Hacker News Reader

Comment by 177tcca | Hacker News Reader

Hardware kill switches, if you don't trust your stack, just means you're moving the exfiltration time to after you've turned the switch back on.

View on HN

Depends on your threat mode. Killswitches will definitely prevent connecting to wrong towers and location tracking.

Sorry for the pedantry: It will prevent live cellular tracking, it will not prevent malicious apps or libraries from vacuuming your Bluetooth, WiFi, GPS, barometric pressure, or whatever else you've given permissions to a trusted app that is being used as an exfiltration vector.

If you have kill switches for WiFi, GPS, Bluetooth and sensors, then it will prevent all tracking. Librem 5 smartphone has that.

If a phone runs the Linux kernel, and are hit with one of dozens and dozens of known unpatched exploits, and has no boot security to detect such, expect your hardware switches to be useless when faced with any motivated attacker.

Librem 5 smartphone has that.

To be clear, you're stating that the Librem 5 and Pinephone, with their hardware kill-switches that prevent current getting to the GPS, modem, cameras, BT & wifi radios, and microphone, will still be able to determine where it's been when power is restored to the above radios?

Because I'd like even a pie-in-the-sky hypothetical for how exactly this would work. Keep in mind, there is no inertial navigation in these devices; no pedometer, no low-power fitness tracking, nothing else.

I'm not sayinmg I know it's impossible, but I'm deeply curious how in the world you can make this assertion in good faith, or with any credibility.

> has no boot security to detect such

Purism's Chief Security Officer Kyle Rankin commented that Purism is "looking into implementing" the Librem Key for tamper-evident booting on the Librem 5. Another way this could be done is storing hashes of the boot files in an OpenPGP smartcard to compare with the current boot files to verify that they haven't been changed.

https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...

Purism can "look into" whatever - they're going to be playing catch up until they have serious security researchers.

I used to be enamored by Purism publications until I saw GrapheneOS.org.

Librem 5 is the only phone in the world having mobile/desktop convergence and OpenPGP smartcard. This is not just theoretical possibility, a lot of research has already been put into it.

Reply on news.ycombinator.com