5 ms·

The solution I have is a wired-in, locked down raspberry pi where I have a separate email account, PGP key, etc. Phones are definitely a writeoff though, with t

by hkt 5y ago

The solution I have is a wired-in, locked down raspberry pi where I have a separate email account, PGP key, etc. Phones are definitely a writeoff though, with the possible exception of the PinePhone. If memory serves, the 4g modem lacks direct memory access which improves security substantially.

MerelyMortal 5y ago
I'm not sure if the PinePhone advertised that. The Librem 5 advertised that though.
Jeff_Brown 5y ago
Can anyone be sure an enormous open source project like a Linux distribution isn't backdoored?
- kingcharles 5y ago
  For something with a lot of eyes on it, like the Linux kernel, I would think it unlikely. It's the smaller projects with no active maintenance that would be easier targets. At the end of the day, all operating systems have exploits. Nation states pay big money online to buy the exploits for their own use, before the good guys find them and out them. If your system is being compromised by a nation state, it is much more likely buy a purchased exploit than by an explicitly-added backdoor. I can't say anything about intercepting your communications, though. The NSA might or might not have technical ways of decrypting some of your encrypted communications.
- hansel_der 5y ago
  no
Ourgon 5y ago
Those components in that PinePhone, they come from China. Are you sure that flash module does not contain a backdoor? What about the SoC, PinePhone uses Rockchip, the full name of that company is Fuzhou Rockchip Electronics Co., Ltd.. Are you sure the SoC is free from backdoors? Why even limit the search to complex components when a simple SMD capacitor is more than big enough to contain a low-power radio. Add some 'intelligence' and the thing will be able to deduce whether it is mounted in a position which gives it access to interesting data - the power path being a good candidate - to be transmitted on demand. The same would have been true had the components come from any other country but as it stands nearly all such components come from China.
- hkt 5y ago
  Being a little flippant here, but it is the British and American govts I worry about more. At least I don't share a language with Chinese spies! Plus, I'm fairly sure the pi is a known quantity. PinePhone less so. Probably the most secure thing you can do is encrypt messages to your friends, send them as a printed out QR code, and make your signature say "burn after reading". Bonus points for a printer that is old enough that it isn't laden with spyware.

by hkt 5y ago

MerelyMortal 5y ago

I'm not sure if the PinePhone advertised that. The Librem 5 advertised that though.

Jeff_Brown 5y ago

Can anyone be sure an enormous open source project like a Linux distribution isn't backdoored?

kingcharles 5y ago
For something with a lot of eyes on it, like the Linux kernel, I would think it unlikely. It's the smaller projects with no active maintenance that would be easier targets. At the end of the day, all operating systems have exploits. Nation states pay big money online to buy the exploits for their own use, before the good guys find them and out them. If your system is being compromised by a nation state, it is much more likely buy a purchased exploit than by an explicitly-added backdoor. I can't say anything about intercepting your communications, though. The NSA might or might not have technical ways of decrypting some of your encrypted communications.
hansel_der 5y ago
no

Ourgon 5y ago

Those components in that PinePhone, they come from China. Are you sure that flash module does not contain a backdoor? What about the SoC, PinePhone uses Rockchip, the full name of that company is Fuzhou Rockchip Electronics Co., Ltd.. Are you sure the SoC is free from backdoors? Why even limit the search to complex components when a simple SMD capacitor is more than big enough to contain a low-power radio. Add some 'intelligence' and the thing will be able to deduce whether it is mounted in a position which gives it access to interesting data - the power path being a good candidate - to be transmitted on demand. The same would have been true had the components come from any other country but as it stands nearly all such components come from China.

hkt 5y ago
Being a little flippant here, but it is the British and American govts I worry about more. At least I don't share a language with Chinese spies! Plus, I'm fairly sure the pi is a known quantity. PinePhone less so. Probably the most secure thing you can do is encrypt messages to your friends, send them as a printed out QR code, and make your signature say "burn after reading". Bonus points for a printer that is old enough that it isn't laden with spyware.