Why Android App Security Is Better Than for the iPhone

By Katherine Noyes, PC World

Application security has become the focus of a flurry of intense attention in the mobile world lately, due largely to a few well-publicized events affecting each of the major platforms.

On the iPhone side, of course, there's the JailbreakMe tool, which unlocks the device's operating system in a way that could potentially be emulated by malicious applications.

On the Android side, it's been the case of the data-accessing wallpaper apps--which, it turns out, did not do anything to put users at risk after all.

Transmission security, meanwhile, has given the Blackberry platform its own share of the limelight in data-monitoring nations.

Yet, while it's clear no mobile platform has perfect security--nor is that even possible--Android has a number of compelling advantages that make its apps inherently safer than those for the iPhone.

1. Application Permissions

On the Linux-based Android platform, each application runs in a separate "silo," unable by default to read or write data or code to other applications. Associated with each isolated application is a unique identifier and a corresponding set of permissions explicitly governing what that particular application is allowed to access and to do.

As a result, much the way Linux users typically don't have "root" privileges with the associated power to do systemwide harm, so Android apps by default are limited in a similar way. Just as Linux minimizes the damage that could be done on the desktop by a virus affecting an individual user, in other words, so Android restricts the potential damage that could be done by a rogue application.

In order for any data to be shared across Android applications, it must be done explicitly and in a way that informs the user. Specifically, before installation can even happen, the app must declare which of the phone's capabilities or data it will want to use--the GPS, for example--and the user must explicitly grant permission to do so. Those wallpaper apps, it should be noted, were no exception. So, if a user sees upon installation that a simple wallpaper app is requesting access to her list of contacts, say, there's probably reason to think twice before proceeding.

On the iPhone, on the other hand, it's a different story. All apps are considered equal and can access many resources by default, and without having to tell the user. So, while on Android you'll be able to see that a malicious app is suspicious the moment you try to install it, on the iPhone iOS, you'll have no idea--potentially until the harm is done.

2. App Markets

Whereas Android puts the user in control of evaluating an application's requirements before it installs, Apple keeps that control for itself. Instead, like an overprotective parent, it insists on approving each and every application before it can be offered up for sale in the App Store--part of its strategy of maintaining the iPhone platform's "walled garden."

In the Android Market, of course, there are no such restrictions--again, it's up to users to evaluate the apps they buy upon installation.

While some view Apple's approach as the safer one for users, the opacity of its process makes it unclear what, exactly, the company checks on incoming applications. Given the sheer number of new apps written every day, it seems unlikely that Apple--or any company--could do more than simply verify the developer's identity and make sure the app does what it promises to do. It would also be easy for any developer to add malicious code after an app has been approved.

Either way, there's no doubt that plenty of apps that Apple had vetted later were found to have vulnerabilities. Just recently, security research firm Lookout found that applications on Android are generally less likely than those for the iPhone to be capable of accessing a person's contact list or retrieving their location. It also found that nearly twice as many iPhone apps can access the user's contact data.

3. Openness

Although the Android platform isn't as open as many would like it to be, there's no denying that it is far more open than Apple's iPhone platform is. Among the many benefits of that openness is that the code underlying the platform is available for scrutiny by users and developers the world over. I don't care how many people Apple's team has; there's no way their number could compete with that. The result? More "eyeballs" studying the code means problems are caught more quickly.

In this era of transparency and participation, I believe that openness and user control are what's needed in the rapidly expanding mobile world. No single company, however capable it might be, can protect users from everything. Nor, indeed, should any single company be entrusted with such a responsibility. The far better approach is to give users a way to play a role in monitoring security themselves, and that's just what Android does.