Pixel won’t get KRACK fix until December, but is that really a big deal?
Android never relied on WPA2 for security, so breaking it shouldn’t matter much.
https://arstechnica.com/gadgets/2017/11/pixel-wont-get-krack-fix-until-december-but-is-that-really-a-big-deal/

In October, security researchers discovered a major vulnerability in a Wi-Fi’s WPA2 security called “KRACK.” This “Key Reinstallation Attack” can disrupt the initial encryption handshake that happens when an access point and a device first connect, allowing an attacker to read information assumed to be securely encrypted. It’s possible to totally defeat WPA2 encryption using KRACK, allowing a third party to sniff all the Wi-Fi packets you’re sending out. Any device that uses Wi-Fi and WPA2 is most likely vulnerable to the bug, which at this point is basically every wireless gadget on Earth.

Google and the rest of the OEMs are working to clean up Android’s KRACK epidemic, and, on Monday, Google addressed the bug in the November Android Security Bulletin. A patch was posted this week to the Android Open Source Project (AOSP) repository, and, at the same time, Google started rolling out a November security update to Google Pixel and Nexus devices. But if you read the bulletin closely, you’ll see the November security patch for Google devices does not contain the KRACK fix.

How whack is KRACK on Android, really?

The KRACK vulnerability affects nearly all Wi-Fi devices, but the researchers put a big target on Android specifically when they said the attack was “exceptionally devastating against Linux and Android 6.0 or higher.” The reasoning the post laid out was that because Android could be tricked via KRACK into installing an all-zero encryption key, the researchers claimed it was “trivial to intercept and manipulate traffic sent by these Linux and Android devices.”

KRACK can essentially completely break WPA2 security, but the thing is, while Android does use WPA2 for encryption where available, Android doesn’t rely on WPA2 for security. Android is used to running on a variety of networks. It has to deal with hundreds of carrier configurations around the world, that random coffee shop hot spot that you share with a bunch of strangers, and sometime just connecting to an unencrypted, open Wi-Fi connection. Android already assumes the network is hostile, so even if you break WPA2 security, you’re only treated to a stream of individually encrypted connections. All the Google apps come with their own encryption, and Google’s development documents tell developers to “Send all network traffic from your app over SSL.” Connecting to websites with HTTPS (like Ars Technica!) will still be secure, and all of Android’s back-end Play Services stuff, like the 24/7 connection to Google, is also encrypted.

KRACK is a big deal for some devices, but it’s mainly those that use WPA2 as their primary form of security. A lot of times this is IoT stuff like video cameras or “dumber” devices like a printer.

https://www.theverge.com/2017/11/6/16616132/google-screen-color-clicking-saturation-update

The regular, monthly patches for the Pixel are one of the main reasons to buy a Google phone instead of another Android device. This month, however, the company has done more than add the usual security fixes. For the Pixel 2 and Pixel 2 XL, it has also layered on a bunch of bug fixes and new features. The most important of which, as Android Central reports, are new options for color saturation.

https://www.wired.com/story/krack-wi-fi-meltdown-open-standards

ON MONDAY, THE security community scrambled to unpack Krack, a fundamental vulnerability in the ubiquitous, secure Wi-Fi network standard known a WPA2. Though some of the most popular devices are mercifully already protected (like most of those that run Windows and iOS), a staggering population remains exposed to data theft and manipulation every time they connect to WPA2 Wi-Fi. But as another interminable patching process begins, a different conversation is picking up, too, about how to catch flaws in crucial standards more quickly, and make it easier to patch them.
No software is perfect. Bugs are inevitable now and then. But experts say that software standards that impact millions of devices are too often developed behind closed doors, making it difficult for the broader security community to assess potential flaws and vulnerabilities early on.

How did a bug like krack fester in WPA2, the 13-year-old wifi standard whose flaws have rendered hundreds of millions of devices insecure, some of them permanently so?

Thank the IEEE’s business model. The IEEE is the standards body that developed WPA2, and they fund their operations by charging hundreds of dollars to review the WPA2 standard, and hundreds more for each of the standards it builds upon, so that would-be auditors of the protocol have to shell out thousands just to start looking.

It’s an issue that Carl Mamamud, Public Resource and the Electronic Frontier Foundation have been fighting hard on for years, ensuring that the standards that undergird public safety and vital infrastructure are available for anyone to review, audit and criticize.

Any impediment to independent scrutiny of standards is a form of high-interest, high-risk technology debt and the bill always comes due.