What can Google do to fix the android "security" issues that it has

[Premium1]

So after reading the article by Jerry (https://www.androidcentral.com/its-...ill-has-bad-reputation-when-it-comes-security), it got me thinking, what can Google do to "correct" the security issues that android as a whole has and to get rid of the stigma about poor security on android? I think project Treble is a step in the right direction, but feel until they can do something like Microsoft does with windows where all devices get the monthly security patches, nothing will change with android outside of the few OEM's that push monthly patches. Thoughts?

 

[B. Diddy]

I think one of the main issues is people downloading and installing apk files from random sites, instead of going through a safe and reliable source like the Play Store. Users might be doing this because they don't have access to the Play Store, or perhaps the app they're looking for is outdated and no longer supported in the Play Store, but I'd guess a significant proportion of these users are also trying to get something that they'd normally have to pay for for free. A simple step that Google could take would be to make it impossible to install apps from Unknown Sources (just like Apple), but this would doubtlessly infuriate many Android users (and understandably so).

 

[Premium1]

I think one of the main issues is people downloading and installing apk files from random sites, instead of going through a safe and reliable source like the Play Store. Users might be doing this because they don't have access to the Play Store, or perhaps the app they're looking for is outdated and no longer supported in the Play Store, but I'd guess a significant proportion of these users are also trying to get something that they'd normally have to pay for for free. A simple step that Google could take would be to make it impossible to install apps from Unknown Sources (just like Apple), but this would doubtlessly infuriate many Android users (and understandably so).

That works but still doesn't address the main issue by updates or lack of updates. Something needs to change in that regard or security and android will never be highly touted

 

[phonejunky]

Android needs to turn The Pixel into its iPhone and stay consistent with updates and it's ecosystem.

 

[Premium1]

Android needs to turn The Pixel into its iPhone and stay consistent with updates and it's ecosystem.

Agree, but until Google makes their own chips, they are at the mercy of qualcomm in terms of how long the device will be supported. That is part of the reason apple can update their devices for 3+ years.

 

[hallux]

A simple step that Google could take would be to make it impossible to install apps from Unknown Sources (just like Apple), but this would doubtlessly infuriate many Android users (and understandably so).

While a decent idea, this would block another, trusted, app source - Amazon.

 

[phonejunky]

While a decent idea, this would block another, trusted, app source - Amazon.

Apple has no problem making drastic choices to improve their platform in the direction they believe it needs to go. Google should have the same attitude.

 

[B. Diddy]

That works but still doesn't address the main issue by updates or lack of updates. Something needs to change in that regard or security and android will never be highly touted

The updates are there -- you just need a phone from Google themselves. Android phones could become more secure if Google decided to go full-on Apple and wall everything off, but that would also kill a lot of the variety and openness that have been a hallmarks of Android since the start.

 

[Premium1]

The updates are there -- you just need a phone from Google themselves. Android phones could become more secure if Google decided to go full-on Apple and wall everything off, but that would also kill a lot of the variety and openness that have been a hallmarks of Android since the start.

I still think there could be a way that Google does like what MS does where all devices get the security updates right away and the OS updates would take a little longer. Don't have to go completely walled garden apple on it. But saying "it works, just get a google device" kind of defeats the variety and choice you mention in your reply.

 

[B. Diddy]

But saying "it works, just get a google device" kind of defeats the variety and choice you mention in your reply.

Oh, I realize that. I meant that if security is really important to a user, that's the way to go.

I don't know much of the technical aspects, but since Google automatically updates Play Services, I wonder if it's feasible to include the security patches with that. Not sure how much of the monthly security patches involve Play Services, and how much are completely outside their realm.

 

[Premium1]

Oh, I realize that. I meant that if security is really important to a user, that's the way to go.

I don't know much of the technical aspects, but since Google automatically updates Play Services, I wonder if it's feasible to include the security patches with that. Not sure how much of the monthly security patches involve Play Services, and how much are completely outside their realm.

Agree. It seems anymore if you care about security it is pixel or iPhone. The rest are up in the air in terms of the updates.

 

[phonejunky]

The way I see it is. If you truly want a secure platform an Android device from Google has to be your choice or you'll just have to be ok with being susceptible to anything happening. Or switch over to Apple.

 

[LeoRex]

I don't know much of the technical aspects, but since Google automatically updates Play Services, I wonder if it's feasible to include the security patches with that. Not sure how much of the monthly security patches involve Play Services, and how much are completely outside their realm.

Oh, Google can push lower level system stuff via the Play Store... but one of the major problems there is the same thing that slows down OEMs... they mess with stuff they don't need to mess with. OEMs routinely go in and start replacing junk in Android core... drivers, libraries, etc., stuff that they really should have no reason to mess with.

Now, security patches are almost always patched versions of these low-level files, and Google has no way of knowing if these files have been altered or replaced with different versions or versions built on entirely different code. Android isn't locked down...

A few years ago, I read a blog post on an Android dev site and the writer was lamenting on how much of a mess the Galaxy S5's Android v5.0 code base was... the topper was that Samsung was reusing libraries from Android Gingerbread to maintain compatibility between Android and some components in Touchwiz (rather than updating their own code). That's the sort of minefield Google would be venturing into if they started updating the OS like that.