Control Your Device without Touch with Hovering Controls

We’ve all seen those Sci-Fi movies and salivated over their technology that allows the characters to perform all sorts of things just by waving their hands in the air. The thing is though, this sort of technology does exist, although nowhere near as advanced as what we see on the big screen. Sony Xperia Sola has its floating touch, Samsung Galaxy S4 has air gestures, and evendoctors nowadays are using X-Box Kinect during cancer surgery. Users of other devices, however, can now also enjoy this sort of flexibility and novelty by simply using Hovering Controls.

Hovering Controls uses the proximity sensor of your device to register simple motions performed in front of your device. Predetermined apps can be launched by either hovering over the sensor, swiping once, or swiping twice. And silencing an alarm or ringtone is as simple as a hand wave. You can also control your media playback this way, allowing you to change to the next or previous song or video without ever turning on the phone screen and physically touching it.

Two modes are available, both offering a different take on opening apps:

1. Target mode: open a pre-determined app with a set gesture
2. Carousel mode: open up apps from a set list of apps

If you’re not sure what sort of gesture is recognized by Hovering Controls, there’s a testing mode where you can test different motions  to see what the app registers them as. Forgin has also included a widget from which you can toggle the app on and off.

Read More

Compromised Sky Apps and the Security Aftermath

After our earlier article warning users to uninstall the Sky apps from their devices, it’s time to take a look at the technical significance of this attack. Firstly, the attackers have managed to do two key things here, each of which should each be impossibly difficult for the Play Store update system to be secure:

• Gained access to the Play Store Developer Console of Sky, presumably through gaining access to the associated Google Account
• Obtained access to, or managed to otherwise generate or reproduce, the private RSA keys used to sign the Sky Android app packages

The former is obviously important to security, since without access to the Developer Console, it is not possible to push out an update to an existing app. While obviously a malicious user could publish his own app, he would not be able to push an update to an existing app already installed via the Play Store, unless he can do so using the account of the developer who originally published the application.

The latter is equally (if not more) important a security measure: Even if an attacker gains access to your Developer Console, they cannot push an update to an existing app if it is not signed using the same keys as before. This check is also enforced on each individual Android device, meaning even if there was a bug in the Play Store implementation of this security, your own device would reject the update! All bets are off though, if the private signing key is compromised or accessed.

In the case of the current Sky attack, it seems likely that both the Developer Account and the private signing keys were compromised. At this point, the safest option would arguably be for Google to use its remote uninstall trigger on these packages, if there is any indication the actual packages themselves were compromised. Sky will no doubt resist this, as they would not want to see their apps disappear from users’ devices. Unfortunately for them though, it is long past that. These users need to uninstall the app now, as Sky can no longer continue to use these keys.

And herein lies the ultimate problem in the Android security chain (and indeed in most certificate based security systems). There is no system for effective, wide-reaching key revocation. If your Android signing keys are compromised, the trust chain ends. There is no way for you to revoke your compromised key, so clients will no longer trust an app update signed with it. There is also (less importantly from security, but more importantly from the developer’s perspective) no way to securely supersede these keys with new ones (while ensuring an attacker cannot replace the keys with his own).

What does this mean for developers?

Take all reasonable steps to protect your Google Play Store Developer account:

• Use two-factor authentication on the account.
• Enable a password or PIN lock on your phones which contain the authenticator app. If you enter a backup phone number, consider the security risks of an attacker compromising your telephone provider via social engineering, or compromising your login to issue a new SIM on your account (to allow them to obtain a one-time login token).
• Use a very, very, very, very, very secure password for your Developer account, and do not use this password anywhere else. Do not use this Google account for anything else. Log into it only from your own computer, only over WPA-2 (or better) encrypted WiFi, which you control. If you can type this password in under a minute, it’s not secure enough. It should also be random. Random is not your partner’s name followed by the year they were born in. Unless their name is “r$kGmn9d4Fl9&*sEm.Xs2Fl0_3fGjdk” and they were born in year “hJfMn?32VwmndkD2lsk34Rojks83″

Take immense care of your private code signing key as well:

• It is called private for a reason. Users who install your applications are trusting you to keep this key safe. Do that, and do so with your life. You should plan on being dead for many years before anyone can gain access to this. Many years would likely be a number greater than the life of the universe. Or at least the expiry date on the certificate.
• Do not decide to “just backup the key to Dropbox for safekeeping” (or indeed any other cloud or remote storage system).
• Don’t give anyone else access to the key. If you work in a team, can you perhaps operate a system whereby only one person signs the final updates? If it’s really necessary, then share the key, and ensure the other person takes equal levels of precautions.
• Attackers will always attack the weakest point in your system, and will password-reset your Dropbox account if it gets them access to the shared folder where you stored your private key (and password to decrypt the key in the corresponding readme file, which you knew to never do, but did anyway), or snoop on your emails if you ever attach the key.
• Protect your key with a very strong and random password (remember the lecture before about what random means?) – do not use this password anywhere else. Do not store this password somewhere an attacker can gain access to. Do not store it with or near your key.
• Store your private key on an encrypted USB flash drive, and disconnect the drive from your computer when not in use. Then put this drive in a safe when not in use. Store a second copy of the key in a safe deposit box in your bank. This will obviously be heavily encrypted, using a long, secure, random key.

Finally though, what lessons should we all learn (and perhaps Google start to ponder)?

• There is currently no way to revoke a compromised application signing key. While arguably this is because anyone can sign an app using their own key, and install it on Android (thus meaning that revoking a key is of limited use), this isn’t the case as Google pushes forward with trying to force automated updates upon unsuspecting users. Automated updates are a huge security risk until there is a rapid and effective key revocation system available to developers.
• There is no way for developers to recover from a compromised signing key. Perhaps Google ought to review the signing system, such that developers create a CA key, which is then used to cross-sign other keys (such as their private signing key), such that if an application key is compromised, they can generate a new one, and sign it with their CA key. (this relies upon the developer understanding this, and realising he must guard the CA key with both his and his family’s lives, and guard the application signing key “simply” with his own life)
• The Sky apps in question had fairly generous permissions access on the devices they were installed upon. Perhaps developers should stop making their apps attractive targets, and stop bestowing themselves with such wide-reaching permissions on our devices. There is no reason for the majority of apps to make use of any permissions whatsoever (perhaps asides from being able to access the SD card, a permission I argue should be sandboxed to an app-specific area anyway)

Hopefully, Google will make use of their remote uninstall ability to remove the app from user devices, and also let them know somehow (email to their Gmail accounts) what happened, and that Sky did not look after their key properly. This is a major embarrassment to Sky, and they should hang their heads firmly in shame for not taking sufficient precautions to ensure that everyone with access to their signing key was suitably competent to prevent it falling into the wrong hands.

At the end of the day, it is the end user whose security is affected by the failings of the developer. And for this reason, security lapses such as these are unforgivable.

Read More

Android Permissions: Permissively Insecure?

Android, as an operating system, is fairly unique in that it makes users aware of the permissions available to apps in a fairly transparent way. Compared to Blackberry or iOS, which issue granular prompts such as “Can Angry Birds access your location?” or “Can Instagram access your camera to take photos?” There is a somewhat subtle difference here: The rivals give the user a choice about these requests.

Jump over to Android where, after installing an app, it has free reign to use every permission you agreed to. While this doesn’t sound an issue, let’s take a look at the Play Store. Let’s look at a nice, popular app (for better or for worse): Facebook.

The Facebook app has permissions to:

• Create accounts and set passwords for those accounts, and add or remove accounts - this allows Facebook to store its account login using the AccountManager, and is good to see
• access your accurate (GPS) location and network location - this is to allow for geo-tagging of posts and status updates, which some people might want, but others may be very against. More on this later.
• full network access - Google lacks a way to give an app selective internet access, so this is needed, much as it might be nice to limit the remote servers an app can communicate with
• directly call phone numbers - I confess to not researching this one – I am fairly sure Facebook lets you tap a phone icon to call someone. Would it really be so bad to just let you confirm you want to call, and avoid this permission? How long until we see profiles listing premium rate numbers as their phone number?
• read your phone status and identity - This one is a privacy stealer – while allowing an app to tell if a call is active or not, it also is fairly invasive, allowing an app to obtain your phone number, IMEI, IMSI, device ID (etc), and if you are on a call, the phone number you are connected to!
  
• read to and write from USB storage devices - Perhaps this is for caching of files, but maybe a tad excessive?
• install shortcuts on your homescreen without user interaction - Not sure when this is used, but the permission is there, so it might like to self-promote Facebook services?
• read your detailed battery statistics - As described in the descriptions, this gives low-level battery use data, and can allow the app to find out what other applications you use.
• see what other apps are running - Likely for the Facebook Home feature, again allows Facebook to see what apps are running
• take photos and videos at any time without prompting - Rather concerning, allows the Facebook app to take photos or videos whenever it wants, without prompting or alerting you
• draw over other applications – Likely for the Chat Heads feature of messenger, although why that’s not a permission in the messenger app is a good question

Getting tired and out of breath yet? It’s not over yet though! Facebook can also:

• write to your call log - Why? Just why? This allows for call log erasing and writing
• read from your call log – and thus see all the calls you have made, and when, and for how long, and who they were to
• read your contacts - while useful if you sync Facebook contacts, many people  don’t want Facebook to have full reign over their contacts
• write to your contacts - pretty much as above

What is perhaps most disconcerting is that while Google acknowledges openly the risks in each permission (I suggest you take a read at the detailed description of some of the permissions on a Play Store listing), the company takes no steps to help you with this. Thus, the entire Android ecosystem is built around you trusting the developer to play fair, and not do anything dodgy.

Unfortunately. This. Doesn’t. Happen. It really seems clear that many app developers just DO NOT UNDERSTAND SECURITY. Full stop.

And while I might be unique in my recommendation (which I firmly believe is warranted in this day and age given recent information revealing the extent of mass surveillance that is ongoing) to trust nobody, not even yourself. For this reason, I suggest the Android permissions system is totally flawed, in relying on developers to not abuse permissions, and not request excessive permissions. How many torch apps on Android have more than the required camera permission (to enable the camera)? I’d suggest most do, feel free to take a look!

You’d think the Android community would rally against such behaviou, but it’s reached a point where it is acceptable for developers to declare a need for excessively gratuitous permissions in order to use their apps. What happened to user choice? I then was pointed towards this post on G+ by Steve Kondik (XDA Recognized Developer cyanogen), which I read with much dismay. While I do not use G+ (closed platform, requiring far too much data to be disclosed to Google), I would suggest that with respect, the need for user privacy and security MUST come first, as it’s clear app developers cannot “do” security.

Perhaps if Google introduced zero tolerance for moronic errors in security (plaintext passwords, gathering contacts data, obtaining device IDs that are not hashed suitably with a cryptographic hash etc), it might offer an incentive to consider security? Given many users (wrongly) reuse passwords between services, the sending of plaintext passwords should be sufficient, in this author’s opinion, to justify immediate removal of all of a developer’s apps from the Play Store, forever.

Some people just don’t know how to do security. And for them, I sigh. Users deserve security, and privacy, and unless you go ahead and look at the OpenPDroid project on XDA (which I strongly suggest you check out), you are pretty much being abandoned by even the leader of CyanogenMod. While I appreciate his concerns for app developers, it is simply inexcusable to not look into fixing the glaring hole that is contacts access. This is 2013, the era of social engineering, and I cannot choose selectively which apps see which contacts in my address book? REALLY?

Something needs to happen here, before people wake up and smell the coffee, and realize this isn’t sustainable. It’s time users became more aware about what apps are doing, and the extent of data mining that is ongoing. It’s your data, and it should be entirely your choice who gets it.

You shouldn’t have to avoid an app because you don’t like the look of its permissions; you should be able to (whether as stock Google feature, or custom ROM feature) be able to selectively decline to allow an app to access your data. And this should be done gracefully, either providing empty data (for contacts, or similar), or null data (i.e. requesting phone number or IMEI should return the same response as a tablet lacking these identifiers).

Is it right to deny your users the choice, to make life “easier” for app developers? (arguably to allow them to capture user data more easily) I argue it’s not, and it’s time the Android community unites to put an end to apps having free reign over YOUR data. If this concerns you, why not check out the aforementioned OpenPDroid (and similar) projects on XDA, and see if you can help out, or test, or contribute to the cause?

Read More

"Have you ever used an iPhone?" "No, I have standards"

Welcome to the all-new Android Central app! Get the latest news, reviews, forum posts, podcasts, wallpapers and more, all from the Android Central App! Ladies and gentlemen, boys and girls! Behold, the all-new Android Central application. Known as an "app" on the streets, this is a long overdue endeavor for us. We've been testing internally for some time now, and it's been floating around our forums for a week or so, and now we've officially gone public, for Android 4.0.3 and up. So what's in the app? We'll have posts detailing the features over the next few weeks, but here are the broad strokes: All the posts from the blog side of things. News. Reviews. Apps. Accessories. Editorials. It's all there. Plus, you can comment on posts directly from the app. Access to our Android forums. If you've used Tapatalk or our dedicated Android Forums app, you'll be used to things here. (We've still got some bugs to iron out on this one, but a good bit of functionality is there.) Podcasts. We're big fans of the major podcatcher apps out there. But why not bake it into our app as well? You can stream or download all of our episodes right from the app. Wallpapers. Downloading from our Wallpaper Gallery is easier than ever. Browse and install, all from the app. Accessories. We've got direct access to ShopAndroid.com, right in the app.  Videos. You can check out everything that hits our YouTube channel -- often before it hits the blog. That's quite a few features for a v1.0 release. But we've still got work to do. read more      • Email to a friend • Article Search • View comments • Google Fiber expansion hits Kansas City suburb of Grandview When Google announced back in mid-2012 that they were bringing a brand new gigabit fiber internet service to Kansas City, Missouri, we had a feeling that local expansion would happen rapidly once the initial infrastructure was built out. Sure enough, Kansas City, Kansas - right across the the Missouri River - got wired up, followed by Kansas-side suburbs Olathe and Shawnee. Tonight Google announced an expansion back on the Missouri side of the Missouri river, with the Board of Aldermen of Grandview, Missouri, approving a Google Fiber rollout in their municipality of 25,000. As with the rollouts in Shawnee and Olathe, as well as out-of-state Google Fiber projects in Provo, Utah. and Austin, Texas, there's no public announcement for when exactly residents can expect Google to be running fiber optic lines to their house. Either way, exciting news for the residents of Grandview, Missouri. And if you happen to be living in one of the Kansas City suburbs that hasn't been confirmed for a Google Fiber expansion, we'd start calling your councilmen and aldermen right away and demanding they approve some gigabits for you too. Come to think of it, we don't live anywhere near any of the announced Google Fiber communities, but that's not going to stop us from nudging our municipal governments to make it happen. Source: Google Fiber Blog      • Email to a friend • Article Search • View comments • "Have you ever used an iPhone?" "No, I have standards" Samsung's voice assistant on the Galaxy S4 burns rival Apple S Voice is Samsung's take on a voice-based personal assistant. And by that we mean it's heavily inspired by Apple's Siri on the iPhone. So it's no surprise -- if a little amusing -- to see Samsung's app poking fun at its long-time rival. On the international Samsung Galaxy S4 (and some other Samsung phones -- we've had varying results), asking S Voice if it's ever used an iPhone prompts the response "No, I have standards." Ask it "Are you Siri?" and it's a little more coy -- "I like to think I am." But it stops short of any direct attacks -- ask it "Do you like Apple?" and it tells you it has no problems with anyone, but its loyalties lie with Samsung. It's one of a few Easter eggs we've run into in S Voice. Back when it launched on the Galaxy S3 we put it to the "woodchuck test," which it passed with flying colors. If you've run into any cheeky behavior from S Voice, be sure to hit the comments and share them with the world.      • Email to a friend • Article Search • View comments • Spotify update brings filters and sorting to playlists and tracks New sorting methods for your tunes and playlists plus bug fixes make today's update a must-have If you're a Spotify user there is an update available that you'll want to download. While the list of new features is short, as is often the case quality trumps quantity and today's update allows users to filter and sort their playlists and songs, making searching and categorizing much easier. The full list of changes: New: Now you can filter and sort your playlists and tracks. Fixed: When returning to your playlist view, you’ll always go back to the same position. Fixed: No more crashing when faced with special character$ in usernames. Fixed: When you next log in, Spotify will remember what you'd been listening to. Fictitious: This app looks great in trousers. Besides the new sorting capabilities, correctly remembering where you left off is a welcome fix, and looking good in trousers is always a bonus. If you're a current user, or want to check out Spotify to see if it satisfies your streaming music needs (there's a free 48 hour trial), hit the Google Play link above. Thanks, David!      • Email to a friend • Article Search • View comments • Spring cleaning: Win a Nexus 4 wireless charging orb Up next in our "Get crap off Phil's Desk" content is the Nexus 4 wireless charger. This is the one that's about the size of a tennis ball, only it's black and charges a smartphone. This one is new and still in the box and completely free of dust and dog hair. (If ya'll want, I'll throw in a second charging orb, only this one might have that dust and dog hair stuff I mentioned.) To enter, just leave a comment on this post and we'll get this charger to a good home.      • Email to a friend • Article Search • View comments • AT&T Galaxy S4 getting first software update too 21-megabyte update now hitting AT&T-branded handsets, users report smoother performance Following the T-Mobile update that landed this morning, AT&T's Samsung Galaxy S4 is also getting its first firmware upgrade. The over-the-air package weighs in at just over 21MB, and although there's no changelog provided with the update, GS4 owners over on the Android Central Forums are reporting faster performance and smoother animations on the new software version. If lag fixes are indeed present in this new firmware, then it'd be a welcome change -- in our review of the U.S. Galaxy S4 on Sprint, we noted occasional, frustrating jitteriness in certain animations. To see if you're ready to update, head to Settings > More > About device > Software update. If you're not seeing anything there, you could try connecting your phone to a PC or Mac and using Samsung's Kies desktop software instead. AT&T Galaxy S4 owners, be sure to let us know how you're getting on with this latest update down in the comments. Source: Android Central Forums      • Email to a friend • Article Search • View comments • Viber launches desktop client, refreshes mobile app design Seamlessly continue conversations, calls and video chats from mobile to desktop Popular cross-platform messaging and VOIP service Viber is introducing brand new desktop apps along with a complete refresh of its mobile apps today. First up are the desktop apps, which are now available for both Windows and Mac and give users the ability to continue all of their VIber conversations and activities just as they would on the phone. You can text and voice chat, send pictures and stickers, make video calls and even transfer audio calls between devices mid-call. On the mobile side, Viber v3.0 refreshes the interface, and enables a new set of features to be in sync with what the desktop now offers. The mobile app now lets you send stickers, leave video messages and a couple of back-end improvements such as sound quality and language localization. If you haven't yet tried Viber you can grab the app from the Play Store link above, and the desktop versions from the link below. More: Viber read more      • Email to a friend • Article Search • View comments • Images of super thin Huawei P6-U06 device leak out Just 6.2mm thick but still packing many of the latest specs of any high-end device Huawei's latest ultra thin high-end device -- known as the P6-U06 for the moment -- may have just leaked out, and this time it is posing for the camera instead of just a few device renders. While it is hard to confirm that this is the exact device Huawei have teased in the past because the back is not shown, all signs point to this being the same 6.2mm thick phone packing a 1.5GHz quad-core processor, 2GB of RAM and a 4.7-inch 720P display. That's a solid set of specs considering the limited space they have to work with. The design feature of having a metal band around the perimeter also adds a little bit of evidence to this being a new P series device from Huawei, as it has used the same technique on other recent phones such as  the Ascend D2. It also seems to pull some design from the Ascend P2. The radio specs suggest a Chinese-only launch for this device, and we wouldn't be surprised if it never launched beyond that market either. Hit the break for a couple more pictures. Source: Engadget read more      • Email to a friend • Article Search • View comments • Samsung Galaxy Note 8.0 review The Samsung Galaxy Note 8.0 brings features a-plenty and the beauty that is the S Pen to the small tablet form factor. But is the $399 price too much to justify? The Galaxy Note 8 is Samsung's latest small form-factor tablet, and it checks in with a $399 price point. That's important, and we'll be referring back to the price several times during this review. Why? Because there are two great tablets at this size that the Note 8 is directly competing against -- the $200 Nexus 7 and the $330 iPad Mini. Price aside, the Note 8 is one of the best tablets Samsung has offered. It's full of the same great features that we're used to seeing in the Galaxy Note line, and it's hardware is plenty fast enough to make the experience pretty good overall. And of course, there's the S Pen to consider. Stop thinking of it as a stylus, because it's deeply integrated into the software and brings things to the table a regular stylus never could. Is that enough to justify the $399 price? To answer that, hit the break and see what we think of the Galaxy Note 8. read more      • Email to a friend • Article Search • View comments • As Google stock hits new highs, we ponder the ceiling Android, even indirectly, is but one tool in Google's money-making arsenal On Monday Google stock (GOOG) closed above $861, marking a new all time high for the Mountain View search giant.  This news, of course, sparked a bunch of headlines talking about it. Most of the “stories” behind the headlines are lacking any substance whatsoever. “Google hit a new all time high.  It rallied by x% to close at $y, and the stock is now up over z% year to date.” That’s typical. Useless. Garbage. Fill-in-the-blank process stories. So let’s talk a bit about Google. Google went public in the summer of 2004. I remember it well because, as an analyst in the financial community, the online auction style of IPO they forced upon Morgan Stanley and Credit Suisse was very much unconventional. And that pretty much sums up how Google operates. It runs the show, and it’s not your average show. Google went public at $85 per share and had a massive run leading up to 2008, when the whole market collapsed as a result of bad mortgage portfolios (the whole collateralized debt obligation market, asset backed commercial paper, etc). So after peaking out around $700, the stock tanked, dropping briefly below $300. As the market recovered from the housing market problems, Google recovered, too. But not to where it once was. It had been bouncing between $500 and $600 for a couple of years. Wall Street had moved onto other exciting stories. Google was still growing, but not by super high double digits, or triple digits like before. Yet grow, it did. And collect cash it did.  And launch important new businesses like Android, it did. read more      • Email to a friend • Article Search • View comments • HTC One 'Ultrapixel' camera pitted against iPhone 5 iMore compares HTC's Ultrapixel camera to the iPhone's 8MP rear shooter Outside of the Android world, one of the HTC One's biggest competitors is Apple's iPhone 5, a device which has earned praise for its 8-megapixel camera and advanced optics. As such, our sister site iMore.com decided to put both cameras through their paces in a side-by-side comparison. As you'll know if you've been following the phone's launch, the HTC One sports a 4-megapixel 'Ultrapixel' camera, with larger (2 micron) pixels on the sensor itself and f/2.0 aperture, not to mention optical image stabilization. On the iPhone 5, Apple takes a more traditional approach, with a large-ish 8-megapixel sensor, supported by a fancy sapphire crystal lens and f/2.4 aperture. So the iPhone wins on megapixels alone, but the HTC One would seem better equipped for low-light photography. Here's what iMore's Ally Kazmucha had to say after putting both phones' cameras to the test in a variety of conditions -- Both cameras produced stellar images, yet excelled in different areas. The iPhone 5 does much better when it comes to handling color depth, tone, and saturation. The HTC One leaves the iPhone in the (noisy, noisy) dust when it comes to capturing low light, relatively stationary images. Apple has been focusing on the iPhone camera for years now, and it's really paid off when it comes to everyday photography. Competitors like HTC, however, are really nailing areas like low light. Hopefully Apple follows their lead, and the lead of Nokia, and starts adding features like optical image stabilization (OIS) and f/2.0 apertures or wider. For the full article, complete with a few dozen comparison shots, check out the full article over on iMore. More: iPhone 5 versus HTC One: Camera shootout      • Email to a friend • Article Search • View comments • RunKeeper for Android updated with Pebble smartwatch support Latest app update allows workout tracking on Pebble Good news for RunKeeper users also lucky enough to be in possession of a Pebble smartwatch -- the former has just been updated to take advantage of the latter. In its latest update, RunKeeper for Android has gained the ability to connect to Pebble, allowing users to track their workouts in real time. The app still does all the heavy lifting, with the watch acting as a secondary display, so you'll still need to keep your smartphone on you during your workout. However, the ability to track your stats without reaching (possibly with sweaty hands) for your phone. Unsurprisingly, with wearable devices set to become more widespread over the next year, RunKeeper says Pebble integration is "one of many integrations with hardware and fitness tracking devices in the coming months." To grab the latest version of RunKeeper, hit the Google Play link above.      • Email to a friend • Article Search • View comments • Using 'Multi-window' on the Samsung Galaxy S4 Samsung's full-screen multi-tasking feature returns on the Galaxy S4. Here's where to find it and how to use. A favorite feature of the Galaxy Note 2, Samsung's 'Multi-window' multitasking capability is included out of the box on the Galaxy S4. It's probably one of the coolest software tricks Samsung has come up with to date, but it's easily overlooked if you don't know it's there. To use Multi-window, you'll first need to enable it in the quick settings area. Drag the notification bar down, hit the block icon in the top right corner and make sure "Multi-window" is lit up. From there, you can toggle the Multi-window bar on or off by long-pressing the back key. It's possible to move the bar around by long-pressing the rounded tab while it's open. (To move the tab up or down, simply long-press and drag up or down when the bar doesn't have focus.) read more      • Email to a friend • Article Search • View comments • T-Mobile Galaxy S4 gets first update, visual voicemail and ISIS improvements included First update for T-Mobile Galaxy S4 going out over the air and through Kies The first update for T-Mobile US's Samsung Galaxy S4 is pushing out today over the air and through Samsung's Kies desktop software. The new software version M919UVUAMDL is a minor update containing "improvements to the visual voicemail app" and "ISIS app improvements," according to T-Mo's support pages. (ISIS being the NFC-based mobile wallet app backed by many U.S. operators.) There's always a chance some other bug fixes or improvements have been sneaked in behind the scenes, so if you're rocking a T-Mo GS4 then hit the comments and let us know how you're getting on after today's update. Source: T-Mobile; via: Android Central forums      • Email to a friend • Article Search • View comments • Deal of the Day: LLOYD HD Clear Screen Protectors for Galaxy Note 2 The May 7 ShopAndroid.com Deal of the Day is the LLOYD HD Clear Screen Protectors for Galaxy Note 2. These protectors are custom designed to protect your Note 2 screen while giving you an ultra-clear, high definition look and feel to your device. Durable and scratch resistant, the TruTouch sensitivity gives these protectors a more natural feel on your touchscreen. Includes 3 per pack. The LLOYD HD Clear Screen Protectors are available for just $5.00, 75% off today only. Grab yours while supplies last! Never miss a deal. Sign up for Daily Deal alerts      • Email to a friend • Sony Xperia SP up for pre-order in the U.S. Sony's latest mid-ranger to sell​ for $489.99 unlocked Hot on the heels of the Xperia Z, Sony's new mid-range offering, the Xperia SP, has also appeared for pre-order on the company's U.S.-based online store. The Xperia SP packs a 1.7GHz dual-core Snapdragon S4 Pro CPU with Adreno 320 GPU, 1GB of RAM, 8GB internal storage and an 8-megapixel Exmor RS rear camera. On the front is a 720p Sony 'HD Reality Display.' Like its high-end siblings, the SP's internal storage is expandable via microSD card. The Xperia SP also sports a unique aluminum-frames design and a large, illuminated transparent element under the screen. Bizarrely, Sony's spec listing for the North American Xperia SP shows support for HSPA+ on 850, 900, 1900 and 2100MHz bands, as well as LTE bands I, II, IV and V. If those specs are accurate, they'd point to an incomplete set of frequencies for both AT&T and T-Mobile. On AT&T you'll get full HSPA+ coverage but no LTE; on T-Mo you're looking at LTE, but no 1700MHz HSPA+ support. The unlocked U.S. Xperia SP variant (C5306) is due to begin shipping from May 20, priced at a not insubstantial $489.99. Source: Sony Store; via: XperiaBlog More: Hands-on with the Xperia SP      • Email to a friend • Article Search • View comments • From the forums: How are you getting on with the Galaxy S4? Top threads for first impressions of Samsung's new handset Depending on where you live, you'll have been able to pick up Samsung's latest handset, the Galaxy S4, for up to two weeks now. As such, the Android Central forums are buzzing with discussion about what's sure to be one of the biggest-selling phones of the year. Whether you're just getting started with your S4, or you're looking to pick one up in the future, here's a selection of the top forum threads to check out -- The Galaxy S4 screenshot thread - If you've got a cool wallpaper or widget setup, be sure to show it off in this thread. The Galaxy S4 bug thread - It's impossible to ship completely bug-free software, and so if you've noticed any software glitches on your S4, this is the place to discuss them. Galaxy S4 photography thread - The S4's 13-megapixel camera is among the best we've seen on a smartphone. Check out some awesome photos from forum members, and post your own! Galaxy S4 cases and covers thread - The place to discuss current and upcoming cases for the Galaxy S4 (also be sure to check out GS4 cases on ShopAndroid.com.) Galaxy S4 better than the HTC One? - This question isn't going to be resolved anytime soon, but the GS4 forum denizens are offering their thoughts in this thread. Verizon Galaxy S4 pre-order/waiting thread - The GS4 isn't available on Big Red just yet, but there's a thread full of Verizon pre-order discussion here to see you through to launch. More: Galaxy S4 forums      • Email to a friend • Article Search • View comments •

Read More