Hacker News Reader

Comment by mindslight | Hacker News Reader

You shouldn't SSH into your server, because the terrible mobile security model means you're vulnerable to both Google and the cell network by doing so. A modern phone should be one of your least trusted devices.

The problem with the mobile ecosystem isn't so much what you can run on your phone, but rather what you can't stop running on your phone. And that perfectly good devices are relegated to the trash bin due to the upgrade treadmill. A Linux-first phone stands a chance at fixing these issues, whereas starting with an OS developed by a surveillance company does not.

View on HN

Boy oh boy do I have bad news for you about every other computer you're using today. The ccNUMA model they teach in school is well and truly dead even on desktops. There is no modern computer that just has the CPU in charge of memory. I don't think there are any general purposes devices you or I can purchase that have actual memory segmentation (either true separation or via SMMUs/IOMMUs. On a modern desktop, you have dozens of random cores sitting on the memory bus that have full access to physical memory, and there's nothing you can do about it because those cores run their own proprietary (often baked in) software.

A Linux-first phone does absolutely nothing to fix this. Even if you're running your own operating system that you wrote yourself, your GPU or hell even the power management controller might reach around and steal all of your stuff. The issue lies in the way we build computers and the rapid proliferation of cores without any serious thought as to how we're supposed to manage and secure the enormous fleet of heterogeneous hardware that lives on a modern SoC.

First, my main desktop is a librebooted KGPE-D16.

Second, it matters if those possibly-hostile cores have network access. Technically they could subvert the software on the main CPUs to communicate with command/control, but that seems like raising the bar to such an attack. Whereas with the standard mobile architecture, I can totally see some phone manufacturer getting the "bright idea" to have the baseband processor collect statistics on the application processor's software for market research.

But I agree with your general point.

Still, I think moving in the direction of Linux phones gives us a starting point to do something about this insecurity - proving the market allows there to be devices that truly separate out the cell modem.

They wouldn't need to even talk to the AP to get out on to the network though :) If you have physical write access, you can talk to the network just by writing data in the network device's mailbox using the exactly same MMIO techniques that the AP uses. Its one of the reasons I am so disenchanted with current rootkit detection tech—if malware can get physical memory write, they can corrupt other cores memory persist into other SoC elements, well and truly out of view from the AP while still maintaining the exact same amount of control. I would not be surprised in the _least_ if the US three letter agencies have at least one implant that does this because its not exactly difficult but is so insanely hard to fix or detect that it makes it ideal for covert monitoring.

That being said, I think there's a fundamental disconnect between how SoCs work and how people actually think they work. Linux lives in just one tiny little corner of the machine and the hardware does so much to coddle Linux into thinking it's in control. The AP is just a core on the memory bus, it typically has no greater privileges (it often has _less_ because hardware vendors hide ""implementation details"" away from OS developers!) than any other core. I don't know that this is so much a radical take in the OS community though it might be one here: Linux _is_ part of the problem. Linux makes several assumptions about how hardware works. Chiefly, it assumes that it is in the driver's seat and it makes cooperating with other cores running their own copies of Linux (let alone other OSs) damn near impossible. I think the next step in computer evolution is going to come from software engineers rediscovering hardware and building code that not only runs on the AP but across all cores—from the power management controller to the AP--in an SoC. This may come from radically changing Linux or it may very well come from a new OS that treats modern hardware platforms as they are: platforms.

The baseband/PMIC is such a huge threat and it is entirely in the hands of the carriers that desperately want user data. Coupled with very tightly held IP the problem seems to be insurmountable. When I see "removing the Google ecosystem" I have a hard time taking the rest of statement seriously.

You suggest a MITM attack against ssh by the carrier? Seems unlikely to me.

Not sure about the threat by Google if you’re using f-droid. Though there is always dmr’s compiler attack I’m not sure ssh would be the right vector. A keyboard attack might be more useful.

Not MITM, but rather the application processor trusting the baseband processor, which is running who-knows-what network-facing code. Qualcomm claims to have recently implemented memory separation, but without actual public documentation and scrutiny of internals why would one believe them?

Installing F-droid does not remove Google's presence in other software. On a vanilla Android phone, that is all of the Google (Play) services and who knows what centralized-expedient hacks have been put into the OS itself.

LineageOS can remove the Google problem with relatively little pain, compared to running mobile Linux.

The untrusted hardware is, of course, a more complicated matter.

OP didn't mention LineageOS or custom ROMs, but rather promoted stock vendor Android with Termux. Yes, you can do additional work to fight the top-down controls. But you're running an uphill battle, and judging by the shrinking device list of LineageOS that hill appears to be getting steeper.

Please continue fighting that fight as I am currently, but at some point it's nicer to cut bait and move to an undeveloped ecosystem where you're welcome rather than persist in a more polished one where you're not.

I would love to switch to a fully open environment once it's available, but I think you're overstating the trouble with running LineageOS or other non-spyware ROMs.

Reasons to favour custom ROMs over Linux phones as a daily driver, at the moment:

- You get to pick between dozens of recent devices, many with flagship specs. (Note that the "official" device list only refers to the ones the core team approved, there are many more that stay "unofficial" for a year or more before getting accepted, but still work quite fine.) Other ROMs like Graphene are more limited, but an old Pixel is still way more powerful than a Pinephone.

- Basically everything that a mainstream Android can do works fine on custom ROMs. Exceptions tend to be big tech stuff like Google Pay which you probably don't want anyway if you're into privacy, or occasional bugs with specific models (under-screen fingerprint readers are a common one)

- As an actual consideration, the security model of Android is actually IMO miles ahead of Linux (assuming the mobile version copied the desktop in that regard). Apps are strongly sandboxed by default and there are plenty of tools to exert even more control, eg TrackerControl or Netguard to firewall them by domain, or Island/Insular to basically chroot them. On desktop OSes, including most Linux distro s, user apps have e.g. access to all of the user's files by default, which would be terrifying in the context of a phone.

(I imagine you already know most of that, I'm just laying out my reasoning for the same target audience as the OP's 'just install Termux' comment)

Do you really think Google or Qualcomm are going to try and root kit servers you ssh into? Google's privacy model is awful for many reasons but this doesn't seem like one if them.

I think my computer is my castle, an extension of my own mind, and subjecting it to the mercy of unaccountable third parties is a terrible idea. I can also foresee many business reasons why they might choose to be active attackers, such as measuring the popularity of various applications and data files. The pop culture mobile ecosystem has steadily increased into a dumpster fire of authoritarian control, and it's reasonable to assume the trend will continue.

That only matters if your threat model includes Google and the cell network. Mine does not, because Google is not in the business of credit card fraud and virus writing.

It's always great to have private options though.

Reply on news.ycombinator.com