3 ms·

A lot of the comments here are complaining about trash software that exists on other phones that isn't removable. The difference here is that it isn't just garb

A lot of the comments here are complaining about trash software that exists on other phones that isn't removable. The difference here is that it isn't just garbage ware that might have vulnerabilities like the stuff Samsung puts on its phone, this is actively malicious. This especially sucks because the people who can't afford a good phone will pay not only in having a poorer user experience but they'll have their financial and social media information stolen as soon as its used on these devices. That means the people who can least afford (via both time and money) to deal with identity theft will be the ones hit the hardest.

kop316 7y ago
Heh, it's funny you say that. I just broke my phone and had to go get a new one. I was holding out for the PinePhone/Librem 5 to be useful enough that I wouldn't need another Android device. The cheapest device that I trusted was the Pixel 3a, and that's because I can cleanly install GrapheneOS and not have google play install. That was $400. It was very tempting to get a $100 phone, but this was my exact worry.
- dathinab 7y ago
  The problem is that it's increasingly harder to run a non Google certified Android phone. For example many German (EU?) Banks now have some form of 2FA system for credit card payments which requires a Android/iPhone app which does only run on non rooted certified phones. (Through it should be noted that in Germany credit card is not the major payment method and many people don't even have one, instead dbit cards with V-Pay, giropay, etc. are dominant. ) As a site note this is also the case for their online banking Apps, but you can just use their website instead.
  - silon42 7y ago
    Some web sites even require an android app to login (key generation)
    - silon42 7y ago
      Banks here used to support client digital certificates well, but have switched to this mess because of poor browser support (removing things like KEYGEN without viable alternatives).
  - deogeo 7y ago
    Sounds like it's time for regulation to step in and stop this practice.
  - klingonopera 7y ago
    > this is also the case for their online banking Apps, but you can just use their website instead. ...unless their website also has 2FA, and relies on an Android/Apple app for auth. Or you pay them money to lug around a USB device for 2FA. For both people who have dumbphones or run custom ROMs, despite the security risks, there should still be an SMS-2FA option.
- TrueDuality 7y ago
  I really wish this was more than just a privacy concern. Google for all the shady, immoral, and frankly weird data collection they do on people; Google doesn't actively discriminate against classes of people with their services. They'll track a high income individual the same as a homeless one. These low-end phones, preloaded with malware, and likely running and outdated and vulnerable version of the base OS with no hope of patches... Having a hope of being successful in our society right now in any meaningful way requires some level of access to the internet and these bare-minimum phones are it for a lot of people. Security online is a massive social issue that we can't rely on end-user awareness to solve. This is a supply chain attack that only hurts the worse off. You're on this site which in its own way gives you a certain baseline technical merit; You're actively are aware of the threat of these low-end phones so you don't fall into that potential trap. The people that can't make that jump between the $100 and $400 phone shouldn't have to deal with additional ongoing personal and financial repercussions from trying to participate in our modern society.

kop316 7y ago

Heh, it's funny you say that. I just broke my phone and had to go get a new one. I was holding out for the PinePhone/Librem 5 to be useful enough that I wouldn't need another Android device. The cheapest device that I trusted was the Pixel 3a, and that's because I can cleanly install GrapheneOS and not have google play install. That was $400. It was very tempting to get a $100 phone, but this was my exact worry.

dathinab 7y ago
The problem is that it's increasingly harder to run a non Google certified Android phone. For example many German (EU?) Banks now have some form of 2FA system for credit card payments which requires a Android/iPhone app which does only run on non rooted certified phones. (Through it should be noted that in Germany credit card is not the major payment method and many people don't even have one, instead dbit cards with V-Pay, giropay, etc. are dominant. ) As a site note this is also the case for their online banking Apps, but you can just use their website instead.
- silon42 7y ago
  Some web sites even require an android app to login (key generation)
  - silon42 7y ago
    Banks here used to support client digital certificates well, but have switched to this mess because of poor browser support (removing things like KEYGEN without viable alternatives).
- deogeo 7y ago
  Sounds like it's time for regulation to step in and stop this practice.
- klingonopera 7y ago
  > this is also the case for their online banking Apps, but you can just use their website instead. ...unless their website also has 2FA, and relies on an Android/Apple app for auth. Or you pay them money to lug around a USB device for 2FA. For both people who have dumbphones or run custom ROMs, despite the security risks, there should still be an SMS-2FA option.
TrueDuality 7y ago
I really wish this was more than just a privacy concern. Google for all the shady, immoral, and frankly weird data collection they do on people; Google doesn't actively discriminate against classes of people with their services. They'll track a high income individual the same as a homeless one. These low-end phones, preloaded with malware, and likely running and outdated and vulnerable version of the base OS with no hope of patches... Having a hope of being successful in our society right now in any meaningful way requires some level of access to the internet and these bare-minimum phones are it for a lot of people. Security online is a massive social issue that we can't rely on end-user awareness to solve. This is a supply chain attack that only hurts the worse off. You're on this site which in its own way gives you a certain baseline technical merit; You're actively are aware of the threat of these low-end phones so you don't fall into that potential trap. The people that can't make that jump between the $100 and $400 phone shouldn't have to deal with additional ongoing personal and financial repercussions from trying to participate in our modern society.