4 ms·

> " This argument would hold more weight if the government was saying not to use any non-US phone" There's not even such a thing as a "US phone" though, is the

> " This argument would hold more weight if the government was saying not to use any non-US phone" There's not even such a thing as a "US phone" though, is there? Even phones manufactured by US companies like Apple are made in China with Chinese/Taiwanese sourced parts. Google always outsources its Nexus/Pixel devices to third parties like LG and Motorola. Speaking of Motorola, they are now owned by Chinese manufacturer Lenovo, which has also been in hot water lately over spyware and rootkits in their laptops. I'm of two minds about the announcement. On the one hand, Huawei and ZTE have both been caught installing backdoors and spyware on their devices in the past[1]. On the other hand, the US three letter agencies have a vested interest in US citizens carrying around easily monitored and tracked devices, and they easily find ways around Constitutional protections against spying within their own borders. I honestly don't know who to believe in this situation. [1] https://www.fastcompany.com/4025254/new-phone-who-dis-huawei-zte-respond-to-reports-of-secret-back-door-in-android-devices https://www.fastcompany.com/4025254/new-phone-who-dis-huawei...

gascan 9y ago
If Huawei and ZTE put in back doors, and the CIA/FBI/NSA wants into your phone, then you'd expect they would want you to have a Huawei phone. After all, as oft repeated here, a backdoor is accessible to anybody, no matter who it was put in for.
- olympus 9y ago
  Not necessarily. If there is a hardware vulnerability specified by the Chinese government, the NSA would not want you to use that phone. They'd rather keep China from having the easy option and then compromise your info another way (that presumably makes it more difficult for China to get your info).
  - emodendroket 9y ago
    Also, finding the backdoor is still some effort.
tomrod 9y ago
> There's not even such a thing as a "US phone" though, is there? BLU?
- chrononaut 9y ago
  No. Their phones are rebranded devices manufactured in China. I'd also steer clear.[0][1] [0] https://www.kryptowire.com/adups_security_analysis.html https://www.kryptowire.com/adups_security_analysis.html [1] https://www.bitsighttech.com/blog/ragentek-android-ota-update-mechanism-vulnerable-to-mitm-attack https://www.bitsighttech.com/blog/ragentek-android-ota-updat...
bitsnbytes 9y ago
"Even phones manufactured by US companies like Apple are made in China with Chinese/Taiwanese sourced parts." Exactly my thought. US gov't even outsources to private contractors that then subcontract and outsource to China for electronic components including chips that can easily end up in our DOD systems. I wonder if this is more of a money or market thing being pushed by the Existing Oligopoly? Something doesn't appear to add up completely?
- 013a 9y ago
  What doesn't add up is that, in the real world, you can't protect against every threat model. Its their job to protect the best they can. They can't tell Apple to stop building their phones in China, but they can simply say "Don't buy Huawei". That's easy. And moreover, its a bigger threat. With a Huawei phone, the Chinese government has control over everything from the processor to the userspace software. With a small piece of silicon in a fab, the threat surface is much smaller; they'd have to sneak it in against Apple's will, past all of Apple's American-loyal QA. In the software world, we tend to think about security as an absolute, because computer logic is absolute. In the real world, security is probabilities. How can you minimize the chance of breach while minimizing costs.
  - carlmr 9y ago
    >they'd have to sneak it in against Apple's will, past all of Apple's American-loyal QA. Is Apple's QA workforce mostly American or do they have a lot of Chinese H1Bs? I mean loyalty is a fickle thing.
  - coldtea 9y ago
    >What doesn't add up is that, in the real world, you can't protect against every threat model. Its their job to protect the best they can. They can't tell Apple to stop building their phones in China, but they can simply say "Don't buy Huawei". If the 'threat' was real, that makes as much sense as hardening one door in your house, when you have 4 other doors because "you can't protect against every threat model".
    - 9y ago

gascan 9y ago

If Huawei and ZTE put in back doors, and the CIA/FBI/NSA wants into your phone, then you'd expect they would want you to have a Huawei phone. After all, as oft repeated here, a backdoor is accessible to anybody, no matter who it was put in for.

olympus 9y ago
Not necessarily. If there is a hardware vulnerability specified by the Chinese government, the NSA would not want you to use that phone. They'd rather keep China from having the easy option and then compromise your info another way (that presumably makes it more difficult for China to get your info).
- emodendroket 9y ago
  Also, finding the backdoor is still some effort.

tomrod 9y ago

> There's not even such a thing as a "US phone" though, is there? BLU?

chrononaut 9y ago
No. Their phones are rebranded devices manufactured in China. I'd also steer clear.[0][1] [0] https://www.kryptowire.com/adups_security_analysis.html https://www.kryptowire.com/adups_security_analysis.html [1] https://www.bitsighttech.com/blog/ragentek-android-ota-update-mechanism-vulnerable-to-mitm-attack https://www.bitsighttech.com/blog/ragentek-android-ota-updat...

bitsnbytes 9y ago

"Even phones manufactured by US companies like Apple are made in China with Chinese/Taiwanese sourced parts." Exactly my thought. US gov't even outsources to private contractors that then subcontract and outsource to China for electronic components including chips that can easily end up in our DOD systems. I wonder if this is more of a money or market thing being pushed by the Existing Oligopoly? Something doesn't appear to add up completely?

013a 9y ago
What doesn't add up is that, in the real world, you can't protect against every threat model. Its their job to protect the best they can. They can't tell Apple to stop building their phones in China, but they can simply say "Don't buy Huawei". That's easy. And moreover, its a bigger threat. With a Huawei phone, the Chinese government has control over everything from the processor to the userspace software. With a small piece of silicon in a fab, the threat surface is much smaller; they'd have to sneak it in against Apple's will, past all of Apple's American-loyal QA. In the software world, we tend to think about security as an absolute, because computer logic is absolute. In the real world, security is probabilities. How can you minimize the chance of breach while minimizing costs.
- carlmr 9y ago
  >they'd have to sneak it in against Apple's will, past all of Apple's American-loyal QA. Is Apple's QA workforce mostly American or do they have a lot of Chinese H1Bs? I mean loyalty is a fickle thing.
- coldtea 9y ago
  >What doesn't add up is that, in the real world, you can't protect against every threat model. Its their job to protect the best they can. They can't tell Apple to stop building their phones in China, but they can simply say "Don't buy Huawei". If the 'threat' was real, that makes as much sense as hardening one door in your house, when you have 4 other doors because "you can't protect against every threat model".
  - 9y ago