Comment by AlBugdy

> Do you also not have root on your laptops or desktops? I don't get why it's so different. I don't just want to open TikTok and Instagram, I want to use my phone computer as a computer. I assumed HN folks would get it.

The security models of desktop operating systems are far, far behind those of mobile operating systems (Android/iOS). ChromeOS, followed by macOS are the closest to mobile security but are still severely lacking. Windows is farther behind and desktop Linux might as well be minimum security. It’s not even an equivalent comparison as you’re comparing mobile OSes to ones on a platform with a fundamentally worse security architecture.

I mean, even to an extent some of the Linux distributions understand the security problems with the traditional model. Look at what Universal Blue is doing with their images and leaning more into Flatpaks and containers for any developer like etc tooling while actively discouraging installing things via rpm-ostree.

> I would choose something as locked down as GrapheneOS for its security if I was going to use it to install random apps left and right and give them root or run JavaScript from random sites on a browser I gave root to. Anyway, not having root seems like a very weird way to harden security. What about compartmentalization?

The first sentence is inherently incompatible with the security structure of GrapheneOS (for example). The point is to not give applications root, giving them root circumvents basically all of the protections GrapheneOS and Android give the user. Yes, mobile operating systems were designed sandbox first to treat all applications as untrusted. However it doesn’t matter if you’re only giving “trusted” apps root, all it takes is one supply chain exploit, one malicious developer, one anything to make that app with root do something its not supposed to do.

Not having root is the best way to harden security. Mobile OSes are designed to be heavily compartmentalized, each application runs in its own sandbox. Giving an application root circumvents the entire thing, allowing that application in theory to see into other sandboxed apps etc. If you want a real world example look at all the malware exploits that come into iOS via iMessage, one of the only apps on iOS that’s not fully sandboxed like normal apps.

> And what's wrong with my my terminal app having root sometimes? How is shadycryptonews.xyz/exploit.js going to leverage it? How would even the Official Authoritarian Police State app leverage it?

The problem is that we don’t know how they could leverage it, so the solution is to eliminate that pathway entirely.

This is also my issue with the push for Linux phones onto the average person (instead of the community coming together and forking AOSP if they want to escape Google). The platform has zero real sandboxing, and the average person still wants to use Meta apps as shit as they are. These big tech companies’ and governments’ apps would go absolutely crazy on Linux phones.

> What's the threat model for someone who doesn't blindly give apps root or do anything stupid, really?

To not get unknowingly pwned. Realistically even if you have a trusted app, you or the community can only verify that it’s trusted at a specific point in time. Realistically a community cannot verify that an app or package etc is consistently not malicious and will more often than not lag behind in the implementation of the exploit vs its discovery, it doesn’t matter if its closed or open source.

To be clear though my view is that we shouldn’t be pushing root-capable mobile operating systems onto the average person and that no root is infinitely more secure than having it. Maybe companies could provide alternatives, i.e. offering devices with rooted versions available but offering no customer support if something goes wrong with the software. But it certainly shouldn’t be a default available feature for the majority of the population.

—

An edit: Also preventing root allows devices to pass attestation checks. I know it has a dirty connotation in light of how companies are behaving recently, but it really is a security benefit for a device to be able to prove that it’s base operating system is unmodified (i.e. no persistent malware is present).

> Who banks that often that they really need to do that, outside of places like Sweden where cash is almost dead?

I often pay cash in physical stores, but when buying things online I (and every other Dutch person) use Ideal (Wero). That means authorising each payment via my bank, and that means either using my smartphone (GrapheneOS) with the bank's app, or using the bank provided OTP device with my debit card inserted.

Using my smartphone is, unfortunately, the easiest way. I hate both options for the fact that I need to fetch either my smartphone or my debit card though.

Banks want their stupid app because it is the easiest way to keep some client-side secret secure in a nearly fool-proof manner. I can do everything I want in any browser, but authorisation and authentication happens by means of that app, so even just logging in means scanning a QR code with the app, and then continuing in the browser of any device I want.

I think most people use bank several times a week at the very least. Some do it constantly and put debit cards on their smartphones and concentrate everything financial on that single device, but even folk who keep ready amounts of cash on hand and don't buy things online too often bank several times a month, even if just to pay taxes and keep an eye on their finances.

>I use all kinds of computers for communication. I'm communicating with you on my desktop.

Sure, now get a date, connect with old friends, get invited to a party or join your children's school parent groups exclusively on free software.

>And a phone IS a computer, so why pretend it's not?

I agree we shouldn't, I'm just saying that it's unlikely for that need to meet a large enough demand.

You might consider Instagram, whatsapp or similar apps personally not essential, but for many (I would say most) people they are - if not truly essential for living, at least essential in the sense that they don't have much use for their phone outside of those apps.

Which was my point, as long as the main use of a phone requires passing through meta's (or whoever else's) hoops, it's going to be a hard battle.

The only minimally mainstream uses of a phone that currently lie outside the walled garden are piracy and emulators, and that's already a stretch.

That breaks Android's security model and reduces overall security.

Exactly. It is my device. End of story.

If I could point out, the vast majority of people you see writing things as stupid as that are either have a huge stake in the company/industry or the government.

Thanks for all of your other comments in this thread I read them all and it is such useful advice for everyone, even seasoned security people.

It isn't natural to want less freedom.

I do (re-)root my phone (after each update I have to flash the Magisk-modified boot.img again), but FWIW almost nothing needs root on Android, it lets you do way more by default than iOS. I think some people equate jailbreaking and rooting when there's not really a jail to begin with. You can install a custom ROM without having root and I think that's what most people really want to do. Cleaner base system, maybe some new features. I run LineageOS without gapps and it's great. I can use `sudo` inside termux since I have root. I don't really use it for anything except to verify that Magisk reinstalled okay (I do `sudo ls /` as a quick check). Installing F-Droid doesn't need root. You can even do it on locked down TVs and Amazon tablets usually. adb works as well, not sure why someone was saying it doesn't. Hell, adb should work even without either root or a custom ROM. I use it to reboot my phone into fastboot without the button combo and then flash Magisk right after.