Favoring Snackbars Over Security

Another day, another report of Android security flaws.

In particular, this flaw makes for a fine demonstration of what I feel are Google’s messed-up priorities.

Here, we have an app that is not sanitizing its inputs. It has an activity that accepts a URL via an Intent extra and (apparently) blindly hands the URL to a WebView . Net result: an attacker can access any file within that app’s internal storage, which is supposed to be private to the app.

Again: this is an app. It’s not part of the framework. Google publishes this app on the Play Store.

This leads to some interesting questions:

Why is it that we have tons of documentation about how Google wants GUIs to appear and very little about how developers should secure their apps? Are we to interpret this as meaning that Google values snackbars over security?

Why can’t we have a Project Schneier, focused on helping developers to secure their apps? While I will agree that Project Butter (60fps View -based UIs), Project Svelte (helping with Android One), and Project Volta (battery and power consumption) are important, one would hope that security would be right up there with them.

(note: no actual Schneiers were harmed in the creation of this blog post)

Even if Google has a Project Schneier in, say, Android O(MG), will they actually use it? After all, Project Butter was a few years ago, and StrictMode came out in 2010, yet the framework team apparently does not use StrictMode to test framework code. Will it be 2020 before Google would apply their own advice and tools to securing their own stuff?

When will I see blog posts, videos, conference presentations, and the like from the Android developer relations group related to security?

And so on.

I’m not expecting a lot of movement from Google in this area, as I have long ago given up worrying about what Google does. So I do what I can to help with Android app security, and I applaud the work that others do in that same area.

And then, I wait for the next in a series of shoes to fall.

Learn second-generation Android app development — with Kotlin and the Android Jetpack — through CommonsWare’s Android app development training!

— Aug 13, 2015