The security team in Google’s Android division is also trying to mitigate the privacy risks posed by app sensor data collection. Rene Mayrhofer is an Android security engineer in Austria at Johannes Kepler University in Linz. He and his colleagues are keeping tabs on the latest security studies coming out of university labs.

Question

But just because someone has a successful prototype of a new smartphone-security system doesn’t mean it will show up in future phone updates. Android hasn’t incorporated any of these proposed sensor safeguards yet. That’s because its security team is still looking for the right balance. The team wants to restrict access for nefarious apps but not slow or degrade the functions of trustworthy programs, Mayrhofer explains.

“The whole [app] ecosystem is so big,” he notes. “And there are so many different apps out there that have a totally legitimate purpose.” Any kind of new security system that curbs an app’s access to the phone’s sensors, he says, could pose “a real risk of breaking” legitimate apps.

Tech companies may also be reluctant to adopt more security measures. Why? These extra protections can come at the cost of user friendliness. (AWare’s additional permissions pop-ups, for instance.)

Mani Srivastava is an engineer at the University of California, Los Angeles. There’s always a trade-off between security and convenience, he says. “You’re never going to have this magical sensor shield [that] gives you this perfect balance of privacy and utility.”

But phones are relying on ever more — and more powerful — sensors. And algorithms for analyzing their data are becoming more wise. Because of this, even smartphone makers may eventually admit that the current sensor protections aren’t cutting it. “It’s like cat and mouse,” Al-Haiqi says. “Attacks will improve. Solutions will improve.” Then more clever attacks will emerge. And security teams will engineer still more clever solutions. And on and on it goes.

The game will continue, Chakraborty agrees. “I don’t think we’ll get to a place where we can declare a winner and go home.” Why won't tech companies put available security measures in place?

They would negatively impact a user's experience with their phone.

There is no guarantee that the security measures would protect users.

The tech companies benefit from user's information being stolen.

The tech companies don't want to admit that their phones are invasive.

Answer 1

The reason tech companies may be hesitant to implement available security measures is primarily due to the fact that these additional protections can negatively impact a user's experience with their phone. Enhanced security measures often come with added complexity, such as more frequent permissions pop-ups or restrictions that could disrupt the functionality of legitimate apps. This trade-off between security and convenience (as noted by Mani Srivastava) makes companies cautious about adopting measures that may deter users from enjoying a seamless experience with their devices.

In summary, the main reason is:

They would negatively impact a user's experience with their phone.