Hacker News Reader

It seems this attack exploited the browser on the device via non-HTTPS sites. So the elaborate networking scheme really wouldn't do much. They just had to inject their browser exploits on every non-HTTPS site the user visited. Just because the PinePhone runs non-Android/iOS doesn't mean there aren't 0-days for the browser it runs.

View on HN

In TFA, it says that they injected the exploit via stingray or cellular network compromise. I'm pretty sure that better isolation of the browser and other apps from the cellular network would have prevented that.

But yes, he would have been vulnerable to malicious sites exploiting browser bugs, as one always is. I mitigate that by compartmentalizing activities in multiple machines and VMs. For example, the host that this VM is running on contains absolutely no information about my meatspace identity.

Reply on news.ycombinator.com