Comment by morganvachon | Hacker News Reader

Comment by morganvachon | Hacker News Reader

Parent Full thread

> " This argument would hold more weight if the government was saying not to use any non-US phone"

There's not even such a thing as a "US phone" though, is there? Even phones manufactured by US companies like Apple are made in China with Chinese/Taiwanese sourced parts. Google always outsources its Nexus/Pixel devices to third parties like LG and Motorola. Speaking of Motorola, they are now owned by Chinese manufacturer Lenovo, which has also been in hot water lately over spyware and rootkits in their laptops.

I'm of two minds about the announcement. On the one hand, Huawei and ZTE have both been caught installing backdoors and spyware on their devices in the past[1]. On the other hand, the US three letter agencies have a vested interest in US citizens carrying around easily monitored and tracked devices, and they easily find ways around Constitutional protections against spying within their own borders.

I honestly don't know who to believe in this situation.

[1] https://www.fastcompany.com/4025254/new-phone-who-dis-huawei...

"Even phones manufactured by US companies like Apple are made in China with Chinese/Taiwanese sourced parts."

Exactly my thought. US gov't even outsources to private contractors that then subcontract and outsource to China for electronic components including chips that can easily end up in our DOD systems. I wonder if this is more of a money or market thing being pushed by the Existing Oligopoly?

Something doesn't appear to add up completely?

What doesn't add up is that, in the real world, you can't protect against every threat model. Its their job to protect the best they can. They can't tell Apple to stop building their phones in China, but they can simply say "Don't buy Huawei".

That's easy. And moreover, its a bigger threat. With a Huawei phone, the Chinese government has control over everything from the processor to the userspace software. With a small piece of silicon in a fab, the threat surface is much smaller; they'd have to sneak it in against Apple's will, past all of Apple's American-loyal QA.

In the software world, we tend to think about security as an absolute, because computer logic is absolute. In the real world, security is probabilities. How can you minimize the chance of breach while minimizing costs.

>they'd have to sneak it in against Apple's will, past all of Apple's American-loyal QA.

Is Apple's QA workforce mostly American or do they have a lot of Chinese H1Bs? I mean loyalty is a fickle thing.

>What doesn't add up is that, in the real world, you can't protect against every threat model. Its their job to protect the best they can. They can't tell Apple to stop building their phones in China, but they can simply say "Don't buy Huawei".

If the 'threat' was real, that makes as much sense as hardening one door in your house, when you have 4 other doors because "you can't protect against every threat model".

No. It makes as much sense as securing the 4 doors because that's a relatively cost efficient way to implement basic security. But let's avoid strengthening all the walls with a titanium alloy to protect us when the threat brings a bulldozer to get in. That's expensive.

Asking Apple to manufacturer their phones outside of the US is a highly expensive action.

And the pictures of NSA employees opening parcels to modify the hardware before it gets shipped to certain targets immediatly comes to my mind.

That being said if you don’t control the software, modifying manually a handful of devices doesn’t scale. If you modify all of them the chance that you will be spotted is very high. If you control the software and it is encrypted / not readable, you can backdoor all devices of a whole country. So I can see how it is a step up in term of threat level.

Not sure why this was downvoted. Those pictures are right here:

https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...

If Huawei and ZTE put in back doors, and the CIA/FBI/NSA wants into your phone, then you'd expect they would want you to have a Huawei phone. After all, as oft repeated here, a backdoor is accessible to anybody, no matter who it was put in for.

Not necessarily. If there is a hardware vulnerability specified by the Chinese government, the NSA would not want you to use that phone. They'd rather keep China from having the easy option and then compromise your info another way (that presumably makes it more difficult for China to get your info).

Also, finding the backdoor is still some effort.

> There's not even such a thing as a "US phone" though, is there?

BLU?

No. Their phones are rebranded devices manufactured in China. I'd also steer clear.[0][1]

[0] https://www.kryptowire.com/adups_security_analysis.html

[1] https://www.bitsighttech.com/blog/ragentek-android-ota-updat...

Reply on news.ycombinator.com