The Security Skeptic

How to choose a sub-$100 Android Tablet – and not be disappointed

Image by Pierre Lecourt

Tablets are attractive alternatives to laptops, mobile phones, or (effectively) single-purpose devices such as eBook readers or handheld game consoles. The tablet market now includes a wide range of offerings for under $100 USD, with such varying quality, OS and feature support. However, it’s hard to find an inexpensive $100 tablet that doesn’t have mixed or conflicting reviews. The presence of mixed reviews is not the hindrance it initially seems to be. With a modest effort, you can deduce quite a lot from even contradictory reviews. Couple this effort with reasonable expectation setting on your part to make an informed choice and avoid a disappointing tablet experience.

Set Reasonable Expectations

You’ve chosen to go down-market. Expect some compromises in performance, battery life, touchscreen quality, or storage.

Choose a tablet that will meet your expectations, think carefully about how you will use it.

Reviews suggest that many tablet hunters want to read eBooks, browse and use social media apps on a larger screen than a mobile phone. Some want to experiment with network or security diagnostic apps. Some want to get a general feel for Android OS. Screen resolution stands out as an important consideration here. 

These needs are very different from gamer or entertainment seeker expectations, which are more demanding of touchscreen input, audio, CPU, and battery than those of someone who will use a table for gaming and streaming. Expect fewer sub-$100 tablets to meet all these expectations.

Glean Information from Positive and Negative Reviews or Ratings

Trade magazine and prepared merchant reviews can be helpful resources. Look for independent reviews that compare like products. Consumer reviews can also be hepful because they represent a wider sampling of users - and one may be just like you. Sample both. I found that reviewers who give a top rating for a device – commenting that the tablet did this small set of things I expected, made my grandson happy, available in pink – often set the lowest expectations. In one 5-star review, I found “whenever I am on the internet it does close the program when I’m in the middle of a purchase” alongside “All of the apps work perfectly!”    

Low ratings generally fall into two categories: non-technical consumers complain of poor battery life, inability to connect to app stores, difficulty installing apps, poor user manuals, limited support, and general usability. Higher ratings for the same tablet – submitted by Android-savvy consumers or consumers who use Google Foo to solve problems – suggest that many tablets require more effort or curiosity to compensate for manuals or support. My advice here is simple:

If you are non-technical or cannot tolerate anything less than an immediate plug-and-play experience, you might be disappointed with any sub-$100 tablet.

A second category of complaints is more worrisome. These describe poor manufacturing quality, inability to boot (DOA) or other issues symptomatic of Android or popular app incompatibility. Steer clear of any device that’s received numerous complaints of these kinds.

The best reviewers share the good and bad about a tablet they’ve purchased: on the typical scale of 5, I found reviews in the 3-4 range most useful. These often share practical findings based on initial experience. Some reviewers return months later and update or revise, as well.

And what did you find?

Here’s a sample of the information I found most helpful in choosing a tablet:

Battery preparation is key. Disappointment with battery life is a common complaint. However, consumers who follow battery preparation instructions describe better battery life experiences than those who do not. Fully charge the battery before initial use. Completely drain the battery. Fully recharge it before resuming battery only use. Repeat this pattern between 2-5 times. Expect wireless and location services to drain batteries quickly; conversely, you may get double digit battery life if you work offline or use the tablet to read eBooks.

Use Android OS version as a litmus check. Tablet shipped with older Android OS versions leave you more vulnerable to infection are more likely to cause you incompatibility problems with newer, popular apps. Avoid tables with older Android OS versions; instead, choose from tablets that come with recent versions (4.0/Ice Cream Sandwich or 4.1/Jelly Bean).

<span style="font-size: 10pt; ">Image by <a href="http://www.flickr.com/photos/matteopenzo/" _mce_href="http://www.flickr.com/photos/matteopenzo/" target="_blank">Matteo Penzo</a></span>

Take time to explore Android OS. Learning how to use Android does not require a STEM education. Many consumer comments appear to be from “can’t program the clock on my VCR and I took no time to learn how” individuals. Go to a consumer electronics store, take some test drives and take time to poke around the Settings menus. Read an article. Watch a video. There’s little point in purchasing an Android tablet if you aren’t comfortable with the OS.

Don’t expect 5-star customer support. Support is likely to be correlate closely with price. Small margins leave little budget for customer support. Expect sketchy info on web sites, bare bones user manuals, and little in the way of interactive forums or knowledge bases. Expect no human contact and be pleasantly surprised if the manufacturer exceeds expectations.

App stores. Prospective buyers who are unfamiliar with the Android market often interpret the absence of an app store icon on their tablet as an indication that they cannot download apps from that market. This is not categorically true. In some cases, the app the user wants is incompatible with the tablet’s OS version; in others, the app will work fine, but the user must adjust settings and manually install. Best advice here: search engines are your friends. At the least, you will discover how to install apps that don’t auto-install via popular App stores. Probe a little further and you’ll learn how to reduce the risk of having your Android tablet infected by malware. Win-win.

ROOT your tablet? Rooting your tablet can be beneficial for people who are technically adept; for example, you can free memory and run some sophisticated apps. Rooting can also turn your tablet into a “brick”, a non-functioning device with a voided warranty. So be forewarned: know what you are doing and gather the instructions and software you’ll need to recover from failure before you consider rooting your tablet.

BYOD device compliance. If you will be using your tablet for business purposes, review your company’s BYOD policy or ask IT. Some tablets may not support features like full device encryption. Narrow your tablet search to a few devices, then confirm with the manufacturer or ask on Android or tablet-specific forums if the device you want supports the BYOD features you’ll need.

What did you buy?

Telling you this would feel like an endorsement. I bought a $85.00 7” tablet that runs Android 4.1/Jelly Bean on a Rockchip 2928 1.2 GHz processor using 1 GB RAM and 4 BG Flash Memory. I followed the battery life instructions and while not overwhelmed with battery life, I’m satisfied. I learned too late that it did not support full device encryption and cannot install one app (of 20) that I had hoped to use. It performs reasonably well; however, it is much slower rendering maps in real time than my mobile phone. I didn’t buy the tablet for gaming but my brief test drive of a pre-installed game (Temple Run) and streaming some videos gives me some confidence that it will suit these purposes as well as I – or you – expect for a hundred bucks.

Top Takeaway from the WhiteHat Website Security Statistics Report (May 2013)

WhiteHat Security surveys customers and examines terabytes of data collected from websites and applications it monitors to annually produce a report that concentrates on unknown vulnerabilities in custom Web applications. Custom has the same meaning here as a "custom made suit": organizations may operate websites using commercial or open source operating systems, web server software and content management systems, but nearly every site of meaningful size has code that is unique to that organization.

Unique code doesn't necessarily translate to unique vulnerabilities: software developers worldwide make similar assumptions, use similar dev languages and tools... and being human, some make errors in logic, poor or uninformed assumptions about program execution or user behavior, and test in haste or without rigor. These are the causes of unknown vulnerabilities that attackers discover and exploit. 

While much of the WhiteHat Security's Report is devoted to sharing the numbers - and most of the numbers are unsurprising confirmations of what OWASP reports or what front line infosec professionals see every day - the WhiteHat Security team looks past the numbers, consider factors that are not always obvious to audiences of this kind of report, and most usefully, share their opinions. Read the Report, not just the Executive Summary. Perhaps you'll conclude, as I did, that this one finding is the important takeaway if you want improve your website security profile:

What's needed is secure software NOT more security software

Not a believer? If your organizations' strategy to prevent leakage, exploitation or abuse relies on deploying firewalls and intrusion detection systems, consider these findings:

• Organizations that provide software security training had 40% fewer vulnerabilities and resolved them 59% faster.
• Organizations that use web application firewalls had 11% more vulnerabilities and resolved them 8%  slower.
• Organizations that make use of application libraries or frameworks to centralize and enforce security controls experienced 64% more vulnerabilities, resolved them 27% slower.

Those who read the Report will note that I've discounted remediation rate when citing findings. As the Report notes, developers have little control over which bugs are fixed or when. These decisions are made based on other business considerations and in my opinion lend little to this conversation; in particular, I suggest you see how your organization fares as you read the section entitled Factors Inhibiting Organizations from Remediating Vulnerabilities.

I'm not suggesting that you toss security software and systems aside and only invest in software security training and disciplined secure code development. I am suggesting that (a) here's good evidence that you ought to invest in software security training and (b) if you want to improve website security, you must recognize that security software and systems at best provide complementary measures. These are additional lines of defense at best; at worst, they sap talent and funding away from secure software projects.

Custom application code is the primary target for website attackers. Focus your security budget on mitigating this problem.

Still not convinced? The Report also finds that organizations whose web site experienced a data or system breach as a result of an application layer vulnerability had 51% fewer vulnerabilities and resolved them 18% faster.

While there is still nothing that makes believers quicker than a breach, you can wait until you become a victim or use this Report and begin to effect change.

Note: I want to thank Jeremiah Grossman for taking time to respond thoroughly and candidly to questions I had after my first read of the Report.