-
After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.
Root Does Rooting make the phone any less secure?
- Thread starter clokwork
- Start date
-
- Tags
- htc droid incredible
Root will cause your phone to ask for super user permissions. What the Superuser app does is log those apps you allow to have su access so that they don't have to re-ask again each time you use them. The best advise for people who root is very simply to pay attention because when the phone does not do all the work of protecting itself then you have to take some responsibility.
wayrad
Android Expert
There was a thread around here recently describing how some apps store passwords in clear text, which might make that information accessible to a rogue app with superuser permissions (if I understood it correctly). One of the listed apps using clear text was the stock HTC mail app. I switched to K9 Mail pretty quickly after that. 
There was a thread around here recently describing how some apps store passwords in clear text, which might make that information accessible to a rogue app with superuser permissions (if I understood it correctly). One of the listed apps using clear text was the stock HTC mail app. I switched to K9 Mail pretty quickly after that.
Good post. Actually, I could see where this could be an issue whether you are rooted or not.
wayrad
Android Expert
IIRC the passwords are in a file that isn't accessible to other apps if they don't have superuser permission, so there isn't any danger unless you're rooted.
Here's the thread:http://androidforums.com/incredible...-passwords-stored-clear-text.html#post1617095
I had seen this but not read it carefully. Thanks. I would think it would be useful to add this link too for people's info as well:
Thread on some of the apps that store passwords as clear text and are accessible when rooted.
wayrad
Android Expert
From the comments in that link, it looks like the stock email app may not have the problem on the Incredible? Oh well, I still like K9 better...
Thank you!
I follow you so far but with another question. If I am rooted and want to install an app, I am assuming that it is going to show me the permissions that the app requests before installing. Is that correct?
If so, are you saying that some apps might try and ask for Super User permissions?
wayrad
Android Expert
The "one-click" Unrevoked method automatically installs the Superuser app. You'll get a request each time an app wants superuser permission, unless you authorize it to not have to ask every time. The Superuser app also lists the apps that have been granted permission, and you can have it put a hash mark in your notification bar when an app is using its permission.
I don't see superuser permissions listed for individual apps when I look at permissions in the usual way - I suspect Google didn't take that into account when setting up the system of posted permission requirements. Usually you know because an app description says it requires root.
Yes, if an app does not require root, it will not ask for su permissions. No need.
sdrawkcab25
Extreme Android User
In what aspect? It being rooted doesn't give the stealer access to any more info than if it wasn't rooted. Always best to secure your phone with a good pin and install a security app that allows remotely wiping your phone (lookout, AVG etc ) if you are concerned of sensitive data on your phone.
jake.ashford
Lurker
Always a valid concern. As someone who has experienced 2 laptop thefts in my lifetime, I would seriously caution any user to consider the consequences of storing sensitive information on a portable device.
I'd recommend keeping sensitive data stored on one machine and keep it encrypted (preferrably a desktop).
I understand it is convenient to use mobile banking apps, etc from portable device like a smartphone, but it's so easy to have something as small as a phone or tablet become lost or stolen. My personal philosophy is DON'T DO IT...if you can live without that stuff on your portable then avoid it and you have less to worry about.
If someone has physical access to a device and are savvy, they can get your data. And who knows how much time they've had the device before you discover the theft and initiate a remote wipe.
If they could manage to load something like clockwork recovery, then AVG, lookout, screen locks, etc.. all become a moot point. They could use clockwork to dump a backup of your whole device. Encrypting your data would be a better route than relying on easily defeated security like a screen lock.
Rooted or unrooted, if you're going to store sensitive info or engage in risky activity, then you have to be extremely diligent. Forget to encrypt one file and you're at risk. Regardless of the what type of device it is.