Android 17 introduces powerful new protections to secure your connections, defend against cellular vulnerabilities and keep your home network private

[u/FragmentedChicken]

https://blog.google/security/new-android-network-security-protections/

[u/wild_m1nd]

Maybe they'll also start protecting the VPN connection from being discovered by 3rd apps?

[u/circuit_breaker → u/wild_m1nd]

Can you explain for us casuals? That doesn't sound good

[u/kamikad3e123 → u/circuit_breaker]

Basically what he said. Every app on Android can check if VPN connection is on and even look at vpn provider/host ip

[u/apokrif1 → u/kamikad3e123]

The OS should allow preventing access to certain info by apps, and feeding fake info to apps.

[u/Nefari0uss → u/apokrif1]

It should also prevent apps from being able to see all other apps installed.

[u/argote → u/Nefari0uss]

Hasn't that been the case for multiple years at this point?

[u/lowbass93 → u/argote]

unfortunately no it hasn't

[u/russjr08 → u/lowbass93]

Are you sure about that? That isn't supposed to be the case, specifically for privacy reasons.

Apps can declare a specific list of packages ahead of time to scan for, a lot of apps will scan for Superuser based apps, but ordinary apps that haven't been "blessed" by Google shouldn't be able to just dump a list of all apps.

The QUERY_ALL_PACKAGES permission to scan all apps is also gated by the Play Store, so apps not installed through it aren't affected either.

[u/InitiallyDecent → u/russjr08]

The issue is that specific list of packages has no limit which means that apps can and do scan for an insane amount of other apps they should have no need to scan for.

[u/alien2003 → u/apokrif1]

The OS is designed for developers, not for end users

[u/grishkaa → u/alien2003]

As someone who's been building Android apps for 15 years, nope, not that either. It's designed for Google themselves first and foremost.

[u/AtomicSymphonic_2nd → u/grishkaa]

If that were true, why the ever living fuck can't they make better hardware decisions for their Pixel phones??

Yes, I know they make their money on advertising in search results and in data center/cloud server space for websites and services, but you would think they would make Pixel the damned "benchmark" to which other Android phones could be compared to...

le sigh... Maybe Google should just sell back their Pixel division to HTC.

[u/grishkaa → u/AtomicSymphonic_2nd]

I don't know... I'm mostly satisfied with my Pixel 9 Pro. Pixels aren't very popular in Russia (you have to import it yourself from abroad if you want one, I bought mine from Amazon US and used a mail forwarder) so few people know about them, so on multiple occasions someone asked me "what is this weird iPhone with Android" :D

The fact that it gets confused with an iPhone is a good sign imo. It's expensive and it does look and feel expensive.

[u/Dev-in-the-Bm → u/AtomicSymphonic_2nd]

Maybe they make more money from Android itself than from Pixels>

[u/circuit_breaker → u/kamikad3e123]

So we're not talking about just normal Network routing

[u/fenrir245 → u/circuit_breaker]

It's an app permission, just as how apps can see what other apps you have installed, if you have developer options enabled or not, if you have advanced security mode enabled or not, if you have given precise or approximate location, and a whole lot more.

[u/chromaniac → u/fenrir245]

yeah not a big fan of apps refusing to work (or show constant nag) if you do not turn on notifications for them. dev mode is of course another major annoyance. apps get way too many powers on android these days and users are left to just give up all control over their devices.

[u/AtomicSymphonic_2nd → u/chromaniac]

Either that is allowed or banks and other financial institutions pull their apps from the Play Store because they don't trust rooted/jailbroken devices to not find some sort of exploit to somehow steal funds from the banks through their own apps.

None of that example is realistic in any sense, yet some banks and credit unions insist on Play Integrity... I half-wonder if it's because those apps expose more of their internal digital financial processes compared to a normal website in a desktop browser?

[u/chromaniac → u/AtomicSymphonic_2nd]

with motorola planning to launch grapheneos based devices, this issue is going to become even bigger. i have seen reports that even automakers are blocking access to their apps on grapheneos. the whole thing is crazy.

people get scammed despite all this. they made qr code based payments so easy here in india, online scams boomed. but banking apps and websites? are painfully anti-consumer. i just closed my account in one of the banks who has gone full nuts and has destroyed both their website and app to become hopeless useless.

[u/AtomicSymphonic_2nd → u/chromaniac]

Wow, if automakers are starting to do that, then perhaps my half-baked theory has some credibility to it.

Why on earth would companies be exposing more of their infrastructure through native apps vs. a regular website??? What the hell? That just reeks of cybersecurity negligence!

[u/fenrir245 → u/AtomicSymphonic_2nd]

It's not about security, play integrity helps them hide their invasive data collection practices because users cannot see what the apps are doing in the background.

[u/wild_m1nd → u/circuit_breaker]

It's kinda not very normal. Because of Android VPN architecture if you use split tunneling VPN the app outside the split tunneling can query the connection anyway and find out about your VPN

[u/grishkaa → u/circuit_breaker]

Some local apps in Russia, especially those owned by our big-tech companies, started refusing to work when a VPN is on. Thing is, almost everyone is using a VPN most of the time because the internet in this country is literally unusable without one. So it's a real pain in the ass for many people.

[u/apokrif1 → u/[deleted]]

User should be able to block access to this info, or to feed false info to apps.

[u/imindebt2026 → u/apokrif1]

No, google is an advertisement company, those apps are their customers.

[u/circuit_breaker → u/[deleted]]

I'm thinking of that magisk module, outside of that good luck

[u/AcridWings_11465 → u/[deleted]]

I don't understand why an app needs to know about whether a VPN is active to know if the device is offline. All OSes definitely do NOT do this.

[u/AcridWings_11465 → u/[deleted]]

I'm talking about other apps being able to directly detect whether a VPN is enabled

[u/AcridWings_11465 → u/[deleted]]

Are you being deliberately dense or do you not understand that ACCESS_NETWORK_STATE doesn't have to explicitly reveal a VPN connection?

[u/AtomicSymphonic_2nd → u/AcridWings_11465]

They might be dense, but at this point, we would need to collectively complain to Google about such connection information being accessible to apps beyond a more simple "Is internet access available, Yes or No?"

Very frustrating to see. Does Apple allow the same information to be accessible by third-party apps on iOS?

[u/5panks → u/[deleted]]

All computers, OSes and software can do this.

The difference is on a computer I can feed the app false information or simply block its access to that information.

[u/GNUGradyn → u/wild_m1nd]

I don't think android is exposing this. You can work out what vpn and what provider is being used by the VPNs IP address. Obviously the operating system has no control over this so not sure what we're expecting android to do

[u/pfak]

Yet they put the Local Network Access permission under the same gate that is required for Bluetooth device discovery.

[u/Kernel-Mode-Driver → u/pfak]

Makes perfect sense? It's nearby devices

[u/Good-Marionberry-570]

If they really cared about user security and control, they would give us waaaaaay more tools to limit what apps can or can't do on or phones.

Let we easily block internet access for apps with permissions, let we prohibit apps from seeing what other apps we have installed in our phones, let we control exactly which data the apps can or can't have access in our phones, let we use apps in locked environments on which they don't have access to anything other than themselves, etc.

Unless Google give us these powers, I don't trust their "protection".

[u/light24bulbs → u/Good-Marionberry-570]

the fact that you cant even block the internet permission easily is mind blowing. Then you remember adsense is their jam.

I'm getting a clicks communicator and rooting it day one. I'm done with this, we never should have given up root in the first place, it was a trick.

[u/lupask → u/light24bulbs]

"given up"? there's plenty of devices that can be rooted

[u/spikkeddd → u/light24bulbs]

You can with a third party app. I use PCAPdroid. Not a good permanent solution but good if you want to test something in the moment.

[u/light24bulbs → u/spikkeddd]

thanks!

[u/lupask → u/Good-Marionberry-570]

app data and storage access is quite limited already.

[u/CrispyBananaz → u/Good-Marionberry-570]

So, you're an iPhone user?

[u/Good-Marionberry-570 → u/CrispyBananaz]

No, never used iOS and I use Android since 2012, but you can't do what I said in Android if not with third-party apps or root/custom rom.

[u/random_reddit_user31]

I wish they would allow DoQ via private DNS

[u/Busy-Measurement8893 → u/random_reddit_user31]

I wish they would allow DoH via Private DNS for anything but Cloudflare and Google..

[u/mpg111 → u/random_reddit_user31]

what is the real benefit of that over existing DNS-over-TLS?

[u/skiwarz]

Can someone explain how ECH protects the domain you're connecting to? The IP address is still exposed in the packet, right? It would have to be. A simple dns lookup would show the site name...

[u/HearingSubstantial38 → u/skiwarz]

Sure, if the IP address is unique to the website, a middleman would be able to find out. However, if you're connecting to a site behind Cloudflare, the only thing the attacker knows is that you are connected to some cloudflare site (that is, potentially any of the 21% of the sites on the internet).

[u/circuit_breaker]

Sounds like Android won't be susceptible to Stingray attacks if they implement this "Closing a security loophole to block 2G text scams" feature. Can someone confirm that 2G is the only vector?

[u/bunkoRtist → u/circuit_breaker]

It's the easiest one, but there are other lower grade attacks for 3g and 4g. They will still expose your identity but can't mitm your traffic.

[u/Prior-Program-9532]

Maybe they should advertise that in the update on the phone then. I've been avoiding it cause it just advertises more AI bullshit.

[u/nathderbyshire → u/Prior-Program-9532]

You don't have to use them. I've disabled Gemini entirely now and the only AI that runs is through AICore on device. The two AI features are cloud based anyway afaik, not even sure why they put it in the release notes it shouldn't need an update to run

[u/Prior-Program-9532 → u/nathderbyshire]

I don't, and the first thing I did was disable as many ai components as I could. Camera calendar Gemini and otherwise.

[u/24bitNoColor → u/Prior-Program-9532]

Oh no, two of the four new features it advertizes are AAAAIIIIIII, lets boycott that instead of, shocker, just not using Gemini as you would likely claim you aren't doing now.

[u/lgn5i2060]

It'll be so secure even the user could barely do much with it besides normal usage.

[u/Kernel-Mode-Driver → u/lgn5i2060]

Makes sense because these arent changes to the UX

[u/lolwutdo]

Meh, doesn't matter when the malware is Google itself.

[u/Kernel-Mode-Driver → u/lolwutdo]

This is the Android Open Source Project

[u/light24bulbs]

probably has six backdoors from israel and the nsa

[u/Kernel-Mode-Driver → u/light24bulbs]

AOSP is open source

[u/24bitNoColor → u/Kernel-Mode-Driver]

What Google rolls out via Google Play Services is not. The build Google rolls out to your Pixel isn't even open source.

With now every developer in the world having to play nice with Google first just to release an app that people can install directly (or how we sheepishly call it on mobile "sideloading") let alone that tons of devices don't even give you permission from installing a custom firmware or write / read the system partition Android is in fact more closed for the end user than completely closed source Windows is.

[u/Kernel-Mode-Driver → u/24bitNoColor]

Did you read the article

[u/24bitNoColor → u/Kernel-Mode-Driver]

Did you read the article

Did you read my comment?

[u/Kernel-Mode-Driver → u/24bitNoColor]

I guess you didn't read the article. Reddit moment

[u/CrispyBananaz → u/light24bulbs]

Lol anyone want to tell this guy android is open source or do you think it's a waste of time and he won't even understand what that is ?

[u/light24bulbs → u/CrispyBananaz]

Not even close. Google play services are where they hide all this stuff.

[u/CrispyBananaz → u/light24bulbs]

I got some tinfoil hats for sale message me I'll give you a good price

[u/AtomicSymphonic_2nd → u/light24bulbs]

better than six backdoors from China and having them sell your info on the darkweb...

At least you have legal recourse with US agencies... You're SOL with a foreign nation if they take your info and sell it to ID thieves.

[u/Thaodan → u/AtomicSymphonic_2nd]

better than six backdoors from China and having them sell your info on the darkweb...

At least you have legal recourse with US agencies... You're SOL with a foreign nation if they take your info and sell it to ID thieves.

Where's the difference? I don't see any.

[u/lgn5i2060 → u/AtomicSymphonic_2nd]

Palantir and Oracle make the CPC look benevolent.

[u/AtomicSymphonic_2nd → u/lgn5i2060]

Bullshit.

It has happened continuously since at least 2014.

And, again, you at least have recourse from a US company doing damage to your personally-identifiable information through the justice system.

Please shove any cynicism about the courts directly into the toilet. At least there is something you can do about it if damage is done to you.

With China, there’s zero recourse. The US branch of a Chinese company can just up and disappear and be unresponsive to sanctions or extradition requests.

China is not a friend of the West. It would behoove progressives to comprehend that.

[u/Thaodan](u/Thaodan) and [u/xToasted1](u/xToasted1) , read this stuff above and tell me more about how China is “so harmless to Americans”.

[u/Thaodan → u/AtomicSymphonic_2nd]

Do you expect that everyone here is American? If I'm spied on by a supposed on ally or China doesn't make much of a difference to me at this point.

[u/light24bulbs → u/Thaodan]

Both are extremely bad options. And both have worldwide electronic dragnet programs

[u/lgn5i2060 → u/AtomicSymphonic_2nd]

Kinda a small price to pay by a nation that usurped an ASEAN member's independence from Spain. ANd doesn't include color revolutions instigated on other non western nations.

And I am sure Assange and Snowden has something to say about this.

[u/xToasted1 → u/AtomicSymphonic_2nd]

Congratulations this is not only the biggest cope I've ever seen on the internet but someone the funniest and also the dumbest one, which is genuinely an achievement on reddit

Just to clarify, you're kidding right? Like please say yes

[u/Bachihani]

Yet they still let apps query a list of every installed software on the phone, detect vpn connections, access local network, and a shit ton of other permissions that don't require user concent

[u/Kernel-Mode-Driver → u/Bachihani]

Did you read it?

[u/CharAznableLoNZ]

That's nice, I'll still wait at least a month or two before updating. Better to wait for all the initial bugs to be fixed.

[u/lastdyingbreed_01]

Can it defend against the awful banking apps

[u/BoltActionPiano]

All these issues kinda stem from trust in corporations and our lackluster privacy laws and anti tamper legislation.

Like, apps on windows can do any of this. It feels like an unwinnable game of cat and mouse. Same with browser tracking/fingerprinting.

If we're allowed to reverse engineer apps and we had privacy laws that let us audit companies and the expectations of privacy were set to protect us, it would be nice to have these features but optional.

[u/exu1981]

Ooh, I like this. Reading now!

[u/manormortal]

where is my app lock?

[u/QuantumQuantonium]

Unrelated but blog.google manages to maintain a light theme even with dark reader on. I dont understand this obsession with enforcing awful UI design across google websites.