How much can you trust your Android Phone?

Introduction
Android sales has been huge, in the last years.
Surely, one of the key success factors of this platform is the possibility to have a smartphone with thousand of apps available with a starting price of 99$.

A big problem
Its huge user base, makes android a fertile ground in which computer thieves, put their efforts to gain access to:

• user accounts
• private data
• credit card numbers

Let's take the webkit engine: it is used from the browser and from some apps for rendering of webpages.
it is one of the most attacked module on the platform, maybe, because it is easier to find a known bug and obtain access to personal data.
If you have a problem on that components, a lot of apps become a security problem, unless you can update the smartphone.


A platform with no bugs doesn't exist and never exist but, anyone who makes you pay for a phone should guarantee  to have a system repairable and upgradable.


Google can guarantee this, but not Android .. why?

Generally, for my experience the only phones that receive system update, are Nexus phones, made by manufactures for Google.

If you have an Android phone .. you should have Jelly Bean now, lastest version of Android.
That's how it should work...
Is there a system update? and your phone must receive it as soon as possible.

Other phone manufacturers, does not update their software.
After you have bought their phone, they ignore you, they leave you with an insecure system that   compromised with a simple link received from a social network, or scanning a qrcode(link) or by NFC(link).

Most of the problems found on a module like webkit are commons to IOS, because also iphones uses Webkit, but on the Iphone the in-security is limited to people who doesn't want to make a system update.

The problem on IOS are solved in some days. 

The solutions
Here they are some solutions:

• buy a new phone every year to have new software update.....
• buy a nexus phone (new will be available soon)
• use a custom rom: you can flash your phone with a rom made by someone like cyanogenmod  (how can I trust them? I don't know.. but it is opensource and better than a stock buggy rom)
• don't buy an android phone

Keep your apps updated and pay attention to what you install too
This is an article about a security problem on Google Drive and DropBox of some days ago: http://blog.watchfire.com/wfblog/2012/10/old-habits-die-hard.html
If Google and Dropbox have security problems, you can immagine how many other apps can have security problem... so  think before "yes install / accept accept accept/ don't care / yes do what you want with my phone".
And this is another recent article about how apps are generally insecure when handle HTTPS connection (for example when you want to watch your bank account from your phone in a public wifi).

If you have not seen this yet.. watch this android bug and... think that the only android platform not affected.. is jelly bean.

If you are better than facebook engineer..than go ahead with HTML5

Yesterday, M. Zuckerberg talked about HTML5 as a mistake for the facebook iphone and android app.

Exactly:

“When I’m introspective about the last few years I think the biggest mistake that we made, as a company, is betting too much on HTML5 as opposed to native… because it just wasn’t there. And it’s not that HTML5 is bad. I’m actually, on long-term, really excited about it. One of the things that’s interesting is we actually have more people on a daily basis using mobile Web Facebook than we have using our iOS or Android apps combined. So mobile Web is a big thing for us.”

Quote from http://blog.tobie.me/post/31366970040/when-im-introspective-about-the-last-few-years-i

(maybe people use Web Facebook instead of native version because the previous version was buggy. Changes are hard to made)

I totally agree about HTML5... but I also think that for any app out there, use HTML5 as a one solution for all the mobile platform out there, and as the main platform to build app is a mistake.
I don't have a good opinion of HTML5 on mobile, for many reason:

• it is a growing and evolving tecnology with a not defined standard: there are 2 standards now..
• you lose the link to the hardware and also control, if you need it.
• I don't believe personally to solution/framework that can works everywhere.. You need compromise; compromise means poor integration & bad performance and so a bad user experience.
• Not all the mobile browsers are the same: on android platform, you can find different browser installed, with different rendering engine. Yes you can choose to support only some browser.. but don't you choose HTML5 because it can runs everywhere?
• Javascript performance may differ a lot from a platform to another: means slow speed on some device.
• The time spent improving App/OS integration..cost.
• No store exist yet... and if it exists.. needs a lot of app that are not native (if not why a user should point to the html5 store?)
• it is early: maybe in the future will be the best choice. We don't really know if it will be the best and when.. we know is not now.

It also have good points:

• HTML is a good solution for content rendering: if you need to show rich text, with images as an example.
• Easy to prototype an app.

and I also don't think to be better than all those nerds engineer at facebook.. so...

Platforms matter
As a personal experience IOS and Android have done a lot in terms of HTML5 integration..and they are continuing to do it but it is not enough, at least for now...for an example in these platform you can't access:
- camera and than shoot photos (for example no QrCode sorry)
- PIM
- Media
- .. many others things
I don't have any experience on Windows Phone platform.. so I can't say more about that.

Damn, I want to make an HTML5 app
You have some choices:

• if you don't need hardware integration, your app display contents grabbed from a web service.. you can accept UI compromise..performance...and you will package your app inside a WebKit window of a native app.. ok go ahead with your HTML5 app
• choose a platform with HTML5 capabilities: Firefox Mobile OS and BlackBerry OS 10.

I have saw enough things of Firefox Mobile OS to say it is not ready, not interesting and it is in a evolving state.. and more important.. may have a 0% market impact when you will see a firefox phone.
It's simple early for Firefox Mobile OS. Someone said Tizen? Same story there.

BlackBerry is pushing a lot their new platform BBOS10, but first of all, they are believing in you, as a developer: pushing a lot of support on forums and social network.

They can't make mistakes (who really can?) for the new platform release (2013) and they have a real HTML5 support on BBOS10! Read More here
There is a growing community.. so if you choose to develop for HTML5, it is time to choose BBOS10.

Playing with OAuth 2.0: how does it works?

Recently I have started to play with a new mobile platform.
Tipically the things that I do when I have a new platform to learn are:
- read general documentation of the platform
- try to realize an application from scratch with the new platform

Just because the project that I have in mind use OAuth I had the necessity to understand how it works.
Many portal and website  nowadays use this protocol for users authentication.

The idea is based on soundcloud and its api…
If you search on the site you will find a lot of documentation, also library, for  the most famous mobile platform (android and ios) but not a general way on how OAuth should works and how you, as developer, should handle it.
Results from a search on the web show me detailed complicated explanation or specific platform dependent explanations ( for the specific api or platform)

Talk auth2.0
With auth2.0 applications the security of your accounts improves.
A client with OAuth never ask for your username and password, instead, it ask authorization from the server where your account is.
The server (typically a famous service like Facebook,twitter, gmail…) than ask you to login(if you are not already logged) and ask if you would like to authorize the application.
If the user authorize the application the server send back to the application a token, something like a string of numbers and letters.
The application than will store the token locally and use that token for next api request to the service.
Someone can hack the application and get the saved token (it can expire and be invalidated also by the users) but it doesn't have access to your account… so your account still remain safe!

An image is better than thousands words...

simple uhm?
you connect to the credential page asking to the user to login (if it is not already logged) and than authorize the application.
the server than send back a message with a code.
with that code you can ask for a token...and with the token you can finally make api requests.

In the next post, I will show a specific implementation…based on soundcloud api!

Mobile OS: need apps...milions of apps!

Everyone wanna do Mobile OS..Blackberry, Microsoft and many others...are trying to get some space in this giant enviroment... because it is the new revolution and maybe mobile (tablet and smartphones) will replace desktop platform in the future.

For many people, a smartphones or a tablet is enough.
People are starting to prefer to use their phone to access internet: because their phone are faster enough and they have dedicated apps.. designed to be easy.
They provide a better user experience.
People can use their phones, without asking to their geeky friends for any trouble, they reach their scope because phones are easy also to reset.
Desktop PC are powerful but noisy, slow, exposed (virus and many problem) = stress & pain for a simple man.
Smartphones is always with you and it can help you in everyday activities, PC only when available.

The main usage of a desktop pc today is open a browser and go to internet..smartphones are enough for many websites and they can accomplish very well this task...and when they are lucky enough there is always an app for a specific task.
We are part of a revolution that will change how we will get information from the net.

The giants
Mobile world is becoming simple everyday.. IOS and Android are the largest platform out there... with so many downloadable apps.
Microsoft is desperately trying to get in.
Desktop platforms are converging to hybrid solution:

• Apple: new release of OSX contains part of IOS and I thinks one day we will see a unique platform with the best approach of both (with an Apple processor on it). They are driving people slowly to these changes and they are careful. This is the approach that I prefer.
• Google: they haven't got a real operating system for desktop.. they have chrome os.. but it is a sort of an experiment..Android for desktop is not an acceptable solution. I thinks docking stations for connecting monitor to a smartphones are great things but.. how many do you see out there? Google is just waiting... They have the power to start something from scratch tomorrow and fight with others in any moment.. (see google voice vs siri). They wait and see.
• Microsoft: Windows 8 is one of the biggest challenge of MSFT. It's a strict parent of windowsphone. If they are right, they can really change mobile enviroment again. What I think? I thinks Metro is a good UI, at least different from IOS, but it is a mobile UI and not good for a Desktop experience (many wasted space and poor aesthetics...).  I don't really like on a tablet, and I really hate on a desktop.. I thinks we will see windows 7 for a long long time.. It is too soon.. but they have enough money for try..I thinks windows 8 is just there to prepare people to windows 9 learning the mistakes from win8, like MSFT did with xbox 1 for xbox 360 (I hope also Nokia will have the power to follow this..change.. or they will die.).

And the others

• Symbian: adieu.
• Blackberry: a fact, they can't make mistakes or they are out. For me the biggest mistakes of blackberry was to open to teenager market and forget business people. BB should focus on business services and business tasks and make something new. A BB phone today is a toy like any other smartphones out there. BB years ago was a tool for work, that is why business man liked it.
• Opensource world: maemo... meego... Tizen... now some  new Firefox OS. It is just crazy to make a new OS and thinks HTML5 will save the world. I don't believe in these revolutions why? read on.

All you need is apps (papaparapa)
Unless IOS and Android.. what platforms need are apps!
Microsoft is trying to become an interesting ($$$) platform for developers.. but the numbers of IOS and Android are pretty different from windows phone.
MSFT is doing the right thing.. pushing people to write apps for them... but it is not an easy task.
I thinks a mobile developer focus more attention for IOS and Android platform now, than he looks the others  platform.

HTML5 apps will not save anyone... because as a developer you have to pay in performance and platform integration (and testing), and HTML5 is just a new technology. So the gain is not enough.
Anyone needs apps and developer who write apps.. so I don't really now how Tizen, Firefox OS and co... can fight with the market numbers of IOS, Android and Windowsphone.
And apart from the hardware of a phone, people don't care about the os, people care about apps!
We wait and see...