Hacker News Reader

Comment by concinds | Hacker News Reader

I thought this was important to post here, given the amount of people that claim to have switched to Linux Phones after Apple's CSAM debacle. The author recommends using mainstream iOS/Android or GrapheneOS on Pixel Phones. Here's his overview of Android security: https://madaidans-insecurities.github.io/android.html

I also slightly editorialized the title, since it is extremely non-descriptive of article contents.

View on HN

It always depend of your definition of security, I'm personally prevented from checking those claims on Android so I trust it much less than my Linux laptop, despite whatever Google could claim. Additionally, who knows what's really running in userland in Android...

I trust my versions of Linux infinitely more times than anything corporate made, despite the claims, just as you succinctly said.

While everything the author writes makes sense to me, I think the kind of security threats he focuses on aren't the main concern for most people.

What % of Android devices have their bootloader unlocked or root enabled? Or have the ability to enable signature spoofing for MicroG? I doubt that malware targeting such weaknesses would be economically profitable to develop, considering also that the typical hardcore user is less likely to just install random Play Store or unverified APKs .

This seems a list of security weaknesses against _targeted_ attacks - the inclusion of "evil maid" attacks is exemplary. If somebody gains physical access to my phone, by far the greatest risk to me is that they will steal it and immediately wipe it, not that they will install bootloader malware and put it back.

So yeah, if you're e.g. a professional user and might be the target of industrial espionage, follow the author's advice to the T (going with GrapheneOS or not depends on whether your company trusts Google with your business data). Graphene > Google > Lineage > Linux. If you just don't want to have your personal data tracked by Google and want better control over the apps you install, Graphene > Lineage > Linux > Google.

> if you just don't want to have your personal data tracked by Google and want better control over the apps you install,

Which is the most common security risk for common people let's be realistic. Yeah they are we could say ""protected"" by the trusted boot but in reality the google & manufacturer blobs sending their data somewhere are their main security threat, much more than any other kind of attacks.

The article also mentions a lot of things that will make it generally easier for remote attackers to gain a "permanent" foot in the door once they find a way in (e.g. an exploitable "app"), like the lack of "app" sandboxing (for the most part).

Did people switch because Linux was thought to be more secure, or did they switch because they were sick of Apple?

> given the amount of people that claim to have switched to Linux Phones

If any significant number of people had switched, we’d have seen announcements by Purism and Pine.

Reply on news.ycombinator.com