Originally Posted by
pranav rai That assumes that giving API access to files and directories to arbitrary apps is a good thing. From the point of view of security, thats a cardinal sin.
The whole spectrum of computer users requires multiple apps to access the same files, from the most casual users (take photo on camera, upload in browser, attach to email) to professionals in the FBI or CIA. Cardinal security sin indeed. SOME users can get by with a phone that cannot do this, if they use other OSes for anything non-trivial. Then the phone is just a multifunction device with apps that cannot work together.
You are now letting a third party app acess data from another app, who might not have encrypted it on the ROM - thats where security nightmares begin.
Either an app intends data to be private, in which case it should put the data somewhere private (isolated storage), or it intends the data to be public, in which case it should put it somewhere public.
Openness can be employed along with secirity, but that is a two pronged effort - MS has to provide additional API's and programmers actually have to use good practices to store data and the like.
This I agree with. There is no need to compromise.
It's quite easy to get apps to avoid saving data to public places except when intended.
E.g. just ask for user confirmation before writing any file outside isolated storage.
Hello to everyone.
CSMR250 and emhemed farhat like this.03-17-2014 07:14 AM
