Hacker News Reader

Comment by tomatowurst | Hacker News Reader

The question is then what phone exists that is immune from this? A flip phone? A Nokia 1011? I might be completely misinformed but seems like SIM card and the underlying OS is vector. What happens if I use a cell phone from late 90s and early 2000s? What is there to hack with those flip phones? JavaME over the wire? What if the cell phone dates even further?

Legitimately curious what options is there. Could If you are someone of interest then it seems like having a smartphone is an automatic liability. What then solution is possible since sending and reading a simple text message is enough to escalate privilege?

View on HN

No technology is entirely secure today, we haven't built it in a provably secure way

The most secure today is probably a Pixel 6 running a secure messaging app with a limited attack surface, no image support, no emoji, etc. Removing all the standard apps including the browser and Webview engine would significantly help.

If you could switch an iPhone into a secure mode which removed large chunks of messaging functionality then it would be the preferred option.

I would be shocked if people couldn't find an RCE in an early 2000s flip phone. I had a friend who had hers since 2010 and MMS crashed it all the time.

If you're talking about flip phones and trying to protect against an eavesdropper of a phone call or SMS, then there's no point. The network that these phones used is full of holes already https://en.wikipedia.org/wiki/Signalling_System_No._7#Protoc...

Attack surface reduction is the important part. I’m not in disagreement with what you said, but if you took a modern iPhone and removed all capabilities other than sending and receiving phone calls, it would be much more secure than one which supports mms, email, browsing, etc.

Are you sure having a phone in your phone is a good idea? Phone calls are a significant source of attacks now, even if none of those attacks exploit a vulnerability in the phone software. As far as I'm concerned, the only point in having a dial-able phone number is to ensure I'm still eligible for car warranty scams and 2FA code harvesting attacks.

You’re right, my point was surface reduction, not that one tech is more or less vulnerable than others

Print from your phone to a piece of paper. Then use RFC 1149 (https://datatracker.ietf.org/doc/html/rfc1149)-- IP over carrier pigeon. And then use one time pads on each end.

thank you for posting this, made my day.

I'm still cracking up over:

> A typical MTU is 256 milligrams

Probably PGP encryption / authentication using files on an SD card with a computer separated from internet is your best bet for secure communication. An ,,easier to use’’ version can use a firewall that only allows the PGP emails through, at least in that case the firewall can be made simple and secure.

GNU/Linux phones are immune to this (or at least they make it easy to fix bugs and separate the modem from the OS): Librem 5 and Pinephone.

Tin foil chat!

https://github.com/maqp/tfc

Reply on news.ycombinator.com