MESSAGE
| DATE | 2016-05-26 |
| FROM | Rick Moen
|
| SUBJECT | Re: [Hangout-NYLXS] | | | Android GRIPE ! | | I take it this was a
|
Quoting Mancini, Sabin (DFS) (Sabin.Mancini-at-dfs.ny.gov):
> Apologies- I know this is a late response, appreciate your feedback-
And I appreciate your thoughts on this.
> Regarding those who say they don't want a smart phone- for me, I
> commute 3 hours round trip per day, and the smart ph. Is a simple and
> quick way to get internet news sites to read ( NON MAIN STREAM MEDIA )
> during commuting, so I might have an idea when the world as we know it
> is coming to an end.... Not practical to boot up a laptop in this
> mode
Back when I was commuting by train, I did bring a small laptop and use
it. For a while in the 1990s, I used a cellular radio as an Internet
gateway for that purpose, but then WiFi became common on trains and
light rail, removing the need for that.
These days, on trains or buses, I'd just use a tablet.
My particular problem with smartphones is two-fold. First, every time
I've checked, the data pricing has been far more than I can justify, so
I just continue to use a mid-200s non-data flipphone (Motorola RAZRv3;
I just got a new one and a spare) for voice calls and SMS, without data
access. Second, the security of smartphones tends to be alarmingly bad
both on the devices themselves and in their radio-communication aspects,
and I don't wish to put my personal data and computing on a device so
much at risk.
The flipphone has the same inherent advantage my PDA does: The hardware
and software is too dumb to suffer major security threat models. And
that is why I continue to keep my 3DES-encrypted password store on my
airgapped PDA, for example -- and _not_ on a computer (except as
encrypted backups of the password database), and never on a smartphone.
One of the principles of security is to favour simplicity. Less going
on means a smaller attack surface, and less to go wrong.
> RE:
> > Just FWIW
> > http://www.ubuntu.com/phone
> >
> > https://www.tizen.org/about
> >
> I take it this was a suggestion to load another OS on the smartpho.
That would have made _some_ degree of sense if I'd owned a smartphone, but
-- as I said -- Ruben knows that I deliberately do not.
If I _did_ have a smartphone, there would be the huge problem of
hardware support. With a tremendous diversity of hardware platforms in
use for smartphones, and a product cycle of around six months, the
likelihood of being able to reflash an aritrary handset to something
else is low to begin with, and decreases to near zero if you wish to be
picky about what you run (Tizen, Maemo/Meego, Copperhead, CynaogenMod,
AOSP, Replicant, Open WebOS, Firefox OS). (Or to _exactly_ zero if it's a device with a
locked bootloader, but that's a total deal-killer.)
The entire embedded-Linux appliance business is frankly hooked on
immediate obsolescence, on proprietary drivers, and consequently on
recklessness about copyright violation. Back when my friend Don Marti
was editor of _Embedded Linux Journal_ (an offshoot of _Linux Journal_
in the days when the latter was published by SSC), he frequently
commented on the anti-open-source attitudes he encountered everywhere.
As much as one has ongoing difficulty doing laptops with Linux on
account of open-source-hostile hardware, the problem is a great deal
worse with smartphones -- and the baseband chipsets (the part that
manages the GSM cellular radio) is the very worst. _Every_ smartphone
requires proprietary baseband firmware, and this has long been known to
be utterly fatal to security. I'll have more to say about this later.
Let us consider the two items suggested (and leave aside the fact that I
specifically don't own, and don't want, as smartphone):
1. Ubuntu Phone. (This distribution ought to be called 'Ubuntu for
Phones', but the other is/was its name. Technically, it is now called
'Ubuntu Touch', by the way, as Canonical renamed it in 2013, in part
because the company pretty much completely failed in the smartphone
market and decided to refocus on tablets.) This load works only on four
very obscure smartphone models from two OEMs ('BQ' and 'Meizu') I've
never even heard of, before. Canonical's Web site claims 'Ubuntu Phone
is all open source', but even a very small amount of Web-searching
reveals that this is a misrepresentation of fact, e.g.,
http://askubuntu.com/questions/235649/will-ubuntu-phone-os-be-entirely-open-source
The only smartphones that are even eligible for Ubuntu Phone / Ubuntu
Touch are ones with an ARM Cortex-A7 CPU, at least 1GB of RAM, 8GB eMMC
for storage, and multi-touch support in the screen hardware. That is
incredibly narrow as a rollout focus, and there are no signs of even
development for other eligible handsets beyond the initial four, let
alone different basic hardware.
Despite the (somewhat false) claim of Ubuntu Phone / Ubuntu Touch being
open source, there is zero existing facility for reflashing any phone,
even eligible ones, with the OS. The only way you can presently get it
is as a preload on one of the four official devices.
2. Tizen. This theoretically promising Linux-based smartphone OS is
theoretically in the hands of an industry consortium with some vague
handwave blessing from Linux Foundation, but in practice is dominated
entirely by Samsung. It is also a horrible forest of patent problems,
for which reason _most_ applications are issued by Samsung under 'Flora
License' a non-open-source MIT-like licence that goes out of its way to
restrict patent rights to the 'Tizen Certified Platform' only.
Although many of the other codebases are under actual open source
licences, the SDK is outright proprietary.
As with Ubuntu Phone / Ubuntu Touch, there is really no ability
whatsoever to load Tizen onto a device. You either buy a (Samsung-only)
device with Tizen preloaded, or you do not have Tizen.
So, no, those were both really lame, objectively bad suggestions on
their merits even leaving aside the fact that Ruben knows I'm not a
smartphone user.
Anyway, about the baseband chipsets: I highly recommend, on both that
subtopic and a lot of surrounding points, this incredibly informative
article by the Tor Project: 'Mission Impossible: Hardening Android for
Security and Privacy':
https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy
I'll quote some eyebrow-raising bits:
Hardware Selection
If you truly wish to secure your mobile device from remote
compromise, it is necessary to carefully select your hardware. First
and foremost, it is absolutely essential that the carrier's baseband
firmware is completely isolated from the rest of the platform.
Because your cell phone baseband does not authenticate the network
(in part to allow roaming), any random hacker with their own cell
network can exploit these backdoors and use them to install malware
on your device. While there are projects underway to determine which
handsets actually provide true hardware baseband isolation, at the
time of this writing there is very little public information
available on this topic. Hence, the only safe option remains a
device with no cell network support at all (though cell network
connectivity can still be provided by a separate device). For the
purposes of this post, the reference device is the WiFi-only version
of the 2013 Google Nexus 7 tablet.
You get that? These security experts, after careful study, gave up
completely on the entire smartphone category (devices with GSM
chipsets), and have developed their hardened-Android setup _solely_
for wifi-only tablets. Why? Because the baseband chipsets are
backdoored and are known to be able to remotely and silently sabotage
system security from below.
And this is one reason why the only GSM device I use (my flipphone)
is one that I do _not_ rely on as a computing device at all, and have no
significant data stored on it.
For users who wish to retain full mobile access, we recommend
obtaining a cell modem device that provides a WiFi access point for data
services only. These devices do not have microphones and in some cases
do not even have fine-grained GPS units (because they are not able to
make emergency calls). [...]
In this way, you achieve true baseband isolation, with no risk of
audio [link] or network [link] surveillance, baseband exploits [link],
or provider backdoors [link].
Get the picture?
I do not choose to own a computing device that the FBI can silently and
invisibly reprogram to spy on me and (e.g.) turn on and off the
microphone at their direction so they can hear what is being said by the
smartphone owner and people around him/her -- even if you've switched
the phone off -- a known capability they have used many times in past
investigations. If FBI can do that, so can Putin's FSB and almost
certainly every major criminal organisation and probably many minor
ones.
http://www.cnet.com/news/fbi-taps-cell-phone-mic-as-eavesdropping-tool/
(Yes, all of those folks and probably dozens of governments can do that
to my RAZRv3, too, but I don't rely on it as a _computing_ device. But
it's not without reason that Snowden asks visitors to put their cellular
phones inside his refrigerator while visiting him.)
_______________________________________________
hangout mailing list
hangout-at-nylxs.com
http://www.nylxs.com/
|
|
