Hacker News Reader

Comment by eeZi | Hacker News Reader

Since nobody pointed it out yet: that change was done for security reasons, not due to a political conspiracy. Media access was a big hole in the otherwise fine-grained permission model.

Your camera app used to be able to access your WhatsApp backup folder and your documents. It was just a flat file system. Developers would request the permission even though all they needed was a caching folder or something, but they could read and upload all of your documents, too.

This change, while breaking a bunch of applications until they migrate to the new fine-grained API, was a necessary one.

View on HN

That was about whatsapp doing a major goof and putting private files in a "public" area (every app already had a private area for file storage) and failing to secure them properly (encryption is hard, apparently).

WhatsApp messed it up particularly bad, but it's not the only example. The point is that there was no private access to the SD card. If you had large files that did not fit on the internal storage, using the shared external storage was the only alternative. Developers abused that and ended up putting all sorts of private data on the SD card.

Lets try to not confuse "external storage" (effectively a partition on the emmc, but mounted under /sdcard for legacy reasons) and an actual SD card.

Removable storage, SD, USB, etc, was moved from external_storage to media_storage with Android 3.1.

Note that external_storage was still about putting files in an area readable by any and all apps that had read_external_storage permission.

In other words, the change would do jack all to safeguard against idiots like the whatsapp app devs.

> The point is that there was no private access to the SD card.

Sure there was! Simply generate a random key, store it in the (small) private storage area, and use it to encrypt whatever you want to write. Instant private area!

Unix 40 year old permission system is enough to deal with this, this is no excuse.

The hard part is the user interface, not the backend. The application needs to invoke a privileged UI where the user can choose which files or directories the application may access.

(many storage media are formatted using FAT, so the media API is probably not implemented using Unix permissions)

I'm talking of allowing apps to mark things (like the WhatsApp data previously mentioned) to only be accessible by itself or some other app(s).

As for FAT, I said in another comment that Google has already imposed MTP on us and Android's adoptable storage uses ext4 anyway, so they could easily require it on all removable storage where application data is stored.

As far as I understand, media was (is?) stored on sdcards, which uses (can use) FAT, which has no permissions support.

It uses ext4 on the mixed mode (which incorporates it as system memory), but it should require ext4 for sd cards as well. They cut off USB mass storage support so they have already crossed that line.

Reply on news.ycombinator.com