This considerably overstates the issues around rooting. Rooting does not give arbitrary code arbitrary access. It does give the user (or whoever rooted it, perhaps the corporate IT department) the ability to run arbitrary code of his choosing with arbitrary access. On my phone, I am prompted to grant such access.
That's as a general statement. Specific techniques of rooting may open up more, and introduce other issues. But rooting can enhance security, too, by allowing you to impose controls that otherwise would not be possible. If you're serious about security, write your own authenticator, based on certificates and a PKI infraststructure, and if needed, a second/ third factor, e.g. a password (never stored or transmitted) and an auth token with a reasonably short timeout, and a onetime token generator device. There's not much you can do to protect against a user being held up at gunpoint while accessing your system, but you can protect against lost phones (revoke the certificate on any compromise, good password, and keep that token generator separately from the phone). Those factors come at a cost of usability. Maybe we'll see biometrics capabilities built into future devices. Maybe the camera and microphone can even do the job.. On Nov 10, 7:40 am, Kostya Vasilyev <[email protected]> wrote: > 10.11.2010 17:11, Marcin Orlowski пишет:> And if you rooted your device, you > can be a victim too, > > no matter how clever you think you are. And (far too) many people rooted > > their > > phones because "it's h4x0r" or they simply found a tool for that, and > > not because > > they really neded to. Majority got not much idea what "rooting" really > > means. > > Rooting your phone is like base jumping - seems like fun, but can come > to a sticky end. > > By doing this, the user deliberately and purposefully violates Android's > security architecture, and this can have side effects, such as possibly > compromised passwords. > > And doing this in a corporate environment is likely to be frowned upon > by the IT department, just like running hacked Windows from a warez site > on your work computer :) > > To OP - you might want to look at source.android.com, starting with the > method that returns a password, mentioned by Martin. Or ask on > android-platform mailing list. > > -- > Kostya Vasilyev -- WiFi Manager + pretty widget > --http://kmansoft.wordpress.com -- You received this message because you are subscribed to the Google Groups "Android Developers" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/android-developers?hl=en
