Security & Privacy

Android security is not one feature but a set of boundaries, each of which assumes the one outside it has already failed. Read them as rings and the design starts to make sense.

Every Android app is a Linux process with its own UID, its own data directory and its own SELinux domain. That single design decision is why installing a stranger's app is a reasonable thing to do.

Linux has discretionary access control: if you own a file, you decide who else may read it. SELinux adds mandatory access control: a policy written by someone else decides, and even root is subject to it.

Android has 365 documented permissions, four protection levels that matter, three grant mechanisms, and a second permission system most developers never see. Here is how they fit together.

Android's privacy model changed from a single install-time gate to a per-capability, per-duration, per-accuracy negotiation. Each release removed a specific capability that apps had been abusing.

Underneath the permission dialog is a second, finer-grained switchboard that records every operation and when it happened. The Privacy Dashboard reads it, data access auditing reads it, and adb shell appops lets you inspect it.

An APK's signature is not a safety guarantee and not a certificate from a CA. It is an identity claim, and it is the hinge that permission checks, update acceptance and Play App Signing all turn on.

Keystore lets an app use a key without ever holding it. The key lives in a TEE or a discrete secure chip, and attestation lets a remote server verify what kind of protection it actually has.

Full-disk encryption protected a phone that was off. File-based encryption protects a phone that is on but locked — which is most of the time, and which is why alarms and incoming calls still work.

Most of Android's worst vulnerabilities were the same bug in different clothes: C or C++ code reading memory it did not own. The response was layered hardening, and then a language change.

Two mechanisms that make an Android phone trustworthy and hard to brick: a chain of signatures rooted in hardware, and two copies of the system so an update can never destroy the one you are using.

Every identifier Android has ever offered has been narrowed, scoped or removed. The pattern is consistent: an identifier that survives uninstall and crosses apps is a tracking mechanism, and tracking mechanisms get regulated.

Stagefright, Janus, the VINTF boot failure, the Oracle lawsuit. Five incidents that changed Android's architecture, told as engineering stories: what broke, why the design allowed it, and what was rebuilt afterwards.