7 ms·

I think this whole exercise gives you a false sense of security. The thing is, there's a closed-source firmware running on the baseband processor which can do r

by mikevm 12y ago

I think this whole exercise gives you a false sense of security. The thing is, there's a closed-source firmware running on the baseband processor which can do rather nefarious things: https://www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor https://www.fsf.org/blogs/community/replicant-developers-fin... So if you really want to be 'free', get rid of the cellphone.

comzeradd 12y ago
Yeap. BUT between trashing your phone and filling it with proprietary apps there is a huge gap. This is what this post is about. I don't claim you'll get ultimate privacy. I'm sure that most people reading my post or commenting here are using a smartphone.
- TeMPOraL 12y ago
  Well the post mentioned NSA several times as a motivation for those privacy changes. But the NSA can "talk" to cell operators, and cell operators can talk to baseband chips, and baseband chips can "talk" (DMA) to the rest of your phone, so let's be explicit here: this will not protect you from intelligence agencies / state actors. This only might protect you from overly targeted ads.
  - comzeradd 12y ago
    True, but NSA is mentioned just because it made these discussions more vivid and relevant over the last months. The post doesn't claim that you get an NSA-proof phone. I don't think such thing exists.
    - spiritplumber 12y ago
      The real question is, would there be demand for it?
    - TeMPOraL 12y ago
      Agree, but when discussing privacy/anonymity it would be good if people talked more explicitly about the end result. Because most of the solutions that "will improve your privacy" and/or "security" will do so only against targeted ads and technically inept stalkers. Without calling out limits to which the solution improves our "privacy", we're just creating false sense of security in people.
    - akavel 12y ago
      Not sure if you really did this by accident, or if you're playing dumb, but the article does sound like claiming it'll make a phone NSA-safe. Yeah, now that you said so, I notice that it doesn't explicitly claim so, but first paragraphs are sure sprinkled with the name; if you really cared about the reader's safety, it would be responsible then to explicitly state that this advice does not protect against NSA.
      - comzeradd 12y ago
        So I have to explicitly state what this article is not about. Interesting approach...
        TeMPOraL 12y ago
        Well, if you already mention the NSA to make discussion "more relevant" to recent events (which were about... NSA surveillance), then it would be also good to mention that the advice from your article are not meant to secure you from the NSA :). It's good for people to know exactly how much security they get by following particular advice :).
        a8000 12y ago
        Just like Private Browsing Modes in Chrome/Firefox tell you that they won't protect from agents.
        comzeradd 12y ago
        I mention NSA to point out that you should at least avoid Companies that cooperate with them. Nothing more, nothing less.
        CHY872 12y ago
        What, like your phone company? Hmmmmm...
- wutbrodo 12y ago
  Is there any reason in particular that Twitter is one of the apps that you're putting on your ideal privacy-phone? I would've imagined that stuff like http://dcurt.is/twitter-is-tracking-you-on-the-web http://dcurt.is/twitter-is-tracking-you-on-the-web would would put them in the same boat as the other services that were rejected.
Zigurd 12y ago
It's still useful for tablets. There could be other back doors, but, without a PLMN-connected radio it will be harder to find you in order to backdoor you.
r4pha 12y ago
I agree, but I think the value of such initiatives is the awereness it brings to the table _and_ the implications of that to manufacturers, that is, the fact that an increasing number of people may care for privacy. Your point certainly adds to the discussion, but we have to start somewhere.
dutchbrit 12y ago
Exactly my thought!
WildUtah 12y ago
More to the point, the FCC will not approve open source radio drivers. Your baseband will either be closed and under the control of your carrier and various government spies or it will be illegal in the USA. The official reason is that open source radio firmware would be too easy to alter to violate FCC regulations on power, frequency band, and such. It's the same reason that non-proprietary antenna connectors are mostly prohibited.
- aluhut 12y ago
  If they don't approve, could we still use them? I mean, they could hardly check people for proper radio driver if they behave, or could they?
  - jhoechtl 12y ago
    We will never know, as the baseband driver is not free ;)
    - aluhut 12y ago
      I belive in you creative, skilled guys to find a way someday ;)
- pslam 12y ago
  Is this actually true? I've seen this repeated in many comments over a decade, and whenever it's researched it turns out there is no basis for it. The usual conclusion is that the manufacturer claims that they cannot allow open access to their radio because of licensing restrictions, but that no restriction actually exists. It's a lazy way for them not to bother.
  - sliverstorm 12y ago
    Maybe it is, maybe it isn't, but it certainly seems like the very first thing anybody who installs dd-wrt does is increase the Tx power tenfold.
deleted 12y ago
[deleted]
hershel 12y ago
In theory , for phones with cortex-a15 cpu, one could use ARMORED[1] , which encrypts the content of ram, with keys saved outside the reach of the baseband, inside registers. But still, CPU backdoors are possibility. [1]http://www1.informatik.uni-erlangen.de/filepool/projects/armored/armored.paper.pdf http://www1.informatik.uni-erlangen.de/filepool/projects/arm...
MaysonL 12y ago
Even if you had open source baseband firmware, the NSA is still willing and able to impersonate and/or infiltrate cellular operators sufficiently to listen to just about any cellphone conversation it wants to.
gggmaster 12y ago
Free-restricted is a spectrum. You shouldn't dismiss people's effort to move toward the free end. Rome was not built in a day. May be one day grid will help us get rid off carriers.
seba_dos1 12y ago
There's a closed-source firmware running on your PC mainboard, HDD/SSD/SD card, mouse, keyboard, GPU, Ethernet card... All of it can be rather nefarious. Get rid of the PC? (or simply use phones which connect their modems as a peripherals and implement monitoring, like Neo900, not as a master with DMA as most phones today do)
deleted 12y ago
[deleted]
SixSigma 12y ago
Same goes for your computer. You'd be surprised at what's running in your North & South bridges

by mikevm 12y ago

comzeradd 12y ago

Yeap. BUT between trashing your phone and filling it with proprietary apps there is a huge gap. This is what this post is about. I don't claim you'll get ultimate privacy. I'm sure that most people reading my post or commenting here are using a smartphone.

TeMPOraL 12y ago
Well the post mentioned NSA several times as a motivation for those privacy changes. But the NSA can "talk" to cell operators, and cell operators can talk to baseband chips, and baseband chips can "talk" (DMA) to the rest of your phone, so let's be explicit here: this will not protect you from intelligence agencies / state actors. This only might protect you from overly targeted ads.
- comzeradd 12y ago
  True, but NSA is mentioned just because it made these discussions more vivid and relevant over the last months. The post doesn't claim that you get an NSA-proof phone. I don't think such thing exists.
  - spiritplumber 12y ago
    The real question is, would there be demand for it?
  - TeMPOraL 12y ago
    Agree, but when discussing privacy/anonymity it would be good if people talked more explicitly about the end result. Because most of the solutions that "will improve your privacy" and/or "security" will do so only against targeted ads and technically inept stalkers. Without calling out limits to which the solution improves our "privacy", we're just creating false sense of security in people.
  - akavel 12y ago
    Not sure if you really did this by accident, or if you're playing dumb, but the article does sound like claiming it'll make a phone NSA-safe. Yeah, now that you said so, I notice that it doesn't explicitly claim so, but first paragraphs are sure sprinkled with the name; if you really cared about the reader's safety, it would be responsible then to explicitly state that this advice does not protect against NSA.
    - comzeradd 12y ago
      So I have to explicitly state what this article is not about. Interesting approach...
      - TeMPOraL 12y ago
        Well, if you already mention the NSA to make discussion "more relevant" to recent events (which were about... NSA surveillance), then it would be also good to mention that the advice from your article are not meant to secure you from the NSA :). It's good for people to know exactly how much security they get by following particular advice :).
        a8000 12y ago
        Just like Private Browsing Modes in Chrome/Firefox tell you that they won't protect from agents.
        comzeradd 12y ago
        I mention NSA to point out that you should at least avoid Companies that cooperate with them. Nothing more, nothing less.
        CHY872 12y ago
        What, like your phone company? Hmmmmm...
wutbrodo 12y ago
Is there any reason in particular that Twitter is one of the apps that you're putting on your ideal privacy-phone? I would've imagined that stuff like http://dcurt.is/twitter-is-tracking-you-on-the-web http://dcurt.is/twitter-is-tracking-you-on-the-web would would put them in the same boat as the other services that were rejected.

Zigurd 12y ago

It's still useful for tablets. There could be other back doors, but, without a PLMN-connected radio it will be harder to find you in order to backdoor you.

r4pha 12y ago

I agree, but I think the value of such initiatives is the awereness it brings to the table _and_ the implications of that to manufacturers, that is, the fact that an increasing number of people may care for privacy. Your point certainly adds to the discussion, but we have to start somewhere.

dutchbrit 12y ago

Exactly my thought!

WildUtah 12y ago

More to the point, the FCC will not approve open source radio drivers. Your baseband will either be closed and under the control of your carrier and various government spies or it will be illegal in the USA. The official reason is that open source radio firmware would be too easy to alter to violate FCC regulations on power, frequency band, and such. It's the same reason that non-proprietary antenna connectors are mostly prohibited.

aluhut 12y ago
If they don't approve, could we still use them? I mean, they could hardly check people for proper radio driver if they behave, or could they?
- jhoechtl 12y ago
  We will never know, as the baseband driver is not free ;)
  - aluhut 12y ago
    I belive in you creative, skilled guys to find a way someday ;)
pslam 12y ago
Is this actually true? I've seen this repeated in many comments over a decade, and whenever it's researched it turns out there is no basis for it. The usual conclusion is that the manufacturer claims that they cannot allow open access to their radio because of licensing restrictions, but that no restriction actually exists. It's a lazy way for them not to bother.
- sliverstorm 12y ago
  Maybe it is, maybe it isn't, but it certainly seems like the very first thing anybody who installs dd-wrt does is increase the Tx power tenfold.

deleted 12y ago

[deleted]

hershel 12y ago

In theory , for phones with cortex-a15 cpu, one could use ARMORED[1] , which encrypts the content of ram, with keys saved outside the reach of the baseband, inside registers. But still, CPU backdoors are possibility. [1]http://www1.informatik.uni-erlangen.de/filepool/projects/armored/armored.paper.pdf http://www1.informatik.uni-erlangen.de/filepool/projects/arm...

MaysonL 12y ago

Even if you had open source baseband firmware, the NSA is still willing and able to impersonate and/or infiltrate cellular operators sufficiently to listen to just about any cellphone conversation it wants to.

gggmaster 12y ago

Free-restricted is a spectrum. You shouldn't dismiss people's effort to move toward the free end. Rome was not built in a day. May be one day grid will help us get rid off carriers.

seba_dos1 12y ago

There's a closed-source firmware running on your PC mainboard, HDD/SSD/SD card, mouse, keyboard, GPU, Ethernet card... All of it can be rather nefarious. Get rid of the PC? (or simply use phones which connect their modems as a peripherals and implement monitoring, like Neo900, not as a master with DMA as most phones today do)

deleted 12y ago

[deleted]

SixSigma 12y ago

Same goes for your computer. You'd be surprised at what's running in your North & South bridges