to take the hit and recreate your 2FA codes in an opensource app like Aegis or Stratum.
Data is broken on both sides of the port? (if you rotate the plug 180° it should use the other pins on the USB-C)
(probably the broken USB port)
https://xdaforums.com/t/the-holy-grail-universal-no-bl-root-...
Side note, it's quite ironic, google being so heavily anti-root is forcing people to opt for root access via more hidden ways, making it easier to avoid root being detected.
(but would love to verify and use)
Apple makes $200B per year from selling the iPhone alone. Plus the services they sell on it, plus deals like the one with Google, plus app store ads, plus cross-selling of other hardware ...
I have one too.
Not because I like the hardware too much. Pixel phones are much nicer, they don't wobble when you put them on a table. Not because I like the software too much. Android is much more to my liking with more freedom to customize it.
But because I have the feeling Apple takes security more seriously.
I wish there was some kind of security arena like there is LLM arena for AI. That gives hard facts about the security track record of phone manufacturers.
What we're seeing is marketing/branding and a genuine for-show effort, all the while they do not audit their code outside some for-show technologies (Siri AI in the cloud).
So the point I am making is that it's all observational bias. You want actual objective security, use GrapheneOS.
And I'm saying this as an iPhone user.
I personally prefer seeing real advancement that integrate both hardware and software like their EMTE[1] which no other vendor has had the balls to implement.
And I say that as a GOS user! My next phone will definitely be an iPhone, mostly because I cannot deal with the terrible Tensor SOC. My G4 overheats for nothing! Shameful
[1] https://security.apple.com/blog/memory-integrity-enforcement...
This might make Apple look like the more secure option but the reality may be different because Android is more scrutinised.
If you are sceptical consider these examples: (1) some versions of Apple silicon have unpatchable security defects, (2) Apple at one point decided to not contact up to 500M users affected by a supply chain attack in China due to "language difficulties".
I didn't find about OEMpocalypse from Google talking about their security issues, I found from calif.io. Security researchers don't wait for companies to "talk about their security".
> but the reality may be different because Android is more scrutinised.
This is famously why Linux appears to be less secure than Windows, right? Because Microsoft doesn't talk about their security while Linux is more scrutinized?
> In the simplest of terms, with the bug, if you created a new APFS (Apple File System) encrypted volume on High Sierra, and set anything at all as the password hint, then your password was stored as the hint. In plain text.
But Google phones had those too.
That's why I said I "feel" like Apple takes security more seriously. And that I wish there were hard facts. Statistics of number of bugs by severity. Independently verified.
So the difference isn't about taking things "more seriously", but in the fact that you take marketing from Apple more seriously.
That's not the same.
(Note: There's plenty of proof that Apple does take security more seriously than Samsung, Xiaomi & Co. in the article, but your feelings aren't it.)
Realistically intelligence agencies aren’t too interested in my grandma, but malware/scams/bloatware absolutely are.
So far only Apple achieved this by ensuring a walled garden around their ecosystem, securing additional revenue-share for every single 3rd party app and every transaction of the user.
All other vendors are structurally prevented to properly compete in services, and have to rely on Google paying some minor revenue-share on Services, while having only limited control over the user-experience to distinguish themselves...
--> If the total potential is an increase in sales of 100k units at ~450 USD/device, there is no fiscal justification for a stock-trading company to actually build such a product. That's why e.g. the EU keeps mandating more and more of this, they "artificially" create the need for it because the market doesn't do it itself.
2. They don't have a comparable service revenue-ecosystem to Google, not even remotely.
Even in sum across their entire mobile ecosystem, the majority of service-revenue their products generate is actually Google's service revenue of the Android ecosystem, of which they get a miniscule revenue-share via Google's RSA program.
The only substantial revenue is still generated at the hardware time-of-sale only, which needs to finance the lifecycle maintenance of the product. So the objective becomes to sell a critical-mass of hardware to sustain the maintenance of the device.
And then, the next level: The market-pressure for in-time software-maintenance can only be fulfilled by not deviating too much from Google's baseline (minimizing the effort of upgrading to newer Android versions). Not deviating from Google's baseline means either contributing back any disruptive changes to Google for integration in the baseline or (more likely) to not disrupt the smartphone landscape on platform-level at all.
Disrupting with hardware innovation only works either on very-large scale or on small-scale, because either you can contract a component supplier for a huge volume of a component exclusive for you, or you pick a innovative component which cannot be supplied in huge quantity yet (and is therefore out of reach for larger brands)
As result, the established players on the smartphone market don't make any more innovative leaps, because the risk/benefit ratio for the ROI is just not there.
--> Vendors ship devices based on common hardware available at that time, combined with software available at that time.
Chinese vendors changed the game a bit by announcing devices with innovative hardware which then never reached the global market, because the components were not available at-scale yet (under-display camera, wrap-around displays, new battery composition, 5G,...) --> This was a game-changer because e.g. Samsung, Apple, Motorola, LG would not announce a device they knew they can't launch at-scale. Oppo, Xiaomi et al could do a limited run for a device-launch in China, with chinese component-suppliers shipping to assembly-factories in China with low ramp-up costs.
Nope nope nope. LLMs helped you do something cool, great. You can still speak for yourself. Stop outsourcing your humanity to a chatbot.
> In practice the coverage of each chain is exactly the set of devices the OEM chose to ship the vulnerable component on.
Wonderful insight, Claude. "The vulnerability covers exactly the devices that are vulnerable".
Not being able to update an app on it is a rarity.