Hacker News Reader

Comment by FirstLvR | Hacker News Reader

this is exactly why Apple still rock at phones

you may choose Android for the specs, guess what, your phone will still get deprecated in 2 years

Hmm. My $170 phone from the middle of 2014 is still working perfectly and shows no signs of being "deprecated". Every application I use gets frequent updates, including the browser. I don't have to worry about targeted attacks (as I am not a billionaire/movie star/CEO of a large company/whatever), and a new shiny iPhone won't help with those anyway. µBlock Origin (with JS disabled on most sites) protects me from everything else.

Apps may be getting security updates, but when was the last time that the version of Android it's running was patched?

Yeah the security patches are still worth thinking about. There was a Media Framework bug that needed nothing but a PNG on your phone to get RCE and there was a bug with the bluetooth stack this year which also could achieve RCE when your bluetooth was turned on and an attacker knew the BSSID

PNGs are easy to send and in times of Contact Tracing via Bluetooth... well there are certain risks to running unpatched

Didn't we recently learn that only Android 10 prevents background apps from constantly watching the contents of the clipboard?

Isn’t that the point though? Your phone works perfectly, shouldn’t it still receive OS updates?

For a lot of folks, especially those at Hacker News, that is totally fine. It is interesting how people's perspectives change when it comes to defending their choice. So in this case, yeah Android seems secure but what happens after 2yrs - even though that point doesn't apply to them. Call out what is important to you vs. just talking about averages.

I’m on hacker news and I care about the environment. I don’t want perfectly good hardware going in to landfill.

Apple supporting their phones for 5+ years is good, and they should be commended for doing this, but we should be introducing laws to make sure all manufacturers are doing this to a reasonable level.

Aside from gaming, which isn't prevalent aside from casual games in NA and EU to my knowledge, I'm not sure what someone may possibly need it's phone for where something like a S7 (a bit more than 4 years old) isn't largely sufficient. Not a diss on Apple, I think the iPhone 5 is vastly better than circa-2012 Android phones, I just disagree with the premise of throwing phones every 2 years as being remotely necessary (perhaps until the next paradigm shift in computing/web/mobile usage where current tech starts to be too sluggish).

on Apple’s case, means good app experience for the users and the developers. for example, SwiftUI comes to iOS 13 or later. If most devices were to be left off without updates(which is the case with Android) most developers would be hesitant to pick up the newer shiniest technology. apps on android still tend to be ugly and old fashioned. sure, there’re exceptions but generally apps on iOS are fresh and consistent probably because developers can depend on the users having the latest platform.

Yeah but in the context of security your point is moot. No more updates means no more security patches, right? Throwing phones away every two years is of course not necessary, an Android phone from 2012 is probably perfectly usable - yet horribly insecure.

Yeah I could have amended about security, but I was replying to a comment about specs and Android phones being deprecated after 2 years, which I don't interpret as being security-related.

Fair enough, I was thinking in context of the overall thread. Cheers

I had an S3 from launch for ~7 years before switching, and it was completely unusable by the end. Most websites and big-name apps halve in performance every 18 months or so. Doesn't help that your battery will be on its last legs by then. 2 years is definitely much more often than required, but until ad-tech corps and web developers call off the assault, we're stuck on the phone treadmill to some degree.

Thus LineageOS (for those who want droid), or in the future postmarketOS (for those who don't care about app support).

No, neither of these support all android phones, but they each support several.

I'm a long-time fan, but Lineage breaks the Android security model - knowingly.

Other AOSP variants are more secure by an order of magnitude.

> Lineage breaks the Android security model - knowingly.

That's gonna be a big nope from me then. I was unaware of this, thank you for bringing it up.

I've been mostly unsuccessful trying to find other android variants that appear to still be maintained, would you mind pointing me towards one? I'll probably still wait for the PinePhone, but I'd like to stay knowledgeable on the subject.

GrapheneOS might be something you like.

https://grapheneos.org

+1, this all day, over Linux phones with dubious security models/hardware switches that just delay exfiltration if it's going to happen on a non-verified boot device.

Thank you, this is super interesting and may well wind up being something that I wind up using in the future.

I noticed that it only officially supports the Pixel devices.

I've always avoided the Pixel devices because I assumed that the firmware was closed source and therefore a privacy issue, especially coming from google.

However, the FAQ states "These devices meet the stringent privacy and security standards and have substantial upstream and downstream hardening specific to the devices."

Am I mistaken about the Pixel drivers being closed source? If not, how is this statement verified?

The author doesn't mean that the drivers are open source. It's impossible to have a device with all drivers open sourced at the moment, hence the Pinephone. From the "supported devices" faq:

"Devices need to be meeting the standards of the project in order to be considered as potential targets. In addition to support for installing other operating systems, standard hardware-based security features like the hardware-backed keystores, verified boot, attestation and various hardware-based exploit mitigations need to be available. Devices also need to have decent integration of IOMMUs for isolating components such as the GPU, radios (NFC, Wi-Fi, Bluetooth, Cellular), media decode / encode, image processor, etc., because if the hardware / firmware support is missing or broken, there's not much that the OS can do to provide an alternative. Devices with support for alternative operating systems as an afterthought will not be considered. Devices need to have proper ongoing support for their firmware and software specific to the hardware like drivers in order to provide proper full security updates too. Devices that are end-of-life and no longer receiving these updates will not be supported."

Source: https://grapheneos.org/faq#device-support

Thank you for the info and being so responsive to my questions. Sorry if I'm slow, this is outside of my normal range and my duckduckgo-fu is weak on this subject.

I saw this part of the faq, but it was a bit beyond my comprehension.

This is an extremely interesting topic to me however, could you point me toward where I could do better research on the topic? I'll keep looking around myself and post something here if I see it for anyone else who's interested.

Asking questions is not a sin. I will endeavour to answer where I can. :)

I'm no expert in this area myself (read as I've been educated by the internet and been too lazy to dig deeper), but I hope this reddit thread[0] leads you to some answers. Daniel Micay is the author of GrapheneOS, formerly CopperheadOS.

[0]: https://www.reddit.com/r/GrapheneOS/comments/bddq5u/os_secur...

Thank you :)

This link does seem like a good place to start, thank you much.

In what way does Lineage break the Android security model?

So many phones can't install those, though. Like every single US Samsung model.

If we had a law forcing phone makers to unlock bootloaders once support ends, then we could talk.

> So many phones can't install those, though. Like every single US Samsung model.

Unfortunately true. If you were going to want to use either of these you would have to purchase a phone specifically for it. The only reason I brought these up was the parent comment implying the purchasing of phones anyways.

> If we had a law forcing phone makers to unlock bootloaders once support ends, then we could talk.

Honestly, this would be amazing. This is one of the reasons I haven't purchased a phone yet, and am waiting on the PinePhone to become a viable daily driver.

> deprecated in 2 years

They get security updates for 3 years (longer for enterprise devices). System libraries and builtin apps such as browser are updated via play store indefinitely.

But how many people _really_ use a phone more than 3 years?

Anecdotally, most of the older folks I know will use hardware until it disintegrates because they don't use many apps and "it still works." I've seen a seven year old iPhone 5C in the wild.

Reply on news.ycombinator.com