4 ms·
This. This phone is a joke. I appreciate the effort in trying to patch up that raging security disaster we call Android, but the real problem in any phone is th
by revelation 12y ago
This. This phone is a joke. I appreciate the effort in trying to patch up that raging security disaster we call Android, but the real problem in any phone is the propietary baseband running on some RTOS with little in the way of process isolation (or security conscious programming, for that) connected to a high bandwidth, always on wireless communication interface speaking complex protocols designed by a committee with an endpoint run by companies that have been happily complying with mass-scale surveillance, mere packets away from direct access to the microphone and GPS chip, possibly a DMA directly into the application processor.
Oh, and that neat little micro SIM you put into it? It runs fucking Java and has carrier push support for new "applications" builtin, in the meantime it stores and generates the crypto keys used by the baseband.
This is the state of mobile security. Unless you are running osmocomBB on a crusty old Motorola brick with a logger between the phone and SIM to check for anomalous activity, don't touch it with a 3m pole.
- StavrosK 12y agoIt seems to me like you're saying "mobile phones can never be secured, security is all-or-nothing, and any attempt to secure mobile phones is futile". Is that accurate? Because it seems to me that, sometimes, not leaving your doors and windows wide open, even though "they can always be broken into", is a good idea.
- rsync 12y agoNo, we're not saying that.
- JshWright 12y agoIs there no middle ground? Is there no value to a phone that reduces your NSA dragnet footprint substantially, while at the same time building the capital necessary to develop an open baseband (as I'm sure you're aware, that is not a cheap proposition)?
- dobbsbob 12y agoThere is for business use. Easy to make your own burner phone with customized AOSP for temporary use while in China or CIS/Russia if worried about industrial espionage or legions of criminal blackhats hanging around hotel wireless APs. After going through the source removing stuff like debuggered and GPS binaries, and writing custom init scripts can drop in TextSecure, Redphone and many other open source apps, thegrugq's Darkmatter app, platform sign them and enforce with middleware install-time mac to prevent anything else not signed being installed and use dm-verity to check system.img on boot for tampering. Lot's of business travelers need something reasonably secure to bring that they just end up throwing away when they return. Boot a Mobiflauge patched kernel temporarily with fastboot and wipe/encrypt the device when you get back for safe disposal, then flash Paranoid Android or CyanogenMod to it and sell it on CL to get some of your money back. There's also Nexus 7 devices that can be bought without a baseband to do this. Essential reading is the Android Hacker's Handbook by @pof. Of course using any phone for something illegal is a guaranteed way to get arrested no matter what has been done to it. The hardware will always be a bundle of proprietary blackboxes, likely with a law enforcement door to brick it, record meetings with the mic or track the owner.
- JshWright 12y ago> Easy to make . . . For some definition of 'easy' I suppose... (not any definition that the average person would use).
- rsync 12y agoAnd unfortunately, just about every one of the osmocombb capable phones are euro frequency only, so even this route is not available to those in the us...
- devcpp 12y agoLet's face it: besides its high price and average specs, Blackphone is a normal phone with a proprietary AOSP-based ROM. That's it. No hardware mic/wireless switch whatsoever, no open hardware, no open baseband, not even open software! This is appallingly bad, and if they make bank, it means very bad things for all of us.
- lallysingh 12y agoThe OpenMoko phones (including the (hopefully) upcoming Neo900) run on osmocombb compatible baseband processors.