Hacker News Reader

Comment by mirimir | Hacker News Reader

This is one reason why I don't use cellphones.

I suspect that Mr. Radi would have been safe if he had 1) used a PinePhone, with cellular and WiFi radios turned off, and a USB-connected cellular modem; and 2) hit the Internet through a VPN, Orchid, Tor or LokiNet.

If you think not, please share, because I hate spreading BS.

Edit: Well, someone seems to think that I'm wrong, but they aren't saying why. Just sayin'.

View on HN

It seems this attack exploited the browser on the device via non-HTTPS sites. So the elaborate networking scheme really wouldn't do much. They just had to inject their browser exploits on every non-HTTPS site the user visited. Just because the PinePhone runs non-Android/iOS doesn't mean there aren't 0-days for the browser it runs.

In TFA, it says that they injected the exploit via stingray or cellular network compromise. I'm pretty sure that better isolation of the browser and other apps from the cellular network would have prevented that.

But yes, he would have been vulnerable to malicious sites exploiting browser bugs, as one always is. I mitigate that by compartmentalizing activities in multiple machines and VMs. For example, the host that this VM is running on contains absolutely no information about my meatspace identity.

Journalists have to communicate with sources though and often that means using WhatsApp.

One can run WhatsApp in Linux.

Or one can use Session, and there are apps for Windows, MacOS, Linux, Android and iOS.

Whatsapp on linux still requires a turned-on phone iirc.

Oh. Maybe that's why I don't use it.

Reply on news.ycombinator.com