<story><title>Smartphone Security: You&apos;ll Never Guess Who Just Messaged You</title><url>http://jordansmith.io/address-book-contact-security/</url></story><parent_chain><item><author>raise_throw</author><text>A variant of the &amp;#x27;single non-root user&amp;#x27; problem on Unix systems.&lt;p&gt;A non-root user (hopefully) can&amp;#x27;t root the system or rm -rf &amp;#x2F;root.&lt;p&gt;But everything interesting is stored in that user&amp;#x27;s home folder with implicit RW permissions anyway.&lt;p&gt;On Android apps just request everything. I imagine (without explicit knowledge) that an app given permissions could rewrite, erase, or pull down over the network contacts &amp;#x2F; photos &amp;#x2F; etc in the background.</text></item><item><author>mirimir</author><text>I really don&amp;#x27;t get the security model for smartphones. It seems horribly brittle. I mean, the fundamental protection is using apps from trusted sources, basically Google or Apple. Anything not trusted can&amp;#x27;t install, unless you&amp;#x27;ve rooted the phone. And so old-school Windows-style malware is blocked.&lt;p&gt;However, when trusted apps are installed, they often demand all sorts of privileged access. And if they&amp;#x27;re malicious, there&amp;#x27;s no way to protect against them. Except that they get reported to Google&amp;#x2F;Apple and become unavailable. But that doesn&amp;#x27;t help people who already got pwned.&lt;p&gt;What am I missing?</text></item></parent_chain><comment><author>duxup</author><text>I remember learning Unix on my school&amp;#x27;s big Unix system.  Lots of talk about how important root was.  I understood it from a system standpoint sure.&lt;p&gt;Yet I was confused, because as a user all I cared about was my stuff that was ... right there in a non root account.&lt;p&gt;As you say all the stuff I was concerned about was right there, but nobody talked about how important that was.</text></comment>
<story><title>Smartphone Security: You&apos;ll Never Guess Who Just Messaged You</title><url>http://jordansmith.io/address-book-contact-security/</url></story><parent_chain><item><author>raise_throw</author><text>A variant of the &amp;#x27;single non-root user&amp;#x27; problem on Unix systems.&lt;p&gt;A non-root user (hopefully) can&amp;#x27;t root the system or rm -rf &amp;#x2F;root.&lt;p&gt;But everything interesting is stored in that user&amp;#x27;s home folder with implicit RW permissions anyway.&lt;p&gt;On Android apps just request everything. I imagine (without explicit knowledge) that an app given permissions could rewrite, erase, or pull down over the network contacts &amp;#x2F; photos &amp;#x2F; etc in the background.</text></item><item><author>mirimir</author><text>I really don&amp;#x27;t get the security model for smartphones. It seems horribly brittle. I mean, the fundamental protection is using apps from trusted sources, basically Google or Apple. Anything not trusted can&amp;#x27;t install, unless you&amp;#x27;ve rooted the phone. And so old-school Windows-style malware is blocked.&lt;p&gt;However, when trusted apps are installed, they often demand all sorts of privileged access. And if they&amp;#x27;re malicious, there&amp;#x27;s no way to protect against them. Except that they get reported to Google&amp;#x2F;Apple and become unavailable. But that doesn&amp;#x27;t help people who already got pwned.&lt;p&gt;What am I missing?</text></item></parent_chain><comment><author>hoppa_liza</author><text>&amp;gt; On Android apps just request everything&lt;p&gt;That was true up to Marshmallow (Android 6), when finer grained permissions were added.</text></comment>