i18n/i18n/ja/os/android-overview.md

title, icon, description

title	icon	description
Androidの概要	simple/android	Androidは、強力なセキュリティー保護機能を備えたオープンソースのオペレーティングシステムであり、携帯電話に関する最も優れた選択肢です。

{ align=right }

Androidオープンソースプロジェクトは、アプリ・サンドボックス、確認付きブート（AVB）、権限管理システムを備えた安全なモバイル・オペレーティングシステムです。

私たちのアドバイス

Androidディストリビューションの選択

When you buy an Android phone, the default operating system comes bundled with apps and functionality that are not part of the Android Open Source Project. Many of these apps—even apps like the dialer which provide basic system functionality—require invasive integrations with Google Play Services, which in turn asks for privileges to access your files, contacts storage, call logs, SMS messages, location, camera, microphone, and numerous other things on your device in order for those basic system apps and many other apps to function in the first place. Frameworks like Google Play Services increase the attack surface of your device and are the source of various privacy concerns with Android.

この問題は、そうした強制的な統合を伴わない、カスタムAndroidディストリビューションを使用すると解決できる可能性があります。 しかし残念ながら、多くのカスタムAndroidディストリビューションは、AVBや、ロールバック保護、ファームウェア・アップデートなどの重要なセキュリティ機能をサポートしておらず、しばしばAndroidのセキュリティーモデルに違反しています。 ディストリビューションによっては、userdebugビルドもリリースしています。このビルドは、 ADB経由でrootを公開し、デバッグ機能に対応するためにより寛容なSELinuxポリシーを必要とするものです。結果、攻撃対象がさらに増加し、セキュリティモデルが弱体化してしまいます。

Androidのカスタムディストリビューションを選択する場合には、Androidのセキュリティーモデルが維持されていることを確認してください。 少なくとも、製品用ビルド、AVBのサポート、ロールバック保護、適時のファームウェアとオペレーティングシステムのアップデート、および強制モードのSELinuxを持つべきです。 私たちが推奨するAndroidディストリビューションはすべて、これらの基準を満たしています。

私たちが推奨するAndroidシステム :material-arrow-right-drop-circle:{.md-button}

root化を避けること

Android携帯電話のroot化を行うと、完全なAndroidセキュリティーモデルが弱められ、セキュリティーが著しく低下する可能性があります。 root化によって低下したセキュリティーの脆弱性が悪用されると、プライバシーが損なわれてしまう可能性があります。 一般的な方法でroot化を行うと、ブートパーティションが直接変更されてしまうため、確認付きブートを行うことはできなくなります。 rootを必要とするアプリはシステムパーティションを変更するため、確認付きブートを無効のままにしておく必要があります。 また、ユーザーインターフェースで直接rootを露出させると、デバイスの攻撃面が増加し、 権限昇格の脆弱性やSELinuxポリシーのバイパスが助長されるおそれがあります。

Content blockers which modify the hosts file (AdAway) and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For content blocking we suggest encrypted DNS or VPN server blocking solutions instead. RethinkDNS, TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN) preventing you from using privacy enhancing services such as Orbot or a real VPN server.

AFWall+ works based on the packet filtering approach and may be bypassable in some situations.

We do not believe that the security sacrifices made by rooting a phone are worth the questionable privacy benefits of those apps.

アップデートをインストールする

It's important to not use an end-of-life version of Android. Newer versions of Android not only receive security updates for the operating system but also important privacy enhancing updates too.

For example, prior to Android 10 any apps with the READ_PHONE_STATE permission could access sensitive and unique serial numbers of your phone such as IMEI, MEID, or your SIM card's IMSI; whereas now they must be system apps to do so. System apps are only provided by the OEM or Android distribution.

メディアの共有

Androidに内蔵された共有機能を使えば、多くのアプリにメディアへのアクセス許可を与える必要がなくなります。 多くのアプリでは、メディアをアップロードするためにファイルを「共有」することができます。

例えば、Discordに写真を投稿したい場合は、Discordにメディアや写真へのフルアクセスを許可する代わりに、ファイルマネージャーやギャラリーを開いて、その写真を Discord アプリと共有できます。

セキュリティーの保護

確認付きブート

確認付きブートは、Androidのセキュリティー・モデルの重要な部分です。 It provides protection against evil maid attacks, malware persistence, and ensures security updates cannot be downgraded with rollback protection.

Android 10 and above has moved away from full-disk encryption to more flexible file-based encryption. Your data is encrypted using unique encryption keys, and the operating system files are left unencrypted.

Verified Boot ensures the integrity of the operating system files, thereby preventing an adversary with physical access from tampering or installing malware on the device. In the unlikely case that malware is able to exploit other parts of the system and gain higher privileged access, Verified Boot will prevent and revert changes to the system partition upon rebooting the device.

Unfortunately, OEMs are only obliged to support Verified Boot on their stock Android distribution. Only a few OEMs such as Google support custom AVB key enrollment on their devices. Additionally, some AOSP derivatives such as LineageOS or /e/ OS do not support Verified Boot even on hardware with Verified Boot support for third-party operating systems. We recommend that you check for support before purchasing a new device. AOSP derivatives which do not support Verified Boot are not recommended.

Many OEMs also have broken implementation of Verified Boot that you have to be aware of beyond their marketing. For example, the Fairphone 3 and 4 are not secure by default, as the stock bootloader trusts the public AVB signing key. This breaks verified boot on a stock Fairphone device, as the system will boot alternative Android operating systems such (such as /e/) without any warning about custom operating system usage.

ファームウェアの更新

Firmware updates are critical for maintaining security and without them your device cannot be secure. OEMs have support agreements with their partners to provide the closed-source components for a limited support period. These are detailed in the monthly Android Security Bulletins.

As the components of the phone, such as the processor and radio technologies rely on closed-source components, the updates must be provided by the respective manufacturers. Therefore, it is important that you purchase a device within an active support cycle. Qualcomm and Samsung support their devices for 4 years, while cheaper products often have shorter support cycles. With the introduction of the Pixel 6, Google now makes their own SoC, and they will provide a minimum of 5 years of support. With the introduction of the Pixel 8 series, Google increased that support window to 7 years.

EOL devices which are no longer supported by the SoC manufacturer cannot receive firmware updates from OEM vendors or after market Android distributors. This means that security issues with those devices will remain unfixed.

Fairphone, for example, markets their Fairphone 4 device as receiving 6 years of support. However, the SoC (Qualcomm Snapdragon 750G on the Fairphone 4) has a considerably shorter EOL date. This means that firmware security updates from Qualcomm for the Fairphone 4 will end in September 2023, regardless of whether Fairphone continues to release software security updates.

Androidのアクセス許可

Permissions on Android grant you control over what apps are allowed to access. Google regularly makes improvements on the permission system in each successive version. All apps you install are strictly sandboxed, therefore, there is no need to install any antivirus apps.

A smartphone with the latest version of Android will always be more secure than an old smartphone with an antivirus that you have paid for. It's better not to pay for antivirus software and to save money to buy a new smartphone such as a Google Pixel.

Android 10:

• Scoped Storage gives you more control over your files and can limit what can access external storage. Apps can have a specific directory in external storage as well as the ability to store specific types of media there.
• Tighter access on device location by introducing the ACCESS_BACKGROUND_LOCATION permission. This prevents apps from accessing the location when running in the background without express permission from the user.

Android 11:

• One-time permissions which allows you to grant a permission to an app just once.
• Auto-reset permissions, which resets runtime permissions that were granted when the app was opened.
• Granular permissions for accessing phone number related features.

Android 12:

• A permission to grant only the approximate location.
• Auto-reset of hibernated apps.
• Data access auditing which makes it easier to determine what part of an app is performing a specific type of data access.

Android 13:

• A permission for nearby Wi-Fi access. The MAC addresses of nearby Wi-Fi access points was a popular way for apps to track a user's location.
• More granular media permissions, meaning you can grant access to images, videos or audio files only.
• Background use of sensors now requires the BODY_SENSORS permission.

An app may request a permission for a specific feature it has. For example, any app that can scan QR codes will require the camera permission. Some apps can request more permissions than they need.

Exodus can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply counting the total and assuming all items listed are equal.

Warning

If an app is mostly a web-based service, the tracking may occur on the server side. Facebook shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely.

Note

Privacy-friendly apps such as Bitwarden may show some trackers such as Google Firebase Analytics. This library includes Firebase Cloud Messaging which can provide push notifications in apps. This is the case with Bitwarden. That doesn't mean that Bitwarden is using all of the analytics features that are provided by Google Firebase Analytics.

プライバシー機能

ユーザープロフィール

Multiple user profiles can be found in Settings → System → Multiple users and are the simplest way to isolate in Android.

With user profiles, you can impose restrictions on a specific profile, such as: making calls, using SMS, or installing apps on the device. Each profile is encrypted using its own encryption key and cannot access the data of any other profiles. Even the device owner cannot view the data of other profiles without knowing their password. Multiple user profiles are a more secure method of isolation.

仕事用プロフィール

Work Profiles are another way to isolate individual apps and may be more convenient than separate user profiles.

A device controller app such as Shelter is required to create a Work Profile without an enterprise MDM, unless you're using a custom Android OS which includes one.

The work profile is dependent on a device controller to function. Features such as File Shuttle and contact search blocking or any kind of isolation features must be implemented by the controller. You must also fully trust the device controller app, as it has full access to your data inside the work profile.

This method is generally less secure than a secondary user profile; however, it does allow you the convenience of running apps in both the work and personal profiles simultaneously.

VPN キルスイッチ

Android 7 and above supports a VPN kill switch, and it is available without the need to install third-party apps. この機能を使うと、VPNが切断された場合に漏洩を防ぐことができます。 It can be found in ⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN.

Global Toggles

Modern Android devices have global toggles for disabling Bluetooth and location services. Android 12 introduced toggles for the camera and microphone. When not in use, we recommend disabling these features. Apps cannot use disabled features (even if granted individual permission) until re-enabled.

Google サービス

If you are using a device with Google services, either your stock operating system or an operating system that safely sandboxes Google Play Services like GrapheneOS, there are a number of additional changes you can make to improve your privacy. We still recommend avoiding Google services entirely, or limiting Google Play services to a specific user/work profile by combining a device controller like Shelter with GrapheneOS's Sandboxed Google Play.

高度な保護機能プログラム

If you have a Google account we suggest enrolling in the Advanced Protection Program. It is available at no cost to anyone with two or more hardware security keys with FIDO support.

The Advanced Protection Program provides enhanced threat monitoring and enables:

• Stricter two-factor authentication; e.g. that FIDO must be used and disallows the use of SMS OTPs, TOTP and OAuth
• Only Google and verified third-party apps can access account data
• Scanning of incoming emails on Gmail accounts for phishing attempts
• Stricter safe browser scanning with Google Chrome
• Stricter recovery process for accounts with lost credentials

If you use non-sandboxed Google Play Services (common on stock operating systems), the Advanced Protection Program also comes with additional benefits such as:

• Not allowing app installation outside the Google Play Store, the OS vendor's app store, or via adb
• Mandatory automatic device scanning with Play Protect
• Warning you about unverified applications

Google Play システム アップデート

In the past, Android security updates had to be shipped by the operating system vendor. Android has become more modular beginning with Android 10, and Google can push security updates for some system components via the privileged Play Services.

If you have an EOL device shipped with Android 10 or above and are unable to run any of our recommended operating systems on your device, you are likely going to be better off sticking with your OEM Android installation (as opposed to an operating system not listed here such as LineageOS or /e/ OS). This will allow you to receive some security fixes from Google, while not violating the Android security model by using an insecure Android derivative and increasing your attack surface. We would still recommend upgrading to a supported device as soon as possible.

広告ID

Google Play Servicesがインストールされているすべてのデバイスは、ターゲット広告に使用される広告 IDを自動的に生成します。 この機能を無効にすると、あなたについて収集されるデータを制限できます。

サンドボックス化されたGoogle Playを備えたAndroid ディストリビューションでは、⚙️ 設定 → アプリ → Sandboxed Google Play → Google Settings → 広告に移動し、Delete advertising IDを選択します。

On Android distributions with privileged Google Play Services (such as stock OSes), the setting may be in one of several locations. Check

• ⚙️ 設定 → Google → 広告
• ⚙️ 設定 → プライバシー → 広告

広告 IDを削除するか、興味や関心に基づく広告をオプトアウトするかを選択できます。これはAndroidのOEMディストリビューションによって異なります。 広告 IDを削除するオプションが表示された場合は、そちらを優先してください。 そうでない場合は、必ず広告IDをオプトアウトしてリセットしてください。

SafetyNetとPlay Integrity API

SafetyNetとPlay Integrity APIは、一般的に銀行アプリに使用されます。 GrapheneOSには、サンドボックス化されたPlayサービスがあり、多くの銀行アプリはうまく動作しますが、一部の非金融アプリには、それ自体の改ざん防止メカニズムが備わっているため、適切に動作しない可能性があります。 GrapheneOSは、 basicIntegrity のチェックは通過しますが、 認証チェック ctsProfileMatchは通過しません。 Android 8以降を搭載したデバイスには、ハードウェア認証のサポートがあります。これは、キーの漏洩や深刻な脆弱性がない限り回避することはできません。

Google ウォレットついては、そのプライバシー ポリシーにより推奨されません。信用評価や個人情報をアフィリエイト マーケティング サービスと共有したくない場合はオプトアウトする必要があると規定されているからです。