Hacker News Reader

Comment by uo21tp5hoyg | Hacker News Reader

The US government has really shaken my trust in services like these (which I guess is their ultimate goal). With the risk that these "secure devices" type sellers are fronts I think it's best practice for anyone wanting a de-googeled device to just buy one of these phones in store with cash and then load the custom OS themselves, it requires the level of technical knowledge you'd need to even know you'd want something like this in the first place so anyone that wants it can easily do it.

Also I find it ironic that this website is full of Google requests, we've got YouTube, google translate, gstatic content, google recaptcha, googleapis, and google fonts requests all just on the landing page alone.

Doesn't help that it's sending data to Facebook either.

View on HN

The Google threat you can still mitigate or even escape.

The US government one you can't. Sorry. As much as I wish I were wrong, the hardware is probably backdoored, so no custom OS will save you. Even if it weren't a phone by design has to communicate with radio towers (backdoored) and even if you get the most secure phone in the world you still have to communicate and pay for some exotic hardware. Guess who will get added to a list of suspicious people to put an extra eye on?

The solution I have is a wired-in, locked down raspberry pi where I have a separate email account, PGP key, etc. Phones are definitely a writeoff though, with the possible exception of the PinePhone. If memory serves, the 4g modem lacks direct memory access which improves security substantially.

Can anyone be sure an enormous open source project like a Linux distribution isn't backdoored?

For something with a lot of eyes on it, like the Linux kernel, I would think it unlikely. It's the smaller projects with no active maintenance that would be easier targets.

At the end of the day, all operating systems have exploits. Nation states pay big money online to buy the exploits for their own use, before the good guys find them and out them. If your system is being compromised by a nation state, it is much more likely buy a purchased exploit than by an explicitly-added backdoor.

I can't say anything about intercepting your communications, though. The NSA might or might not have technical ways of decrypting some of your encrypted communications.

I'm not sure if the PinePhone advertised that. The Librem 5 advertised that though.

Those components in that PinePhone, they come from China. Are you sure that flash module does not contain a backdoor? What about the SoC, PinePhone uses Rockchip, the full name of that company is Fuzhou Rockchip Electronics Co., Ltd.. Are you sure the SoC is free from backdoors? Why even limit the search to complex components when a simple SMD capacitor is more than big enough to contain a low-power radio. Add some 'intelligence' and the thing will be able to deduce whether it is mounted in a position which gives it access to interesting data - the power path being a good candidate - to be transmitted on demand. The same would have been true had the components come from any other country but as it stands nearly all such components come from China.

Being a little flippant here, but it is the British and American govts I worry about more. At least I don't share a language with Chinese spies!

Plus, I'm fairly sure the pi is a known quantity. PinePhone less so. Probably the most secure thing you can do is encrypt messages to your friends, send them as a printed out QR code, and make your signature say "burn after reading". Bonus points for a printer that is old enough that it isn't laden with spyware.

My first “tech” job out of college was tech support for a VPN company. Brilliant little operation reselling bandwidth to folks visiting China and those who wanted to hide their traffic. One reason I really respected the CEO and CTO is that they told us specifically to never, ever promise that we made people “anonymous on the Internet.” Even when they went to no-logs — a big step for them — they still maintained that we always stick to this line: “You are never anonymous on the Internet. Our service is to help you create a more private connection, one that makes it more difficult for you to be tracked by corporations and hackers. It does not protect you against state-level actors.” When I discussed this with them, they had an even more candid take: “Look, if you have the US government after you, you’re already fucked. No level of encryption is going to help.”

This has always stuck with me.

>“Look, if you have the US government after you, you’re already fucked. No level of encryption is going to help.”

Relevant XKCD: https://xkcd.com/538/

Yet somehow the US government can't even prevent me from downloading copyrighted torrents.

There's a difference between stopping an action at a societal level, and targeting an individual through any means necessary.

> There's a difference between stopping an action at a societal level, and targeting an individual through any means necessary.

Yup. It always amazes me how often people conflate, "The U.S. government can't be bothered to stop people from doing X" with, "The U.S. government can't stop people from doing X". If you want to test this out, try not paying federal taxes for a while.

There are people getting away with tax fraud all the time.

Relevant Wiki: https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

The telcos can be mitigated by using burner SIM's that you rarely turn on. Use VOIP numbers with SIP phone clients. Only turn off airplane mode when needed.

I know somebody who refuses to use any encryption anywhere because he is worried that he will raise suspicion.

ArcaneOS comes to my mind as a recent example. I always suggest anyone to load the custom ROM themselves or ask someone you know IRL to do it for you.

If you think you do not have the expertise to do it, you should ask for help. There is a good chance that you will do something wrong and compeletely brick the phone.

Rob Braxman sells degoogled phones on his online store https://brax.me/prod/host.php?f=_store&h=rob&p=. Some say he is goverment psyop while some think he is pretty legit https://www.reddit.com/r/privacytoolsIO/comments/imf6vx/how_...

He ow can you trust the ArcaneOS releases to not be free from backdoors, etc?

Even if you build the image yourself you're still relying on someone else's code. It reminds me of the office space quote, "no one can check all that code. Thumbs up their a$$es."

> I think it's best practice for anyone wanting a de-googeled device to just buy one of these phones in store with cash and then load the custom OS themselves

The best practice is to abandon locked down Android phones and switch to GNU/Linux phones (Librem 5 and Pinephone).

Long term, but the software isn't quite there, though improving.

Worse the radios don't support everything my carrier does. 5g is a must where I live as 4g is being skipped in remote locations that are finally being upgraded from 2g.

In that case a fairphone might meet your requiements while still being open to installing alternative OS'es.

Is fairphone available in the US yet?

Doesn't look like it, only continental europe & uk. The bands it supports are in use by Sprint and T-mobile though, so if you import it it will probably work on those carriers.

Linux phones are entirely impractical for most people. I live in India, and there are several apps I need to use to access government services that only work on iOS and Android. Some services aren't even available over the Web.

We're at a point where any successful mobile OS will at least need to support running Android apps, preferably directly from the Play Store. I suspect this is one of the reasons Microsoft is adding Android support to Windows 11.

I like the idea of an entirely FOSS phone, but sadly that ship sailed years ago.

Waydroid allows Linux devices to run Android apps when needed, which also can help bridge the gap in usability until mobile Linux distros are competitive with Android.

One option would be to keep an iPhone or Android strictly for such apps but keep your personal browsing/email/IM/etc off it.

If you want some anonymity, you can't just have a single phone and expect it can do everything.

You need separated devices, and do the anonymous stuff in the most private one.

It is the same principle as having separate machines for work and personal stuff.

Yes, it is "impractical". That's unavoidable. Let's keep the conversation on what can be done, not some theoretical perfect device no one will ever make.

> It is the same principle as having separate machines for work and personal stuff.

Fortunately, for normal computers it's not necessary, because we have Qubes OS for that: https://qubes-os.org

I would be happy to try Librem 5, but I looked at the specs a few days ago, and just...

It was mid-spec a half decade ago, and hasn't changed since. You're really paying a lot for that old hardware. This won't help adoption.

iPhones are very high-spec, but you can't really run anything serious on them due to the walled garden. What are you going to do with this phone?

A lot less with lower specs, than the higher end specs I deserve. That's what people will think, as soon as they see them.

The frontend seems to be 100% shopify dependent (ie. the page is blank if the shopify domain is blocked), but I don't know if that's a good thing or a bad thing.

So Google is balancing your privacy with their expansion. If something went to court Google could be what keeps you out of court, because unless there is an independent expert, manufacturers tend to become the defacto court expert and most of the time you are probably a tiny little cash cow for them and they like milking you.

how would you look at e.foundation in comparison? they sell phones with their own OS, so if you trust the OS then i think you can trust their phones.

It's even easier these days with the web installer that GrapheneOS uses.

https://grapheneos.org/install/web

Reply on news.ycombinator.com