3 ms·

Not to mention the vast majority of android devices have vulnerable wifi firmware, that will never be updated. Somehow fans of phone security think there is not

by throwaway2048 10y ago

Not to mention the vast majority of android devices have vulnerable wifi firmware, that will never be updated. Somehow fans of phone security think there is nothing strange about replacing a phone every 12 months to keep receiving updates...

tptacek 10y ago
What's really happening is that fans of phone security want to say "iPhone" rather than "phone", but when they do that on HN, Linux-on-the-desktop Android supporters come out of the woodwork to yell at them, and it's a winnable argument on a thread that is only about whether iPhones are more secure than Android phones, but not on broader threads where it's just an enormous distraction. As you can see from this thread, some people are bored and just want the distraction and will go out of their way to revive the slapfight. Despite having friends working hard to deliver a secure Android phone for Google, my advice to generalists is the same as yours: avoid Android.
- bitexploder 10y ago
  Agreed. Until the last year or so there was not a single Android OS+Hardware combo that basically had the same full file based encryption capabilities of iOS 4.0. 4 .... dot .... zero. It took some super small subset of Android to reach the security of iOS 5 years ago. I think (think!) Pixel comes close to having most of the features of Secure Enclave -- but you can hardly wave one of the most recent and expensive Android devices around and say "Android is as secure as iOS"... Odds are almost certain any Android phone a consumer will buy today will have far less platform security than iOS.
- ams6110 10y ago
  Since Kryptonite is available for Android phones, it's a point at least worth highlighting. One might think that anyone savvy enough to want an app to manage his ssh private keys would also think about his phone's security. In practice, from my observation, a lot of people who have to use ssh keys don't really understand them and would not think twice about loading an app like this onto their Android phones, alongside all manner of ad-laden apps of unknown quality or provenance. I myself use an Android phone. But I assume it's not secure.
  - yzmtf2008 10y ago
    Edit: misread the message. Removed.
    - deleted 10y ago
      [deleted]
h4waii 10y ago
No. There are hundreds of models of Android devices. Only a handful of Samsung, HTC, Motorola, and some lesser known manufacturers used the BCM4339 chipset.

tptacek 10y ago

What's really happening is that fans of phone security want to say "iPhone" rather than "phone", but when they do that on HN, Linux-on-the-desktop Android supporters come out of the woodwork to yell at them, and it's a winnable argument on a thread that is only about whether iPhones are more secure than Android phones, but not on broader threads where it's just an enormous distraction. As you can see from this thread, some people are bored and just want the distraction and will go out of their way to revive the slapfight. Despite having friends working hard to deliver a secure Android phone for Google, my advice to generalists is the same as yours: avoid Android.

bitexploder 10y ago
Agreed. Until the last year or so there was not a single Android OS+Hardware combo that basically had the same full file based encryption capabilities of iOS 4.0. 4 .... dot .... zero. It took some super small subset of Android to reach the security of iOS 5 years ago. I think (think!) Pixel comes close to having most of the features of Secure Enclave -- but you can hardly wave one of the most recent and expensive Android devices around and say "Android is as secure as iOS"... Odds are almost certain any Android phone a consumer will buy today will have far less platform security than iOS.
ams6110 10y ago
Since Kryptonite is available for Android phones, it's a point at least worth highlighting. One might think that anyone savvy enough to want an app to manage his ssh private keys would also think about his phone's security. In practice, from my observation, a lot of people who have to use ssh keys don't really understand them and would not think twice about loading an app like this onto their Android phones, alongside all manner of ad-laden apps of unknown quality or provenance. I myself use an Android phone. But I assume it's not secure.
- yzmtf2008 10y ago
  Edit: misread the message. Removed.
  - deleted 10y ago
    [deleted]

h4waii 10y ago

No. There are hundreds of models of Android devices. Only a handful of Samsung, HTC, Motorola, and some lesser known manufacturers used the BCM4339 chipset.