4 ms·

If you're running an Android phone open settings > Network & Internet > Internet > click on your network (e.g. Google Fi) > turn on 2G network protection (at th

If you're running an Android phone open settings > Network & Internet > Internet > click on your network (e.g. Google Fi) > turn on 2G network protection (at the bottom). Alternatively: Security & privacy > Advanced Protection > Device protection. That does other stuff too though I'm not aware of a way to do this on iPhones... I'm not an expert, but my understanding is that many of these attacks work by performing 2G downgrading.

lcnPylGDnU4H9OF 1y ago
> a way to do this on iPhones A quick search suggests Lockdown mode might do it, which is corroborated by their support docs. It also does a bunch of other things that will probably degrade most users' experience, for what it's worth. https://support.apple.com/en-us/105120 https://support.apple.com/en-us/105120 > Wireless connectivity: Your device won't automatically join non-secure Wi-Fi networks and will disconnect from a non-secure Wi-Fi network when you turn on Lockdown Mode. 2G and 3G cellular support is turned off for iPhone and iPad. (Instructions to enable it are on the linked page.)
- godelski 1y ago
  Thanks! But also WTF Apple... I appreciate that this mode exists but each of those things should be allowed to be toggled independently. People need more fine grained experience. For things that I think will affect people more than the wireless connectivity Messages: Most message attachment types are blocked, other than certain images, video, and audio. Some features, such as links and link previews, are unavailable. FaceTime: Incoming FaceTime calls are blocked unless you have previously called that person or contact within the past 30 days. Features such as SharePlay and Live Photos are unavailable. I swear... Apple really does not want to make privacy and security convenient for users. It's as if (...) they want to provide the tools to say they have the best security but then make the UX so poor that no one will end up using them (and then they can justify not developing more because "nobody uses them")
  - xvector 1y ago
    Security engineer here. Bundling these together actually makes sense. - Message attachments are blocked because Apple has not figured out to serialize and deserialize attachments without buffer overflows. Look at how many zero days are due to message attachments. It's pretty clownish tbh. - FaceTime is blocked because Apple has not figured out how to prevent an incoming FaceTime call from silently spying on you, which has already happened a couple times. Government interception of your cell connection falls into a similar category of threat, so it's bundled together.
    - toast0 1y ago
      > FaceTime is blocked because Apple has not figured out how to prevent an incoming FaceTime call from silently spying on you, which has already happened a couple times. There's also the codec problem. Apple doesn't trust itself to write secure codecs for message attachments, realtime codecs are at least as suspect. Codecs are tricky, and many vendors mess them up, so I'm not picking on Apple.
    - godelski 1y ago
      I'm sorry, but you didn't make a case for bundling together and why finer grain control is would not make sense. I have no doubt that the problems you guys solve are incredibly complex. There is no question about that. But does bundling really make sense? I'm not sure why being subject to a 2G downgrade attack is relevant to my threat model including message attachments or FaceTime. For example, going to a concert, protest, or any large gathering greatly increases my chance of being subject to a 2G downgrade attack but I'm unconvinced it increases my chances of multimedia or FaceTime based attacks. These fall together in an high enough level but doesn't all security issues? A step down in abstraction and I don't think these are linked. But you're the expert here. I'll trust you over me, but would like to better understand what I'm missing. This is Hacker News. We can expect everyone here to be familiar with programming and basic security here. So get technical with me
      - habinero 1y ago
        Also security engineer here. You're thinking too small and in the wrong direction. You're not protecting against 2G downgrade attacks, you're protecting against an attacker who has a whole library of things to try on you to see what works. Lockdown mode is intended to protect against sophisticated actors, the kind who will buy 0days for six or seven figures, roll it into a new version of their product and sell it to governments. Lockdown mode blocks the riskiest parts of the platform. For example, iMessage no longer automatically unfurls links, because anyone can send you a message and potentially send an exploit that your phone happily triggers without you doing anything. You don't get to pick a la carte because Apple wants the feature to be effective and simple to enable.
- Havoc 1y ago
  There is also a 5G standalone option that forces everything on to 5g That would appear to cut 4G too though which is not great
hypeatei 1y ago
Is there a reason why Google and Apple wouldn't turn 2G downgrade off by default? Even the setting itself says "emergency calls over 2G are still allowed" so what is the reasoning behind leaving people exposed to this?
- simcop2387 1y ago
  Likely due to areas that still have only 2g coverage. Still a lot of that in rural usa
  - hypeatei 1y ago
    What areas are those? From some quick research, the only carrier left that provides 2G coverage is T-Mobile but they're phasing that out this year.
    - godelski 1y ago
      Just because the map shows you can get 5G (or 4G) does not mean you'll actually be able to use that network. It's tricky and telecom companies like to play these bullshit games. It's pretty similar to how they'll advertise "up to X MBPS" internet speeds but the average speed is far lower. You'll actually have these experiences in congested cities. Ever go to a concert and realize you don't actually have cell service? That's because the tower is fully occupied. Unfortunately phones might not report this to you and might not report the downgrade. Making Android and Apple complacent...
  - yencabulator 1y ago
    Is that still true? Even 3G support was largely torn down in the US some years back. https://www.eseye.com/resources/blogs/2g-3g-network-status-updates/#shutdown-dates https://www.eseye.com/resources/blogs/2g-3g-network-status-u... https://www.pcmag.com/how-to/the-3g-shutdown-how-will-it-affect-your-phone https://www.pcmag.com/how-to/the-3g-shutdown-how-will-it-aff...
- zigzag312 1y ago
  My recent experience when roaming was that calls only worked on 2G even though 4G and 5G were avaliable. After a call, phone would sometimes stay stuck on 2G which meant internet was not working. I had to disable 2G to force the phone to switch to 5G. But if I forgot to enable 2G again, calls didn't work. I checked this with multiple people and they all had the same issue.
esalman 1y ago
It looks like there's no such option on T-Mobile network settings. I'm on an OnePlus 12R and vanilla Oxygen OS.
- hnuser123456 1y ago
  Not tmobile's fault, oxygenos' fault.
cookiengineer 1y ago
Better way to protect yourself is to get rid of Android's Google Play services. Install a mod like GrapheneOS or LineageOS and use F-droid to get your apps. Install Molly, the FOSS Signal client. Don't use WhatsApp, don't use Telegram, don't use Meta apps, don't use TikTok, don't use Snapchat. Install EFFs Rayhunter App. Install a Bluetooth beacon tracker protection app like AirGuard. Use a firewall app like NetGuard to protect leaking traffic. Always remember, a device has an IMEI associated with its modem, there is no point to switch SIM cards if they're tracking you. Phones with no removable battery are always on, even when they're off, and will react to Silent SMS (class 0) that are stealthy pings that can track you. Especially iOS devices are always trackable, even in Airplane mode or when they're turned "off". Buy used hardware from eBay, check LineageOS wiki for compatibility. Stay safe.

lcnPylGDnU4H9OF 1y ago

> a way to do this on iPhones A quick search suggests Lockdown mode might do it, which is corroborated by their support docs. It also does a bunch of other things that will probably degrade most users' experience, for what it's worth. https://support.apple.com/en-us/105120 https://support.apple.com/en-us/105120 > Wireless connectivity: Your device won't automatically join non-secure Wi-Fi networks and will disconnect from a non-secure Wi-Fi network when you turn on Lockdown Mode. 2G and 3G cellular support is turned off for iPhone and iPad. (Instructions to enable it are on the linked page.)

godelski 1y ago
Thanks! But also WTF Apple... I appreciate that this mode exists but each of those things should be allowed to be toggled independently. People need more fine grained experience. For things that I think will affect people more than the wireless connectivity Messages: Most message attachment types are blocked, other than certain images, video, and audio. Some features, such as links and link previews, are unavailable. FaceTime: Incoming FaceTime calls are blocked unless you have previously called that person or contact within the past 30 days. Features such as SharePlay and Live Photos are unavailable. I swear... Apple really does not want to make privacy and security convenient for users. It's as if (...) they want to provide the tools to say they have the best security but then make the UX so poor that no one will end up using them (and then they can justify not developing more because "nobody uses them")
- xvector 1y ago
  Security engineer here. Bundling these together actually makes sense. - Message attachments are blocked because Apple has not figured out to serialize and deserialize attachments without buffer overflows. Look at how many zero days are due to message attachments. It's pretty clownish tbh. - FaceTime is blocked because Apple has not figured out how to prevent an incoming FaceTime call from silently spying on you, which has already happened a couple times. Government interception of your cell connection falls into a similar category of threat, so it's bundled together.
  - toast0 1y ago
    > FaceTime is blocked because Apple has not figured out how to prevent an incoming FaceTime call from silently spying on you, which has already happened a couple times. There's also the codec problem. Apple doesn't trust itself to write secure codecs for message attachments, realtime codecs are at least as suspect. Codecs are tricky, and many vendors mess them up, so I'm not picking on Apple.
  - godelski 1y ago
    I'm sorry, but you didn't make a case for bundling together and why finer grain control is would not make sense. I have no doubt that the problems you guys solve are incredibly complex. There is no question about that. But does bundling really make sense? I'm not sure why being subject to a 2G downgrade attack is relevant to my threat model including message attachments or FaceTime. For example, going to a concert, protest, or any large gathering greatly increases my chance of being subject to a 2G downgrade attack but I'm unconvinced it increases my chances of multimedia or FaceTime based attacks. These fall together in an high enough level but doesn't all security issues? A step down in abstraction and I don't think these are linked. But you're the expert here. I'll trust you over me, but would like to better understand what I'm missing. This is Hacker News. We can expect everyone here to be familiar with programming and basic security here. So get technical with me
    - habinero 1y ago
      Also security engineer here. You're thinking too small and in the wrong direction. You're not protecting against 2G downgrade attacks, you're protecting against an attacker who has a whole library of things to try on you to see what works. Lockdown mode is intended to protect against sophisticated actors, the kind who will buy 0days for six or seven figures, roll it into a new version of their product and sell it to governments. Lockdown mode blocks the riskiest parts of the platform. For example, iMessage no longer automatically unfurls links, because anyone can send you a message and potentially send an exploit that your phone happily triggers without you doing anything. You don't get to pick a la carte because Apple wants the feature to be effective and simple to enable.
Havoc 1y ago
There is also a 5G standalone option that forces everything on to 5g That would appear to cut 4G too though which is not great

hypeatei 1y ago

Is there a reason why Google and Apple wouldn't turn 2G downgrade off by default? Even the setting itself says "emergency calls over 2G are still allowed" so what is the reasoning behind leaving people exposed to this?

simcop2387 1y ago
Likely due to areas that still have only 2g coverage. Still a lot of that in rural usa
- hypeatei 1y ago
  What areas are those? From some quick research, the only carrier left that provides 2G coverage is T-Mobile but they're phasing that out this year.
  - godelski 1y ago
    Just because the map shows you can get 5G (or 4G) does not mean you'll actually be able to use that network. It's tricky and telecom companies like to play these bullshit games. It's pretty similar to how they'll advertise "up to X MBPS" internet speeds but the average speed is far lower. You'll actually have these experiences in congested cities. Ever go to a concert and realize you don't actually have cell service? That's because the tower is fully occupied. Unfortunately phones might not report this to you and might not report the downgrade. Making Android and Apple complacent...
- yencabulator 1y ago
  Is that still true? Even 3G support was largely torn down in the US some years back. https://www.eseye.com/resources/blogs/2g-3g-network-status-updates/#shutdown-dates https://www.eseye.com/resources/blogs/2g-3g-network-status-u... https://www.pcmag.com/how-to/the-3g-shutdown-how-will-it-affect-your-phone https://www.pcmag.com/how-to/the-3g-shutdown-how-will-it-aff...
zigzag312 1y ago
My recent experience when roaming was that calls only worked on 2G even though 4G and 5G were avaliable. After a call, phone would sometimes stay stuck on 2G which meant internet was not working. I had to disable 2G to force the phone to switch to 5G. But if I forgot to enable 2G again, calls didn't work. I checked this with multiple people and they all had the same issue.

esalman 1y ago

It looks like there's no such option on T-Mobile network settings. I'm on an OnePlus 12R and vanilla Oxygen OS.

hnuser123456 1y ago
Not tmobile's fault, oxygenos' fault.

cookiengineer 1y ago

Better way to protect yourself is to get rid of Android's Google Play services. Install a mod like GrapheneOS or LineageOS and use F-droid to get your apps. Install Molly, the FOSS Signal client. Don't use WhatsApp, don't use Telegram, don't use Meta apps, don't use TikTok, don't use Snapchat. Install EFFs Rayhunter App. Install a Bluetooth beacon tracker protection app like AirGuard. Use a firewall app like NetGuard to protect leaking traffic. Always remember, a device has an IMEI associated with its modem, there is no point to switch SIM cards if they're tracking you. Phones with no removable battery are always on, even when they're off, and will react to Silent SMS (class 0) that are stealthy pings that can track you. Especially iOS devices are always trackable, even in Airplane mode or when they're turned "off". Buy used hardware from eBay, check LineageOS wiki for compatibility. Stay safe.