Hacker News Reader

Comment by octosphere | Hacker News Reader

There is a myth in the infosec community that phones, because of their tendency to be 'always on' devices; that phones are more secure/private than a standard Windows desktop machine or even a macbook machine running OSX. This is a BS concept - Phones leak data all over the place and have a higher data exhaust than a desktop computer.

Unless the phone is flashed with LineageOS[0], it will phone home data to Google nonstop and beacon out its presence to hackers 24/7. To make matters worse, there is a huge fragmentation problem with Android and some phones are disallowed from updating to the latest Android version. The same goes for iOS; a user can often be locked into using the same iOS version and cant upgrade to the latest version (a huge security hole)

[0] https://www.lineageos.org/

View on HN

Apple still provides security fixes for phones as old as the iphone 5s, which was released almost 6 years ago.

I don't think that's even remotely comparable to the fragmentation problems Android has where you're lucky to get even 2 years of security updates with some providers

iPhone 5S and iPhone 6 will stuck on iOS 12 btw.

6 years is still twice as long as the original 3 year commitment apple made when the 5S came out and it's 6x as long as most android phones that were manufactured at that time.

> There is a myth in the infosec community ... that phones are more secure/private than a standard Windows desktop machine

This doesn't make sense on any level. What subset of the infosec community actually believes this? Teenagers hiding porn from their parents?

https://news.ycombinator.com/item?id=14241752 for example.

Windows spews to 30+ microsoft domains with pinned certs, so we can't MITM to see what's going on.

Android spews to X Google domains with pinned certs, so we can't MITM to see what's going on.

Apple is perceived to value security and privacy, due to prior postures and public statements that Apple doesnt work with terrori... FBI. But we only have their word.

The only thing that doesn't spit and spew is a hardened install of Linux.

All are terrible, except Linux. We know what it's doing.

Phones can be more secure than a desktop because the user isn’t allowed to make decisions that are bad, such as installing untrusted software or allowing that software out of the sandbox.

Using a specific Android like distribution is not a magic bullet and will not solve all your security problems.

Reply on news.ycombinator.com