6 ms·

Speaking as an Android user, the usefulness of the eco-system is undeniable and leaving that is too much friction for most, even for those who do care about pri

Speaking as an Android user, the usefulness of the eco-system is undeniable and leaving that is too much friction for most, even for those who do care about privacy. I think in addition to the focus on hardware, one approach should be to provide the tools to the users for more control. Provide a rooted phone by default. Add tools that let me see what my phone is doing behind the scenes. Give me option to turn-off some of the things I don't like (e.g. an app is sending analytics to some domain, let me turn that part off without turning off the whole app in a relatively simple way). Help with planned obsolence by providing updates etc and so on. Basically give back some control of jail/castle to the users without asking them to leave it completely. Edit: one more thing, please add NFC. Going back to carrying boatload of cards again is not an option.

fsflover 6y ago
> Provide a rooted phone by default. Librem 5 is rooted. It's basically just a Desktop computer in the form-factor of a phone. > Add tools that let me see what my phone is doing behind the scenes. Everything is open source. You have all the power to study what your phone is doing. Standard GNU/Linux tools should work. > Give me option to turn-off some of the things I don't like Everything is free software, you can change it as you like. Also, there is no analytics by default: https://www.youtube.com/watch?v=yHcHi0TBFv4 https://www.youtube.com/watch?v=yHcHi0TBFv4 > Help with planned obsolence by providing updates Lifetime updates are promised. Even if the company dies, the community can support the phone, since it's FLOSS: https://wp.puri.sm/posts/librem-5-longevity-solving-the-problem-of-disposable-technology/ https://wp.puri.sm/posts/librem-5-longevity-solving-the-prob... > Edit: one more thing, please add NFC. Going back to carrying boatload of cards again is not an option Unfortunately, not in the first version. One step at a time.
- tpxl 6y ago
  >> Add tools that let me see what my phone is doing behind the scenes. >Everything is open source. You have all the power to study what your phone is doing. Standard GNU/Linux tools should work. Yes, for the base system, however for third-party stuff, it would still be nice to prevent the apps from phoning home and stuff.
  - deleted 6y ago
    [deleted]
  - fsflover 6y ago
    But how do you already do it on GNU/Linux? You can do the same.
    - tpxl 6y ago
      Of course you can, but is it obvious and user friendly?
      - entropicdrifter 6y ago
        Linux phones are never going to be especially obvious or user friendly. To get those types of features you need a boatload of investment that the open source community can't hope to muster in any sort of reasonable timeframe. For now the choice is privacy vs user friendliness. Currently rooted/de-Googled Android provides one of the best compromises for the average privacy-minded power user, but maybe in a few more years these Linux phones will be mature enough to give Android more of a run for their money.
        zozbot234 6y ago
        > To get those types of features you need a boatload of investment that the open source community can't hope to muster in any sort of reasonable timeframe. The Linux desktop is an obvious counterexample. If the open source community can develop user-friendly desktop environments (GNOME, KDE Plasma, Xfce) they can surely develop user-friendly mobile stacks.
- brnt 6y ago
  > Everything is open source. You have all the power to study what your phone is doing. Standard GNU/Linux tools should work. The vastness of the just the changelogs makes that untenable. Understanding the changes to such a nontrivial stack is something experts will even struggle with. Certainly, open source code is a prerequisite to any trust, but just that isn't enough.
  - fsflover 6y ago
    Everyone needs to check just one small thing of their choice. It would be enough for a good coverage.
- dathinab 6y ago
  > [..] It's basically just a Desktop computer in the form-factor of a phone. Which is what has me worried the most. The (common) security model of GNU/Linux is for today/2020 in my opinion pretty bad for desktops and totally unacceptable for phones. When I first heard about snap and flatpack I thought things are slowly heading in a better direction but it turns out that was a misconception. I haven't looked into how the libre phone does sandboxing but I don't have to much hopes to be honest.
  - lelele 6y ago
    > The (common) security model of GNU/Linux is for today/2020 in my opinion pretty bad for desktops and totally unacceptable for phones. Would you please expand on this for desktops? or reference any kind of document? Thank you.
    - Zak 6y ago
      I'm not the one you asked, but I think the underlying issue is that the Unix security model is built around the assumption that software shares the user's intent, and is treated as exactly as trusted as the user. Computers at the time tended to be multi-user, so the focus was on protecting users from other users. While there was a risk of overtly malicious software, preventing remote code execution attacks and teaching users not to run trojan horses was mostly sufficient (for Unix users; the broader population using Windows often installed malicious adware in the early 2000s). In a modern environment, software should not necessarily be trusted to act in accordance with the user's wishes or best interests, and there's often a financial incentive for software creators to do things users wouldn't want them to. In the early 2000s, the most visible issue was Windows software that displayed advertisements outside of the software, often not obviously connected to the software. It would often monitor the user's browsing habits and such, leading to the name "spyware". Spyware of that sort was universally considered malicious, but modern smartphone apps often send far more sensitive information, such as location and address books to their creators. Those provide a simple example of a situation the classic Unix security model doesn't address very well. I am the only user of my phone, and I obviously want to be able to read my address book and get my location from the GPS. I do not want the latest and greatest app for sharing pictures of my lunch to track my location to show me restaurant ads, and I only want it to know about people I have explicitly connected to within the app, not my whole address book. Android's security model addresses that to a degree, restricting some capabilities until the user explicitly allows them. Some of these, like filesystem access aren't handled very gracefully, and it's possible for an app to refuse to work until granted permissions it doesn't really need (this is against policy for inclusion in the Play store, but enforcement is imperfect, and software can be installed from other sources). One workaround seen in XPrivacy is to feed fake data to apps.
mvlpn 6y ago
as someone who left ProtonMail for FastMail i fully agree with the friction remark.
- pedro2 6y ago
  I also use Fastmail but can’t commit to it due to Australia’s ‘new’ snooper charter: https://www.reddit.com/r/privacy/comments/auhwq6/australian_fastmail_loses_customers_faces_calls/ https://www.reddit.com/r/privacy/comments/auhwq6/australian_... Looking at Sovereign Email now.
- avianes 6y ago
  Could you explain why you left ProtonMail?
birksherty 6y ago
I use XPrivacyLua. It provides what you are asking privacy wise on android. https://github.com/M66B/XPrivacyLua https://github.com/M66B/XPrivacyLua
- noisy_boy 6y ago
  Thanks for the tip - I'll try it out.
otterlicious 6y ago
Provide a rooted phone by default. Going back to carrying boatload of cards again is not an option. Google Pay doesn't (officially) work on rooted phones. There are lots of other things like that, which is why it makes a lot of sense to ship phones not rooted, while still making it easy to do so.
- Zak 6y ago
  > Google Pay doesn't (officially) work on rooted phones. As the original request was at least partially pointed in Google's direction, it's probably reasonable to treat it as including a request that google not punish the user in other ways for rooting. I do believe fundamentally that if you don't have (or can't easily get) root on a device, you don't really own it. On the other hand, giving unlimited permission to third-party apps isn't a great idea in today's model where arbitrary app developers are most certainly not worthy of unlimited trust. I'd like to have a more sophisticated permissions model, to include things like allowing an app access to only specific files and directories rather than full filesystem access (I'm aware Android has a barely-usable form of this), or network access, but only to specific domain names.
codethief 6y ago
> Provide a rooted phone by default. As a freedom-, privacy- and also security-aware person, I disagree quite strongly. Phones should by default provide a way for people to modify their phone as they see fit but they should definitely not be rooted by default. The reason being that root access is, well, the root of all evil. Practically nothing has advanced end consumer device security in recent times as much as Apple and Google enforcing a secure boot chain (in particular: read-only root file systems), implementing heavy sandboxing and cutting down[0] on apps' permissions. All this is worth nothing if apps can obtain root and do whatever they want. People often claim Linux (as a desktop OS) is secure. It's not by any standard. All the apps you use in your day-to-day tend to have full file system access to all your personal files and full network access. You've merely been lucky so far that you (hopefully) haven't gotten pwned by any rogue application. I'm eagerly awaiting a time when my root file system will be read-only, my entire boot chain will be verified[1] and all my day-to-day applications will be fully sandboxed and only very few of them have network access. [0] Granted, one might argue whether this is actually what Google has done. [1] https://safeboot.dev https://safeboot.dev.
- nybble41 6y ago
  > Phones should by default provide a way for people to modify their phone as they see fit but they should definitely not be rooted by default. You don't see the contradiction here? Root access is synonymous with the ability to modify the device as you see fit. The root of trust starts with the owner of the device, not the hardware manufacturer or operating system developer. This does not imply that any random app should be able to obtain root access, or that you can't have things like verifiable read-only root filesystems and strict sandboxing. It just means that the owner of the device should be in control of the keys—i.e. the "root" user—and that apps should not be able to introspect the system to determine whether or not it's running in a "vendor-approved" configuration. You don't have to use the root account for day-to-day operations just because it's there.
  - codethief 6y ago
    A ROM being "rooted" in the Android context has a very specific meaning: Namely, apps can simply request root access and, boom!, they will have it after the mere tap of a button. (It should be obvious that for security reasons this is not something that should be available to everyone and their grandpa.) So no, I don't see a contradiction here. For instance, I'm running LineageOS on my one phone and stock Android without GApps on my other, so in both cases I'd say I have full control over what's running on my phone. But neither of my phones is rooted.

fsflover 6y ago

> Provide a rooted phone by default. Librem 5 is rooted. It's basically just a Desktop computer in the form-factor of a phone. > Add tools that let me see what my phone is doing behind the scenes. Everything is open source. You have all the power to study what your phone is doing. Standard GNU/Linux tools should work. > Give me option to turn-off some of the things I don't like Everything is free software, you can change it as you like. Also, there is no analytics by default: https://www.youtube.com/watch?v=yHcHi0TBFv4 https://www.youtube.com/watch?v=yHcHi0TBFv4 > Help with planned obsolence by providing updates Lifetime updates are promised. Even if the company dies, the community can support the phone, since it's FLOSS: https://wp.puri.sm/posts/librem-5-longevity-solving-the-problem-of-disposable-technology/ https://wp.puri.sm/posts/librem-5-longevity-solving-the-prob... > Edit: one more thing, please add NFC. Going back to carrying boatload of cards again is not an option Unfortunately, not in the first version. One step at a time.

tpxl 6y ago
>> Add tools that let me see what my phone is doing behind the scenes. >Everything is open source. You have all the power to study what your phone is doing. Standard GNU/Linux tools should work. Yes, for the base system, however for third-party stuff, it would still be nice to prevent the apps from phoning home and stuff.
- deleted 6y ago
  [deleted]
- fsflover 6y ago
  But how do you already do it on GNU/Linux? You can do the same.
  - tpxl 6y ago
    Of course you can, but is it obvious and user friendly?
    - entropicdrifter 6y ago
      Linux phones are never going to be especially obvious or user friendly. To get those types of features you need a boatload of investment that the open source community can't hope to muster in any sort of reasonable timeframe. For now the choice is privacy vs user friendliness. Currently rooted/de-Googled Android provides one of the best compromises for the average privacy-minded power user, but maybe in a few more years these Linux phones will be mature enough to give Android more of a run for their money.
      - zozbot234 6y ago
        > To get those types of features you need a boatload of investment that the open source community can't hope to muster in any sort of reasonable timeframe. The Linux desktop is an obvious counterexample. If the open source community can develop user-friendly desktop environments (GNOME, KDE Plasma, Xfce) they can surely develop user-friendly mobile stacks.
brnt 6y ago
> Everything is open source. You have all the power to study what your phone is doing. Standard GNU/Linux tools should work. The vastness of the just the changelogs makes that untenable. Understanding the changes to such a nontrivial stack is something experts will even struggle with. Certainly, open source code is a prerequisite to any trust, but just that isn't enough.
- fsflover 6y ago
  Everyone needs to check just one small thing of their choice. It would be enough for a good coverage.
dathinab 6y ago
> [..] It's basically just a Desktop computer in the form-factor of a phone. Which is what has me worried the most. The (common) security model of GNU/Linux is for today/2020 in my opinion pretty bad for desktops and totally unacceptable for phones. When I first heard about snap and flatpack I thought things are slowly heading in a better direction but it turns out that was a misconception. I haven't looked into how the libre phone does sandboxing but I don't have to much hopes to be honest.
- lelele 6y ago
  > The (common) security model of GNU/Linux is for today/2020 in my opinion pretty bad for desktops and totally unacceptable for phones. Would you please expand on this for desktops? or reference any kind of document? Thank you.
  - Zak 6y ago
    I'm not the one you asked, but I think the underlying issue is that the Unix security model is built around the assumption that software shares the user's intent, and is treated as exactly as trusted as the user. Computers at the time tended to be multi-user, so the focus was on protecting users from other users. While there was a risk of overtly malicious software, preventing remote code execution attacks and teaching users not to run trojan horses was mostly sufficient (for Unix users; the broader population using Windows often installed malicious adware in the early 2000s). In a modern environment, software should not necessarily be trusted to act in accordance with the user's wishes or best interests, and there's often a financial incentive for software creators to do things users wouldn't want them to. In the early 2000s, the most visible issue was Windows software that displayed advertisements outside of the software, often not obviously connected to the software. It would often monitor the user's browsing habits and such, leading to the name "spyware". Spyware of that sort was universally considered malicious, but modern smartphone apps often send far more sensitive information, such as location and address books to their creators. Those provide a simple example of a situation the classic Unix security model doesn't address very well. I am the only user of my phone, and I obviously want to be able to read my address book and get my location from the GPS. I do not want the latest and greatest app for sharing pictures of my lunch to track my location to show me restaurant ads, and I only want it to know about people I have explicitly connected to within the app, not my whole address book. Android's security model addresses that to a degree, restricting some capabilities until the user explicitly allows them. Some of these, like filesystem access aren't handled very gracefully, and it's possible for an app to refuse to work until granted permissions it doesn't really need (this is against policy for inclusion in the Play store, but enforcement is imperfect, and software can be installed from other sources). One workaround seen in XPrivacy is to feed fake data to apps.

mvlpn 6y ago

as someone who left ProtonMail for FastMail i fully agree with the friction remark.

pedro2 6y ago
I also use Fastmail but can’t commit to it due to Australia’s ‘new’ snooper charter: https://www.reddit.com/r/privacy/comments/auhwq6/australian_fastmail_loses_customers_faces_calls/ https://www.reddit.com/r/privacy/comments/auhwq6/australian_... Looking at Sovereign Email now.
avianes 6y ago
Could you explain why you left ProtonMail?

birksherty 6y ago

I use XPrivacyLua. It provides what you are asking privacy wise on android. https://github.com/M66B/XPrivacyLua https://github.com/M66B/XPrivacyLua

noisy_boy 6y ago
Thanks for the tip - I'll try it out.

otterlicious 6y ago

Provide a rooted phone by default. Going back to carrying boatload of cards again is not an option. Google Pay doesn't (officially) work on rooted phones. There are lots of other things like that, which is why it makes a lot of sense to ship phones not rooted, while still making it easy to do so.

Zak 6y ago
> Google Pay doesn't (officially) work on rooted phones. As the original request was at least partially pointed in Google's direction, it's probably reasonable to treat it as including a request that google not punish the user in other ways for rooting. I do believe fundamentally that if you don't have (or can't easily get) root on a device, you don't really own it. On the other hand, giving unlimited permission to third-party apps isn't a great idea in today's model where arbitrary app developers are most certainly not worthy of unlimited trust. I'd like to have a more sophisticated permissions model, to include things like allowing an app access to only specific files and directories rather than full filesystem access (I'm aware Android has a barely-usable form of this), or network access, but only to specific domain names.

codethief 6y ago

> Provide a rooted phone by default. As a freedom-, privacy- and also security-aware person, I disagree quite strongly. Phones should by default provide a way for people to modify their phone as they see fit but they should definitely not be rooted by default. The reason being that root access is, well, the root of all evil. Practically nothing has advanced end consumer device security in recent times as much as Apple and Google enforcing a secure boot chain (in particular: read-only root file systems), implementing heavy sandboxing and cutting down[0] on apps' permissions. All this is worth nothing if apps can obtain root and do whatever they want. People often claim Linux (as a desktop OS) is secure. It's not by any standard. All the apps you use in your day-to-day tend to have full file system access to all your personal files and full network access. You've merely been lucky so far that you (hopefully) haven't gotten pwned by any rogue application. I'm eagerly awaiting a time when my root file system will be read-only, my entire boot chain will be verified[1] and all my day-to-day applications will be fully sandboxed and only very few of them have network access. [0] Granted, one might argue whether this is actually what Google has done. [1] https://safeboot.dev https://safeboot.dev.

nybble41 6y ago
> Phones should by default provide a way for people to modify their phone as they see fit but they should definitely not be rooted by default. You don't see the contradiction here? Root access is synonymous with the ability to modify the device as you see fit. The root of trust starts with the owner of the device, not the hardware manufacturer or operating system developer. This does not imply that any random app should be able to obtain root access, or that you can't have things like verifiable read-only root filesystems and strict sandboxing. It just means that the owner of the device should be in control of the keys—i.e. the "root" user—and that apps should not be able to introspect the system to determine whether or not it's running in a "vendor-approved" configuration. You don't have to use the root account for day-to-day operations just because it's there.
- codethief 6y ago
  A ROM being "rooted" in the Android context has a very specific meaning: Namely, apps can simply request root access and, boom!, they will have it after the mere tap of a button. (It should be obvious that for security reasons this is not something that should be available to everyone and their grandpa.) So no, I don't see a contradiction here. For instance, I'm running LineageOS on my one phone and stock Android without GApps on my other, so in both cases I'd say I have full control over what's running on my phone. But neither of my phones is rooted.