3 ms·

>If you can replace the software to whatever you like, so can the baddies What are you talking about? A "baddie" can grab my phone, replace my OS, and I won't

• gruez 5y ago
  >What are you talking about? A "baddie" can grab my phone, replace my OS, and I won't even notice? Is that so hard to believe when you consider that you're unconscious 8 hours a day? Even when you're awake I don't imagine it's too hard to find some time where you're separated from your phone. >How does he know my encryption passphrase to set it back? Or he would insert malicious software into a powered-off encrypted block device? He inserts malicious software into the bootloader, which can't be encrypted. See: https://en.wikipedia.org/wiki/Rootkit#Bootkits https://en.wikipedia.org/wiki/Rootkit#Bootkits
  • lvass 5y ago
    >Is that so hard to believe Yes. It's virtually impossible with the physical security measures I employ. Also, if someone did that, my phone would either be left off/prompting encryption passphase - which would be incredibly suspicious, or prompting the screen unlock code, which I could safely insert, realize the phone was tampered, re-install my system and use a different screen lock password having given no useful information, even if the attacker was sophisticated enough to emulate my wallpaper. In the comically-absurd case you still need to protect yourself against that, having a separate device with /boot in a safe location is simple.
    • gruez 5y ago
      >Yes. It's virtually impossible with the physical security measures I employ Do you live in a bunker or something? I'm interested in knowing what types of security measures you employ that protects your phone when you're unconscious for 8 hours. Moreover, the fact that you can adopt such security measures doesn't mean everyone else can or is willing to, and they'd rather have a technological solution. This is especially true if they're not the type of person to compile and flash their own ROMs. >Also, if someone did that, my phone would either be left off/prompting encryption passphase - which would be incredibly suspicious, Phones shut off all the time. It doesn't seem too implausible to fake an excuse, eg. 1. battery ran out 2. the power button was held too long (from being in an awkward position in your pocket?), forcing a reboot 3. flaky software crashing/hanging > re-install my system How can you trust the system was actually reinstalled? Do you disassemble your phone and flash the chips with your computer? >having a separate device with /boot in a safe location is simple. 1. that doesn't actually fix the problem, just moves it around 2. I know of exactly zero phones that can boot off a removable device.
      • BenjiWiebe 5y ago
        My bedroom door has shifted and makes a loud noise when opened. Those 8 hours of unconsciousness are very likely to be interrupted when an attacker opens my door (and then proceeds to trip over the stuff on my floor). Oh, he also has to prevent our paranoid house dog from barking while he's picking the lock on the door.
      • seba_dos1 5y ago
        > 2. I know of exactly zero phones that can boot off a removable device. I know several, including Librem 5 and PinePhone.