Mastering Android Privacy & Security

Explore how permissions underpin privacy and security, laying the foundational knowledge for the upcoming sections. Delve into why permissions matter for privacy and security in Android.

Overview of android permissions, their types and permission groups, the permission request workflow, privacy best practices, and strategies to minimize or avoid sensitive requests through disclosure and consent.

Android protects restricted data and actions with install time, runtime, and special permissions, including normal and signature at install time, dangerous level at runtime, and permission groups.

Explore the Android permissions workflow, deciding when permissions are unnecessary, declaring needed permissions in the manifest, and distinguishing install-time versus runtime permissions that require user approval.

Learn about Android manifest, normal versus runtime permissions, and how max SDK version affects storage permission. See a demo of requesting camera permission, handling denial, and degrading gracefully.

Master special permissions for sensitive system resources—like exact alarms, all storage data, or drawing over apps—declared in the manifest, checked via alarm manager or environment, with graceful degradation if denied.

Request permissions only when a feature is needed, explain why via an educational UI, and degrade gracefully while auditing data access and minimizing permissions.

Minimize permission requests by using purpose-built APIs, evaluating location needs (coarse vs precise), and leveraging on-device solutions like photo pickers and barcode scanning that avoid camera and SMS permissions.

Minimize camera permissions by using the activity results contract camera picker to take pictures, store them as URI in the cache, and update the gallery without camera permission.

Present prominent disclosure and consent for sensitive permissions in line with Google Play policy. Show in-app disclosures before requests, explain why, what data, and how, with grant and deny options.

Explore location privacy basics through use cases, learn how to request location permissions aligned with app features, and discover strategies to minimize location usage and permissions.

Explore Android location usage, including foreground and background location, permissions, API 29 requirements, precise versus approximate location, and location updates via the settings client.

Learn how to use background location responsibly in Android apps, including when to request permissions, choose precise or approximate location, declare permissions in the manifest, and understand background update limits.

Explore runtime location permissions, request foreground first, handle approximate versus precise location on Android 12, and request both permissions in a single request to upgrade to precise and background access.

Explore location minimization in Android by using Android 13 nearby Wi-Fi devices permission, the companion device manager API for scans, and favoring coarse location with foreground services for background tasks.

Demonstrates best practices for runtime location permissions, using approximate location, Android manifest setup, and graceful degradation when denied, with a map-focused demo and permission launcher workflow.

Explore how apps should handle data in a privacy friendly way, building on permissions and location privacy to design data access that protects user privacy.

Explore package visibility and its privacy implications, then examine data storage with scoped storage to reduce privacy risks, and discuss device cities and common use cases.

Examine how Android 11 closes the privacy gap with limited and automatic package visibility, and how to request extra visibility via manifest queries, intent filter signature, or provider authority.

Explore common use cases where an app interacts with other apps, using manifest queries to check available handlers for intents like action view, custom tabs, and deep links.

Explore how Android 10's scoped storage gives users control by default, with apps accessing only their external app specific directories and Mediastore API media, unless permissions are requested.

Learn best practices for choosing privacy-friendly identifiers in Android apps, comparing user resettable IDs with hardware IDs, advertising IDs, and Firebase installation IDs, while respecting user consent and policy constraints.

Compare accounts, sim status, subscriptions, and advertising identifiers, and distinguish app set ID from Firebase ID for crash, performance, cross-device installs, abuse detection, and per-device state.

Explore how Android apps should be designed for transparency and user control, detailing what, why, and how permissions and system resources are used.

Audit private user data access with a practical demo, discuss data safety and data collection and sharing guidelines, and explore privacy facing UI elements added in Android 12.

Explore android 11 data access auditing to reveal how apps and dependencies access private data like location, contacts, or microphone via app ops manager callbacks for on, self, and async.

Demonstrates data access auditing in an Android app by logging user location access in the Android manifest via app ops callbacks, attribution tags, and logcat, covering synchronous and asynchronous cases.

Explore data safety in Android apps, detailing how Google Play communicates data collection and sharing to users. Highlight categories like location, personal info, and payments, with permissions and indicators.

Update the data safety section in the Google Play Console to declare data types such as approximate location, personal info, photos, and crash/diagnostics data, and explain collection and processing.

Android 12 introduces three private user interface elements to inform users and control access to sensitive resources, including the privacy dashboard, status bar indicators, and quick settings toggles.

Explore how Android 12 privacy dashboard shows permissions usage, including location, camera, and microphone, with a timeline, data access rationale, attribution tags, and indicators that reveal usage.

Android app hibernation, introduced in Android 11, optimizes storage by clearing the cache and resetting permissions when unused. Reactivation requires regranting permissions and may require rescheduling of jobs and notifications.

Explore Google's Android privacy sandbox to enable privacy preserving personalized advertising without current tracking, as the work in progress evolves through developer previews and platform features.

Explore how the SDK runtime separates the app process from the SDK runtime to reduce data access and tracking, and examine privacy-preserving APIs that support use cases without cross-app IDs.

Discover how the privacy sandbox enforces a secure app sandbox with process isolation for runtime enabled SDKs, introducing privacy preserving APIs and a separate SDK distribution model.

Explore privacy-preserving APIs that keep data on-device, aggregate topics and signals with noise, and enable on-device ad selection, remarketing, and attribution for privacy-friendly advertising.

Explore the core Android security concepts, including kernel security and app security, to understand how the operating system protects privacy.

Explore Android security concepts, from kernel and app sandbox to SELinux, verified boot, rooting, storage encryption, lockscreen protection, inter-process communication, and app signing, including custom permissions.

Explore Android's open, multi-layer security architecture from Linux kernel to apps, including the app sandbox, permissions, and services like Google Play updates and Play Integrity API.

Explore how the Linux kernel provides operating system level security, process isolation, and secure inter-process communication to protect Android apps and user resources in a multi-user Android environment.

Explore the Android app sandbox with a unique linux user ID per app to isolate processes and data. Review discretionary and mandatory access control and data sharing via content providers.

Learn how SELinux enforces mandatory access control through a policy, including allow source target class permissions, to limit access in permissive and enforcing modes, protecting Android apps, data, and logs.

Examine verified boot in Android, tracing the chain of trust from hardware root of trust to boot partitions with dm-verity checks, rollback protection, and warnings for custom or unlocked states.

Examine why rooting Android devices enables debugging and access to hidden API features, and how unlock bootloader, kernel root permissions, SELinux, and Verified Boot constrain or protect data.

Learn how Android kernel storage encrypts user data with symmetric keys, transitioning from full disk to file based encryption, plus metadata encryption, direct boot, and credential versus device encrypted storage.

Learn about android kernel security concepts, including read-only, integrity-protected system partitions and safe boot mode, plus per-app file system permissions that require explicit file sharing.

Explore how Android permissions guard access to system resources, from hidden and signature-protected APIs to runtime requests and a per-app privacy dashboard.

Explore how Android IPC uses binder and messenger with RPC over a Linux driver to enable secure inter-process communication, protected by manifest permissions and explicit intents.

Master app signing and certificate trust to publish updates on Google Play using App Bundle, and implement APK signing schemes v1 through v4 for secure, backward-compatible verification.

Explore additional app security concepts, including the application sandbox, keystore, certificate authorities, authentication, and app verification with Google Play Protect to protect privacy and prevent harmful apps.

Explore how hardware-backed security on Android supports secure storage of data, including cryptographic keys, and review the role of kernel security and app security in enabling these capabilities.

Explore hardware backed security in Android, including trusted execution environment and secure element. Learn how Android Keystore enables authentication via PIN, pattern, or biometrics and supports DRM and identity credentials.

Explore Trusty, a trusted execution environment that isolates the Android OS to protect secret data and cryptographic keys. See how applications run in a trusted kernel with non-exportable keys.

Highlight secure elements as hardware backed storage with their own cpu and tamper resistant components. Discuss strongbox keymaster, key attestation, and android ready se for hardware backed cryptographic keys.

Leverage hardware backed keystore in Android, including trusted execution environment and secure element, to securely generate, store, and use cryptographic keys with authorization tags, attestation, and version binding.

Explore cryptographic key storage and user authenticators that secure keys via Keystore, Gatekeeper, and biometric prompts. Understand enrollment flows and authentication tokens within secure hardware like trusted execution environments.

Explore secure storage and digital rights management schemes for apps, detailing content protection, access control, usage restrictions, and license management through White wine, Pretty Ready, Primetime, and Fairplay.

Demystify cryptography by exploring the fundamentals of symmetric cryptography, establishing a solid foundation for the three sections—symmetric, asymmetric, and hashing—in this Android privacy and security course.

Explore the basics of cryptography, then dive into symmetric cryptography, modes of operation, and detailed walkthroughs of Des, triple Des, and AAS, with Android implementation demos.

Explore symmetric cryptography, including des, triple des, aes, and its key exchange with diffie-hellman, as well as asymmetric cryptography, public keys, digital signatures, and hashing for secure Android data.

Explore symmetric cryptography by examining confusion and diffusion, the avalanche effect, and how DES and AES use substitution, transposition, and permutation with stream and block ciphers.

Explore symmetric cryptography by mastering NIST-defined modes of operation for block ciphers, including ECB, CBC, CFB, OFB, and CTR, with padding and security considerations.

ECB mode uses the same key for every block, making blocks independent and fast for small data, but it reveals patterns with large data, as shown by the ECB penguin.

Explain cipher block chaining (cbc) as a block mode where each block depends on the previous ciphertext and an initialization vector, providing confidentiality and authentication, though it sacrifices speed.

Explain cipher feedback mode, which converts a block cipher to a stream cipher using an initialization vector and s-bit selection to xor with plaintext, for real-time data with no padding.

Learn how output feedback mode turns a block cipher into a stream cipher by encrypting an initialization vector, or nonce, and xoring the result with plaintext; decryption mirrors the process.

Apply counter mode (CTR) for AES encryption and IP security, using a counter input to xor with plaintext, enabling parallelized computation, real-time processing, and pre-processing while keeping counters in sync.

This lecture presents the data encryption standard, a 64-bit block cipher with a 64-bit key in a feistel structure of 16 rounds, providing confusion and diffusion.

Explore how the Data Encryption Standard encrypts a 64-bit plaintext with a 64-bit key through 16 rounds of a Feistel structure, subkey generation, and the mangler, S-boxes, and permutations.

Demonstrates data encryption standard on Android, showing encryption and decryption using ECB, CBC, CFB, OFB, and CTR modes with PKCS5 padding and initialization vector handling.

Examine how the Data Encryption Standard can be cracked, reviewing linear cryptanalysis and differential cryptanalysis, s-box behavior, avalanche effect, and the impractical need for massive plaintext-ciphertext pairs.

Learn about triple des in symmetric cryptography, using three 56-bit keys across three des rounds of encryption and decryption, yielding ciphertext and offering more security than single des, though slower.

Explore triple des encryption and decryption on Android by generating a 24-byte key, selecting modes (including ECB), applying pkcs5 padding or no padding, and initializing ciphers with iv when required.

Master the advanced encryption standard, a 128-bit block cipher with 10–14 rounds and variable key sizes, using substitution, shift rows, and mixed columns to achieve confusion and diffusion.

Explore the Advanced Encryption Standard on Android, covering AES encryption and decryption, block modes (ECB, CBC, CFB, OFB, CTR), key sizes (128/192/256), and padding options (none, PKCS5).

Examine the Advanced Encryption Standard's resistance to brute-force attacks with 128, 192, or 256-bit keys, and how non-linear substitutions, S-boxes, and diffusion ensure strong encryption.