OS Support – Only 3 Years?

[han]

You couldn’t even figure out how to uninstall apps with ADB and are grossly uniformed about Android’s security model, yet are calling my arguments weak?

I’m trying to encourage Mudita to do the right thing and make a secure product, blind loyalty isn’t helping anyone.

@han

While sideloaded apps are “officially unsupported”, Bluetooth, WiFi, SMS, and other core system components (WebView browser) present equally serious attack vectors on unpatched devices.

At minimum, security patches for these domains need to be backported.

@han

WebView - Accidentally opening on a link in the unpatched built-in webview browser can hand over control of your device to a compromised website.
Public WiFi - Connecting to public wifi networks with an unpatched device allows attackers to push malware directly to your device via vectors like wifi chip vulnerabilities.
Bluetooth - Walking into public areas with Bluetooth enabled allows attackers to take over your device without any interaction.
Malicious files - Opening media or documents with hidden code designed to exploit outdated file handling systems.
SMS/MMS - Message payload attachments can be delivered that install malware.

@han

There are several critical vulnerability types that the Kompakt will forever be at risk for now.

Elevation of Privilege - Malicious code that is able to exploit a vulnerability and gain root access, which compromises every single app on the device.

Remote Code Execution - Bluetooth and network connections, or even websites that are able to run malicious code on your device without any user interaction or permissions granted.

Take a look at the monthly Android Security Bulletin. Almost every bulletin has dozens of critical vulnerabilities of both types.

Android Security and Update Bulletins  |  Android Open Source Project