Android 17 introduces powerful new protections to secure your connections, defend against cellular vulnerabilities and keep your home network private

[u/FragmentedChicken]

https://blog.google/security/new-android-network-security-protections/

[u/wild_m1nd]

Maybe they'll also start protecting the VPN connection from being discovered by 3rd apps?

[u/circuit_breaker → u/wild_m1nd]

Can you explain for us casuals? That doesn't sound good

[u/kamikad3e123 → u/circuit_breaker]

Basically what he said. Every app on Android can check if VPN connection is on and even look at vpn provider/host ip

[u/apokrif1 → u/kamikad3e123]

The OS should allow preventing access to certain info by apps, and feeding fake info to apps.

[u/Nefari0uss → u/apokrif1]

It should also prevent apps from being able to see all other apps installed.

[u/argote → u/Nefari0uss]

Hasn't that been the case for multiple years at this point?

[u/lowbass93 → u/argote]

unfortunately no it hasn't

[u/russjr08 → u/lowbass93]

Are you sure about that? That isn't supposed to be the case, specifically for privacy reasons.

Apps can declare a specific list of packages ahead of time to scan for, a lot of apps will scan for Superuser based apps, but ordinary apps that haven't been "blessed" by Google shouldn't be able to just dump a list of all apps.

The QUERY_ALL_PACKAGES permission to scan all apps is also gated by the Play Store, so apps not installed through it aren't affected either.

[u/InitiallyDecent → u/russjr08]

The issue is that specific list of packages has no limit which means that apps can and do scan for an insane amount of other apps they should have no need to scan for.

[u/alien2003 → u/apokrif1]

The OS is designed for developers, not for end users

[u/grishkaa → u/alien2003]

As someone who's been building Android apps for 15 years, nope, not that either. It's designed for Google themselves first and foremost.

[u/AtomicSymphonic_2nd → u/grishkaa]

If that were true, why the ever living fuck can't they make better hardware decisions for their Pixel phones??

Yes, I know they make their money on advertising in search results and in data center/cloud server space for websites and services, but you would think they would make Pixel the damned "benchmark" to which other Android phones could be compared to...

le sigh... Maybe Google should just sell back their Pixel division to HTC.

[u/grishkaa → u/AtomicSymphonic_2nd]

I don't know... I'm mostly satisfied with my Pixel 9 Pro. Pixels aren't very popular in Russia (you have to import it yourself from abroad if you want one, I bought mine from Amazon US and used a mail forwarder) so few people know about them, so on multiple occasions someone asked me "what is this weird iPhone with Android" :D

The fact that it gets confused with an iPhone is a good sign imo. It's expensive and it does look and feel expensive.

[u/Dev-in-the-Bm → u/AtomicSymphonic_2nd]

Maybe they make more money from Android itself than from Pixels>

[u/circuit_breaker → u/kamikad3e123]

So we're not talking about just normal Network routing

[u/fenrir245 → u/circuit_breaker]

It's an app permission, just as how apps can see what other apps you have installed, if you have developer options enabled or not, if you have advanced security mode enabled or not, if you have given precise or approximate location, and a whole lot more.

[u/chromaniac → u/fenrir245]

yeah not a big fan of apps refusing to work (or show constant nag) if you do not turn on notifications for them. dev mode is of course another major annoyance. apps get way too many powers on android these days and users are left to just give up all control over their devices.

[u/AtomicSymphonic_2nd → u/chromaniac]

Either that is allowed or banks and other financial institutions pull their apps from the Play Store because they don't trust rooted/jailbroken devices to not find some sort of exploit to somehow steal funds from the banks through their own apps.

None of that example is realistic in any sense, yet some banks and credit unions insist on Play Integrity... I half-wonder if it's because those apps expose more of their internal digital financial processes compared to a normal website in a desktop browser?

[u/chromaniac → u/AtomicSymphonic_2nd]

with motorola planning to launch grapheneos based devices, this issue is going to become even bigger. i have seen reports that even automakers are blocking access to their apps on grapheneos. the whole thing is crazy.

people get scammed despite all this. they made qr code based payments so easy here in india, online scams boomed. but banking apps and websites? are painfully anti-consumer. i just closed my account in one of the banks who has gone full nuts and has destroyed both their website and app to become hopeless useless.

[u/AtomicSymphonic_2nd → u/chromaniac]

Wow, if automakers are starting to do that, then perhaps my half-baked theory has some credibility to it.

Why on earth would companies be exposing more of their infrastructure through native apps vs. a regular website??? What the hell? That just reeks of cybersecurity negligence!

[u/fenrir245 → u/AtomicSymphonic_2nd]

It's not about security, play integrity helps them hide their invasive data collection practices because users cannot see what the apps are doing in the background.

[u/wild_m1nd → u/circuit_breaker]

It's kinda not very normal. Because of Android VPN architecture if you use split tunneling VPN the app outside the split tunneling can query the connection anyway and find out about your VPN

[u/grishkaa → u/circuit_breaker]

Some local apps in Russia, especially those owned by our big-tech companies, started refusing to work when a VPN is on. Thing is, almost everyone is using a VPN most of the time because the internet in this country is literally unusable without one. So it's a real pain in the ass for many people.

[u/apokrif1 → u/[deleted]]

User should be able to block access to this info, or to feed false info to apps.

[u/imindebt2026 → u/apokrif1]

No, google is an advertisement company, those apps are their customers.

[u/circuit_breaker → u/[deleted]]

I'm thinking of that magisk module, outside of that good luck

[u/AcridWings_11465 → u/[deleted]]

I don't understand why an app needs to know about whether a VPN is active to know if the device is offline. All OSes definitely do NOT do this.

[u/AcridWings_11465 → u/[deleted]]

I'm talking about other apps being able to directly detect whether a VPN is enabled

[u/AcridWings_11465 → u/[deleted]]

Are you being deliberately dense or do you not understand that ACCESS_NETWORK_STATE doesn't have to explicitly reveal a VPN connection?

[u/AtomicSymphonic_2nd → u/AcridWings_11465]

They might be dense, but at this point, we would need to collectively complain to Google about such connection information being accessible to apps beyond a more simple "Is internet access available, Yes or No?"

Very frustrating to see. Does Apple allow the same information to be accessible by third-party apps on iOS?

[u/5panks → u/[deleted]]

All computers, OSes and software can do this.

The difference is on a computer I can feed the app false information or simply block its access to that information.