• viking@infosec.pub
    link
    fedilink
    English
    arrow-up
    12
    arrow-down
    2
    ·
    15 hours ago

    And people wonder why I keep rooting my Android phones.

    Without advanced permission denial and file access restrictions, phones will spy on anything and anyone.

    • dev_null@lemmy.ml
      link
      fedilink
      English
      arrow-up
      2
      ·
      8 hours ago

      That helps with other dangers, but in this case all you need to do is not give “Pool 3D” access to the microphone, no rooting required.

    • sunzu2@thebrainbin.org
      link
      fedilink
      arrow-up
      5
      arrow-down
      10
      ·
      15 hours ago

      Rooting is no longer required and is a security risk

      Or do you mean flashing custom privacy respecting rom

      • viking@infosec.pub
        link
        fedilink
        English
        arrow-up
        17
        arrow-down
        1
        ·
        edit-2
        14 hours ago

        No, I exactly mean rooting, and it is a hard requirement for me when choosing phones.

        If you know what you’re doing, there is no security risk involved, since every app requesting for root access needs to be granted individually, and you can opt to do so for a limited time or permanently. Or not grant it at all, obviously.

        Tools like AppOps (advanced permission management), Storage Isolation (prevent access to certain folders even if “file access” permission is granted to some app), Ice Box (keep certain apps in a permanent state of hibernation unless you explicitly launch them) are absolute core essentials.

        Other apps that enable you to fully remove system apps, system level adblockers, VPN sharing etc. might be optional, and there are no-root workarounds, but they all come with serious limitations.

        • Rolivers@discuss.tchncs.de
          link
          fedilink
          English
          arrow-up
          2
          ·
          7 hours ago

          Hmm… Do you use a different root method than magisk? I don’t think a root method based on the efforts of a single developer is a safe practice.

          • viking@infosec.pub
            link
            fedilink
            English
            arrow-up
            1
            ·
            6 hours ago

            There are other tools, but their developers aren’t publicly known. So I indeed trust into the one man show that is magisk, at least as a full time Google employee who gets his codebase reviewed in-house, there’s some more trust than to a random nobody. And he does publish the code and allows for user contributed fixes on github.

      • dai@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        1
        ·
        14 hours ago

        Granting blanket root to all programs on an android phone sure that’s a risk; but who the fuck does that on any system…

        From memory individual apps would be able to request root which could be denied, approved once, approved always or ignored.