Hacker News Reader

Comment by nunobrito | Hacker News Reader

[flagged]

Security-through-obscurity (i.e. using a custom ROM on a lesser-known device) does have some upsides, since you're less likely to be compatible with off-the-shelf exploits. But this is much less true now that LLMs exist, and anyone who can afford the tokens can port any exploit to any and all vulnerable devices.

Who maintains the kernel+driver trees used by the LineageOS port you're using? And what's the modem's security like?

Just gave me something else to be annoyed about today ("anyone who can afford the tokens can port any exploit to any and all vulnerable devices.")

Not sure that is exactly correct yet but guessing not long til it would be. Bleh.

I can tell you from first-hand experience that it is true already (Well, it's true for the specific exploit/device pairings I've tried, I've not tried to construct an omni-exploit)

Completely random public example: https://github.com/BuSung-dev/Root-My-Galaxy-Payloads/pull/1... (where GLM 5.2 is credited with the port) (Check out the other PRs in that repo for other similar examples)

Are you also one of those people who think AES is backdoored because the NSA recommends it?

A member of the NSA also provided the ECDSA P-256 curve seeds but totally can't remember why

It would be funny if it actually was intentionally selected, but for DES-like instead of Dual EC reasons, and they're just too embarrassed by Dual EC to admit it.

Since we're speculating here, I hope whatever phone you have allows you to lock the bootloader (My oneplus doesn't after installing LineageOS). And certainly NSA has no way of infiltrating AOSP or less hardened chipsets.

There has been successful honeypots like EncroChat. What's the evidence that GrapheneOS is not yet another one?

For one, GrapheneOS is open source, unlike EncroChat which was a shady proprietary app distributed on shady modified smartphones.

GrapheneOS also doesn't have any custom messengers or other services which could potentially be monitored. It's very easy to check where your phone is sending requests, and if Graphene was secretly MITMing all of your traffic it would be discovered within days.

Since more than a decade that MITM is not a mass event. It is a targeted event for selected users which are scored as having a low chance of discovering anomalous traffic. It first (publicly) started by government authorities sending fake updates to operating systems which then weaken the target machines or straight up RAT them.

Same case here.

Reply on news.ycombinator.com