Just going by the numbers, it’s a pretty safe bet that most Hackaday readers own an Android device. Even if Google’s mobile operating system isn’t running on your primary smartphone, there’s a good chance it’s on your tablet, e-reader, smart TV, car radio, or maybe even your fridge. Android is everywhere, and while the development of this Linux-based OS has been rocky at times, the general consensus is that it seems to have been moving in the right direction over the last few years. Assuming your devices actually get the latest and greatest update, anyway.
So it’s not much of a surprise that Android 11, which was officially released yesterday, isn’t a huge update. There’s no fundamental changes in the core OS, because frankly, there’s really not a whole lot that really needs changing. Android has become mature enough that from here on out we’re likely to just see bug fixes and little quality of life improvements. Eventually Google will upset the apple cart (no pun intended) with a completely new mobile OS, but we’re not there yet.
Of course, that’s not to say there aren’t some interesting changes in Android 11. Or more specifically, changes that may actually be of interest to the average Hackaday reader. Let’s take a look at a handful of changes and tweaks worth noting for the more technical crowd.
Improved Availability
Perhaps the biggest change for Android 11 is the fact that more people will actually get it on day one. In the past you’ve always had to have a Pixel or Nexus device to get a fresh build of Android on release, and even then, it was often a staged roll out. But this time around, not only are all the Pixel devices getting it immediately, but so will phones from other manufactures. Well, some of them anyway.
Google says that in addition to their own phones, Android 11 will begin popping up as an update for select OnePlus, Xiaomi, OPPO and realme phones. Obviously there are some very big names missing from that short list of partnered companies, but at least it’s a start. While in general a good thing for the larger Android community, it’s worth noting that this is actually taking something away from the Pixel’s list of elusive features. Combined with the surprisingly low price of the recent Pixel 4a, this could be a sign that Google’s losing interest in trying to develop their own “flagship” phone and would rather focus on pushing the Android ecosystem forward.
Aggressive Permission Controls
Android has always been ahead of the curve in terms of how applications were granted permissions, with even the earliest versions of the operating system indicating what parts of your device each app was designed to interact with. Later, Google added the ability to selectively revoke these permissions after the software was installed. So if you decided down the line that a particular program had no business checking your location or turning on your microphone, you could turn access to those systems off.
![](https://hackaday.com/wp-content/uploads/2020/09/android11_permissions.jpg?w=400)
In Android 11, Google has taken that concept even farther. Now you can chose to grant permissions to an application on a one-time basis instead of permanently. This will be especially useful for software that you might only use once or twice, such as the configuration tool that each new piece of smart home gadgetry invariably requires you to download to complete the initial setup.
What’s more, application permissions will now expire if you haven’t used the application in awhile. Google isn’t clear on how long it actually takes, but eventually the OS will reset all the permissions for an application that hasn’t been started recently.
The next time you open the application, it will ask you to confirm the permissions it requires as if it had just been installed. On the whole, this will help reduce the attack surface of your device, meaning that only your most commonly used (and presumably, most trusted) applications will have active permissions at any given time.
Centralized Smart Home Devices
Speaking of those per-device applications that have regrettably become the norm with smart home products, Android 11 attempts to improve the situation somewhat by automatically collecting all the smart gadgets detected on the network and putting their controls on a single screen. When pressing the power button, you’re now greeted with a configurable array of the smart home products that Android has sniffed out. With just a tap on this screen, you can turn things on and off without having to dive into each gadget’s respective applications.
Naturally, there are some caveats. You’ll still need to complete the initial setup of new products with their manufacturer-supplied applications, perhaps making use of that one-time permission feature, and of course the devices need to be supported by Google’s own ecosystem for them to show up.
Native Screen Recording
This one might not seem like a big deal at first glance, especially since there’s already been plenty of screen recording applications available for Android. But now the feature is baked right into the OS without the need to download anything separately.
Both your device’s audio and video can be recorded with a tap of the “Screen Record” icon in the quick settings menu. There’s even an option that will toggle visible screen touches, so that viewers seeing the video will know where you were tapping.
With more and more projects including a mobile phone component, this feature could be a boon for documentation. If you’re using an Android application or even a mobile-targeted website as part of your project, the native screen recording capability and tap visualization will let you easily produce step-by-step instructions and walk-through videos without having to resort to some ad-ridden app from the Play Store.
Videos created with the built-in screen recorder are dropped in the “Movies” directory of your device’s storage partition, and according to ffmpeg
are encoded as exceptionally high bitrate (~27,000 kbps) H264.
Exposure Notification API Changes
As we covered in the past, Google has been working behind the scenes to push a new contact tracing API into the majority of Android devices in response to the COVID-19 pandemic. In Android 10 and below this was silently distributed through a Google Play Services update, and required your device’s Location service to be enabled. But on Android 11, things are a little different.
The Exposure Notification API is now fully integrated into the OS and is ready to go as soon as the device boots up. Further, Google says they have tweaked how the API works so that it no longer allows apps to request your Location data. In turn, that means it doesn’t require the Location service to be enabled. On the positive side, it makes good on the privacy promises of the API framework. Undoubtedly some will see this as a negative, as it makes selectively disabling contact tracing more difficult.
While there’s still plenty of debate about how effective these systems are, it seems Google isn’t giving up the fight.
Android or Bust
While there might not be any huge changes to the OS in Android 11, it does have enough little tweaks that seem like they add up to a solid update. Of course it’s too soon to see what the downsides are, as it will take a week or so before any particularly egregious bugs bubble their way to the surface. In that case, perhaps being in the second or third wave of users to get the latest update isn’t such a bad thing.
At this point, we’re all pretty much stuck with Android. The only serious alternative is iOS, and we won’t even get into why that system is at odds with the hacker ethos. While we’d all like to see a fully free and open source mobile operating system (Linux based or otherwise), the reality is that there just aren’t any serious contenders on the horizon. As impressive as projects like postmarketOS are, nobody is under the delusion that they are going to eat up any appreciable market share.
So if we’ve got to live with Android for the foreseeable future, let’s at least hope Google stays the course and produces more updates like this one. It might not be perfect, but it’s getting better.
“As we covered in the past, Google has been working behind the scenes to push a new contact tracing API into the majority of Android devices in response to the COVID-19 pandemic.”
Only fools would trust Google to protect their private life.
Now the Covid app API can get the location while other’s can’t?
So read it as: Google gets your location always even if blocked for all apps?
You are mis-reading. Of all of the
spywearapplications on your phone, COVID apps should be actually denied location info. It’s everything else that’s untrustworthy. Refuse location info if you don’t want your location info known.Or indeed any 3rd party company.
It is always a Faustian pact. They provide services, we pay in data about ourselves, family etc. Any company that says that it is not using the data you provide for its own purposes is lying. However if you accept that fact, and you have some measure of control on the data they can access, it is not the worst evil in the world. We complain that they use our data, but expect things like google maps to be provided free. You cannot have both.
Actually you can. If you don’t like it, ditch your mobile phone and kill the internet to your house, you will get total privacy, but you may find some disadvantages.
Just follow the safe practice guidelines for coronavirus, and everything will be fine.
https://pbs.twimg.com/media/EgNCgXsXkAEum3k?format=jpg&name=900×900
As it turns out, the COVID-19 exposure notification API (which wasn’t just Google, it was jointly developed with Apple too), doesn’t use GPS at all.
In fact, there’s no actual location data at all, it uses basically uses random UUIDs and cryptographic signatures (AES) to exchange keys over BLE to log contact with nearby phones. Of course, because the system uses public/private keys, you can never track what phone you come in contact with (since you get a randomized unique ID from the other phones).
It’s all pretty neat actually: https://en.wikipedia.org/wiki/Exposure_Notification
“The only serious alternative is iOS, and we won’t even get into why that system is at odds with the hacker ethos. While we’d all like to see a fully free and open source mobile operating system (Linux based or otherwise), the reality is that there just aren’t any serious contenders on the horizon.”
I consider https://grapheneos.org/ a game changer. Android with privacy and security in mind. The system only applies to Pixel phones (yet?) but I hope to see the community grow.
GrapheneOS and the closely related CalyxOS (which is less secure but more usable)
I’ve been using Sailfish devices exclusively for five or six years.
I don’t care about the “latest and greatest” hardware, so it has been great for me. Currently using a Sony Xperia XA2 Ultra with the officially licensed Sailfish X release. Frequent updates, CVE patching, sensible Linux running Wayland, dbus and systemd.
Aside from a Purism Librem 5 (or maybe the PinePhone?), it’s about as good as it gets for the privacy-conscious… at the moment.
Bonus: if you need something that isn’t natively available on Linux — or isn’t already available in the official and third-party repositories — you can run Android apps in a sandboxed VM, which actually works exceptionally well.
It’s not for everyone, obviously, but I’ve been happy with it.
I love hacking as much as the next guy or gal, but I don’t need my phone to be the device I hack, and I don’t trust Google with so much of my data since I’m a libertarian christian from flyover country. Don’t get me wrong… I’m all about Open Source Ethos and I DEFINITELY am on the right to repair train, but I just choose not to get off at the Google stop.
So who did you choose to give all your personal data to?
I believe Apple makes their money by device sale rather than data. I’m interested in GrapheneOS after reading about it today, but for now given my available choices, I’d rather give my data to Apple than Google.
“I don’t need my phone to be the device I hack,”
My phone is the one device that is always with me. The more things I can make it do the better because my desktop and even my laptop are probably sitting at home. That makes my phone the number one most important device for me to be able to hack.
With cheap bluetooth serial modules my android phone can easily be the control panel for any and every “with an arduino” project I ever make. I could download Android studio for free and build control apps. There are several already out there however that allow one to almost effortlessly just drag controls around and then specify what string gets sent over the serial connection when that control is pressed.
iPhones don’t even support bluetooth serial protocol. Even if I did buy a Mac and subscribe to their fruity club just to get the ability to write apps for it the hardware wouldn’t allow this.
Mostly true. IOS does support BLE which you can implement with a number of embedded platforms including Arduino. You can also of course do WIFI sockets. I even did a project for an election company where I interfaced an ESC POS printer with an Arduino simulating a keyboard to the iPad. I sent raw data using their MIDI protocol and then the Arduino translated it to ESCPOS. It was even powered over USB.
Things can be done, but I agree it’s a little more effort. My favorite is just using Bonjour with wifi on the same network, once you have a socket open, bob’s your uncle.
That’s just a JOKE… Please wake me up!
Google is putting pressure on all **other** apps, but they can’t even bother fixing their own sh.t. Try to deny access to your location or your “health data” for Google Play Service, and it’ll pop up every 5 mn asking you for that permission (which it doesn’t need, since, if you refuse it, it’ll work anyway). So, what they are actually doing is destructing any other competition so the competitor are seen as more painful to use. Sure you can give permission once to an app, and you’ll forget about it. Yet, if you need to give permission again to some app, it’ll appear as a PITA compared to the “native” googl equivalent.
Of course there are all of the Linux based systems being developed for the PinePhone as an alternative.
I’d love to have a good Linux based phone OS that works just like a good desktop with GNU & X (not Wayland please!) on top of Linux. But I also want a compatibility layer that allows it to run Android apps because there is just too much out there. Maybe eventually Anbox will be up to that task?
Why do you want to put the security disaster called X Windows on a “secure”:device? They are never going to fix it.
If you’re willing to give Wayland a go, Sailfish X already does what you want. See my other comment further up the chain.
tl;dr
Google has an update to Android, your privacy is still screwed.
Android 10 already ahs native screen recording. I use it on my S9+ all the time.
Samsung may have baked screen recording into their version of Android, but it hasn’t been in the core OS before this.
Yep, my Doogee s60 had screen recording baked in to Android 7. Just got the Pixel 4a and it’s absent in Android 10.
Apple – use our super friendly phones, we are the only people that really know what you need, we are the good people, you need to trust our gold cage, it is so fine and really beautiful.
Alphabet – use our android operating system, we will be watching you, every step you make, every breath you take, every word you say, we will be watching you. But purely to get to know what you like better (think of use like an obesessive girlfriend/boyfriend), so that we can help you to buy buy buy. But we will never sell your metadata, that is ours to keep.
Hackaday readers: I wonder can I get a cheap phone module that just does SMS, data and voice. Maybe I could 3D print a keypad. The design must have a 555 in it (for the ringtone) and maybe an Arduino :)
Throw a few spare op-amps in it and it’s be perfect!
Its OK. ORACLE will own Android soon enough! 🤣🤣
Voluntary contact tracing. A wet dream for government. How do you alibi ” Yes I was there, but not involved.” Damn close to electronic DNA.
I just Googled “Non-Google phones”
and the first one displayed is the Google Pixel 4!
LOL!
Non [with] -google
might olay as a double negative..
😶🙄😏
I just got the Pixel 4a the day before 11 was pushed out to Pixel devices. I spent hours unlocking, trimming my SIM card, rooting, and setting everything up how I like it. The next morning, 11 was pushed out without any permission on my end and it simply said some updates had been installed and I should reboot. I rebooted and bam. Root is gone. 11 hasn’t been rooted yet, so back to 10 I go. Re-download factory images, extract boot.img, patch, fastboot, reset up everything again, and this time I found the setting for preventing auto updates to the OS.
What I’m worried about is that setting to prevent updates is hidden away in the developers’ menu. That’s not necessarily a problem if you know the menu exists. If you don’t, this is very Apple/Windows10 like behavior. I hope Google doesn’t go full moron and take out the ability to stop system updates. Then it really will be time to dump Google 100%. Once 11 is rooted, I will probably update just for the built in screen recording, but that’s really the only feature that catches my attention. It seems like they were a little premature on the version number jump. If you only get a couple big updates per device “lifetime” then I feel like this one was wasted.
The contact tracing seems fine with me, but I am a little worried about the smarthome integration.
We need open standards that work without any cloud APIs whatsoever, not more proprietary stuff.
With the way things are going, it seems like Google could say “Oh, we don’t like how your light bulb sends it’s analytics to China so we’re disabling it” or “Oh, turns out your microwave could spy on you if someone has physical access to it, gotta buy a new one”.
The smarthome should be open, local, and standardized, and no manufacturer should be be able to remote brick or kick things off the system.
got a chuckle out of seeing that this release, like the other ones, improves performance on low-end phones. after so many compounded improvements on low-end phones, they must be pretty fast by now!