4 ms·

How do we compromise the e-waste with the fact that a Pixel and Pixel 2 already have, comparatively speaking, insecure hardware to the latest secure phones?

rektide 6y ago
There is improved physical security, but I'm not aware of any hardware errata out there that would make the a Pixel or other internet-communicator insecure to use as an internet device. If you can upgrade the kernel, you can get modern defenses against timing attacks (which mainly but not exclusively have appeared in x86 archs), &c.
- 177tcca 6y ago
  There's no upstream firmware being patched by Google. The phone is effectively unpatched once the hardware manufacturer gives up on maintaining its security. This is a fundamental misunderstanding for, I'd guess, well over half of the custom ROM/custom phone OS community. ie: Lineage is customizable, and helps certain activity be more private - but it shatters security.
  - rektide 6y ago
    Again I'd love to see some details, some CVE's, for what issues the hardware has. The computer itself is general purpose enough that I'm not afraid. The cellular stack is a shitshow though! Totally unsupportable garbage, as you say, beholden entirely to a bunch of dodgy punks with no incentive to keep the world running. Which is very much why it's exciting to see Pine64 working on getting Linux running on the PinePhone modem[1]. Because this shit is bogus, 100% bogus full of shit crap. The firmware is all for the most part software, rebadged as firmware because none of us get the privilege of working with it or seeing it. I still would like some evidence that any firmware on the Pixel or Pixel 2 is actually problematic. That the computer itself is at risk. Perhaps there are some DMA engines onboard that can not be locked down, that peripherals unfortunately just had too much unmediated access. I'd like to see some shred of evidence that insecure peripherals are a real threat to the general main computer though, before I agree that we can just start throwing these devices out. [1] https://twitter.com/thepine64/status/1346582145557524488 https://twitter.com/thepine64/status/1346582145557524488
    - 177tcca 6y ago
      > The cellular stack is a shitshow though! IOMMUs are a valid response to this concern that I once also held. That, and no verified boot means if you were hit with a persistent worm through one of a bazillion Linux kernel exploits on the Pinephone, you wouldn't be notified. Check out GrapheneOS.org for what's possibly the most cutting edge applied information on this topic. It's pretty comprehensive. Also: we shouldn't throw the devices out! Just don't put them on a network that has any other valuable equipment.

rektide 6y ago

There is improved physical security, but I'm not aware of any hardware errata out there that would make the a Pixel or other internet-communicator insecure to use as an internet device. If you can upgrade the kernel, you can get modern defenses against timing attacks (which mainly but not exclusively have appeared in x86 archs), &c.

177tcca 6y ago
There's no upstream firmware being patched by Google. The phone is effectively unpatched once the hardware manufacturer gives up on maintaining its security. This is a fundamental misunderstanding for, I'd guess, well over half of the custom ROM/custom phone OS community. ie: Lineage is customizable, and helps certain activity be more private - but it shatters security.
- rektide 6y ago
  Again I'd love to see some details, some CVE's, for what issues the hardware has. The computer itself is general purpose enough that I'm not afraid. The cellular stack is a shitshow though! Totally unsupportable garbage, as you say, beholden entirely to a bunch of dodgy punks with no incentive to keep the world running. Which is very much why it's exciting to see Pine64 working on getting Linux running on the PinePhone modem[1]. Because this shit is bogus, 100% bogus full of shit crap. The firmware is all for the most part software, rebadged as firmware because none of us get the privilege of working with it or seeing it. I still would like some evidence that any firmware on the Pixel or Pixel 2 is actually problematic. That the computer itself is at risk. Perhaps there are some DMA engines onboard that can not be locked down, that peripherals unfortunately just had too much unmediated access. I'd like to see some shred of evidence that insecure peripherals are a real threat to the general main computer though, before I agree that we can just start throwing these devices out. [1] https://twitter.com/thepine64/status/1346582145557524488 https://twitter.com/thepine64/status/1346582145557524488
  - 177tcca 6y ago
    > The cellular stack is a shitshow though! IOMMUs are a valid response to this concern that I once also held. That, and no verified boot means if you were hit with a persistent worm through one of a bazillion Linux kernel exploits on the Pinephone, you wouldn't be notified. Check out GrapheneOS.org for what's possibly the most cutting edge applied information on this topic. It's pretty comprehensive. Also: we shouldn't throw the devices out! Just don't put them on a network that has any other valuable equipment.