15 ms·

Linux Phones [are less secure than mainstream Android]

44 points by concinds 5y ago

concinds 5y ago
I thought this was important to post here, given the amount of people that claim to have switched to Linux Phones after Apple's CSAM debacle. The author recommends using mainstream iOS/Android or GrapheneOS on Pixel Phones. Here's his overview of Android security: https://madaidans-insecurities.github.io/android.html https://madaidans-insecurities.github.io/android.html I also slightly editorialized the title, since it is extremely non-descriptive of article contents.
- realusername 5y ago
  It always depend of your definition of security, I'm personally prevented from checking those claims on Android so I trust it much less than my Linux laptop, despite whatever Google could claim. Additionally, who knows what's really running in userland in Android...
  - atok1 5y ago
    I trust my versions of Linux infinitely more times than anything corporate made, despite the claims, just as you succinctly said.
- jiggunjer 5y ago
  Did people switch because Linux was thought to be more secure, or did they switch because they were sick of Apple?
- piaste 5y ago
  While everything the author writes makes sense to me, I think the kind of security threats he focuses on aren't the main concern for most people. What % of Android devices have their bootloader unlocked or root enabled? Or have the ability to enable signature spoofing for MicroG? I doubt that malware targeting such weaknesses would be economically profitable to develop, considering also that the typical hardcore user is less likely to just install random Play Store or unverified APKs . This seems a list of security weaknesses against _targeted_ attacks - the inclusion of "evil maid" attacks is exemplary. If somebody gains physical access to my phone, by far the greatest risk to me is that they will steal it and immediately wipe it, not that they will install bootloader malware and put it back. So yeah, if you're e.g. a professional user and might be the target of industrial espionage, follow the author's advice to the T (going with GrapheneOS or not depends on whether your company trusts Google with your business data). Graphene > Google > Lineage > Linux. If you just don't want to have your personal data tracked by Google and want better control over the apps you install, Graphene > Lineage > Linux > Google.
  - realusername 5y ago
    > if you just don't want to have your personal data tracked by Google and want better control over the apps you install, Which is the most common security risk for common people let's be realistic. Yeah they are we could say ""protected"" by the trusted boot but in reality the google & manufacturer blobs sending their data somewhere are their main security threat, much more than any other kind of attacks.
  - rndgermandude 5y ago
    The article also mentions a lot of things that will make it generally easier for remote attackers to gain a "permanent" foot in the door once they find a way in (e.g. an exploitable "app"), like the lack of "app" sandboxing (for the most part).
- zepto 5y ago
  > given the amount of people that claim to have switched to Linux Phones If any significant number of people had switched, we’d have seen announcements by Purism and Pine.
aborsy 5y ago
But Linux based phones might be better in terms of privacy and data collection en mass, and giving back to society via open source software and hardware. Large firms offer platforms that are secure against anyone other than themselves (and their partners, such as states). Google tracks and collects huge data through various channels, and Apple scans your information in your own device (and its operating system is even closed source and cannot be verified). Their platforms might be incrementally more secure against advanced expensive attacks, e.g., targeted attacks performed by a company such as NSO. If you are an average user, do you worry more about maximizing the security or major privacy concerns, namely: automatic mass data collection, tracking and profiling by governments and those in power, or fancy attacks targeted to you?
- boopmaster 5y ago
  I was overseas recently checking out the Huawei Harmony OS devices and did stop to consider that while the Chinese could be spying on me with their distribution, they’d totally lack authority over me and may be less inclined to provide account details as Google will do for location based dragnet requests.
  - Iolaum 5y ago
    I d be cautious of that approach given Apple's history in China. Your use case is a mirror image of it (Apple in China).
- AnonHP 5y ago
  > Apple scans your information in your own device (and its operating system is even closed source and cannot be verified). Open source may be better in certain ways, but a statement that closed source cannot be verified as to what it’s doing is narrow and incomplete. Android’s key parts are also closed source (there’s a lot more in “Android” than AOSP).
  - nicce 5y ago
    Open source is also quite meaningless in terms of privacy, unless you can verify that the running binary is build from the visible source.
goodpoint 5y ago
Only if your definition of "security" ignores privacy, freedom from surveillance and bugdoors.
Kenji 5y ago
That's complete bullshit propaganda and you know it. Remember how the govt simply pushed Covid surveillance apps to Android users without their consent? Yeah, try that on a bare Linux phone.
- goodpoint 5y ago
  The article makes plenty of completely arbitrary statements and ignores entire categories of attacks.
- zepto 5y ago
  Which govt?
- temptemptemp111 5y ago
  Yes, it makes you wonder how many people in the "compsec" community are on a payroll. They are always making a security value judgement that their own literature calls fallacious. They choose to trust Google/Intel/AMD "because you have to trust someone" (and the like). They are doing the security analysis for us and telling us that if we have a different value judgement of risk assessment (a risk assessment is a value judgement in and of it self), then we are not expert enough to have an opinion. Clearly this is dishonesty. And it is no wonder none of them will put their credentials on the line critiquing the literal black box operating systems running inside of every modern CPU called a "management engine." These are often even network accessible.
padraic7a 5y ago
I would be interested to see a more comprehensive article. Pure OS, and the Librem phone get a lot of coverage but they aren't the totality of Linux phones. As I understand it Ubuntu Touch, which is the most mature Linux phone OS, does have app sandboxing. This blog post might be a little out of date but is hopefully useful; https://ubports.com/blog/ubports-news-1/post/ubuntu-touch-safety-architecture-25 https://ubports.com/blog/ubports-news-1/post/ubuntu-touch-sa...
- jiggunjer 5y ago
  I'm considering a Cosmo communicator with Sailfish OS.
  - mpol 5y ago
    Sailfish already uses selinux and there is work in progress for firejail (sailjail). Sailjail is already enabled for system apps, but not for third party apps. Also, the Android App Support is running under LXC.
    - zeotroph 5y ago
      Thanks for the information, is there an page with an overview of the SailfishOS security concept and progress somewhere (other than reading the changelogs)?
      - m4rtink 5y ago
        I found this: https://sailfishos.org/wiki/Security https://sailfishos.org/wiki/Security https://forum.sailfishos.org/t/privacy-and-security-of-sailfishos/6028 https://forum.sailfishos.org/t/privacy-and-security-of-sailf... But personally I don't think sandboxing is the the one and only ideal solution - already I can introspect the environment on my Sailfish OS device much better than an Android device with hundreds of opaque proprietary services running in background doing something. Also basically all the third part native apps are open source & developed by long term trusted community members. So I personally trust Sailfish OS devices much more to be secure and private just as a result of these things.
jiggunjer 5y ago
Security is only one of many factors people consider when purchasing a phone. That said, the author isn't very convincing when he mentions trivial stuff like verified boot. My takeaway is that Linux (or PureOS) has some issues but Android still has more closed source.
tommek4077 5y ago
What a crap. Secure boot is a straw man for "locked down" phone. In this view it is insecure to be free to use any software you like. And this article on a hacker site. BS.
- gruez 5y ago
  >In this view it is insecure to be free to use any software you like. How is this "BS"? If you can replace the software to whatever you like, so can the baddies. Readers of a "hacker site" (you do realize the "hacker" in hn refers to hackathons rather than bad guys breaking into servers?) might accept this trade-off, but it still means it's less secure
  - realusername 5y ago
    > How is this "BS"? If you can replace the software to whatever you like, so can the baddies. And how are we confident that the ROM preinstalled is itself secure? Nobody can assert that and the owner is even prevented to check it. The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs, all behind the so-called trusted boot.
    - gruez 5y ago
      >And how are we confident that the ROM preinstalled is itself secure? And what about your linux phone's rom? Do they have reproducible builds yet? Sure, it might be open source, but did anyone audit the millions of line of code to make sure it's actually backdoor/bug free? Moreover, HN readers might actually understand this stuff, but what about non-technical people? They're probably better off using a locked down phone with OEM ROM (you already have to trust the OEM) than with a locked down phone that can possibly be replaced with malicious firmware. >The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs source?
      - realusername 5y ago
        I'm not even talking about reproducible builds, pre-installed phone ROMs are one step below that, there's no "builds". You just have no idea at all what's in it, there's not even a simple list available of what's in it... Here's a reminder that there's not a single android phone on the planet which runs AOSP. > They're probably better off using a locked down phone with OEM ROM (you already have to trust the OEM) than with a locked down phone that can possibly be replaced with malicious firmware. I don't think so, unless OEM are going to increase their standards, a thirdparty ROM will always be better since they can be reviewed and have at least a list of what's in there. That's a very low bar indeed but preinstalled ROMs have such low standards, that makes it better. > source? Which source? They aren't publishing any. Those services blobs have full permission to do whatever they want. They update in the background, can escape the sandbox, send device data home...
ollieparanoid 5y ago
I'm involved in postmarketOS, one of the Linux phone distributions the article talks about. Also a heavy Qubes OS user and previously user of a certain hardened android project on the nexus 5x while strcat was still involved in it. I think it's quite simple, * if you are a more casual user with strong security and privacy needs, then the Linux phone distros are not there yet. Use something else. * if you are a Linux enthusiast/developer/hacker who is interested in getting away from Google and Apple eco systems, consider getting involved in one of these Linux phone projects and helping out there. This should not be seen as competition, it's all free and open source software. Android hardening projects focus on delivering a reasonable solution today while Linux phone projects focus on getting something truly independent in the long run.
- fouric 5y ago
  When you say: > the Linux phone distros are not there yet Is there any indication that Linux is going to catch up to Android/iOS in terms of security? From my perspective, not only has Linux userspace security barely improved at all over the past few decades (almost all programs run as the user with all of their privileges, no sandboxing, barely any permission/access control to speak of (and yes, I know that there are some projects that aim to fix this, but they're all woefully immature and barely adopted)), but the Unix philosophy itself seems opposed to these security measures. Am I just being overly pessimistic?
  - doubled112 5y ago
    I like to think there are some groups thinking about these problems. Could using something like Fedora Silverblue or OpenSUSE MicroOS (immutable OSes) plus Flatpak (containerized apps) plus SELinux (access controls) get you almost there? These already exist, but I've seen the push back to the concepts in real life among admins around me, so I wouldn't expect the mass adoption it'd need to stabilize anytime soon. I'm not even including the Internet rage and arguments about these technologies.
    - the_rectifier 5y ago
ape4 5y ago
Android gives each installed app a unique userid and groupid. Do phone Linuxs do that.
- ptx 5y ago
  The usefulness of this approach depends, I think, on whether the apps are actively working against the user's interests and need to be treated as hostile entities. Putting "ls" in a sandbox would make it much less useful and doesn't provide much benefit. On the other hand, the .NET Core CLI utilities, which collect telemetry on Microsoft's behalf, would benefit from sandboxing.
  - ape4 5y ago
    User choice could be good
- goodpoint 5y ago
  Better: they can sandbox each application.
marcodiego 5y ago
The article seems to be considering only security against vulnerabilities. It is completely ignoring security against the vendor.
- foxfluff 5y ago
  Yeah. Exploit mitigations or access controls can improve security in various circumstances, but they are not synonymous with security, and there are circumstances where such security features are just dead weight. Real security is more complicated than just a checklist of features.
incrudible 5y ago
Sure, if you measure security by the amount of buzzwords that were deployed, these phones don't look that great. In practice, these phones are more secure because nobody will bother to target this vanishingly small installed base - except for a highly targeted attack, in which case Android probably isn't going to protect you any better either.
- judge2020 5y ago
  Exactly. If someone like the TSA has a data extraction suite, it'll work on Android and iOS devices before they care about niche linux distros.
- kaba0 5y ago
  Security by obscurity is no real security.
D13Fd 5y ago
I would be surprised by any other result. Android/iOS phones are used by millions of users and backed by huge companies with the resources and strong motivation to make the phones secure. Of course they are going to have fewer vulnerabilities than a niche open-source OS with far fewer resources behind it.
kop316 5y ago
I have seen this article a few times, and there's enough wrong info in it that it makes me question the rest of its claims: - The article confuses FireWire and USB in the last paragraph. USB, to my knowledge, doesn't do DMA, while FireWire does. (USB-C can if it has thunderbolt, but Linux phones don't have thunderbolt). The article then references this link for why USB is bad: https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html (here's an archived link: https://web.archive.org/web/20210903200926/https://madaidans-insecurities.github.io/linux.html https://web.archive.org/web/20210903200926/https://madaidans... ) But a crtl+f "USB" comes out empty. - While the accelerometer hack is theoretically possible, it's practically infeasible, EVEN if the accelerometer takes measurements above 4 KHz (being extremely generous here, you probably really want close to 8-10 KHz). But you need that high of a sampling rate to overcome Nyquist. Accelerometer are much closer to 100-500 Hz, so Nyquist will tell you that theorically, you can only recover audio data below 250 Hz. I'm all for discussing security tradeoffs with Linux Phones vs Android vs iOS, but seeing those two issues alone makes me question the other claims that I don't have knowledge about. Edit: For a paper on using an accelerator as a microphone: https://crypto.stanford.edu/gyrophone/files/gyromic.pdf https://crypto.stanford.edu/gyrophone/files/gyromic.pdf So on this paper looking at it, the experiment is done where the speakers are at 75 dB and the phone is one foot away (See Section 3.4). 75 dB looks to be about as loud as a vacuum cleaner. The phone is also completely still, so there is no other data that is being recorded besides (very loud) audio.
- concinds 5y ago
  > The article confuses FireWire and USB in the last paragraph. I believe he's not; the paragraph about USB and the one about FireWire are separate ones. And his point that kernel isolation of the modem is flawed because of properties of the Linux kernel seem accurate, though I don't have the expertise to confirm that (you'd need to ctrl+f "kernel", not "USB", since the point is a general one)
  - kop316 5y ago
    So why bring in FireWire at all to the argument? Why not give USB examples? Giving the benefit of the doubt, the writing is extremely unclear and, to me, gives the impression of a comparison between the two. Same with referring to the other article, there's a general link to another article, where the reader is left guessing where they are making the point. To me, if you reference an article in this manner: "Linux kernel USB stack which is not a strong barrier as shown in the Linux article" I would expect the linked article to reference....well the USB stack, or USB in general. Or reference what section you mean, or quote it and bring it in to the article.
reuqwajhae 5y ago
This is spectacularly bad. Author rails against separating the modem, claiming iommu is sufficient (yeah, google qualcomm iommu cve, you'll find plenty of fun to be had). Then goes on claiming that chips connected by usb 2.0 (a protocol explicitly used because it doesn't have rdma) might be vulnerable to some rdma attack.... because firewire exists? They rail against being unable to swap out "the firmware", while failing to mention that "the firmware" in question is nothing more than the ddr4 memory training blob.
nsajko 5y ago
This is a veiled attack on user freedom itself. The article is based on the idea that software isn't free and doesn't give controls to the user that the user should rightfully have as the device owner. When it talks about security models and "modern security features", it assumes that the running software utilities aren't trusted. One interesting point is the firmware being difficult to update. I guess that that could hypothetically become an issue if the firmware were open-sourced or reversed, but still it seems like a reasonable decision once you realize that firmware updates can introduce new bugs/vulnerabilities.
- seba_dos1 5y ago
  It's not true though, the firmwares aren't difficult or impossible to update on these phones. It's a common myth that's often being repeated just because PureOS does not include non-free firmware updates in its repositories.
- kaba0 5y ago
  > but still it seems like a reasonable decision once you realize that firmware updates can introduce new bugs/vulnerabilities. As opposed to having only old bugs and vulns…
Wowfunhappy 5y ago
If retaining control of my own devices makes me less secure, then I want to be less secure.
xt00 5y ago
The authors suggestion to “install android” as a way to fix the security on these Linux phones obviously misses the point. People want a phone where they can do whatever they want with it.
xlaacid 5y ago
While most of this article can be argued to be true, they missed a key point of early adoption of linux phones- privacy. They forgot to mention how both Ios/Android are less private than the linux phone. Also, they should have delineated between security, privacy, and anonymity to be clear on what point they were trying to make. Poorly written at best.
lvass 5y ago
The only remotely sane points are about UX and the fact these GNU/Linux systems allow users to do stupid things if they want to. Running software from your distro's repos? That's safe, I mean, how could you use a system and not trust the people who make it? The only alternative here is writing your own OS (analyzing everything is much harder than that). Running something else? Firejail is really simple to use. Sometimes flatpak or docker can get you covered (just don't assume it's safe by default). You can always use SELinux if you have to. You can't prove linux-libre is less safe than a slightly more recent non-libre, and it'd be surprising if that were the case. Not having kill switches isn't better than having them. The rest either have been considered acceptable in the safety-paranoid Linux community for years or are absurd. Claiming something like DMA is possible from the isolated modem is a VERY strong claim presented with zero evidence.
- kaba0 5y ago
  > Running software from your distro's repos? An important distinction to make: open-source software has a high chance of not being malicious. It doesn’t make them safe, especially with the overwhelming majority of them being C all the way down. A single bug (of which they are not absent at all) can introduce security implications depending on their usecase. Eg a firefox bug can easily make your device running untrusted code without any other remaining defense on your device. So open-source is orthogonal to security.
claudiojulio 5y ago
Github repository there is a lot of criticism: https://github.com/madaidans-insecurities/madaidans-insecurities.github.io/issues https://github.com/madaidans-insecurities/madaidans-insecuri...

44 points by concinds 5y ago

I thought this was important to post here, given the amount of people that claim to have switched to Linux Phones after Apple's CSAM debacle. The author recommends using mainstream iOS/Android or GrapheneOS on Pixel Phones. Here's his overview of Android security: https://madaidans-insecurities.github.io/android.html https://madaidans-insecurities.github.io/android.html I also slightly editorialized the title, since it is extremely non-descriptive of article contents.

realusername 5y ago
It always depend of your definition of security, I'm personally prevented from checking those claims on Android so I trust it much less than my Linux laptop, despite whatever Google could claim. Additionally, who knows what's really running in userland in Android...
- atok1 5y ago
  I trust my versions of Linux infinitely more times than anything corporate made, despite the claims, just as you succinctly said.
jiggunjer 5y ago
Did people switch because Linux was thought to be more secure, or did they switch because they were sick of Apple?
piaste 5y ago
While everything the author writes makes sense to me, I think the kind of security threats he focuses on aren't the main concern for most people. What % of Android devices have their bootloader unlocked or root enabled? Or have the ability to enable signature spoofing for MicroG? I doubt that malware targeting such weaknesses would be economically profitable to develop, considering also that the typical hardcore user is less likely to just install random Play Store or unverified APKs . This seems a list of security weaknesses against _targeted_ attacks - the inclusion of "evil maid" attacks is exemplary. If somebody gains physical access to my phone, by far the greatest risk to me is that they will steal it and immediately wipe it, not that they will install bootloader malware and put it back. So yeah, if you're e.g. a professional user and might be the target of industrial espionage, follow the author's advice to the T (going with GrapheneOS or not depends on whether your company trusts Google with your business data). Graphene > Google > Lineage > Linux. If you just don't want to have your personal data tracked by Google and want better control over the apps you install, Graphene > Lineage > Linux > Google.
- realusername 5y ago
  > if you just don't want to have your personal data tracked by Google and want better control over the apps you install, Which is the most common security risk for common people let's be realistic. Yeah they are we could say ""protected"" by the trusted boot but in reality the google & manufacturer blobs sending their data somewhere are their main security threat, much more than any other kind of attacks.
- rndgermandude 5y ago
  The article also mentions a lot of things that will make it generally easier for remote attackers to gain a "permanent" foot in the door once they find a way in (e.g. an exploitable "app"), like the lack of "app" sandboxing (for the most part).
zepto 5y ago
> given the amount of people that claim to have switched to Linux Phones If any significant number of people had switched, we’d have seen announcements by Purism and Pine.

aborsy 5y ago

But Linux based phones might be better in terms of privacy and data collection en mass, and giving back to society via open source software and hardware. Large firms offer platforms that are secure against anyone other than themselves (and their partners, such as states). Google tracks and collects huge data through various channels, and Apple scans your information in your own device (and its operating system is even closed source and cannot be verified). Their platforms might be incrementally more secure against advanced expensive attacks, e.g., targeted attacks performed by a company such as NSO. If you are an average user, do you worry more about maximizing the security or major privacy concerns, namely: automatic mass data collection, tracking and profiling by governments and those in power, or fancy attacks targeted to you?

boopmaster 5y ago
I was overseas recently checking out the Huawei Harmony OS devices and did stop to consider that while the Chinese could be spying on me with their distribution, they’d totally lack authority over me and may be less inclined to provide account details as Google will do for location based dragnet requests.
- Iolaum 5y ago
  I d be cautious of that approach given Apple's history in China. Your use case is a mirror image of it (Apple in China).
AnonHP 5y ago
> Apple scans your information in your own device (and its operating system is even closed source and cannot be verified). Open source may be better in certain ways, but a statement that closed source cannot be verified as to what it’s doing is narrow and incomplete. Android’s key parts are also closed source (there’s a lot more in “Android” than AOSP).
- nicce 5y ago
  Open source is also quite meaningless in terms of privacy, unless you can verify that the running binary is build from the visible source.

goodpoint 5y ago

Only if your definition of "security" ignores privacy, freedom from surveillance and bugdoors.

Kenji 5y ago

That's complete bullshit propaganda and you know it. Remember how the govt simply pushed Covid surveillance apps to Android users without their consent? Yeah, try that on a bare Linux phone.

goodpoint 5y ago
The article makes plenty of completely arbitrary statements and ignores entire categories of attacks.
zepto 5y ago
Which govt?
temptemptemp111 5y ago
Yes, it makes you wonder how many people in the "compsec" community are on a payroll. They are always making a security value judgement that their own literature calls fallacious. They choose to trust Google/Intel/AMD "because you have to trust someone" (and the like). They are doing the security analysis for us and telling us that if we have a different value judgement of risk assessment (a risk assessment is a value judgement in and of it self), then we are not expert enough to have an opinion. Clearly this is dishonesty. And it is no wonder none of them will put their credentials on the line critiquing the literal black box operating systems running inside of every modern CPU called a "management engine." These are often even network accessible.

padraic7a 5y ago

I would be interested to see a more comprehensive article. Pure OS, and the Librem phone get a lot of coverage but they aren't the totality of Linux phones. As I understand it Ubuntu Touch, which is the most mature Linux phone OS, does have app sandboxing. This blog post might be a little out of date but is hopefully useful; https://ubports.com/blog/ubports-news-1/post/ubuntu-touch-safety-architecture-25 https://ubports.com/blog/ubports-news-1/post/ubuntu-touch-sa...

jiggunjer 5y ago
I'm considering a Cosmo communicator with Sailfish OS.
- mpol 5y ago
  Sailfish already uses selinux and there is work in progress for firejail (sailjail). Sailjail is already enabled for system apps, but not for third party apps. Also, the Android App Support is running under LXC.
  - zeotroph 5y ago
    Thanks for the information, is there an page with an overview of the SailfishOS security concept and progress somewhere (other than reading the changelogs)?
    - m4rtink 5y ago
      I found this: https://sailfishos.org/wiki/Security https://sailfishos.org/wiki/Security https://forum.sailfishos.org/t/privacy-and-security-of-sailfishos/6028 https://forum.sailfishos.org/t/privacy-and-security-of-sailf... But personally I don't think sandboxing is the the one and only ideal solution - already I can introspect the environment on my Sailfish OS device much better than an Android device with hundreds of opaque proprietary services running in background doing something. Also basically all the third part native apps are open source & developed by long term trusted community members. So I personally trust Sailfish OS devices much more to be secure and private just as a result of these things.

jiggunjer 5y ago

Security is only one of many factors people consider when purchasing a phone. That said, the author isn't very convincing when he mentions trivial stuff like verified boot. My takeaway is that Linux (or PureOS) has some issues but Android still has more closed source.

tommek4077 5y ago

What a crap. Secure boot is a straw man for "locked down" phone. In this view it is insecure to be free to use any software you like. And this article on a hacker site. BS.

gruez 5y ago
>In this view it is insecure to be free to use any software you like. How is this "BS"? If you can replace the software to whatever you like, so can the baddies. Readers of a "hacker site" (you do realize the "hacker" in hn refers to hackathons rather than bad guys breaking into servers?) might accept this trade-off, but it still means it's less secure
- realusername 5y ago
  > How is this "BS"? If you can replace the software to whatever you like, so can the baddies. And how are we confident that the ROM preinstalled is itself secure? Nobody can assert that and the owner is even prevented to check it. The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs, all behind the so-called trusted boot.
  - gruez 5y ago
    >And how are we confident that the ROM preinstalled is itself secure? And what about your linux phone's rom? Do they have reproducible builds yet? Sure, it might be open source, but did anyone audit the millions of line of code to make sure it's actually backdoor/bug free? Moreover, HN readers might actually understand this stuff, but what about non-technical people? They're probably better off using a locked down phone with OEM ROM (you already have to trust the OEM) than with a locked down phone that can possibly be replaced with malicious firmware. >The most common security threat aren't coming from the trusted boot but play services blobs & manufacturer blobs source?
    - realusername 5y ago
      I'm not even talking about reproducible builds, pre-installed phone ROMs are one step below that, there's no "builds". You just have no idea at all what's in it, there's not even a simple list available of what's in it... Here's a reminder that there's not a single android phone on the planet which runs AOSP. > They're probably better off using a locked down phone with OEM ROM (you already have to trust the OEM) than with a locked down phone that can possibly be replaced with malicious firmware. I don't think so, unless OEM are going to increase their standards, a thirdparty ROM will always be better since they can be reviewed and have at least a list of what's in there. That's a very low bar indeed but preinstalled ROMs have such low standards, that makes it better. > source? Which source? They aren't publishing any. Those services blobs have full permission to do whatever they want. They update in the background, can escape the sandbox, send device data home...

ollieparanoid 5y ago

I'm involved in postmarketOS, one of the Linux phone distributions the article talks about. Also a heavy Qubes OS user and previously user of a certain hardened android project on the nexus 5x while strcat was still involved in it. I think it's quite simple, * if you are a more casual user with strong security and privacy needs, then the Linux phone distros are not there yet. Use something else. * if you are a Linux enthusiast/developer/hacker who is interested in getting away from Google and Apple eco systems, consider getting involved in one of these Linux phone projects and helping out there. This should not be seen as competition, it's all free and open source software. Android hardening projects focus on delivering a reasonable solution today while Linux phone projects focus on getting something truly independent in the long run.

fouric 5y ago
When you say: > the Linux phone distros are not there yet Is there any indication that Linux is going to catch up to Android/iOS in terms of security? From my perspective, not only has Linux userspace security barely improved at all over the past few decades (almost all programs run as the user with all of their privileges, no sandboxing, barely any permission/access control to speak of (and yes, I know that there are some projects that aim to fix this, but they're all woefully immature and barely adopted)), but the Unix philosophy itself seems opposed to these security measures. Am I just being overly pessimistic?
- doubled112 5y ago
  I like to think there are some groups thinking about these problems. Could using something like Fedora Silverblue or OpenSUSE MicroOS (immutable OSes) plus Flatpak (containerized apps) plus SELinux (access controls) get you almost there? These already exist, but I've seen the push back to the concepts in real life among admins around me, so I wouldn't expect the mass adoption it'd need to stabilize anytime soon. I'm not even including the Internet rage and arguments about these technologies.
  - the_rectifier 5y ago

ape4 5y ago

Android gives each installed app a unique userid and groupid. Do phone Linuxs do that.

ptx 5y ago
The usefulness of this approach depends, I think, on whether the apps are actively working against the user's interests and need to be treated as hostile entities. Putting "ls" in a sandbox would make it much less useful and doesn't provide much benefit. On the other hand, the .NET Core CLI utilities, which collect telemetry on Microsoft's behalf, would benefit from sandboxing.
- ape4 5y ago
  User choice could be good
goodpoint 5y ago
Better: they can sandbox each application.

marcodiego 5y ago

The article seems to be considering only security against vulnerabilities. It is completely ignoring security against the vendor.

foxfluff 5y ago
Yeah. Exploit mitigations or access controls can improve security in various circumstances, but they are not synonymous with security, and there are circumstances where such security features are just dead weight. Real security is more complicated than just a checklist of features.

incrudible 5y ago

Sure, if you measure security by the amount of buzzwords that were deployed, these phones don't look that great. In practice, these phones are more secure because nobody will bother to target this vanishingly small installed base - except for a highly targeted attack, in which case Android probably isn't going to protect you any better either.

judge2020 5y ago
Exactly. If someone like the TSA has a data extraction suite, it'll work on Android and iOS devices before they care about niche linux distros.
kaba0 5y ago
Security by obscurity is no real security.

D13Fd 5y ago

I would be surprised by any other result. Android/iOS phones are used by millions of users and backed by huge companies with the resources and strong motivation to make the phones secure. Of course they are going to have fewer vulnerabilities than a niche open-source OS with far fewer resources behind it.

kop316 5y ago

I have seen this article a few times, and there's enough wrong info in it that it makes me question the rest of its claims: - The article confuses FireWire and USB in the last paragraph. USB, to my knowledge, doesn't do DMA, while FireWire does. (USB-C can if it has thunderbolt, but Linux phones don't have thunderbolt). The article then references this link for why USB is bad: https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html (here's an archived link: https://web.archive.org/web/20210903200926/https://madaidans-insecurities.github.io/linux.html https://web.archive.org/web/20210903200926/https://madaidans... ) But a crtl+f "USB" comes out empty. - While the accelerometer hack is theoretically possible, it's practically infeasible, EVEN if the accelerometer takes measurements above 4 KHz (being extremely generous here, you probably really want close to 8-10 KHz). But you need that high of a sampling rate to overcome Nyquist. Accelerometer are much closer to 100-500 Hz, so Nyquist will tell you that theorically, you can only recover audio data below 250 Hz. I'm all for discussing security tradeoffs with Linux Phones vs Android vs iOS, but seeing those two issues alone makes me question the other claims that I don't have knowledge about. Edit: For a paper on using an accelerator as a microphone: https://crypto.stanford.edu/gyrophone/files/gyromic.pdf https://crypto.stanford.edu/gyrophone/files/gyromic.pdf So on this paper looking at it, the experiment is done where the speakers are at 75 dB and the phone is one foot away (See Section 3.4). 75 dB looks to be about as loud as a vacuum cleaner. The phone is also completely still, so there is no other data that is being recorded besides (very loud) audio.

concinds 5y ago
> The article confuses FireWire and USB in the last paragraph. I believe he's not; the paragraph about USB and the one about FireWire are separate ones. And his point that kernel isolation of the modem is flawed because of properties of the Linux kernel seem accurate, though I don't have the expertise to confirm that (you'd need to ctrl+f "kernel", not "USB", since the point is a general one)
- kop316 5y ago
  So why bring in FireWire at all to the argument? Why not give USB examples? Giving the benefit of the doubt, the writing is extremely unclear and, to me, gives the impression of a comparison between the two. Same with referring to the other article, there's a general link to another article, where the reader is left guessing where they are making the point. To me, if you reference an article in this manner: "Linux kernel USB stack which is not a strong barrier as shown in the Linux article" I would expect the linked article to reference....well the USB stack, or USB in general. Or reference what section you mean, or quote it and bring it in to the article.

reuqwajhae 5y ago

This is spectacularly bad. Author rails against separating the modem, claiming iommu is sufficient (yeah, google qualcomm iommu cve, you'll find plenty of fun to be had). Then goes on claiming that chips connected by usb 2.0 (a protocol explicitly used because it doesn't have rdma) might be vulnerable to some rdma attack.... because firewire exists? They rail against being unable to swap out "the firmware", while failing to mention that "the firmware" in question is nothing more than the ddr4 memory training blob.

nsajko 5y ago

This is a veiled attack on user freedom itself. The article is based on the idea that software isn't free and doesn't give controls to the user that the user should rightfully have as the device owner. When it talks about security models and "modern security features", it assumes that the running software utilities aren't trusted. One interesting point is the firmware being difficult to update. I guess that that could hypothetically become an issue if the firmware were open-sourced or reversed, but still it seems like a reasonable decision once you realize that firmware updates can introduce new bugs/vulnerabilities.

seba_dos1 5y ago
It's not true though, the firmwares aren't difficult or impossible to update on these phones. It's a common myth that's often being repeated just because PureOS does not include non-free firmware updates in its repositories.
kaba0 5y ago
> but still it seems like a reasonable decision once you realize that firmware updates can introduce new bugs/vulnerabilities. As opposed to having only old bugs and vulns…

Wowfunhappy 5y ago

If retaining control of my own devices makes me less secure, then I want to be less secure.

xt00 5y ago

The authors suggestion to “install android” as a way to fix the security on these Linux phones obviously misses the point. People want a phone where they can do whatever they want with it.

xlaacid 5y ago

While most of this article can be argued to be true, they missed a key point of early adoption of linux phones- privacy. They forgot to mention how both Ios/Android are less private than the linux phone. Also, they should have delineated between security, privacy, and anonymity to be clear on what point they were trying to make. Poorly written at best.

lvass 5y ago

The only remotely sane points are about UX and the fact these GNU/Linux systems allow users to do stupid things if they want to. Running software from your distro's repos? That's safe, I mean, how could you use a system and not trust the people who make it? The only alternative here is writing your own OS (analyzing everything is much harder than that). Running something else? Firejail is really simple to use. Sometimes flatpak or docker can get you covered (just don't assume it's safe by default). You can always use SELinux if you have to. You can't prove linux-libre is less safe than a slightly more recent non-libre, and it'd be surprising if that were the case. Not having kill switches isn't better than having them. The rest either have been considered acceptable in the safety-paranoid Linux community for years or are absurd. Claiming something like DMA is possible from the isolated modem is a VERY strong claim presented with zero evidence.

kaba0 5y ago
> Running software from your distro's repos? An important distinction to make: open-source software has a high chance of not being malicious. It doesn’t make them safe, especially with the overwhelming majority of them being C all the way down. A single bug (of which they are not absent at all) can introduce security implications depending on their usecase. Eg a firefox bug can easily make your device running untrusted code without any other remaining defense on your device. So open-source is orthogonal to security.

claudiojulio 5y ago

Github repository there is a lot of criticism: https://github.com/madaidans-insecurities/madaidans-insecurities.github.io/issues https://github.com/madaidans-insecurities/madaidans-insecuri...