Now android phones are unsafe on the internet

[sulky_uk]

1st there was the iphone now this

http://www.bbc.co.uk/news/technology-13422308

so does that mean my bbc micro sitting unused under the bed is a threat to the nuclear security of the world....

[TeaLeaf]

Yes, immediately wrap yourself completely in tin foil to avoid detection.  They are coming for you.

It was fixed in version 2.3.4 but, suggest Google figures, only 0.3% of Android phones are running this software.

Some Google services, such as image sharing site Picasa, are still using unencrypted authentication tokens that can be stolen, found the team.

They urged Android phone owners to update their device to avoid falling victim to attacks via the loophole.

[kregoron]

Incredible! or just do it indiana jones style, hide in the fridge from the 50's

[Gandalf]

meh, I'm running 2.3.4 so I'm one of the 0.3% :narnar:

[smilodon]

Likewise 2.3.4. Still it's a little worrying now that we're throwing so much of our stuff online or across the internet

Sent from my HTC Desire using Tapatalk

[T-Bag]

I'm on 2.3.3

I don't really use my calendar so that doesn't worry me. If my contacts were to become corrupted it would annoy me, but I've got a backup. I actually see this as a good thing in a way. If phone manufacturers are forced to keep the version of android up to date through scares like this (that don't seem that risky in real life) then it's far better for the average customer.

[Eggbloke]

tokens are sent in plain text over wireless networks

This isn't really new or specific to Android phones. People have been doing this for years.

I'm still on 2.2 and the 2.3.3 update for my phone isn't even ready yet. 2.3.4 is probably going to be another year.

[Gandalf]

Fix coming...
http://www.gsmarena.com/android_security_fix_coming_no_device_update_necessary-news-2666.php

Google is already hard at work to fix the security hole that affects the security of Android apps that sync with servers on the Internet. They have found a way to fix the problem without having to update users’ devices, which is good since 99.7% of devices (all running Android 2.3.3 and below) were affected.

It’s a server-side fix â€" Google will make its servers switch to a secure channel when syncing users’ data. The fix should roll out to Google's servers over the next few days and affect every Android device.

The Contacts and Calendar apps were affected and this fix should make them secure. The Gallery app, which syncs online albums with Picasa, however is and will remain vulnerable after the fix (the Gallery app is developed by a third party). Google is looking into that but didn’t give a timeframe for fixing the Gallery hole.

It’s a good thing Google managed to find a solution that doesn’t require updating the Android devices themselves â€" that usually takes quite a while and some older devices aren’t being updated at all any more.