Hacker News Reader

Comment by nevi-me | Hacker News Reader

I appreciate that a solution is for people to update immediately. It really makes me wonder if my Android phones over the years have had 1-days exploited by the sheer incompetence of the ecosystem in updating phones.

Not much confidence when you get an update with security patches from 2-3 months ago.

View on HN

These exploits are highly targeted, they aren't just flying around hitting random devices.

Best way to secure your devices is to not be a target!

I understand that, and I'm partially assessing that in the context of any high targets who might be using the latest Android flagship, that frankly still suffers from the same problem as all Android phones.

Only when they’re unknown. Once they’re known they’re built into shit like kali Linux.

1-day / n-day zero click nso exploits are certainly not available in kali linux.

> they aren't just flying around hitting random devices.

For the moment, but only until other wankers reverse engineer the security flaws based on the updated 16.6.1 firmware from Apple. After that you too are vulnerable if you haven't updated.

Google devices offer such better security posture than other Android manufactures.

Then there's the issue of privacy regarding Google devices.

I strongly suggest checking out the GrapheneOS project if Android security is of concern.

Unless proven by leaked testimonials I would not fully trust GrapheneOS to be fully safe either. Maybe they have zero days as well and we just didn't discover them because of obscurity but NSO bought them and uses them.

My dad used to say "Known devil is better than unknown angel."

I'd argue nothing is "fully" safe against zero-days - this is the nature of zero-days.

But GOS takes more security precautions than stock Android, so by that metric there is a greater chance it is unaffected by an unreleased zero-day.

But like I said, there really is no way to know. That goes for Android, GOS, and iOS.

Reply on news.ycombinator.com