Ads are now able to bypass Google Play to install apps WITHOUT user consent
reddit.com
reddit.com
I also can't install any apps on new devices without giving Apple an email and phone number, which is its own kind of bullshit.
It‘s not like I needed another reason to hate the common Android ecosystem, but here we go. I maintain that there’s no way you can legitimately trust your phone manufacturer’s software. The incentives are just too misaligned. You have to use a third-party ROM like LineageOS (which has its own issues).
Most hardware manufacturers can not be trusted with software at fucking all. Apple seems to be the only exception.
Hardware and software need to be distributed separately (see personal computers), which could also solve some issues with updates. Treble is a good but under-utilized step in between.
Nah.
EDIT: Thanks to the commenters below, it appears not participating in the app store ecosystem does not safeguard someone from this. Quite concerning.
Based off the "SingleTap" demo video, it even works in a browser on an ad, which is a bit scary.
According to the partners list, phone/provider brands affected are: Verizon, At&T, Samsung, LG, Xiaomi, Motorola, Panasonic, Acer, T Mobile, Cricket, US Cellular, America movil, Tracfone, Telfonica and Tim Gruppo Tim.
Safeguarding your phone from network communication wouldn't be enough, as you would have to prevent audio communication as well - which kinda defeats the purpose of it being a phone.
I'd recommend to use LineageOS or Graphene on any Android smartphone. Use RethinkDNS [1] as firewall and AppWarden [2] to identify spyware.
You can also double check the reports page of the exodus prvcy project [3].