[Feature request] Allow secondary users to install apps from unknown sources - Omni Features Development

The following issue in Lollipop refers: https://code.google.com/p/android/issues/detail?id=79728
Since there's no indication from Google whether they will take any action on this, I request that that Omnirom 5 preemptively add this feature to allow secondary users to install apps from unknown sources.

aidfarh said:
The following issue in Lollipop refers: https://code.google.com/p/android/issues/detail?id=79728
Since there's no indication from Google whether they will take any action on this, I request that that Omnirom 5 preemptively add this feature to allow secondary users to install apps from unknown sources.
Click to expand...
Click to collapse
This seems like it might have some nasty security implications... e.g. guest user installs bad stuff that negatively impacts primary user.

Entropy512 said:
This seems like it might have some nasty security implications... e.g. guest user installs bad stuff that negatively impacts primary user.
Click to expand...
Click to collapse
This was enabled in Kitkat, were there complaints of this happening?

aidfarh said:
This was enabled in Kitkat, were there complaints of this happening?
Click to expand...
Click to collapse
If Google restricted it, my assumption would be yes. Google made a number of security improvements with 5.0

In my case, there are 2 concerns with this issue : Humble Bundle and Amazon App Shop (but mostly humble bundle).
To be able to play games bought via humblebundle, my girlfriend has to use my session on the tablet now (Nexus 10 with stock lollipop, I wanted to give it a try), which is even more a threat.
Maybe letting the main user select which users are able to install app from unknown sources could be good (instead of letting thoses users decide by themselves).
Another more friendly possibility : add a password to intall such apps, so the other users will have to ask the main user to validate the installation.

supermamie said:
In my case, there are 2 concerns with this issue : Humble Bundle and Amazon App Shop (but mostly humble bundle).
To be able to play games bought via humblebundle, my girlfriend has to use my session on the tablet now (Nexus 10 with stock lollipop, I wanted to give it a try), which is even more a threat.
Maybe letting the main user select which users are able to install app from unknown sources could be good (instead of letting thoses users decide by themselves).
Another more friendly possibility : add a password to intall such apps, so the other users will have to ask the main user to validate the installation.
Click to expand...
Click to collapse
Hmm, so secondary users can't install apps BUT they also can't access apps installed by the primary user?
OK that could be a problem.

I am not sure to understand your question but in lollipop, if I install a game from humble bundle on my session, my girlfriend can't install it on hers.
The only way for her to use it is to play it from my session (not good for games with evolution, and she has access to all my stuff, in this case it is not a problem, but is is a larger security breach than letting her install awful applications that she now can install in my session)

Related

[App] SwitchMe secure login manager needs Tab testers please!

Hi everyone. Im one of the developers of SwitchMe, and app that allows multiple secure logins into separate installations of android on a single device. The pr is after the break.
I really need a few people to check into some issues people on the original Tab have been experiencing. There are some warnings involved:
- testers must perform a full nandroid backup before using the app, it is not our responsibility if you start getting boot loops
- if you report results or bugs, please use the "Write to us" function in the app whenever possible, and always describe the issue in the header of the logs you send
- if you post here, be sure to include your device type and rom
- if you have apps installed on sd, be sure to mention that as well
--------------------------------------------------------------------
SwitchMe is a unique application for root users that allows you to log in and out of multiple installations of Android just as you would on a desktop computer.
The technology behind SwitchMe saves all of your applications and data, protects it and stores it as a file in memory. You can then log out of an
account and log into a fresh installation of Android or another account with its own unique content.
You may create as many profiles as the memory is capable of holding. Some of these may require very little free memory because they contain few apps,
others will be larger as they contain many applications and lots of cache and data.
Why is this functionality useful?
Privacy - the most obvious benefit is that you can securely share one device among multiple users, which gives you privacy and peace of mind.
Testing - if you are a developer, you can use profiles as clean sandboxes to test your applications and their interaction with the system.
Gaming – with multiple installations of Android on a single device, you can now play online MMOs as different characters.
Speed - the games your kids play slow down your tablet, but with SwitchMe you can easily create profiles without games or instant messengers.
Battery life - when the battery is low but there are important emails or documents to edit later, switch to a profile which only contains these essentials.
These of course are only suggestions - there are plenty of other uses for the functionality SwitchMe offers.
Market link:
https://market.android.com/details?id=fahrbot.apps.switchme
The Lite version allows the creation of two profiles, enough to test on.
Screens:
SwitchMe 1.2 has been rolled out and now includes a lockscreen replacement:
1.2
Added lock screen for logging in and out
More stable Fast switch implementation
Reworked UI colors
Now, its very important that we get some feedback on how this big new feature works, so please read up on it in the help and post your thoughts!
1.2.2 - HOTFIX 2
Reworked widget on qHD+ displays
Fixed widget text on HC and ICS
Fast switch improved on older devices
So guys any comments?
There is no way this app affects recovery whatever youre doing wrong its a user error.
Arobase40 said:
Sorry Man, but I haven't installed Superuser, as the ROM was prebuilt with Superuser and CWM, and was working fine since SwitchMe... ^^
No access to the Market as, AGAIN, no Google apps at all, and so no Market !
I just created the profiles as instructed BUT this apps did NOT copied the Samsung ROM correctly... Don't know what happens with Recovery ???
I've spent the whole night to find out a way to flash back my backup.
This is my report and I can't change it and since this is your first report with this device, I guess ???.
Then telling this is a user error, please explain what was my error except being your first beta tester with your app on this device ???
Click to expand...
Click to collapse
I cant explain anything to you because your description of the issue makes no sense - all i can say is that its not possible for this app to modify the recovery partition. Its physically impossible.
The lack of gapps is probably because they were bot installed in /system. Same with superuser. Check your rom for more info.
Any issues to report?
Not working on Galaxy tab GT-P1000
Hi,
Exact same problem as Arobase40.
I Installed Switchme, added 2 accounts (one for actual user and a new user). Then rebooted. No more market (and google apps) nor SuperUser. SwitchMe and Cwm complain I didn't give root permission.
Is there a solution or do I have to flash rom with Odin ?
Chag
chagam said:
Hi,
Exact same problem as Arobase40.
I Installed Switchme, added 2 accounts (one for actual user and a new user). Then rebooted. No more market (and google apps) nor SuperUser. SwitchMe and Cwm complain I didn't give root permission.
Is there a solution or do I have to flash rom with Odin ?
Chag
Click to expand...
Click to collapse
That means there are symlinks to the /system or /data folders where the gapps and superuser are stored. That is the problem - the app does not and will never support these links.
Any issues with the new build?
No... I'm not willing to take into account individuals. I work with the lowest common denominator. Dont like it? Don't use it. Frankly, arguing with a dv really isn't going tointuce him to help you...
Sent from my GT-P6800 using xda premium
1.5.3.5
Profile creation and cloning now restricted to admins
Fixed many device-specific issues from logs
Fixed rare crash on profile switch
Fixed Superuser footprint issue on some ICS tablets
Lots of small issues on the new x86 and MIPS architectures fixed as well
Yes, obviously. But the actual word is trolls - opinionated and easily offended, these creatures can often be found lurking in forums doing nothing much at all other than flaming others and bottom feeding.
A lot of them are in my GIANT ignore list. So long.
1.5.3.8
Fixed issue switching profiles (One X and others)
Fixed rare crash on adding/ removing profiles
Fixed many device specific issues from user logs
ftgg99 said:
That means there are symlinks to the /system or /data folders where the gapps and superuser are stored. That is the problem - the app does not and will never support these links.
Click to expand...
Click to collapse
Does that mean all SGT P-1000 will have the same problem? I have no problem losing gapps, I can always download it from goo manager. I'm afraid I would lose superuser/root access like they did.
Will it work on ICS CM-9mod (MTD)?
It would be a killer app if this can work.
No of course not. It applies only to roms with symlinks.
Well I just moved from CM9 to AOKP and because I am not a dev, I wouldn't know if they use any symlinks or not when they make their custom ROM.
But I decided to go ahead install ur app and see if it will work. We'll find out soon.
Here goes nothing. I hope it will work.
Test Result
yappoe said:
Well I just moved from CM9 to AOKP and because I am not a dev, I wouldn't know if they use any symlinks or not when they make their custom ROM.
But I decided to go ahead install ur app and see if it will work. We'll find out soon.
Here goes nothing. I hope it will work.
Click to expand...
Click to collapse
Hey! So far it works! That means:
1. This apps works for SGT-P1000 with CM9 Rom, as well as AOKP rom
2. both AOKP and CM9 builds do not have symlink.
Here are the test cases I did
(You asked us to test just the compatibilityto P1000 not the functionality)
preps:
1. downloaded SwithMe from Google play. App automatically installed
2. Backed up everything in titanium backup
3. Reboot to Recovery and did nandroid backup
TC1. Startup SwitchMe app Result: App startup, displaying 2 warnings.
Warning 1. Preparation warning. 2. Apps on Sdcard warning
TC2. - Move allapps on SDcard back to internal sdcard, restart SwitchMe app
result: 1warning displayed.
- Confirm warning
result: Superuser asks for confirmation for access
- Confirm superuser access Result: App goes to empty page with "Add profile" button.
TC3 Create 2 profilea
Result: Both created.
TC4. Activate Profile, reboot.
Result: Tablet rebooted and started normally
TC5. Activate profile 2, Reboot
Result1: Tablet rebooted and started as a new untouched rom,
prompting user to initial wizard.
Result2: SwitchMe app available, while other user apps are not available.
Result3: gapps are still available.
I hope this helps.
Thank you. A pleasure to see someone actually help us out!
My pleasure.
Pointers for users:
1. Using different google accounts for different profiles will prevent you from downloading app from playstore (error message).
2. Do not select google backup when setting up second profile. If you select google backup, it will automatically install missing apps from google market, therefore you will have an exact clone with your main profile at the end.
Once you get used to it, it is a nice app to have.

[APP 2.3+] 3C Toolbox (aka Android Tuner)

Dear users,
Considering all 3C apps are now based on the same source code, they all behave the same way, and will exhibit the same issues. Any queries will also likely applies to all apps.
To make my life easier while continuing to provide support here (and start with a clean slate), I decided to close all my app threads and open a fresh new thread here.
With your continuous help and support, the past 4 years have been a great adventure and experience. Let's take a fresh start and continue this amazing adventure.
Thank you all!
*** See at the end of this post on how to get support for any issues ***
The most comprehensive toolbox to save battery, tweak, tune, backup, secure and monitor any Android devices running any ROMs, any kernels.
What is 3C Toolbox
Replaces 20+ apps easily worth 30€ for the price of a couple of beers!
NB: Starting with version 1.0.3, Android 2.2.x and 2.1.x are no longer supported. App supports Android 2.3 and above, including Android L preview.
Safest root app on Play Store: I run the app and all its features on at least 4 devices every day, and change 3 of them frequently for testing purposes. With about 250.000+ actual users, it's pretty safe to assume the app is very safe. App can create a reset package to disable all system tweak features from CWM/TWRP at any time. App has automatic fallback in case of boot loops while re-configuring the CPU.
See signature for download links.
☺ App Features
☺ 3C Apps Feature Comparison
☺ More app screenshots
☺ Low CPU consumption, please check benchmarks
☺ Get started guide
☺ Online help
♦♦ Unique features not available elsewhere ♦♦
◊ Track your ROM, kernel and battery performance (%/h or mA, screen on or standby)
◊ Battery milli-amp (mA), mW and %/h consumption reporting
◊ Automatic backup of installed and updated applications
◊ Highly configurable graphical monitoring widgets
◊ Advanced script editor
♦♦ Unique features not available elsewhere (root required) ♦♦
◊ Clean and safe reboots, without data loss
◊ Turn on/off APN, BT discovery, tethering, GPS & WiFi Localization
◊ Logcat reader for Android JellyBean 4.1.x
◊ Easiest Link2SD / App2SD capabilities ever
◊ More about permissions requested
◊ Issues with CPU temperature or battery current mA or capacity mAh?
Please explain this in a support request from app settings, help and support so we can provide the appropriate option to use in 'mA retrieval method' of battery / monitoring settings and add out-of-the-box support for your device. All necessary information is provided in the request's attachments.
◊ How to get support for any other issues
Please send a support request from app settings, help and support. You need to clearly explain your issue, attach any relevant screenshots showing where and how the issue occurs. I will not provide any support here.
All I ask is to provide reasonable details for me to be able to help, empty requests are mostly trashed, I keep one requests per device for the sake of a possible source of information for how the app supports things, to possibly fix things too or compare between variants of the same device.
For example a support request contain the following (you can check the content before sending it!),
all discovered SD cards, very useful for any related issues, including the mentioned read cache stuff.
app installation path and configuration, for xposed, battery, cpu, tweaks, apps or task managers problems.
battery history and configuration for any battery problems.
CPU configuration for CPU problems, including thermal, mp, voltage, etc
The idea is that you explain the observed issue, possibly add a screenshot so that I know exactly where to look for (app has 100+ screens and sometimes words don't mean the same for you and me), and there I can really do a good job at helping you.
PS: And so you know, I hate liars, insults, disrespect and myself. So please try to avoid those when requesting support.
Actually if you want support, posting the whole support request content, the screenshot and details here should be ok. Doing otherwise, I'll either ignore you completely or send you elsewhere very quickly, you want to leave me a one star rating, so be it: developing is my passion and I love it, you want my help, do it the right way or don't at all. I don't develop for stars, I develop for fun.
Attention !!!! Installs an apk to /system/ dosnt know what it does !!! Apk is there when uninstalled too !!!!
Will the users of BMW pro and system tuner pro get a discount or count this as an upgrade?
Amazing! Downloading now.
Sent from my Nexus 7 using xda premium
Hi 3c,
Not a bad idea to make an "all in one", just need to see about memory, battery and CPU usage... but I am pretty confident about that
No more update for System Tuner pro?
In all cases I buy it! (although slightly damage the impressive increase in the price ).
Thanks and congratulations for your new app
DJxSpeedy said:
Attention !!!! Installs an apk to /system/ dosnt know what it does !!! Apk is there when uninstalled too !!!!
Click to expand...
Click to collapse
I've updated the first post with more information about that. Will publish an updated APK to ask user permission before installing it within the next hour.
EDIT: Didn't expected you guys to be so quick while I finalize the publishing of all required information.
By the way, the uninstall process can't uninstall other stuff, but as a rooted device, you should have no problem getting rid of this APK.
Please try the new APK published a minute ago (available in a couple of hours) that will allow you to refuse the APK installation.
dirtyreturn said:
Will the users of BMW pro and system tuner pro get a discount or count this as an upgrade?
Click to expand...
Click to collapse
Yes, just contact me with the order lists (bmw, system tuner and the new android tuner) and I'll refund old apps. This is the migration plan I'm working on.
EDIT: As of December 20th, 2013, direct refunds on Play Store are no longer possible. This was the only available way to offer discounts in a decent way. PayPal was an alternative available until February 2014, but it was abandonned because of the complexity, 30+% extra fees and the lack of global support (some countries could not receive refunds).
viking37 said:
Hi 3c,
Not a bad idea to make an "all in one", just need to see about memory, battery and CPU usage... but I am pretty confident about that
No more update for System Tuner pro?
In all cases I buy it! (although slightly damage the impressive increase in the price ).
Thanks and congratulations for your new app
Click to expand...
Click to collapse
Yes, high price for now to avoid users who just try any apps and put comments after a few minutes of testing. And also to be able to offer discounts by refunding old apps paid version.
Nevertheless there will be updates on existing apps (not everyone wants an all in one app) with existing improvements, except features that require additional permissions.
Do you think youll ever add ability to spoof app permissions? And let user input the value... This would be an ultimate feature!
Sent from my Nexus 7 using xda premium
NicholasQ said:
Do you think youll ever add ability to spoof app permissions? And let user input the value... This would be an ultimate feature!
Sent from my Nexus 7 using xda premium
Click to expand...
Click to collapse
I'm looking into this actually, along with a smart "renicer", but both requires hacking Android or every APK to monitor and it turns out to be very complex.
There's 3 existing solutions on Market today:
- Hacking of Android class loader, as done by LBE Security app.
- Hacking of APK installed, as done by SRT Guard
- Patching the ROM like PDroid does.
They all have their advantages and problems, but the APK hacking seems the best option to go for as it results in a more stable experience, not as dependent on Android version as the 2 others and probably less disruptive as LBE can be when it messes up one's device. But then I'm not sure an APK can actually be installed properly
That said, I'm still looking into the first solution hacking app loading directly.
3c said:
I've updated the first post with more information about that. Will publish an updated APK to ask user permission before installing it within the next hour.
EDIT: Didn't expected you guys to be so quick while I finalize the publishing of all required information.
By the way, the uninstall process can't uninstall other stuff, but as a rooted device, you should have no problem getting rid of this APK.
Please try the new APK published a minute ago (available in a couple of hours) that will allow you to refuse the APK installation.
Yes, just contact me with the order lists (bmw, system tuner and the new android tuner) and I'll refund old apps. This is the migration plan I'm working on.
Yes, high price for now to avoid users who just try any apps and put comments after a few minutes of testing. And also to be able to offer discounts by refunding old apps paid version.
Nevertheless there will be updates on existing apps (not everyone wants an all in one app) with existing improvements, except features that require additional permissions.
Click to expand...
Click to collapse
We are Quick we are fast...we are xda !
DJxSpeedy said:
We are Quick we are fast...we are xda !
Click to expand...
Click to collapse
Not at removing bad comment on Market though
So i take it you find this app extremely bad to rate it one star, right?
yes iam that i dosnt have it installed atm.. but one is good that you are here.. i have another bug for you
why does it make an backup of build.prop when i change nothing at it ?
DJxSpeedy said:
yes iam that i dosnt have it installed atm.. but one is good that you are here.. i have another bug for you
why does it make an backup of build.prop when i change nothing at it ?
Click to expand...
Click to collapse
So far you didn't find any bugs.
changed my play store entry about it
Is this [really] compatible with gingerbread? It lags, 'freezes' on screen and I have to long click the home button. I am using a sensation 4g 2.3.4. I'll get a logcat if you will find that that will help.
DJxSpeedy said:
changed my play store entry about it
Click to expand...
Click to collapse
Thanks, appreciated. I'm sure your new entry will be more useful to new users.
So I still hope you can enjoy my new app and report any of your findings, directly here or best is using the 'support request' from the app settings, it provides a lot of useful information for debugging
dirtyreturn said:
Is this [really] compatible with gingerbread? It lags, 'freezes' on screen and I have to long click the home button. I am using a sensation 4g 2.3.4. I'll get a logcat if you will find that that will help.
Click to expand...
Click to collapse
Yes it is compatible. When did it lag? After requesting to install the system app or at some other times?
When lagging, the OS usually creates a file in /data/anr/traces.txt. If you experience a new lag, you can send it to me, possibly using the support request feature in the app settings. You can then attach a file to the newly created email.
When it comes to lags (or ANRs for that matter), logcat is useless. It only mentions a reference to the traces.txt file
3c said:
Yes it is compatible. When did it lag? After requesting to install the system app or at some other times?
When lagging, the OS usually creates a file in /data/anr/traces.txt. If you experience a new lag, you can send it to me, possibly using the support request feature in the app settings. You can then attach a file to the newly created email.
When it comes to lags (or ANRs for that matter), logcat is useless. It only mentions a reference to the traces.txt file
Click to expand...
Click to collapse
To me (if I'm wrong it's all user error) the system apk it was requesting to install (it appeared to me) was for ics/jb, so I refused the install. Your app kept requesting to install the extras. After a little thought - is the extra apk mandatory? No intention to cause any concern if what I'm experiencing is nonsense. I have not rated your app on the play store.
It lagged randomly.
dirtyreturn said:
To me (if I'm wrong it's all user error) the system apk it was requesting to install (it appeared to me) was for ics/jb, so I refused the install. Your app kept requesting to install the extras. After a little thought - is the extra apk mandatory? No intention to cause any concern if what I'm experiencing is nonsense. I have not rated your app on the play store.
It lagged randomly.
Click to expand...
Click to collapse
The extra APK is now only for specific toggles as I manage to find a different work around for the JB logcat issue. Those toggles include the APN (mobile data), background data (this one's obsolete), debug mode, unknown sources, gps and wifi localization. The 1 useful toggles is for GPS though.
Until you press 'do not ask again', the app would continue to request the APK installation ;(
As for the lags you're experiencing that seems like a bug. Have you found any trace.txt in /data/anr directory by any chance?
It's just fair to be concerned with things like that, I can understand. But installing an app requesting 35 permissions, then granting root access to that app and then being scared about a 40Kb APK being installed on /system folder is quite funny actually.
If I may make this comparison, it's like letting a heavily armed man (the 35 permissions+root) in your home and then being worried being he is hiding a wallet (the 40Kb apk) in your home!
Anyway, bad comments always call for improvements
3c said:
The extra APK is now only for specific toggles as I manage to find a different work around for the JB logcat issue. Those toggles include the APN (mobile data), background data (this one's obsolete), debug mode, unknown sources, gps and wifi localization. The 1 useful toggles is for GPS though.
Until you press 'do not ask again', the app would continue to request the APK installation ;(
As for the lags you're experiencing that seems like a bug. Have you found any trace.txt in /data/anr directory by any chance?
It's just fair to be concerned with things like that, I can understand. But installing an app requesting 35 permissions, then granting root access to that app and then being scared about a 40Kb APK being installed on /system folder is quite funny actually.
If I may make this comparison, it's like letting a heavily armed man (the 35 permissions+root) in your home and then being worried being he is hiding a wallet (the 40Kb apk) in your home!
Anyway, bad comments always call for improvements
Click to expand...
Click to collapse
Seems permissions are about the same as some system apps. the taces.txt is up for you. Hope it does something helpful. Thanks for the app. I had sent a PM with the information about the purchases. I do not use google wallet.
Awesome news that you are working on user defined app permissions. I really hope you can find a good work around. And I do currently use SRT appguard in conjuction with Android Tuner and I did notice it seems to handle disabling app permissions pretty good. The only downside is that you won't get app updates from market but that's not a big deal to me. I think if you can get the spoofing action to work, a lot of people are going to want your app. There are plenty of times I haven't downloaded an app because I didn't like it's permissions. So being able to control them without breaking the app will be a dream come true.
Sent from my Nexus 7 using xda premium

[Q] katkiss-4.3 restricted users accounts limitations vs

Dear all,
First, a big thanks to the communauty ot provide such great jobs. We really enjoy this !
Now, a quick question about restricted accounts use and their possible consequences regarding applications:
I've got a ASUS Tranformer 101 device.
I've followed the procedure provided in this thread (http://forum.xda-developers.com/showthread.php?t=2392087) to install the KatKiss rom 4.3 provided by Timduru which works really well. :good:
Context description:
I am the defaut account (admin I guess ?) for the tablet.
I've got two (lovely) children.
Each one have a Restricted account. Those restricted accounts have permissions to see onyl specific (games) applications.
Now, using my (admin) account, if I try to launch any application -> it works fine.
If I switch to one of the two restricted accounts, I can see and launch those 'shared' applications, but, for SOME of them, I observe the following behaviors:
Error encountered:
-> [Error message shown on the screen immediately after launch complaing about a "license verification error"]:
Example of applications impacted:
Grimm's Snow White (https://play.google.com/store/apps/details?id=com.storytoys.GrimmsSnowWhite.GooglePlay&hl=en)
Grimm's Sleeping Beauty (https://play.google.com/store/apps/details?id=com.storytoys.GrimmsSleepingBeauty.GooglePlay&hl=en)
(For what matter I've already sent an email regarding this behavior to the editor "Story toys" and I'm waiting for an answer on their side ...)
-> Application launched but nothing is clickable on the screen:
Example of applications impacted:
Lep's World 2 (https://play.google.com/store/apps/details?id=at.ner.lepsWorld2&hl=en)
This Could Hurt Free (https://play.google.com/store/apps/details?id=com.chillingo.thiscouldhurtfree.android.row&hl=en)
-> Application which works fine using a restricted account:
4 in a Row Multiplayer (https://play.google.com/store/apps/details?id=org.pjf.fourinarow&hl=en)
Glow Hockey (https://play.google.com/store/apps/details?id=com.natenai.glowhockey&hl=en)
Hence, does someone already faced these issues ? Is it related to the applications themsleve not being designed to run in a restricted account environment or is it related to the current state of the rom ? (android 4.3)
Thanks you for shedding some light on these questions.
If it is not the best place to post this question could you please redirect me to the right place ? (knowing I can not post into DEV forums yet).
regards,
Are all the multi user accounts using the main Google id, as this can cause problems with some apps which check with Google Play Store at run time to see if the current user has the valid Google id associated with his profile.
Theziggy said:
Are all the multi user accounts using the main Google id, as this can cause problems with some apps which check with Google Play Store at run time to see if the current user has the valid Google id associated with his profile.
Click to expand...
Click to collapse
Thanks you Theziggy for your quick answer.
Regarding the use of the GoogleID, I don't know how to check this. Do you have a procedure ?
However, I confirm those applications have been installed, using my account, directly from the GooglePlay store. (noTitanium Backup recovery attempt or anything else).
In the meantime, I've received an answer from Story Toys (editor of "White Snow' and "Sleeping Beauty" saying their development team is aware of an issue with restricted accounts and they are working on this subject.)
Hence it seems the source of the problem is per application ? Maybe, depending of what the application attempts with the account data, this might work or fail in a restricted account context (as you've pointed in your answer Theziggy).
Regards,
Hello every body, I have been provided a solution regarding my problem with the "Story toys" applications licensing and usage of restricted accounts.
The editor kindly provided me this step by step a mini-guide (kudo to them for providing the solution !) which solved my issue.
I put it below hoping it can help others people in the same or similar context:
1. Delete the app from the device
2. Turn off the device, wait a moment, then turn the device back on again
3. Ensure you have a working internet connection
4. Clear the cache and data of both the Google Play store app and the download manager. Here's how:
- Visit Menu > Settings > Applications > Manage applications
- Tab over to All
- Select the Google Play store app, and then tap Clear data and Clear cache.
- Then, select Download manager and tap Clear data and Clear cache.
5. Ensure you are logged in to Google Play with the same account you used to make the purchase.
6. Download the app and launch it straight away using the restricted account.
Once the app has been launched from the restricted account with the wifi/internet connection still running, you can then turn the wifi off again and the license won't be re-checked for another year.
Hope it helps,
Regards,
I have also been investigating a similar setup for a tablet used by kids, and looking into whether to create separate users or the restricted profile users. The one downside of using restricted users seems to be that I believe it is still a shared install of the app/game, so all users share the same user data. What this means is that all of those users would share the same game progress (i.e., levels completed, achievements, points/coins collected, etc.). Is that what your experience has been?
The alternative is to setup separate users and install the app for each user. It doesn't actually take up more space (the actual app files are only saved once for each user install), but each user has its own app data.
I have also been investigating a similar setup for a tablet used by kids, and looking into whether to create separate users or the restricted profile users. The one downside of using restricted users seems to be that I believe it is still a shared install of the app/game, so all users share the same user data. What this means is that all of those users would share the same game progress (i.e., levels completed, achievements, points/coins collected, etc.). Is that what your experience has been?
Click to expand...
Click to collapse
Good question, I've done a quick test using the game "Jewel Saga" and switched between the two restricted profiles. I confirm that, at least with this game (I did do perform other tests), each restricted account get its own progress and settings saved properly (Ej.: music on/off, level reached, number of stars earned per level ... ) .
As I said, this is just one test quickly performed on one application. So maybe the user experience varies regarding how applications handles data save with retricted profiles ?
Anyway, as long as my kids are not complaining, I'm fine
The alternative is to setup separate users and install the app for each user. It doesn't actually take up more space (the actual app files are only saved once for each user install), but each user has its own app data.
Click to expand...
Click to collapse
Good to know, thanks for the tip !
Has anyone managed to get lep's world 1 or 2 working in a restricted profile?
The developer doesn't seem interested in fixing the apps to allow it.
Lep's world 3 seems to work, despite the game spitting messages to the contrary

[Q] security of rooting apps and custom roms

Hello,
I think about rooting my device.
However I also think about how secure the custom roms builds or rooting apps are.
E.g.
In the modaco forum there is a tool called Superboot r2 to root the motorola moto g device.
How can I know/trust that this tool doesn't contain any spyware/malware or other malicous code?
How do you guys look at the security of custom roms and other apps which root your device?
Customizing and rooting one's phone can be done very securely. Even more now than a few years ago. I would be wary about apps that can root your phone with a buttoon press. Unless, of course, there is a really long thread about it on xda. The same with apps not from the Google store. You should run a virus scan on any apks you get in general. They can contain malicious code that can mess up your device and steal your information.
Once you root your device, it's a good idea to look into the XPrivacy app. You can use it to control the individual permissions of all of your installed app. There are a lot of other security measure you can take too. Do research on what would be relevant to your device.
kbntk said:
Hello,
I think about rooting my device.
However I also think about how secure the custom roms builds or rooting apps are.
E.g.
In the modaco forum there is a tool called Superboot r2 to root the motorola moto g device.
How can I know/trust that this tool doesn't contain any spyware/malware or other malicous code?
How do you guys look at the security of custom roms and other apps which root your device?
Click to expand...
Click to collapse
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
Elzbach said:
Customizing and rooting one's phone can be done very securely. Even more now than a few years ago. I would be wary about apps that can root your phone with a buttoon press. Unless, of course, there is a really long thread about it on xda. The same with apps not from the Google store. You should run a virus scan on any apks you get in general. They can contain malicious code that can mess up your device and steal your information.
Once you root your device, it's a good idea to look into the XPrivacy app. You can use it to control the individual permissions of all of your installed app. There are a lot of other security measure you can take too. Do research on what would be relevant to your device.
Click to expand...
Click to collapse
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Thank you for your replies guys.
jcase said:
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Click to expand...
Click to collapse
I agree rooding the device decreases the overall secruity of the device.
On the other hand, rooting the device gives access to the apps that give you control over the system and data on it. For example as Elzbach wrote, with the app XPrivacy I can control what apps have access to my personal information.
Now - without root - when I instal a new keyboard or launcher with widgets, I'm warned that these apps can have access to my personal information and can use them malicously. For me that means, that even without root using normal apps I can get big security risk when using some apps from play store.
Do you build the custom android version by yourself from the source or use builds provided on this forum or modaco or use another way?
kbntk said:
Thank you for your replies guys.
I agree rooding the device decreases the overall secruity of the device.
On the other hand, rooting the device gives access to the apps that give you control over the system and data on it. For example as Elzbach wrote, with the app XPrivacy I can control what apps have access to my personal information.
Now - without root - when I instal a new keyboard or launcher with widgets, I'm warned that these apps can have access to my personal information and can use them malicously. For me that means, that even without root using normal apps I can get big security risk when using some apps from play store.
Do you build the custom android version by yourself from the source or use builds provided on this forum or modaco or use another way?
Click to expand...
Click to collapse
XPrivacy, and apps like them introduce additional security concerns of their own. Android is not designed to work the way they force it too, introducing many new unknowns.
New keyboard, launchers introduce an infinitely smaller risk than any root app, and unlike with root apps you are warned and privileges are handled by an established well tested permission system. Comparing the two is completely silly.
Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all.
A completely valid scenario (one we have seen in the wild): An app with 0 permissions, but the ability to use su could download and dynamically execute new code to perform the malicious activities. IE Google bouncer, and any anti virus software would be @#[email protected] out of luck on that one. All because a user decided to completely break the basic security model, by installing su.
The only customized version of Android I use, is a customized emulator I use for analysis, and that only used when I suspect something could damage an actual test device.
I do not mess with customized versions of Android on real hardware, I only build when testing patches I plan to push to the AOSP gerrit for review.
jcase said:
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Click to expand...
Click to collapse
jcase said:
XPrivacy, and apps like them introduce additional security concerns of their own. Android is not designed to work the way they force it too, introducing many new unknowns.
New keyboard, launchers introduce an infinitely smaller risk than any root app, and unlike with root apps you are warned and privileges are handled by an established well tested permission system. Comparing the two is completely silly.
Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all.
A completely valid scenario (one we have seen in the wild): An app with 0 permissions, but the ability to use su could download and dynamically execute new code to perform the malicious activities. IE Google bouncer, and any anti virus software would be @#[email protected] out of luck on that one. All because a user decided to completely break the basic security model, by installing su.
The only customized version of Android I use, is a customized emulator I use for analysis, and that only used when I suspect something could damage an actual test device.
I do not mess with customized versions of Android on real hardware, I only build when testing patches I plan to push to the AOSP gerrit for review.
Click to expand...
Click to collapse
Well I stand corrected.
Apologize if I'm resurrecting an oldie but this is a topic I've been contemplating for a while now. I used to root, looking back to my old OG Droid days. But I find newer devices sufficient as to not root anymore (mostly). I'm currently debating rooting a Samsung Tab S 8.4 to remove Touchwiz and hopefully speed some things up and maybe further control the CPU.
If the user is rooted and they only install apps from the marketplace that are known to be safe (I assume)- i.e.- not downloaded from some misc internet site and from "non-trusted sources," would this still be able to happen?
- "Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all."
I guess I'm just not sure how google approved apps, or if they even do. And what's the process of showing app permissions in the Play Store these days, since permissions are front and center when you download an app. Do dev's just flag permissions on their own will or is it built into the Android code? I would ASSUME the android code when posting to Play Store decides permissions for the dev. I would be horrified if Android relied on good will for people to post permissions solely from the dev's input.
I could be completely wrong
But as I understand dev a pick the permissions they need for the app to work correctly. They declare the permissions they need to the Android system. And then they can only use those permissions and no others. However they don't need to use all of the permissions but they can if they want to.
Btw apps from google play are in no way safe.it has no bearing if you do or don't have apps from unknown sources on your device. fact is google in no way checks the source code of apps on the play store.now maybe the run a virus checks but honestly that means nothing as moron could code in malicious code that would not trigger a scanner (and Trojans are far more prevalent for Android than viruses). If the source code is not available then no one knows what an app could be doing.
90% of my apps come from fdroid, who builds everything from source.
In the discussion above I should also note (but could be wrong about this completely) that system apps (the ones that come with your phone) all have root(administrator) permissions by virtue of being system components.
So rooting may decrease your security but personally I think factory roms are far too unsecure to start with and will never have a device that is not rooted. The benefits far out weight the risks for the careful user. Until such time as the source code is released.
Unless you trust google, face book, Samsung, Twitter, and a host of other baked in developers who get to put apps on your phone at the factory.
Or Apple who has their own way of making money off your every move, or microsoft with win 10 that also sells your habits.
jcase said:
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Click to expand...
Click to collapse
This alone is enough for me to stay away from root and its capability to make things worse in my end. Thank you for the professional input on this.
Without root you can't add any security to Android. Which has very little security to start with. Permissions are vague and can't be denied on a per app basis short of not installing the app.
System apps have no way of being removed without root unless you do it before flashing, and without root you can't do a complete backup of your system.
Even if you don't root a device yourself Trojans can gain root with many of the same exploits, root themselves and cause whatever havoc they desire.
An app only gets root if you allow it even after rooting your device. It will pop up and ask you if you want to allow or deny or always allow or deny. a Trojan that can create root will do can do it regardless if you root your device yourself, I have no idea if such a Trojan tried to get root if supersu, or superuser will pop up and ask.
A firewall requires root and that alone is worth rooting for me.
But then I have very few apps that I allow online.
Can root cause serious damage to your device? Yes
Can you administrator your device without root? No
Every Linux has root capabilities,
if you own it you should be able to administer it to the best of your abilities and to do that you need root.
Custom Roms are updated far more often that oem roms and as such generally have the newest fixes and updates for security.come that to factory roms that may update once or twice in their expected lifetime, regardless of how many security holes are found in the rom.older devices(read older as a synonym for 2 years old) may never get another update and the only way to protect yourself with out a custom Rom is to buy a new device.
For example Android 5.01 has a major memory leak.and even with that and other bugs and security issues Samsung had not updated the north American galaxy s5 (just over a year old,) above 5.01 yet and may not until marshmallow comes out (Which will mean almost a year after the security and memory leak were found). And until then you walk around using a device with major security issues and a major memory leak.
XPrivacy is not about Security. "Security" is never linked to Xprivacy on Github. "XPrivacy can prevent applications from leaking privacy-sensitive data". Saying the opposite is a lie.
Whether you have root access or not you can almost do nothing against serious attacks BUT having root access allows you to control some things like Internet connection, restricted access,...
Finally do not confuse Custom ROMs and Root. You can run a custom rom without root and vice versa. As explained above custom ROMs are more updated so you can enjoy more patches and new security features like SElinux.
Kayak83 said:
Apologize if I'm resurrecting an oldie but this is a topic I've been contemplating for a while now. I used to root, looking back to my old OG Droid days. But I find newer devices sufficient as to not root anymore (mostly). I'm currently debating rooting a Samsung Tab S 8.4 to remove Touchwiz and hopefully speed some things up and maybe further control the CPU.
If the user is rooted and they only install apps from the marketplace that are known to be safe (I assume)- i.e.- not downloaded from some misc internet site and from "non-trusted sources," would this still be able to happen?
- "Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all."
I guess I'm just not sure how google approved apps, or if they even do. And what's the process of showing app permissions in the Play Store these days, since permissions are front and center when you download an app. Do dev's just flag permissions on their own will or is it built into the Android code? I would ASSUME the android code when posting to Play Store decides permissions for the dev. I would be horrified if Android relied on good will for people to post permissions solely from the dev's input.
Click to expand...
Click to collapse
Go to F-Droid or fossdroid instead of Google Play to avoid crappy apps and unwanted connections. Apps on F-Droid are safer. Google has an automatic system to scan apks when they are uploaded but it doesn't detect everything... Be sure that if you didn't update the version number of your apk you will be blocked though lol
Permissions are stored in the AndroidManifest.xml. If the developer doesn't want to state the permissions he needs then nothing will be shown into the Manifest. That's why it's important to use 3rd party apps to control what apps really do.
Would never use my phone without a firewall installed. I want to have control over what apps can access the net and which cannot.
So rooting is a must for me.
Have no gapps installed and privacy is important to me.
Semseddin said:
This alone is enough for me to stay away from root and its capability to make things worse in my end. Thank you for the professional input on this.
Click to expand...
Click to collapse
And you'll be 100% wrong. You are getting a bad advice from someone who sounds like he works for Google. He is wrong and he knows it...
Your system apps have root whether you like it or not. So, they can do whatever Google wants them to do. And they can do it silently. So, the question is are you going to have control over your device or google? Without root you can't; with root you can if you know what you are doing. Your main security threat comes from Gapps and the infamous google services framework, which spies on you and regularly transmits home (google servers) your every activity. That has to go and for that you need root. Custom rom vs stock. Custom roms don't have Gapps and gsf, so that puts them on pedestal, as compared to stock. Stock rom is android plus manufacturer's bloat which also spies on you and wastes battery. Custom roms don't have gapps and they are open source (like Linux). Have you ever heard about viruses on Linux? Maybe 2 or 3, but thousands in other OSs. As another user noted, linux (on which android is based) has root. So is any major OS. Root is just a key to control your device. It can be set up to restrict everything, even system apps, so the point that having root reduces security is invalid except for one situation, when you don't know what you are doing. Do you want incompetent and malicious evil Google to own your phone? If you do, stay away from root.
optimumpro said:
And you'll be 100% wrong. You are getting a bad advice from someone who sounds like he works for Google. He is wrong and he probably knows it...
Your system apps have root whether you like it or not. So, they can do whatever Google wants them to do with your device. And they can do it silently. So, the question is are you going to have control over your device or google? Without root you can't; with root you can if you know what you are doing. Your main security threat comes from Gapps and the infamous google services framework, which spies on you and regularly tramsmits home (google servers) your every activity. That has to go and for that you need root. Custom rom vs stock. Custom roms don't have Gapps and gsf, so that puts them on pedestal, as compared to stock. Stock rom is android plus manufacturer's bloat which also spies on you and wastes battery. Custom roms don't have gapps and they are open source (like Linux). Have you ever heard about viruses on Linux? Maybe 2 or 3, but thousands in other OSs. As another user noted, linux (on which android is based) has root. So is any major OS. Root is just a key to control your device. It can be set up to restrict everything, even system apps, so the point that having root reduces security is invalid except for one situation, when you don't know what you are doing. Do you want incompetent and malicious evil Google to own your phone? If you do, stay away from root.
Click to expand...
Click to collapse
Thank you for your detailed answer but if i am not mistaken, are you suggesting that a custom rom made by a 3rd party hobbiest developer is more secure than oem's firmware ? If so, i will continue to be mistaken.
Semseddin said:
Thank you for your detailed answer but if i am not mistaken, are you suggesting that a custom rom made by a 3rd party hobbiest developer is more secure than oem's firmware ? If so, i will continue to be mistaken.
Click to expand...
Click to collapse
Most of the time the answer is yes. Also, you could be a developer yourself meaning you can compile your rom from sources with your own modifications. OEMs have user's security on the back burner. Their goal is to monetize the user and in case of mobile devices, there is no way to monetize the user without compromising security. The beauty of a published source code is that anyone could examine it and they do (even if it is not you yourself). Look at businesses: the majority of them use neither windows nor apple. They use Linux, because linux does not monetize the user and it is open sources and by the way, it is maintained by "hobbiest" developers. And naturally, because of this Linux has a vastly superior security and virtually no viruses.
Google is malicious and incompetent, but luckily, Android is based on linux and most of the code there is from linux.
This is of course a separate from root issue, which remains simply an issue of control: whether you want to be in control of your device or not. You can't name any OS that does not provide root to the user out of the box... Just because some (or most) smart phone dumb users don't know what they are doing does not mean that everyone should be denied root on their devices... And by the way, most Google engineers also don't know what they are doing and had it not been for Linux and the community at large, google wouldn't be able to produce anything that moves...

security concerns migrating from iOs to Android

As title suggests, coming from a so called "clean" iOS environment to Android, my main concern how susceptible is my data to being stolen. I have no (current) plans to root my next phone and will be used mainly from business, but from what I have read in the past even google play store apps have been to known to have malicious content. Am I worrying too much ? I do carry sensitive work data on my iPhone.
applefag said:
As title suggests, coming from a so called "clean" iOS environment to Android, my main concern how susceptible is my data to being stolen. I have no (current) plans to root my next phone and will be used mainly from business, but from what I have read in the past even google play store apps have been to known to have malicious content. Am I worrying too much ? I do carry sensitive work data on my iPhone.
Click to expand...
Click to collapse
As long as the apps you install are from known sources (i.e. Play Store) you don't need to worry. Also every time you download an app check the permissions. If you think that the app shouldn't have those permissions then don't download it. Finally for safety reasons never install any apps from unknown sources (i.e. outside of Play Store) unless you trust the developer.
If you still find yourself worrying read this.
applefag said:
Am I worrying too much ?
Click to expand...
Click to collapse
Yep
I think you won't install any app outside Google Play so install apps that you know and you won't need to worry. FYI http://en.wikipedia.org/wiki/Security-Enhanced_Linux
kalpetros said:
Also every time you download an app check the permissions. If you think that the app shouldn't have those permissions then don't download it.
Click to expand...
Click to collapse
Well only if you are sure. Sometimes apps need permissions that aren't justified for some people.
for the open nature of the android ecosystem, it is somewhat normal that you will have to be careful though there are several different techniques, i use this the most.
Root your phone, install xposed framework and install xprivacy. here is a review of what it does http://www.xda-developers.com/android/manage-individual-app-permissions-with-xprivacy/ . I know the installation pprocess may seem daunting, but it is easier than you think this module wil allow you to block apps of certain permission. IE. you can block location service for all the apps on your phone so that no app can get your location. There are bunch of other permissions that you can block like access to contact, gallery etc
My question to others is : Is antivirus application on android worth it? I mean can it protect me from real time attaks and malwares??
SaffatBokul said:
My question to others is : Is antivirus application on android worth it? I mean can it protect me from real time attaks and malwares??
Click to expand...
Click to collapse
Not useful IMO. FYI I remember this article.
User sensibility is your best defense. Don't install apps not from the market. Only install apps with a lot of positive comments.
I would advise again rooting your phone. It's true that there are ways to block apps from accessing your private data on a rooted phone, but the additional vulnerability from unlocking your bootloader and rooting is not worth it. Just stick to apps from major developers.
snapper.fishes said:
User sensibility is your best defense. Don't install apps not from the market. Only install apps with a lot of positive comments.
I would advise again rooting your phone. It's true that there are ways to block apps from accessing your private data on a rooted phone, but the additional vulnerability from unlocking your bootloader and rooting is not worth it. Just stick to apps from major developers.
Click to expand...
Click to collapse
I agree, rooting your phone comprimises your security even if you do it to install security apps.
Primokorn said:
Yep
I think you won't install any app outside Google Play so install apps that you know and you won't need to worry.
Click to expand...
Click to collapse
Unfortunately, new apps in Google Play are rarely verified by Google staff, so there is still always a possibility of trojan or other malware.

Categories

Resources