4 ms·

You don't use Signal because your phone manufacturer can put a backdoor in the OS or hardware? Why even use a phone?

by verroq 10y ago

Sir_Cmpwn 10y ago
I don't use Signal because of Google Play Services, which is the backdoor this article refers to. I'm reasonably confident that my phone's OS is uncompromised and I take the radio problem into consideration as part of my threat model and change my behaviors on my phone accordingly. I have also made some progress on using OsmocomBB as a radio baseband, and on building a custom phone that treats the radio as hostile and isolates it as much as possible.
- BuuQu9hu 10y ago
  Which device are you using OsmocomBB on? Which custom device are you building? Neo900 looks pretty good for baseband isolation. The phone network and the protocols for connecting to it are pretty user hostile no matter how open and secure the phone and baseband are though. Don't forget the SIM card runs its own insecure OS that people have hacked before and you just can't replace that.
  - Sir_Cmpwn 10y ago
    >Which device are you using OsmocomBB on? A Motorola C139. >Which custom device are you building? A, uh, custom one. >The phone network and the protocols for connecting to it are pretty user hostile no matter how open and secure the phone and baseband are though. >Don't forget the SIM card runs its own insecure OS that people have hacked before and you just can't replace that. Yeah, I'm keeping both of those things in mind. There won't be any assumption that your phone calls or SMS will be secure, but rather that your mainboard OS is secure _from_ the radio and that you don't have to worry about discussions had near your phone and such.
    - BuuQu9hu 10y ago
      Make sure it is secure from the SIM card too.
snowpanda 10y ago
So we should just aim for no security at all then? Why is it that every time someone points out a security flaw, people say "well then don't use a phone?" As if we shouldn't strive for improvements unless everything is 100% secure.

You don't use Signal because your phone manufacturer can put a backdoor in the OS or hardware? Why even use a phone?

by verroq 10y ago

You don't use Signal because your phone manufacturer can put a backdoor in the OS or hardware? Why even use a phone?

I don't use Signal because of Google Play Services, which is the backdoor this article refers to. I'm reasonably confident that my phone's OS is uncompromised and I take the radio problem into consideration as part of my threat model and change my behaviors on my phone accordingly. I have also made some progress on using OsmocomBB as a radio baseband, and on building a custom phone that treats the radio as hostile and isolates it as much as possible.

BuuQu9hu 10y ago
Which device are you using OsmocomBB on? Which custom device are you building? Neo900 looks pretty good for baseband isolation. The phone network and the protocols for connecting to it are pretty user hostile no matter how open and secure the phone and baseband are though. Don't forget the SIM card runs its own insecure OS that people have hacked before and you just can't replace that.
- Sir_Cmpwn 10y ago
  >Which device are you using OsmocomBB on? A Motorola C139. >Which custom device are you building? A, uh, custom one. >The phone network and the protocols for connecting to it are pretty user hostile no matter how open and secure the phone and baseband are though. >Don't forget the SIM card runs its own insecure OS that people have hacked before and you just can't replace that. Yeah, I'm keeping both of those things in mind. There won't be any assumption that your phone calls or SMS will be secure, but rather that your mainboard OS is secure _from_ the radio and that you don't have to worry about discussions had near your phone and such.
  - BuuQu9hu 10y ago
    Make sure it is secure from the SIM card too.

snowpanda 10y ago

So we should just aim for no security at all then? Why is it that every time someone points out a security flaw, people say "well then don't use a phone?" As if we shouldn't strive for improvements unless everything is 100% secure.