3 ms·
"Between the Google play store, Android's general insecurity, and now cell carriers actively pushing spyware, what alternatives exist?" There are no alternativ
by rsync 10y ago
"Between the Google play store, Android's general insecurity, and now cell carriers actively pushing spyware, what alternatives exist?"
There are no alternatives until we have an open baseband.
Every objection you state in your comment about android (and iOS) is dwarfed by the objections you would have if you truly understood the two other general purpose computers inside your phone that you have no control over - namely, your baseband processor and your SIM card.
Your carrier owns you. Your carrier owns you more deeply than any spyware author ever dreamed of owning you.
Your carrier can upload and run arbitrary java applets onto your SIM card without you ever knowing. Your carrier, depending on which SOC you have and how it is implemented, can access your CPU and memory directly. As in, read the passphrase of your cutesy encrypted chat app as you key it in.
We cannot begin to speak of a secure mobile platform or any kind of open source mobile platform until we have an open baseband and control our own SIM cards. We are very, very far away from this.
In the meantime, you have two choices:
1. treat your mobile device as fully compromised and behave accordingly. This is what I do.
2. Buy a non-cellular mobile device (for instance, the old "samsung galaxy player" devices that have no mobile chipset or SIM card) and insert a cellular modem into the USB port and segregate that function there, and use VOIP software. This actually sounds sort-of workable except for one interesting problem - in addition to handling cellular communications, the baseband also handles voice quality like noise cancellation and so on that also needs to be done in real-time and not interrupted by userland events ... and so your actual voice quality will drop as a result of using VOIP on a handset.
- natdempk 10y agoHow does iOS and the iPhone handle this SIM card/baseband processor issue? Is there an article that details the exact threat model and defenses in place?
- londons_explore 10y agoiOS uses Qualcomm and Intel chipsets for basebands. For Qualcomm at least, they share a lot of code with Android, and nearly all the code is fully closed source, even to Apple engineers building the phone above. Note that code does everything from camera autofocus to doing NAT for tethering, to audio decoding while the CPU is sleeping, to setting up the GPU, to handling supercomplex GSM protocols, to determining USB charging current and serial debug interfaces. It is probably more complex than the whole of the rest of the OS. Looking at the quality of open source code from Qualcomm, I have nearly zero confidence in the security of that baseband. I'm confident you could find an "accidentally" open debug interface within a few days of looking.
- M_Grey 10y agoI just use my cell phone as a phone... just a phone (it's not a smartphone); the rest I do on a device that isn't networked. The convenience of a smartphone comes with far too many hooks in my opinion.
- maxerickson 10y agoThe tower pings are for many users just as damaging as all the paranoid fantasies people protect themselves from. Like how many people with legitimate concerns about baseband tampering can safely carry a dumb phone?