Opinion: Why End User Devices are Locked Down For Security, and Why They Have To Be

I started cutting my teeth on Android here on XDA back in the days of rocking a Kyocera Zio . The goal back then? Finding out how to block those irritating calls almost everyone gets from an auto-dialer. Since those days we have seen Android grow and most definitely mature, and I have loved the journey.

Just as much as I have enjoyed the journey and learning all the potential that Android has had to offer in its growth, I also realize that the game has changed. And as much as it pains me to say this from one perspective, another perspective tells me the fans of open systems and development have to realize that this has permanent changes in how we see development, security and open devices in the mobile ecosystem.

In that same 5 years we have seen the go-to enterprise provider, Research In Motion, dramatically lose its market share and almost completely exit the scene. As this was happening the U.S. National Security Agency released specifications that greatly expanded the opportunities for manufacturers like Apple, Samsung, LG and others to become approved for government use, which in turn saw many corporations want to have the same security available to protect its own data and interests. Solutions like Samsung’s Knox were born from these changes in the market. Here in the XDA community we saw the transformation differently: devices became locked, with development being only available on certain models or not at all. The days of getting a development device for the cost of an end user were already dwindling.

In my day job, risk assessment is a necessity. Shortly after I started writing here at XDA I even shared some of those lessons from a business perspective. I see that there’s a growing frustration about the fact that all Samsung Galaxy S7 and S7 Edge models in the United States have been locked down, preventing root and alternative ROM options for all users. And while I do sincerely believe T-Mobile may try and find a way around that, the simple truth that we as a community need to start accepting is that we should no longer expect (by default) end user devices to remain open to rooting and custom development.

The truth has been there for some time. The more we rely on these same devices to handle very secure data and tasks, the more we have to make sure that they’re secure. Let’s take the recent kerfuffle with Samsung. Secure boot features from Qualcomm block anything with an improper signature being run on the system, including custom recoveries, kernels and ROMs. That may be frustrating for those of you who want to do that, but we have to realize that a much larger part of the market share neither wants, needs or even expects the system to allow such a lack of security. It’s not what’s actually being done that’s the problem; it’s what is made possible by the reduced security that poses the greater risk. To further reinforce the fact that this is becoming the norm, readers only have to understand UEFI Secure Boot and how that is doing the same thing in the PC world.

What does that mean for those of us who want to see open development on those mainstream devices? Just like PCs still have options that don’t require UEFI Secure Boot we will continue to see options in the world of Android that will remain open. The first and most obvious will be the Nexus products. Because these are considered the development devices when it comes to Android, I can’t imagine a scenario where these will ever get locked down with no option to unlock it. What I do see happening with this model is the continuation of more open systems for features that cannot guarantee 100% secure functionality in that insecure environment. HTC looks to be continuing this model; Motorola was and hopefully will under its new ownership. LG also started this with the G4 and I hope that it will expand this year beyond the European model.

What if an OEM doesn’t want to work with the development community like this? To be rather blunt developers are going to have to bring their development to the OEM for approval. OEMs probably won’t always go along with it — if you’re a large enough organization you may find it possible with large enough licensing deal (and associated revenue). But that’s entirely their prerogative; after all, any custom ROM or recovery is essentially a competing function against what the OEM is likely already providing. Startups and growing companies may be okay with that risk as it allows them to increase their adoption rate.

Finding the same in a well established corporation such as Samsung is less likely as they have very little incentive versus the corporate buyers to open the system back up to the open source community. To do so actually exposes them to risks that they may not be even willing to take on any longer. An alternative would be allowing user-generated signatures to be added to the secure processes as approved; but how is this accomplished without some sort of control or overview by the manufacturer?

If readers still disagree and think this is the wrong way, consider an alternative set of discussions: the ones within the security community. You might even see a few familiar names since several of our Recognized Developers and members participate there as well. Right now they are applauding the improvements to the ecosystem but still believe we have a long way to go to really ensure things are secure for end users. We see this in the blogosphere, constantly denouncing Android security flaws yet at the same time crying out against certain security features. A lot of that has to deal with proper updates and extended support for devices in the market. As long as all of the involved parties are struggling to keep up with this very basic (and necessary) security, it’s hard to imagine that they’re going to accept even more risk to support a small percentage of the overall Android population. It’s a hard pill to swallow, but the sooner we get past this the sooner we can engage these parties to see where we can fit into the ecosystem and work together.

So what do you think about the state of Android security and locked devices? Do you think the party is slowing coming to an end for many? Or do you think this is just a swing of the pendulum and we’ll see it swing back again towards a more open environment? Let us know below in the comments or feel free to continue the discussion with us on social media!

from xda-developers http://ift.tt/1RVAEep
via IFTTT