Google has announced that it is implementing a new "quality rating system" for security vulnerability reports submitted as part of its Android and Google Devices Vulnerability Rewards Program (VRP).
Google will rate vulnerability reports as High, Medium, or Low quality based on the level of detail provided in the report.
They are looking for reports to come with:
* An accurate and detailed description
* A root cause analysis
* A proof-of-concept
* A step-by-step explanation on how to reproduce it
* And evidence that shows the type of issue and level of access or execution it achieves
The "highest quality and most critical vulnerabilities" are now eligible for payouts of up to $15,000.
—-
In addition, Google says that, starting March 15, 2023, Android will no longer assign CVEs to "most" moderate severity issues. CVEs will continue to be assigned to critical and high severity vulnerabilities.
Google will rate vulnerability reports as High, Medium, or Low quality based on the level of detail provided in the report.
They are looking for reports to come with:
* An accurate and detailed description
* A root cause analysis
* A proof-of-concept
* A step-by-step explanation on how to reproduce it
* And evidence that shows the type of issue and level of access or execution it achieves
The "highest quality and most critical vulnerabilities" are now eligible for payouts of up to $15,000.
—-
In addition, Google says that, starting March 15, 2023, Android will no longer assign CVEs to "most" moderate severity issues. CVEs will continue to be assigned to critical and high severity vulnerabilities.
Google Online Security Blog
New Android & Google Device Vulnerability Reward Program Initiatives
Posted by Sarah Jacobus, Vulnerability Rewards Team As technology continues to advance, so do efforts by cybercriminals who look to explo...
👍21
Android 14 prepares to let you save an 'app pair' that launches side-by-side in split-screen mode!
In Beta 2, a new launcher flag has been added that, when enabled, surfaces a "save app pair" menu item in the context menu of split-screened apps in the recents overview.
Currently, tapping "save app pair" doesn't work, but when the feature is ready, I'm guessing this will let you add a shortcut to the home screen to launch two apps in split-screen mode.
Samsung & Microsoft already offer this feature in their respective Android forks, but Google implementing it means other OEMs with large screen devices can inherit this feature for their launchers.
I hope this becomes available in time for the Pixel Tablet & Pixel Fold launches!
Google revamped how split-screen works in Android 12 & the OS already internally creates an app pair when you place apps side-by-side in split-screen. That's why you can relaunch split-screened apps from recents. It's just we lacked a way to save this app pair for future launches.
In Beta 2, a new launcher flag has been added that, when enabled, surfaces a "save app pair" menu item in the context menu of split-screened apps in the recents overview.
Currently, tapping "save app pair" doesn't work, but when the feature is ready, I'm guessing this will let you add a shortcut to the home screen to launch two apps in split-screen mode.
Samsung & Microsoft already offer this feature in their respective Android forks, but Google implementing it means other OEMs with large screen devices can inherit this feature for their launchers.
I hope this becomes available in time for the Pixel Tablet & Pixel Fold launches!
Google revamped how split-screen works in Android 12 & the OS already internally creates an app pair when you place apps side-by-side in split-screen. That's why you can relaunch split-screened apps from recents. It's just we lacked a way to save this app pair for future launches.
👍31🔥5❤2
Android's QR code scanner, powered by Google Play Services, is starting to more widely roll out a "scan from photo" button to let you scan a QR code that's within an image in your gallery. Tapping the button opens the Photo Picker.
This feature was first mentioned in the January 2023 Google System Updates changelog as rolling out with version 23.02.23 of Google Play Services. However, I think many users only recently started to see it. (I still don't see it on any of my Pixels).
The QR code scanner Quick Setting tile was added to AOSP in Android 13, and on GMS Android devices, it's powered by Google Play Services. Soon, Pixel phones will be able to access the QR code scanner from a lock screen shortcut as Google showed off at I/O.
The new lock screen shortcut customization feature is part of AOSP so OEMs can enable this experience as well. (The Wallpaper & styles app is proprietary, but the app it's based on, ThemePicker, is in AOSP. Plus the SystemUI-side changes are also in AOSP.)
Screenshot credits: Kieron Quinn
This feature was first mentioned in the January 2023 Google System Updates changelog as rolling out with version 23.02.23 of Google Play Services. However, I think many users only recently started to see it. (I still don't see it on any of my Pixels).
The QR code scanner Quick Setting tile was added to AOSP in Android 13, and on GMS Android devices, it's powered by Google Play Services. Soon, Pixel phones will be able to access the QR code scanner from a lock screen shortcut as Google showed off at I/O.
The new lock screen shortcut customization feature is part of AOSP so OEMs can enable this experience as well. (The Wallpaper & styles app is proprietary, but the app it's based on, ThemePicker, is in AOSP. Plus the SystemUI-side changes are also in AOSP.)
Screenshot credits: Kieron Quinn
👍37❤2
Android 14 will let you navigate between apps when dragging and dropping items, meaning you don't have to have both apps open side-by-side in split-screen mode to be able to move text or images between them (provided the apps support drag-and-drop).
It's kind of clunky to do this on a phone given the limited screen real estate, but I can imagine this being more useful if you have a tablet with a keyboard + mouse attached so you can click & hold on text/images with the mouse and use keyboard shortcuts to switch apps.
Video credits: @nailsad_eleos for @google_nws
It's kind of clunky to do this on a phone given the limited screen real estate, but I can imagine this being more useful if you have a tablet with a keyboard + mouse attached so you can click & hold on text/images with the mouse and use keyboard shortcuts to switch apps.
Video credits: @nailsad_eleos for @google_nws
👍43🔥16❤7❤🔥3😱1
As part of Global Accessibility Awareness Day, Google announced updates to Lookout, Google Maps, Live Caption, Wear OS, and Chrome:
* Lookout is getting an "image question and answer" feature that will process images to provide descriptions of them, useful for when there's no alt text included.
* Google Maps will now show a wheelchair icon when a place has a wheelchair-accessible entrance. This was previously only shown if you opted in to the Accessible Places feature in Maps.
* Live Caption will add a tablet-optimized captions box; expand the Live Caption for calls feature to more devices like the Pixel 4, Pixel 5, select Samsung Galaxy devices, and others; and add support for French, Italian, and German on the aforementioned devices
* Wear OS 4 will include a new text-to-speech experience that is "faster and more reliable"
* Google Chrome on desktop will detect URL typos and suggest websites based on those corrections. This will roll out to mobile in the coming months. Mobile also recently added new functionality for TalkBack users to make it easier to manage and organize tabs. TalkBack users will have access to a tab grid instead of the old tab list view, complete with features like tab groups, bulk tab actions, and reordering.
* Lookout is getting an "image question and answer" feature that will process images to provide descriptions of them, useful for when there's no alt text included.
* Google Maps will now show a wheelchair icon when a place has a wheelchair-accessible entrance. This was previously only shown if you opted in to the Accessible Places feature in Maps.
* Live Caption will add a tablet-optimized captions box; expand the Live Caption for calls feature to more devices like the Pixel 4, Pixel 5, select Samsung Galaxy devices, and others; and add support for French, Italian, and German on the aforementioned devices
* Wear OS 4 will include a new text-to-speech experience that is "faster and more reliable"
* Google Chrome on desktop will detect URL typos and suggest websites based on those corrections. This will roll out to mobile in the coming months. Mobile also recently added new functionality for TalkBack users to make it easier to manage and organize tabs. TalkBack users will have access to a tab grid instead of the old tab list view, complete with features like tab groups, bulk tab actions, and reordering.
👍19
Mishaal's Android News Feed
As part of Global Accessibility Awareness Day, Google announced updates to Lookout, Google Maps, Live Caption, Wear OS, and Chrome: * Lookout is getting an "image question and answer" feature that will process images to provide descriptions of them, useful…
Live Caption is available to OEMs that preload the Android System Intelligence app provided by Google.
Google currently offers two versions of ASI to OEMs: Private Infrastructure and Private Features. Both have the same package name but provide different capabilities.
Private Infrastructure includes Speech Recognition Service, text classifier, and keyboard suggestions.
Private Features includes all the above plus app suggestions, screen attention, and live caption.
Devices that preload Private Infrastructure declare com.google.android.feature.ASI_MINIMAL, while devices that preload Private Features declare com.google.android.feature.ASI.
Preloading Private Features is optional, while preloading Private Infrastructure is required for all 4GB+ RAM devices running Android 13+.
373 device models declare com.google.android.feature.ASI, so quite a few Android devices should have access to the Live Caption feature!
Google currently offers two versions of ASI to OEMs: Private Infrastructure and Private Features. Both have the same package name but provide different capabilities.
Private Infrastructure includes Speech Recognition Service, text classifier, and keyboard suggestions.
Private Features includes all the above plus app suggestions, screen attention, and live caption.
Devices that preload Private Infrastructure declare com.google.android.feature.ASI_MINIMAL, while devices that preload Private Features declare com.google.android.feature.ASI.
Preloading Private Features is optional, while preloading Private Infrastructure is required for all 4GB+ RAM devices running Android 13+.
373 device models declare com.google.android.feature.ASI, so quite a few Android devices should have access to the Live Caption feature!
👍18👏1
Android 14's platform Credential Manager supports multiple password managers simultaneously and lets third-party managers save and retrieve passkeys.
When Android 14 launches, 1Password, Dashlane, Keeper, and Okta will support Credential Manager (ie. passkeys on Android).
On Android 13 and lower, the Credential Manager is backed by Google Password Manager - which is part of Google Play Services.
Credential Manager supports passwords on Android 4.4+ but passkeys only on Android 9+, according to the documentation.
Source: How to reduce reliance on passwords in Android apps with passkey support (Video on YouTube)
When Android 14 launches, 1Password, Dashlane, Keeper, and Okta will support Credential Manager (ie. passkeys on Android).
On Android 13 and lower, the Credential Manager is backed by Google Password Manager - which is part of Google Play Services.
Credential Manager supports passwords on Android 4.4+ but passkeys only on Android 9+, according to the documentation.
Source: How to reduce reliance on passwords in Android apps with passkey support (Video on YouTube)
❤🔥22👍8
Hands-on: I finally got this fully working, so here's a full demo of Android 14's new partial screen recording feature.
This feature lets you record a single app without any System UI elements or notifications appearing in the video! A useful feature to have when you need to screen record something to share with others!
(In the app selector dialog, you can swipe up to show the full app list. You can also swipe left or right on the carousel to show more apps from your recents app list.)
EDIT:
If you leave the app you selected to record, then Android will continue screen recording but the content will be black. If you open the app again, the contents will once again be captured in the same recording.
The recording doesn't end unless you swipe down and end it manually.
This feature lets you record a single app without any System UI elements or notifications appearing in the video! A useful feature to have when you need to screen record something to share with others!
(In the app selector dialog, you can swipe up to show the full app list. You can also swipe left or right on the carousel to show more apps from your recents app list.)
EDIT:
If you leave the app you selected to record, then Android will continue screen recording but the content will be black. If you open the app again, the contents will once again be captured in the same recording.
The recording doesn't end unless you swipe down and end it manually.
🔥59❤🔥10👍8❤3🥰2👏2
Android 14 Beta 2 continues to improve on the "app cloning" feature I first revealed in DP1. A new launcher flag called ENABLE_APP_CLONING_CHANGES_IN_LAUNCHER has been added that, when toggled, hides cloned apps from the work profile tab, as illustrated below.
However, the home screen icons are still not differentiated yet, even though in Settings, the cloned apps have a unique icon badge. This will hopefully be remedied in a future build!
For more details on this in-development app cloning feature, refer to this article.
However, the home screen icons are still not differentiated yet, even though in Settings, the cloned apps have a unique icon badge. This will hopefully be remedied in a future build!
For more details on this in-development app cloning feature, refer to this article.
❤🔥30👍14❤5👏1
If your app uses the SafetyNet Attestation API, heads up that the deprecation timeline has been adjusted!
Now, you have until the end of January 2024 to migrate to the Play Integrity API. If you migrate by then, SNet Attestation will continue to work on older versions of your app.
SNet Attestation will fully stop working at the end of January 2025.
Visit this page to see the full SafetyNet Attestation deprecation timeline.
Now, you have until the end of January 2024 to migrate to the Play Integrity API. If you migrate by then, SNet Attestation will continue to work on older versions of your app.
SNet Attestation will fully stop working at the end of January 2025.
Visit this page to see the full SafetyNet Attestation deprecation timeline.
👍16
Mishaal's Android News Feed
Android 14 is adding a new safety feature to protect your hearing: Headphone loud sound alert. Android will alert you if you've been listening to audio at a volume above the recommended level for long periods over your headphones. You can keep listening…
This feature is indeed live in Android 14 Beta 2! User Nick Cipriani shared this image from their Pixel. Oddly, they received this message while playing audio from their Bluetooth speaker and not headphones.
👍41👎4
If you connect a physical keyboard to a large screen device running Android 14, under Settings > System > Keyboard > Physical keyboard, the "keyboard shortcuts" menu will now show a MUCH more comprehensive list of available keyboard shortcuts, as shown above!
The more comprehensive list of keyboard shortcuts only appears on large screen devices, and it was added in Android 14 Beta 2. On phones/earlier versions of Android, the keyboard shortcuts dialog contained much fewer items.
This is one of several improvements Google is making in Android 14 to improve the use of physical keyboards + trackpads, as I previously talked about in this article.
The more comprehensive list of keyboard shortcuts only appears on large screen devices, and it was added in Android 14 Beta 2. On phones/earlier versions of Android, the keyboard shortcuts dialog contained much fewer items.
This is one of several improvements Google is making in Android 14 to improve the use of physical keyboards + trackpads, as I previously talked about in this article.
👍37
Google has added a new Vulnerability Reward Program (VRP) called the Mobile VRP that focuses on its first-party Android apps.
Security researchers that disclose qualifying vulnerabilities impacting Android apps developed or maintained by Google can be rewarded depending on the type of vulnerability, the scenario in which the vulnerability can be exploited, and the importance of the app that's affected.
Full details on the new Google Mobile VRP can be found here.
Security researchers that disclose qualifying vulnerabilities impacting Android apps developed or maintained by Google can be rewarded depending on the type of vulnerability, the scenario in which the vulnerability can be exploited, and the importance of the app that's affected.
Full details on the new Google Mobile VRP can be found here.
👍20🔥11
A few days ago, I asked y'all (on Twitter) if you've enabled Android's Themed Icon feature and which apps haven't implemented it. Some of you recalled that Google is working on a feature to generate a themed icon for ANY app.
How good is the forced Themed Icon feature? Here's a comparison!
Okay, so first of all, attached to this post is an image showing the apps I'm working with. On the left we've got apps that support the Themed Icon feature (ie. they supply a monochrome icon). On the right we've got apps that don't support the feature.
For this little experiment, I applied 3 different wallpapers and noted what the background & foreground colors of each icon should be. (I looked at Launcher3's source to find out exactly which R.color values it pulls from to theme icons.)
Attached to this post is an image showing what it looks like when you theme icons of apps that DO supply a monochrome icon. As expected, it looks fine because the developers themselves created a monochrome icon rather than an algorithm doing it.
Also attached to this post is an image showing what it looks like when Android generates a monochrome icon for apps that don't supply one, ie. forcing themed icon support. I'll let you be the judge about whether this is shippable.
How good is the forced Themed Icon feature? Here's a comparison!
Okay, so first of all, attached to this post is an image showing the apps I'm working with. On the left we've got apps that support the Themed Icon feature (ie. they supply a monochrome icon). On the right we've got apps that don't support the feature.
For this little experiment, I applied 3 different wallpapers and noted what the background & foreground colors of each icon should be. (I looked at Launcher3's source to find out exactly which R.color values it pulls from to theme icons.)
Attached to this post is an image showing what it looks like when you theme icons of apps that DO supply a monochrome icon. As expected, it looks fine because the developers themselves created a monochrome icon rather than an algorithm doing it.
Also attached to this post is an image showing what it looks like when Android generates a monochrome icon for apps that don't supply one, ie. forcing themed icon support. I'll let you be the judge about whether this is shippable.
👍21🌭3🍌2