Hacker News Reader

Comment by prepend | Hacker News Reader

I have a lot of phones sitting around. I don’t recycle them because there’s usually no benefit to me and there’s a risk that someone would mine my data still on the device.

They don’t start so there’s no way to boot and wipe. And they are hard to disassemble and remove the storage.

So I do the calculation of getting like $2 off a new phone or the extremely low, but non-zero, probability of all my photos ending up somewhere not cool.

To help with this, right to repair also makes things more recyclable.

View on HN

My mother died this year and one thing I have kept is her phone to remember her: a little time capsule of her last messages, her photos, etc. I keep it near the charger and keep the charge from dropping too low.

I've thought about how long I intend to do this, or, even if I let the battery stay disconnected, how long I will keep the phone. I suspect I'll keep the phone until I die myself but wonder if it would end up being some odd sort of family heirloom/relic 100 years from now.

(FWIW, I have captured to other devices her photos and such so that I am not reliant on the physical device for these memories.)

I am guessing I am telling you the obvious when I tell you to backup all meaningful pictures and videos into whatever your long-term storage solution is (aka SSD or Cloud) before the phone inevitably dies and becomes inaccessible, especially if the phone memory is encrypted with some weird proprietary algo where you will never get the data off of it even if you know the password.

I found some old computers a while back, from the early 2000s. None of them booted. I couldn't get anything off even after pulling the HDs and connecting to them directly - everything was corrupted despite sitting in a fairly dry, clean, climate-controlled space.

My dad still has a 2001 era Inspiron that he keeps because of Microsoft Works. I am shocked that it still boots! Won’t connect to the internet for some reason, but it did connect to the LAN and WS_FTP helped me move old files to my laptop.

> Won’t connect to the internet for some reason

Likely: time/date, and you will need to compile modern ssl and gnu tls. I've found that even if I'm doing a pure http request (no https), I can't fetch anything without a modern ssl/tls library. At least that's how it was on an old kindle

That rings a bell :-)

> I am guessing I am telling you the obvious when I tell you to backup all meaningful pictures and videos

My Dad died in 2021 and like the OP above I have his phone still connected to power and photos videos, calls etc. on it.

What you say is correct but I haven't the courage to look at the photos yet. Videos will be especially hard much more real than a picture.

But yes I have to act.

Just in case you haven't thought of it--at least as far as photos/videos there are easy/straightforward generic options for copying them off without having to look.

You can install something like Dropbox or Nextcloud and set them up to sync the entire photo album. Just checking the rough counts on either end should get you a decent indicator that you've got everything. (It's possible something gets missed but, trying to not let the perfect be the enemy of the good, it would certainly be a much safer position over where you are today.)

As much as anything, I'm just trying to give you a nudge. I can only imagine how much it would compound the heartbreak to lose all of that.

My sympathies for your loss.

Uploading unseen photos may not necessarily be such a great idea.

The last thing I'd want to remember about my mother is her interactions with modern technology.

(I actually mean that, but I'm also attempting to be sorta funny)

I know what you mean, but it is only a small part of my mementos from her life. I also have photo albums from her (actual, physical photos) that are treasures to me and represent the majority of her life. But I can't deny the last decade or so of her life that was online. The phone became her camera, her letters....

Just before he passed away, my grandfather spoke with everyone he loved (and who couldn’t be there during his very final moments) from his hospital bed using a Nokia 2600 phone. A few years ago, I realised my mother kept the phone and refused to sell it as it had become the final memory of her father. Inanimate things can often serve as portals into a time that our loved ones were still with us, when we were young or just generally, some fond memory that we can never really live again and yet are loathe to part with.

Most carriers should be able to put together an independently audited process to ensure your old data cannot be mined. Locked boxes, chain of custody, secure transfer, cameras and two people in the room... until the phone is physically destored.

Though it would be nice if they had a get the old data off that dead phone and return to you process. (Which reminds me, I need to setup backups on my latest phone

> Locked boxes, chain of custody, secure transfer, cameras and two people in the room

It's difficult to see this being profitable. Or even possible, given the meagre training most carriers' employees at physical stores seem to have.

Easier: a device that shreds the phone onsite, in front of the customer.

There are various document destroying firms with shredder-on-a-truck that probably already offer that service, for businesses. Not economical for a single device though.

Hard to see how it's very economical even for many devices, given you have to take each one far enough apart to remove the battery or else throwing it in the shredder sets your truck on fire.

A better play might be to liaise with phone repair shops both carrier-owned and independent, since they already do this as a matter of course, and it's quicker if you don't care what damage you do in the process. Lot of cats to herd, though, that would be.

> you have to take each one far enough apart to remove the battery or else throwing it in the shredder sets your truck on fire

Lithium-ion batteries can be safely shredded. You need to ensure they're discharged and/or shredded in an inert atmosphere [1].

[1] https://www.recovery-worldwide.com/en/artikel/efficient-and-...

Oh, well, I can't see any way that could go wrong!

> given the meagre training most carriers' employees at physical stores seem to have

Training is one thing, but the primary issue is wages and career prospects. Nobody working in a customer-facing role at a mobile carrier is paid enough to give a shit to do proper data protection - in fact they might be paid more by a malicious actor (bribery) to intentionally compromise data protection, just like it happens with fraudulent SIM swaps.

>Easier: a device that shreds the phone onsite, in front of the customer.

Given that most phone these days have non-removable batteries, can one really shred them safely? And wouldn't it make it harder to recycle if you can't isolate the various components?

It's not too difficult to destructively open phones to remove the battery and destroy the motherboard, but that requires some tools and know-how.

> Easier: a device that shreds the phone onsite, in front of the customer.

My local PC repair shop has a hard-disk destroyer that you can use to destruct your own drives. It's basically a lever-operated vice-crusher with a four-foot lever that you use to close the jaws. As soon as I discovered it I was able to destroy the hard drives that I'd been keeping in a bucket in my garage. The shop keeps the bits and manages the e-waste disposal. Bonus: it gives you an upper-body work-out

Aren't a lot of carrier stores in reality franchises?

How about a portable shredder right in the store, with a nice big glass window on it? Bring your phones in and let your kid drop them in the shredder and watch the snap-crackle-pop, and get paid a nominal amount for each one!

There are lots of parts that can and should be recycled (at the very least the battery), so that sounds like a waste.

They could have tools there to quickly pop out the battery so you can recycle it separately from the rest of the phone.

They would need to pay a technician to do that. Having the typical consumer do that would definitely result in injury and fire.

Only because of how they're installed. This is yet another reason why we should go back to having user-replaceable batteries.

Serious question, but how do they intentionally recycle phones/batteries/ ewaste? My first guess would that everything goes through a shredder. Precious metals and plastics are then separated because any kind of disassembly at scale would be infeasible.

High value items are disassembled by robot, like in the case of iPhones. https://www.youtube.com/watch?v=MC81peMLEfo

Medium value stuff is shredded into a big pile and then they leach the gold off it with cyanide. It has a much higher concentration of gold then raw gold ore.

Low value stuff is shipped to poor countries where the copper is extracted by burning and picking through the ash. Very toxic process.

Nudes are already being stolen from customer phones during phone repairs.

Don’t hand in your phone when there is any chance that data can be recovered.

If your phone can boot, wipe it.

If your phone cannot boot, remove the battery and then smash everything else into tiny little pieces with a hammer.

It would be nice if “contains data” chips were mandated to be bright pink, then you could know what parts to destroy.

Open phone, snap off the pink, recycle the rest.

> Most carriers should be able to put together an independently audited process to ensure your old data cannot be mined.

I don’t trust any carrier to do this honestly or competently. And I don’t have the time to audit their process.

I also don’t care enough to do a secure wipe but would gladly take out the storage card and destroy it. That way I’m certain.

It’s not that it’s not possible. It’s that I don’t think it’s worth the work for a negligible benefit.

> To help with this, right to repair also makes things more recyclable.

Storage encryption, which most modern phones should utilize, also helps.

I may be overly optimistic, but who are you expecting to dig your dead phone out of the garbage, take the flash storage out and read it for your personal photos? If the phone belonged to the president or something that's a potential threat, but for a random individual's data?

The bigger threat, imo, is a device that is still authenticated or trusted by some service I've forgotten about. A bank, email provider, Apple, etc. Yes, it's "easy" to fix any single one of these but hard to remember them all.

If the alternatives are store forever, throw in the trash, or give to a carrier...

Nobody is getting the data off at my house. I assume nobody will go through the dump looking for old phones, but someone did go through the dump and found the ET cartridges, so there's prescedent. Also, I feel a little bad about putting phones directly in the dump.

If it goes to a carrier program, there's a good chance it goes into a repair process where the battery is replaced and maybe it works again. If it works again, I expect it to get the least intensive wipe required so that the user can get into the home screen, and then sold. That might mean the new user can get access to my data.

Story time: my spouse had an Amazon Fire phone for quite some time; when she was done with it, my dad needed a phone, but FireOS was a really poor choice, so I flashed it with a 3rd party Android build. Several years later, he ran it all the way out of battery, and when he got it charged up, somehow it booted up into FireOS instead and had my spouse's accounts and what not. Whoops. No big deal, we got him a new phone and got the Fire Phone back (and I tried to wipe it again, but better) and now it lives in a drawer and won't power on.

I agree with true scenario you describe.

Story time: I was a contractor a few decades ago and I got a “new pc.” Theoretically it was imaged with a developer setup. Reality is the local user accounts were removed and a new account created for me.

The previous user was an HR analyst who kept all their data in c:\employee_salary and didn’t get wiped. So it had layoff analysis of every employee, their salary, their layoff priority. Comically, sadly, the HR analyst was layed off despite being listed as high priority.

I tried reporting the data and my contractor manager squashed it for fear that I would be rolled off the project.

My lesson is that unless I destroy the data, assume others will see it.

Maybe it was using an A/B partition setup and somehow switched to the other non-flashed slot

Yeah, something like that seems probable. I don't really remember how I set it up, and I don't know what my Dad might have done in the boot menu.

It’s a very low probability. I expect it to never happen, but it’s non-zero and easily mitigate-able for free by leaving it in a drawer.

Although I suspect someone will think it a fun project to sift through old storage devices found in the dump to automatically scan for photos of interest. Given the high interest in pornography, I expect the motivation of “found nudes” will lead to some discoveries no one ever thought possible.

Same concern, at least with older phones. I think any newer phones (last 5 years or so) are encrypted by default. Anyone with real expertise in this, please chime in.

Updte: hmm. Not full disk encryption. Does this mean that its up to the app to encrypt?

https://source.android.com/docs/security/features/encryption

Most of my old phones still boot but have cracked screen & either are unreadable and/or more frequently non-working touchscreens.

Thankfully with Android I can just plug in a mouse! On my Samsung phones I can plug in a full display + mouse. It's a bit of a risk leaving thr gate open like this, but occasionally I've also setup dying phones to auto switch to ADB, so when they do go, I can still access them.

The main barrier I have is that some phones have bad usb micro ports. With that, I'm hosed. Thankfully haven't seen a single usb-c device with a bad port; loving it.

Ideally we should be able to trust on-disk encryption on our phones. Alas with pin codes, there's not enough entropy to do a for real job of encrypting, but it'll ward off casual snooping. I'm honestly not sure when the changeover was where users ought to be able to expect this fundamental builtin protection.

A tip for you and anyone else doing this: do yourself a favor and get a heat gun or other tools required to at remove and recycle the battery, before your house burns down.

I've had various old phones, laptops speakers etc. that became bloated in storage because an internal lithium ion cell was halfway ruptured.

And once you do that it's usually trivial to pop out and destroy the motherboard or storage device, especially as you don't care about doing so destructively. Then you can recycle the rest.

If the battery bloats up, it often helps undo the glue. Win-win

I'd be interested to find out how many of these bloated batteries still have any charge. Internal discharge feels like a pretty nice accidental safety feature, albeit at the price of also killing a lot of old devices.

But yeah, preemptively removing batteries for safety is a good move.

It's less dangerous, but some of the flammability is inherent in the chemicals withing the battery, and how they'll react to oxygen or water.

Let's say that you were able to magically disassemble a cellphone battery into its constituent elements and compounds, made rods out of each, and then sealed each rod in a zip-lock bag in a vacuum chamber.

The resulting collection of zip-lock bags is still something you wouldn't want to keep on a shelf somewhere, e.g. https://youtu.be/Vxqe_ZOwsHs shows how elemental lithium reacts.

I have so many broken devices with enough information on them to compromise my entire life. Yeah, I’m not selling those.

What kind of devices do you have that are unencrypted? Both Android and iOS have been encrypted by default for what must be a decade by now?

What’s encrypted and safe now may not be in 20 years.

I have an original iPhone in my drawer. It was decent 15 years ago, but not safe now.

This is an important point about encryption that a lot of people miss: it's not forever. All encryption is broken eventually.

The purpose of encryption is not to keep secrets eternally. The purpose of it is to keep secrets long enough that by the time they're revealed, they aren't worth anything.

Wait, what encryption would iOS have used 15 years ago that's now unsafe?

AFAIK Android has always used dm-crypt (should be familiar to any Linux user) with AES, which I'm pretty sure is still safe.

Back then I think maybe it used CBC mode, whereas now it defaults to XTR, but again AFAIK, CBC is still safe, it's just that XTR performs better for block devices or something.

Someone please correct me if I'm wrong.

What data are you holding that is still extremely sensitive after 20 years?

I can maybe see someone repairing phones to boot them and grab unencrypted data. But no one is holding on to them for 20 years to decrypt them.

Nude photos of your mom of course.

I think that’s what concerns people. And makes random phones of interest to bored people. A decent percent of phones probably have nudes. And I think that data stays sensitive.

In 20 years you'll be able to AI generate that from a facebook profile pic.

Since they don’t boot, I kinda understand. But why did they get to this point? Did you replace them because they didn’t turn on

I've got a couple old Androids (MotoX and something else ~2015ish) that won't boot due to dead batteries. There's an endless loop of:

- Charge to ~.25%

- Phone automatically powers on

- The boot process takes more power than the charger can provide, so it drains the battery

- Automatically powers off because battery is back to 0%

I've had them on the charger for a few hours and watched this process repeat over and over. Short of disassembling and swapping the batteries I've tried everything I can think of to get them to power up

I've never had a phone that refused to boot up with the battery fully removed and the USB charger plugged in.

You could try:

- booting into recovery -- find out which key combo might trigger that at power-on

- booting into an OEM download mode -- "" - probably a cable insert + key combo

- triggering the Qualcomm download mode -- ""

That would load a different boot setup (maybe kernel, or just ramdisk, and whatever tools they added on top from that particular OEM), and that may allow you to charge. That can work sometimes.

Yeah, those fall in the "I've tried everything I can think of" category. They don't help, the devices die too quickly to make it into any alternate boot modes.

> there’s usually no benefit to me

Apart from slowing down ever so slightly the oncoming scarcity of resources.

Not a significant benefit to me. I put that labor toward more productive things to better help with scarcity of resources.

Reply on news.ycombinator.com