4 ms·

> if we're talking strictly about security of data at rest (i.e. from a powered off state) I trust my rooted Android with a long FDE passphrase over any iPhone.

> if we're talking strictly about security of data at rest (i.e. from a powered off state) I trust my rooted Android with a long FDE passphrase over any iPhone. If you never power-up your phone maybe. But in any realistic usage scenario you're way insecure with a rooted Android phone. Check this link, it's a quick read. https://madaidans-insecurities.github.io/android.html https://madaidans-insecurities.github.io/android.html

marcan_42 6y ago
That whole article is massive fear mongering. > If an attacker has managed to compromise the entire system and gain extremely high privileges, verified boot will revert their changes upon reboot and ensure they cannot persist. Unlocking the bootloader chiefly means you are insecure against evil-maid attacks. If your phone is compromised via software badly enough that they can flash the OS, the attacker has all your data already. And if they pwned you like that, they can pwn you again, and also, who ever powers off their phone except when the battery runs out? Besides, data-only persistence exploits aren't hard to find. Since I use FDE, an evil-maid attack will at least leave behind the evidence of a powered off phone, and if they just steal it they get nothing. > Verified boot is not just for physical security as many people assume. Its main purpose is protection against remote attackers and the physical security is a nice side-effect. As I said, that's BS because that assumes people power off their phones, which they don't. > An attacker can fake user input by for example, clickjacking That only works if you give apps Accessibility permission. Which nobody sane does for anything but extremely trustworthy apps. > The majority of custom ROMs ruin the security model by disabling verified boot, using userdebug builds, disabling SELinux, not including firmware updates, and a lot more. A common ROM that does many of these is LineageOS. LineageOS isn't one ROM, it's many ports for many devices, and as far as I know most of the decent ones include firmware updates and absolutely do not disable SELinux (are there even any that still do that?). I haven't used a LineageOS build without SELinux in at least 6 or 7 years. Verified boot has to be disabled to allow for add-ons, but we've already covered how that isn't that big of a deal except against evil-maid attacks. As for userdebug, the only thing that does is enable root via ADB - but then LineageOS gives you a toggle to disable it in the settings. And since ADB access is secured via a secure key exchange, you can only use it after a permission prompt or from a previously authorized host. Also, LineageOS doesn't even come with root these days. It's an optional add-on. You can just uninstall it and away goes root. > It does not implement rollback protection so an attacker can downgrade the OS to an old version and exploit already patched vulnerabilities Oh, really? Well, I tried downgrading LineageOS recently, and it refused to unlock my FDE, presumably as the Keymaster implementation noticed and said nope. > It does not include firmware updates which prevents you from getting new patches to fix vulnerabilities. Again, this is device-specific and a meaningless generalization. LineageOS isn't one ROM, it's many ROMs for many devices. Which one are they talking about? Back when I was using a Nexus device, LineageOS builds didn't include firmware but were tied to certain firmware versions and prompted you to pull those updates from factory builds to match, which I always did to make sure my firmware was up to date. Yes, there are more security-focused ROMs like GrapheneOS, and yes, Pixel/Nexus devices are usually the reference for serious security in the Android space (I'm actually waiting for LineageOS support to get a Pixel 4a). But saying "rooting your phone kills security" is a fearmongering generalization. Rooting your phone doesn't mean you give every app root access, it means you give yourself root access.

marcan_42 6y ago

That whole article is massive fear mongering. > If an attacker has managed to compromise the entire system and gain extremely high privileges, verified boot will revert their changes upon reboot and ensure they cannot persist. Unlocking the bootloader chiefly means you are insecure against evil-maid attacks. If your phone is compromised via software badly enough that they can flash the OS, the attacker has all your data already. And if they pwned you like that, they can pwn you again, and also, who ever powers off their phone except when the battery runs out? Besides, data-only persistence exploits aren't hard to find. Since I use FDE, an evil-maid attack will at least leave behind the evidence of a powered off phone, and if they just steal it they get nothing. > Verified boot is not just for physical security as many people assume. Its main purpose is protection against remote attackers and the physical security is a nice side-effect. As I said, that's BS because that assumes people power off their phones, which they don't. > An attacker can fake user input by for example, clickjacking That only works if you give apps Accessibility permission. Which nobody sane does for anything but extremely trustworthy apps. > The majority of custom ROMs ruin the security model by disabling verified boot, using userdebug builds, disabling SELinux, not including firmware updates, and a lot more. A common ROM that does many of these is LineageOS. LineageOS isn't one ROM, it's many ports for many devices, and as far as I know most of the decent ones include firmware updates and absolutely do not disable SELinux (are there even any that still do that?). I haven't used a LineageOS build without SELinux in at least 6 or 7 years. Verified boot has to be disabled to allow for add-ons, but we've already covered how that isn't that big of a deal except against evil-maid attacks. As for userdebug, the only thing that does is enable root via ADB - but then LineageOS gives you a toggle to disable it in the settings. And since ADB access is secured via a secure key exchange, you can only use it after a permission prompt or from a previously authorized host. Also, LineageOS doesn't even come with root these days. It's an optional add-on. You can just uninstall it and away goes root. > It does not implement rollback protection so an attacker can downgrade the OS to an old version and exploit already patched vulnerabilities Oh, really? Well, I tried downgrading LineageOS recently, and it refused to unlock my FDE, presumably as the Keymaster implementation noticed and said nope. > It does not include firmware updates which prevents you from getting new patches to fix vulnerabilities. Again, this is device-specific and a meaningless generalization. LineageOS isn't one ROM, it's many ROMs for many devices. Which one are they talking about? Back when I was using a Nexus device, LineageOS builds didn't include firmware but were tied to certain firmware versions and prompted you to pull those updates from factory builds to match, which I always did to make sure my firmware was up to date. Yes, there are more security-focused ROMs like GrapheneOS, and yes, Pixel/Nexus devices are usually the reference for serious security in the Android space (I'm actually waiting for LineageOS support to get a Pixel 4a). But saying "rooting your phone kills security" is a fearmongering generalization. Rooting your phone doesn't mean you give every app root access, it means you give yourself root access.