8 ms·
I understand this entirely, but there are some pretty bad iOS vulnerabilities out in the wild now (e.g. KRACK wpa2). It’s pretty dangerous to avoid updates nowa
by alphonsegaston 9y ago
I understand this entirely, but there are some pretty bad iOS vulnerabilities out in the wild now (e.g. KRACK wpa2). It’s pretty dangerous to avoid updates nowadays.
I think what needs to happen across the industry is a complete decoupling of “feature” from security patching. Too many people are exposed because of exactly the kind of unwanted UI upgrades you describe.
- miguelrochefort 9y agoDangerous? What's the worse that could happen?
- willstrafach 9y ago1. Ability to passively decrypt network activity (KRACK). 2. Ability to throw a fully persistent implant onto the device (via Wi-Fi exploit + pivot to AP kernel exploit)
- mindslight 9y agoMost phones already come with two persistent implants - the user-antagonistic OS, and the baseband processor! I'm all for trusting computing devices to act as one's agents, but attempting to do so with anything resembling a modern mobile phone is barking up the wrong tree. Even though just having one means taking the location-tracking hit from negligently designed cellular protocols, further exposure can be mitigated by using these little snitches for as little personal activity as possible.
- tscs37 9y agoYour phone will probably turn up in a botnet soon enough, but atleast you had the moral high ground.
- mindslight 9y agoOh no, not a month's allocation of mobile data down the drain! An impersonal passive botnet would likely do less damage than status quo "apps" that are built to siphon as much personal data as possible. Never mind these few Mifi devices that I have - default configs that listen on wan telnet with static passwords! Well known domestic manufacturer, not worth attempting to report - the manufacturer obviously did not care, has long moved on, and there's countless other models with the same problem. The panacea of every node being secure with an identifiable owner fell apart long ago. You can either cling to that belief in a fundamentalist manner (and prop up the totalitarians who wish to track communication ever more). Or you can work on understanding how non-technical people actually attempt to moderate their own exposure to these insecure-by-design surveillance devices.
- tscs37 9y agoYou should install security updates. Period. You don't help anyone by feeling better because instead of having the vendor maybe sniff on you, a hacker can do it instead. I also haven't found any apps yet that intentionally waste my monthly datacap.
- mindslight 9y agoSure, and I didn't advocate doing otherwise. My point is the larger context - there is no "secure" on mobile. Likewise, my point about losing a datacap was that it was preferable to having more personal info backhauled into commercial surveillance databases. It's not an either-or and I'm not desiring either one - just calling attention to the larger context of user-security versus the myopia of marketing/corporate security.
- tscs37 9y agoThere is secure on mobile. Secure is not a binary property, it's a spectrum of options and possibilities which heavily depend on your environment and your threat model. You either get security updates at the possible downside of sending more data to some database of a known vendor or you get the very possible risk of being part of a slide on DEFCON Fail Panel by some unknown blackhat. I choose a known advesary over an unknown any day.
- Analemma_ 9y agoThis all might be true, but as a reason to not install patches, it still makes no sense. If you don’t trust the baseband or the OS, why did you buy the phone to begin with? You trust iOS n, but not iOS n+1?
- mindslight 9y agoOne is forced to buy a phone, as an expectation/requirement of modern society. This does not imply they wish to spend even more money in support of the broken ecosystem every year/six months/etc.
- jamespo 9y agoYou're not forced, particularly not to get a smartphone. You're trading off convenience.
- alsetmusic 9y agoAt some point, reckless behavior affects people beyond the individual. I am irritated that people allow their systems, networks, devices etc to become compromised, thus becoming the assets of malicious actors. Most of the people in this category have are not particularly savvy, which doesn’t give them an out so much as it explains the predicament. However, you are demonstrating that you choose to be in this category, despite understanding the problem. You are letting your personal convictions get in the way of good judgement. You now shoulder responsibility for knowingly making the world a little less safe for the population at large.
- mindslight 9y agoIt's very fucking weird that by pointing out the larger non-corporate context of digital security, it's being inferred that I deliberately do not secure my devices. I guess by not toeing the AppGoogAzon "Security (TM)" marketing lines, I just end up in that "other - outsider" category, and must be wrong. I already explained a mechanic of causality whereby assorted end nodes being owned up actually increases our security, as it helps keep at bay the simplistic/totalitarian philosophy of tracking/controlling communication. But don't let that get in the way of the malunderstanding that is ultimately driving this nebulous desire for promised "security".
- staticassertion 9y agoMost people are willing to accept the risk that the NSA is listening in on them. Most people are not willing to accept the risk of an arbitrary person being able to steal their identity.
- junkscience2017 9y agoThat already happened as a result of Equifax. Your SSN is no longer secret...so rejoice, you are free to choose whatever phone you like!
- zaarn 9y agoSadly, the world is not America and most people on this planet are unaffected by the latest problems of America.
- ben_w 9y agoLike 95% of the world, I don’t have an SSN. Even if every American owns one of those outdated Android phones, 2/3rds of the phones would still have to be owned by people who don’t have SSNs.
- mindslight 9y agoIf one's "identity" is so bland that it can be trivially "stolen", then perhaps it's not much of an identity after all.
- nindalf 9y ago
- PhasmaFelis 9y ago> Most phones already come with two persistent implants - the user-antagonistic OS, and the baseband processor! I don't trust Apple or Google to have my best interests at heart at all, but I am quite confident that neither of them will literally try to extort me with ransomware or kiddie porn. It's weird that you're equating the two.
- fulafel 9y agoDo you mean the worst that could happen to you personally or the worst for everyone? When your device is compromised by hostile actors I guess it depends on what your nightmares are, but getting framed for child pornography and/or blackmailed for it is a popular one. Or getting your cloud accounts hijacked and all your stuff compromised. Or getting the bad guys access to your employer's network. Etc. Collectively a widespread Android device botnet could take down a lot of infrastructure, or start a war, or ruin everyone's days with ransomware. I'm sure more imaginative people have thought about it.
- viraptor 9y agoSimilar questions were likely asked by owners of insecure routers/cameras before they got hit with Mirai
- WillReplyfFood 9y agoBetter have a bricked phone but secured phone? That is basically your argument? Security is used to euthanize perfectly working systems and harass users for money. Security has become dangerous for the user in that aspect.
- amelius 9y agoThat's one reason I'm still hoping for a Linux/Firefox phone.
- noobermin 9y agoThere's not much left to hope for as every platform that attempted one has fizzled out.
- la_oveja 9y agoYou can already have a Linux phone.
- amelius 9y agoBut it doesn't run my banking app.
- jhasse 9y agoMost banking apps are available for Android, which uses the Linux kernel.
- amelius 9y agoYeah, it uses the Linux kernel, but I wouldn't call it a "Linux phone".
- laumars 9y agoI'll grant you that GP was being pedantic but he is also correct. The only part in Debian/RHEL/Arch/whatever that is Linux is the kernel. "Linux" only refers to the kernel. So technically Android is also a distribution of Linux. I think what you're arguing is that Android isn't GNU/Linux or that Android isn't libre like what we've come to expect from desktop distributions of Linux.
- atomicnumber1 9y agoGoogle kind of does that but OEM does not seem to implement them into their phones.