6 ms·

On a secure OS like e/OS or Graphene? Not many I'd wager. And you can use something like Insular[0] for extra piece of mind. Besides, these shifty apps are not

On a secure OS like e/OS or Graphene? Not many I'd wager. And you can use something like Insular[0] for extra piece of mind. Besides, these shifty apps are not trying to root your phone, just to, in the worst case, send back data they should, or shouldn't even have access to. [0]https://f-droid.org/en/packages/com.oasisfeng.island.fdroid/ https://f-droid.org/en/packages/com.oasisfeng.island.fdroid/

uhtred 3y ago
hmm so should I use Insular, or Island, or Shelter? Am I not tech savvy enough if I don't know which of those is more trustworthy/better? Is the bar for tech savvy so high now that I have to know what fdroid is, and how to install it (since I don't think it is on google play). Am I only tech savvy if I know what a custom android ROM is and how to install one? This is getting absurd!
- PrimeMcFly 3y ago
  [flagged]
  - uhtred 3y ago
    You're a prick! I have done all these things, but the hypothetical person I am using might not be able to, yet they might be a Windows power user, an Excel master, a gadget lover... but they are not tech savvy because they don't use lineageOS?
    - PrimeMcFly 3y ago
      Insults are not allowed on HN. Please do better.
mindslight 3y ago
This is the solution I've chosen as well. But you need to realize this is a high bar to clear, even in the tech community. Researching, buying the correct phone model, installing a user-representing distribution, and then staying on that distributions' device upgrade treadmill all take time and effort. It would be best described as a hobby, and unfortunately nobody has the time and effort to do all the hobbies they'd like. (I've also got a bunch of "smart" devices sitting around effectively unutilized because Home Assistant crapped the bed 5 years ago and I haven't had time to set up something new) Furthermore all of the secure Android distributions are community projects spearheaded by one or two developers. They could easily fall by the wayside tomorrow (eg CopperheadOS). It's nowhere near a self-sustaining off the shelf solution, despite how easy it seems once you actually do it. Also the looming threat of remote attestation could destroy using secure Android distributions for consumer apps in the blink of an eye. And it's not like the venues that went digital only will then go back to having a paper option if the secure option has disappears. In short, it's great to proselytize and grow the number of people interested in secure phone operating systems. But it's so far from being a prescriptive model to imply that people who haven't done so deserve what they get.
- PrimeMcFly 3y ago
  You don't have to go as far as using a specific rom. There are plenty of much easier sandboxxing solutions available. All that's required is that a tech savvy user use one. Any one.
  - mindslight 3y ago
    You do realize that's a worse message, right? "Use GrapheneOS" is an easy answer, capable of being implemented in two weekends by any intermediate computer user, once they decide to take it on. Figuring out what "easier sandboxing solutions" are actually secure and aren't just snake oil is a much taller order. Especially with the way folk security (mis)advice gets repeated in forums, and the tendency for security amateurs to think more customization choices implies more security.
    - PrimeMcFly 3y ago
      > Figuring out what "easier sandboxing solutions" are actually secure and aren't just snake oil is a much taller order. It shouldn't be for a tech savvy user. I'm sure there are plenty of articles covering this from reputable sources.
      - mindslight 3y ago
        > It shouldn't be for a tech savvy user. I'm sure there are plenty of articles covering this from reputable sources. I'm sorry, but this reads as straight up Dunning-Kruger. Care to suggest any articles about these "easier sandboxing solutions" ? Popular articles on Android security are just as likely to rot your brain as they are to inform you. Remember that trend of "task killers" ? If you were referring to your earlier link to Island - using Android Work Profiles on its own adds some security properties, but it's nowhere near comprehensive enough to assume your device now represents you. The problem is that security is essentially a prove-a-negative endeavor. You can add "solutions" and configure things all day long for a simulation of making things more secure (see also: "antivirus"). But it's only by moving up to a higher context can you see/fix the holes. Witness that even with Graphene on Pixel, you still have the baseband processor doing who-knows-what behind the scenes, and the application processor likely has vulnerabilities to it (this is seemingly a step up from the legacy Qualcomm standard where the AP completely trusts the BB, but it's still a black box). It's just one of the best answers we've got right now for a secureish solution that fits in your pocket with a long battery life, and so it's appropriate to recommend it in a consumer security context. (You also haven't responded to the larger initial point I made, where adoption of these things are really not to the point where we can take them for granted in a societal context)

uhtred 3y ago

hmm so should I use Insular, or Island, or Shelter? Am I not tech savvy enough if I don't know which of those is more trustworthy/better? Is the bar for tech savvy so high now that I have to know what fdroid is, and how to install it (since I don't think it is on google play). Am I only tech savvy if I know what a custom android ROM is and how to install one? This is getting absurd!

PrimeMcFly 3y ago
[flagged]
- uhtred 3y ago
  You're a prick! I have done all these things, but the hypothetical person I am using might not be able to, yet they might be a Windows power user, an Excel master, a gadget lover... but they are not tech savvy because they don't use lineageOS?
  - PrimeMcFly 3y ago
    Insults are not allowed on HN. Please do better.

mindslight 3y ago

This is the solution I've chosen as well. But you need to realize this is a high bar to clear, even in the tech community. Researching, buying the correct phone model, installing a user-representing distribution, and then staying on that distributions' device upgrade treadmill all take time and effort. It would be best described as a hobby, and unfortunately nobody has the time and effort to do all the hobbies they'd like. (I've also got a bunch of "smart" devices sitting around effectively unutilized because Home Assistant crapped the bed 5 years ago and I haven't had time to set up something new) Furthermore all of the secure Android distributions are community projects spearheaded by one or two developers. They could easily fall by the wayside tomorrow (eg CopperheadOS). It's nowhere near a self-sustaining off the shelf solution, despite how easy it seems once you actually do it. Also the looming threat of remote attestation could destroy using secure Android distributions for consumer apps in the blink of an eye. And it's not like the venues that went digital only will then go back to having a paper option if the secure option has disappears. In short, it's great to proselytize and grow the number of people interested in secure phone operating systems. But it's so far from being a prescriptive model to imply that people who haven't done so deserve what they get.

PrimeMcFly 3y ago
You don't have to go as far as using a specific rom. There are plenty of much easier sandboxxing solutions available. All that's required is that a tech savvy user use one. Any one.
- mindslight 3y ago
  You do realize that's a worse message, right? "Use GrapheneOS" is an easy answer, capable of being implemented in two weekends by any intermediate computer user, once they decide to take it on. Figuring out what "easier sandboxing solutions" are actually secure and aren't just snake oil is a much taller order. Especially with the way folk security (mis)advice gets repeated in forums, and the tendency for security amateurs to think more customization choices implies more security.
  - PrimeMcFly 3y ago
    > Figuring out what "easier sandboxing solutions" are actually secure and aren't just snake oil is a much taller order. It shouldn't be for a tech savvy user. I'm sure there are plenty of articles covering this from reputable sources.
    - mindslight 3y ago
      > It shouldn't be for a tech savvy user. I'm sure there are plenty of articles covering this from reputable sources. I'm sorry, but this reads as straight up Dunning-Kruger. Care to suggest any articles about these "easier sandboxing solutions" ? Popular articles on Android security are just as likely to rot your brain as they are to inform you. Remember that trend of "task killers" ? If you were referring to your earlier link to Island - using Android Work Profiles on its own adds some security properties, but it's nowhere near comprehensive enough to assume your device now represents you. The problem is that security is essentially a prove-a-negative endeavor. You can add "solutions" and configure things all day long for a simulation of making things more secure (see also: "antivirus"). But it's only by moving up to a higher context can you see/fix the holes. Witness that even with Graphene on Pixel, you still have the baseband processor doing who-knows-what behind the scenes, and the application processor likely has vulnerabilities to it (this is seemingly a step up from the legacy Qualcomm standard where the AP completely trusts the BB, but it's still a black box). It's just one of the best answers we've got right now for a secureish solution that fits in your pocket with a long battery life, and so it's appropriate to recommend it in a consumer security context. (You also haven't responded to the larger initial point I made, where adoption of these things are really not to the point where we can take them for granted in a societal context)