Hacker News Reader

The solution is a de-Googled Android running an AOSP-derived distribution with an enclave (or 'second space' or 'multiple personalities') for those few Google or Google-dependent apps. You can either use one of the second space/enclave/container apps to create such an enclave or you can enable and disable the apps before and after each use (which is what I do). It is always worth trying those apps on a Google-free device since many of them work fine without having any Google services installed even though the complain loudly about GSF needing to be installed for them to work correctly - the Swedish BankID tool is one of the latter, it always produces a popup telling me it won't work without Google Services but does its job once that popup is dismissed.

Eventually there may be a non-Android 100% free software alternative but as it stands now the above solution works fine and keeps the data vampires from your door.

My question, building on that one, is: Can there be a true alternative?

This is a genuine question, not an attempt to paint Apple as the be-all and end-all or a paragon of perfection (for all that I'm an unapologetic Apple fan, I recognize that they have serious faults).

I think there is a strong case to be made that the limitations Apple has placed on the iPhone are instrumental in guaranteeing the privacy and (relative) freedom from crap that makes it as good as it is. There is also a strong case to be made that it should be possible to create a phone (or computer) with nontrivial privacy safeguards, but without the specific limitations Apple imposes.

I lean somewhat toward the former camp, as I believe that in a space like smartphone apps, bad actors are both willing and able to do whatever is necessary to make their unethical money, whether that's with extra ads, crapware apps, or just actual malware, scams, and theft. But I would genuinely love to be proven wrong, and I hope that there comes a day when we have a meaningful competition in the space without sacrificing our collective ability to use our phones without fear.

From a technical perspective, of course it is possible to give users control of the trust on the devices they ostensibly own, rather than giant megacorps, and I remain extremely unconvinced that this leads to a meaningful loss of security or privacy for those users. From a socioeconomic perspective, it's a much bigger question; the allure for those megacorps is far too strong and the economics of the industry makes it hard for society to wrest power from them, and for some reason people seem mostly okay with this status quo.

It seems to me that it's inevitable that if we let these megacorps control our devices, they will use it against us in one way or another. The only way for us as users to actually have freedom, security, and privacy is if we can control what entities the device trusts ourselves. We must create choice where the corps would rather we have none.

I will also point out that I consider Apple's rent seeking and censorship, that is more or less literally impossible to avoid, to be unethical use of this power they wield over users, and a pretty clear and meaningful way that users are harmed by it. In very concrete ways it can be considered more harmful than malware. But few seem to care enough to ask for control of their devices back, and in many of these threads more seem willing to jump to the defence of these practices than see them as a problem.

Oh, this is certainly a question primarily about the social aspects and second-order effects. The technical perspective is much more solvable, though still not, I think, a solved problem.

The problem with "I control my device" is, and always has been, twofold:

First, that when some malware gets in, it looks like you.

Second, that people who are not technically savvy will not be able to use that control to protect themselves, but will instead very often have it used against them.

The former of these is, in fact, a technical problem; the latter is social, and much harder to control for.

> First, that when some malware gets in, it looks like you.

I don't see what this has to do with trust. Whether or not there is a secure trust chain, malware can likely impersonate you.

> Second, that people who are not technically savvy will not be able to use that control to protect themselves, but will instead very often have it used against them.

If people are going to ignore the flashing red banners that pop up when they try to override the trust store that comes with their device, then that is a price we have to pay, IMO. We accept in the rest of our lives that some things are dangerous, and while we erect many barriers to make those things more difficult, we recognize that is the price of freedom. People will do them anyway, and some will be harmed. It doesn't have to be frictionless, it just has to be possible.

Is there a spate of malware going around that involves users installing new keys in their UEFI secure boot trust store? I haven't really heard of this. I also haven't really heard of a spate of malware using Android's developer mode that is pretty easy to enable, if you know how. I think the risk involved in giving users ultimate control of the device's trust store is greatly overblown.

This is what I'll be doing. There are no smartphones on the market that I feel comfortable with trusting, even a little, so I'll be shifting to using a dumbphone instead, and also carrying a real, honest-to-goodness pocket computer that doesn't have a cell phone attached to it.

The phone will be used for exchanging calls and texts. The computer for everything else.

Which pocket computer would you choose? Out of interest.

I haven't decided. The pickings seem slim, but I'm still working through the options (including the option of building my own).

> dual-wield and use a Linux or de-googled android phone for daily use and keep a second device around for the apps that won't run there

I was thinking about this but what happens with on-the-spot payments? This seems like a functionality that's really convenient (not having to carry a bank card) but that would be on the official device, not the daily use device due to security issues. But paying for stuff in person is a daily use activity.

> I was thinking about this but what happens with on-the-spot payments?

YMMV, but I don't (and won't) use my smartphone for this right now anyway. It's fine. Barely an inconvenience.