Lockdown Mode on the Librem 5: Beyond Hardware Kill Switches | Hacker News Reader

Lockdown Mode on the Librem 5: Beyond Hardware Kill Switches

puri.sm

86 pointsNotYourAvgJoe48 comments

I am glad physical switches are making a come-back in computers and phones but I wish it had happened sooner and because it's more convenient and practical than a stupid piece of unreliable integrated flaky software rather than for privacy concerns (meaning: why did we convert hardware knobs to software ?).

> why did we convert hardware knob to software

Because it was cheaper, and most consumers want cheaper goods.

But why did we lose our knobs on expensive equipment?

Because it was cheaper, and most companies want higher margins.

> But why did we lose our knobs on expensive equipment?

Because it was cheaper, and most companies/shareholders want better profit margins.

Because very few people buying expensive phones are doing so for knobs; they're doing so for better cameras, larger screens, the cachet of having an expensive phone.

Well-written and properly-designed software buttons can satisfy the same need as hardware buttons, anyway; when they don't hold up, it should be considered either a UI bug or a design flaw, not just a consequence of the hw-vs-sw choice. (Same with wireless headphones--when they don't work as well as wired headphones, the answer is to fix them, or develop new tech as necessary so that they're at usability parity, not insist that wires are better.)

> Well-written and properly-designed software buttons can satisfy the same need as hardware buttons

Technically, but software buttons are inferior to physical ones in terms of usability. Or at least I've yet to see software buttons that aren't, but I have not seen all implementations of software buttons.

> why did we convert hardware knobs to software ?

Reliability.

Switches fail, and make devices less waterproof.

I have had plenty of modern devices fail due to broken on/off or volume switches (and failed sensors, and failed plugs or sockets).

And the software "switches" fail too: I had wifi on my iphone 4 disabled after an update. Who knows why.

Fair enough. But hardware is easier to fix for most than a software bug.

This really reminds me of Doctorow's Walkaway. Not exactly my favourite book, but it has its merit. Among others "Lockdown mode" is mentioned right in the beginning as being something crucial to get right. Glad to see at last someone is actually trying. :)

That's pretty nice. I wish more devices came with hardware kill switches, especially on laptops -- I always disable the camera and microphone on my laptops, and it would be so much easier just to throw a physical switch (as in a switch that actually breaks electrical contacts to the camera and microphone).

Id like No 1 and 2 to be separated. I stay on Wifi a lot but rarely use Bluetooth. Far as mic vs camera, I also use the camera separately from the phone. Keeping video off by default can block privacy invasions that can happen, by attackers or buggy apps.

On covering tablet/laptop camera threads, a few people not worried about spying said some video app came on broadcasting to coworkers. One was in bed half-naked with spouse. Another on toilet in office. So, they cover cameras or kill video apps by default to prevent that stuff from happening again.

You can always turn off Bluetooth via software to save on battery if that's what you mean.

I wish they had gone with a single kill switch. The most common use case is probably "Nothing gets in or out right now." But instead of flipping one switch one direction, the user must now flip three switches the same direction to get that common behavior.

Also, what's the use case for switches flipped in different directions that wouldn't be covered by software buttons? We can't possibly be talking about targeted attacks-- in those cases you're screwed no matter what.

That only leaves indiscriminate software attacks. Now take the hardware switch setting where baseband=off and wifi=on. I guess it's nice that evil software cannot pretend that baseband is off when it's actually on. But evil software attempting to "get out" is probably going to use a high level call out to the net. So who cares that it must now leave through the wifi radio instead of the baseband radio?

I'm happy about multiple switches. I don't really understand how cell basebands work and if I can trust a software kill. My biggest issue with my phone is cell phone companies selling real time location data, so I will mainly have that switch off while using wifi for communication. If the software kill means the baseband transmits no data, great, I'd be fine with just that. If it means the basebands transmits no data from the phone, but still beacons out to cell towers, I absolutely will want to kill it while remaining on wifi.

I also expect to have the baseband switched off most of the time and wifi on most of the time.

I basically want a pocket computer. Access to the cell network is a useful feature, but one I don't need most of the time, so why be connected to it all the time, with all the privacy concerns that comes with.

It will be interesting to see how carriers react to the option, though. As it stands, they are happy to help themselves to your location and usage data (much like ISPs do), having a handset that could turn that money-making flow on and off might cause at least some to refuse to take you on as a customer.

You cannot do that in the EU. Also, phones communicate imei and other sim information, not OS information on the header plane during handshakes with the towers.

What kind of crazy country do you live in where the carriers can choose whether or not to have you as a customer based on the device you use?

There's plenty that are "bring your own device". From a carriers standpoint, switching off the basband is the same as turning it off, so I would rralpy doubt they could figure out the difference, much less do anything about it.

Like an iPod Touch? https://www.apple.com/ipod-touch/

Despite the name, it's basically just an iPhone without a cellular radio (though I'm not sure if it's actually removed, or just disabled/neutralized). So you can use it to do anything an iPhone can do, it's just dependent on having access to a WiFi connection if you want to do anything over the network.

Not sure why you're downvoted. The iPod Touch is a great solution and I've bought one before. I don't love the Apple (walled garden) ecosystem though, which is another reason I'm excited about the Librem 5.

I have and enjoy my iPod Touch for a whole host of reasons, particularly its thinness when compared to a iPhone.

That said, sometimes you need/want cellular in a pinch, but don’t want it always on, hence the kill switch.

> I basically want a pocket computer.

If you have hobbyist-level electronics assembly skills, a weekend, and a couple of hundred dollars, you can pretty easily assemble such a thing using a Raspberry PI with a touch screen, battery, and any of several commercially available cases (or 3D print your own).

I have one that I put together to use for pentesting. It works quite well.

I have several Pi's. To be more specific, I want a pocket computer that will fit in my pocket, and have more than a few hours of battery life.

Mine fits in my pocket (it's about 1cm thick) and the battery lasts about 4 hours if I keep the display on. The display is the big power draw, and I could have used a more expensive but less thirsty one.

The easiest way to meet the size constraint is to use the Pi Zero. I wanted more grunt than that, though, so I used a normal Pi and stripped the board of all the connectors except the micro USB to achieve the profile I needed.

> if I can trust a software kill

You can't. If the functionality can be enabled/disabled via software, then there's always the possibility that malware will enable it.

Sure. But to justify the three switches you must tell me more about this malware that would succeed with the baseband disabled in hardware while you continue to have wifi enabled in hardware.

I can only think of the special case where a carrier wants send a specially crafted message to exploit a flaw in FLOSS in order to implant malware that tricks the user about the status of the baseband. Still, if the carrier wanted to take that risk the only users who are protected are the ones who never switch on the baseband OS.

I don't think it makes sense to decrease usability for the off chance that some user has an idiosyncratic threat high enough to never use the baseband os, yet low enough to toggle wifi on and off.

> to justify the three switches

I'm not speaking to the number of switches, merely the importance of actual physical switches that physically disconnect the subsystems.

I have mixed feelings about a phone that might lull me into thinking it's not a computer controlled by a hostile entity. Carrying a cheap android, I know I have an attacker in my pocket. On the other hand, I like the idea of being able to mitigate the danger further than I can already.

> Carrying a cheap android, I know I have an attacker in my pocket.

You have an spy on your pocket. Cheap spy or costly, don't matter

Surely it's more nuanced than that! I like the idea of my pocket-spy definitely, for sure, not being able to turn on the wifi radio because I've cut the power with a hardware switch. What worries me is that this ability might cause complacency.

Not if they can hack it remotely with 0-days or get you to install a backdoored app. Then, they just leak the secrets out gradually or all at once when you reconnect.

what ifs

I suppose it depends on what information you're trying not to leak? If you're trying not to leak, say, your browser history, I'm fully in agreement with you. But if you're trying not to leak a list of wifi hotspots picked up by the wireless radio, then there's no way the phone can leak information it never had.

This feels like a bit of an odd position to me, as it looks like this would legitimately be a computer not controlled by a hostile entity, to the same degree that most desktops or laptops running Linux would be.

What are your outstanding concerns about control?

I like this approach but I don't think you take it far enough. I like to scatter broken glass around my apartment so I don't lull myself into a false sense of security that it's safe to walk to the bathroom in the dark. I also have my girlfriend poison some of my meals at random so I don't get complacent about food being safe to eat.

Look, if you want to attack my point with a house analogy, you're doing it wrong. A better attack by analogy would be, "I don't want a lock on my front door, because locks make you complacent."

If you think your analogy makes my point better than mine then you haven't understood my point. I might also have mentioned how I only befriend convicted criminals to avoid falling into the trap of thinking I can trust my friends, or how I only hire accountants who have been convicted of defrauding their clients so I don't get complacent about checking they are not stealing money from me.

I am yet to see actual images of this phone. Sounds like something I would buy, especially if I can install just a plain Debian release on it.

Is there any reason to think it would run anything other than PureOS? Wouldn't you lose all the functionality they are talking about in the post if you installed another OS?

Why would you lose the functionality of hardware kill switches by running different software?

PureOS will no doubt be the best supported distribution but since the whole point of the phone is to be as open as possible and Purism aims to upstream as many of their changes as possible I expect it will be possible to run Debian with most functionality intact.

Isn't PureOS Just debian?

Yeah, they say "Does not use Android or iOS. The Librem 5 comes with the mobile version of our FSF-endorsed operating system PureOS by default, and is expected to be able to run most GNU+Linux distributions." under "Security focused by design" on the product page (https://puri.sm/products/librem-5/).

Myself, I really want to get NixOS running on it.

>Myself, I really want to get NixOS running on it.

Let's start a working group, stat! What a cool story it would be if we could say that we built images for the thing before it ever even shipped and had a one liner to emit new NixOS-based images for a Librem 5.

There is so much potential for experimenting with update models, read-only secondary secure OS partitions (combined with Nix's reproducability starts getting pretty compelling, in my opinion).

I go by the same name and am persistently in the Nix(OS) related IRC channels. Cheers.

Those are hardware switches and don't rely on software to operate.

There are some images of the phone on this page of their website [1]. Looks like a fairly clean generic phone really, other than having more physical side buttons than normal

[1] https://puri.sm/products/librem-5/

Reply on news.ycombinator.com