5 ms·

Ask HN: Are there any secure alternatives to iPhone?

5 points by smk_ 5y ago

After the recent revelation of the zero-click exploits targeting iPhones, I am reconsidering my choice of phone. Are there any alternative hardware designers or software systems that offer better security than Apple phones? How does Android or its different distributions hold up? How can one best protect oneself and ones device?

gtvwill 5y ago
Choice of device is mostly useless. They're all the same re. Security. Which is to say their only as good as the jurisdiction their being sold/used in. And given the laws Australia has implemented, if a company sells their product here or has operations registered in Australia you can't guarantee it hasn't been backdoored.
- tentacleuno 5y ago
  > And given the laws Australia has implemented, if a company sells their product here or has operations registered in Australia you can't guarantee it hasn't been backdoored. Could you elaborate on this? I haven't heard anything about a new law allowing installing backdoors on devices mid-transit, although I would not be surprised.
RicoElectrico 5y ago
In your threat model take into consideration that there was a "secure phone" sold with an IM app that turned out to be backdoored by the author in cooperation with FBI. https://arstechnica.com/tech-policy/2021/06/fbi-sold-phones-to-organized-crime-and-read-27-million-encrypted-messages/ https://arstechnica.com/tech-policy/2021/06/fbi-sold-phones-...
shaicoleman 5y ago
Security is only as good as the weakest link. Each company that touches the phone or the software increases the attack surface. Therefore, from a security perspective, the phones with the best security are the iPhones and the Google Pixel phones. They also generally have the quickest security updates. If you install a custom ROM (e.g. LineageOS), you can make almost any phone reasonably secure, but that involves a lot of time and hassle. If you don't trust Apple/Google, that's probably your best option. An alternative approach is to have a second device for security sensitive purposes, which can be locked-down, only essential apps installed, offline by default, etc.
- tentacleuno 5y ago
  > f you install a custom ROM (e.g. LineageOS), you can make almost any phone reasonably secure Do the official LineageOS releases have Verified Boot (allow you to lock the bootloader)? Everything I've tried uses userdebug keys, which is pretty bad security-wise, and requires an unlocked bootloader. I ask because Verified Boot ensures the root of trust is there in the binaries. If they're wrong by one bit, the OS won't boot. Realistically, even if your OS has additionally security features compared to AOSP, it'd still be like building a house out of obsidian, then putting a wooden barn door on it.
  - shaicoleman 5y ago
    > Do the official LineageOS releases have Verified Boot (allow you to lock the bootloader)? Possible in theory, but complicated: https://source.android.com/security/verifiedboot/device-state#user-settable-root-of-trust https://source.android.com/security/verifiedboot/device-stat... https://www.reddit.com/r/LineageOS/comments/i76xme/is_it_possible_to_run_los_with_a_locked_bootloader/g10dew0/ https://www.reddit.com/r/LineageOS/comments/i76xme/is_it_pos... These attacks require physical access to the device, and a rather sophisticated adversary. If the attacker has physical access to the device, they could plant a camera to get the passwords or use a $5 wrench, etc. https://xkcd.com/538/ https://xkcd.com/538/ At that security level, you can't trust a single device, and you'll probably need to look at security solutions such as hardware security keys (Yubikeys), Shamir's Secret Sharing, plausibly deniable encryption, etc.
- tentacleuno 5y ago
  > Security is only as good as the weakest link. Each company that touches the phone or the software increases the attack surface. Didn't Librem try to work around this? I think they sealed it before transport, and used nail polish to ensure the device had not been tampered with in transit.
yuppie_scum 5y ago
Seriously consider a risk-based approach to your security posture.
brenda1996 5y ago
yes you can select from one-plus phone
- tentacleuno 5y ago
  Could you give more information? Why OnePlus in particular?
feisar 5y ago
use the pixel 4a and put graphine OS on it https://graphineos.org https://graphineos.org
- tentacleuno 5y ago
  Either GrapheneOS[0] or CalyxOS[1] are generally viewed as good choices in the privacy community, depending on your threat model. [0]: https://grapheneos.org https://grapheneos.org [1]: https://calyxos.org https://calyxos.org