It sounds as if you're confusing "the owner of the phone" with "the momentary user of the phone", as in, the DHS officer who may ask for your phone when you travel into the US.
"How will I keep people from breaking into my cell if the warden doesn't lock it?"
This is the exact kind of amnesia I was talking about. Are you really unfamiliar with default passwords that one changes at boot, such as every consumer router has?
Would you be happy if Google granted access to run Google-supplied programs as root, but not programs from anyone else? No?
With root access, you have the ultimate ability to decide what runs on the computer. Including programs that do not have root access or programs that prevent other programs from running with root access.
If the highest level of privilege is secure boot (the ability to decide what OS runs on the device), then you can run an OS that lets you read everything off the filesystem, sure. But you can also run an OS that doesn't let you read everything off the filesystem.
What matters is that if you have root, you (as a person) are at the top of the trust chain. It doesn't matter if the root permissions trickle down to seated users because you can change that if you're at the top.
No user ever gets root. What gets root is a process. "Grant root access to the owner" while blocking malware means that the OS kernel must distinguish whether a process is acting on behalf of the owner of the device, and has not deceived the owner about what the process will do. If the OS developer (Google in this case) does not do that, clearly the OS developer is evil or horribly incompetent, and anyone who thinks that what the OS currently does is reasonable is an apologist who comes creeping out of the woodwork.
https://astralcodexten.substack.com/p/book-review-the-revolt...
Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned.
If a smartphone vendor wants to give a wide audience access to apps and the net, then the vendor has to cater to people like that neighbour. And that, in turn, means that it must be very, very, very difficult to social-engineer that neighbour into granting another app access to the data in the banking app. To my mind, protecting most people's savings is much more important than catering to people like you and me. You may disagree.
Let me guess, bank transfers? Maybe we should think about improving banking security and informing users before we try locking down nearly every piece of consumer electronics on the market. There is no need for these "banking apps" to exist in the first place. What happened to online banking over the web? Where is the accountability of these banks here? Where is the personal accountability from these users?
I really don't buy this argument. If you can't practice basic security and due diligence, you shouldn't have an online banking account, let alone a computer, you should be in a nursing home.
Personally, I consider it quite reasonable if our OSes are set up to make it difficult to scam regular people, even at the cost of making my tinkering difficult. It's the sensible default, IMO. Feel free to disagree, or even to downvote me.
(I'm sure some of the fifty-odd people used apps to pay the criminals, but that wasn't relevant to the way the scam worked.)
But since you haven't offered any details of the social engineering attack, I'm going to assume there's a freedom-respecting way to prevent it that you're ignorant of, just as you were ignorant of how random people may be prevented root access to non-manufacturer-controlled devices by something as common and trivial as default, buyer-changeable passwords.
So there is an argument to be made for “should it be possible”. I am saying this even though I would still prefer to be allowed to access everything in the system.
The alternative is that the manufacturer holds control over your device, and when the government wants to get in, you're none the wiser.
Jail time, denying entry, a gun to your head are all potential ways I can think of.
For manufacturer & government; it depends on which government. If we are talking of the US government; you are right. If we are talking about most smaller authoritarian regimes? Not so much.
A gun may motivate someone to unlock their hard drive, but if they are are not sufficiently motivated then a gun cannot do anything. You could imagine a spy or a terrorist who prefers to die vs reveal important information, or a journalist who prefer to spend years in jail vs reveal an in-progress investigation that might get them assassinated.
Really, rubber hose attacks are a question of motivation, not technical ability. If apple invented a feature that wiped your storage when you are detained by border guards in some tyrannical state, then you would probably just be tortured to death. In that case you would prefer the ability to unlock your device because the purpose of torture is not to reveal secrets, but to "persuade" you into revealing your secrets.
It's a completely different mode of attack. If the manufacturer has control over the phone, and the gov. makes the manufacturer unlock it, then you will have no idea that you have been attacked, or how much information the gov has on you. They do not need to confront you at all.
When only you have control over the phone, you will know when the government has access to your information, and what information they will have because they will need to torture it out of you.
That's why this "crypto-nihilism" that munroe entertains is just stupid. It leads people to believe that cryptography doesn't matter when in reality it's a major hurdle for the government and corporations trying to exert tyrannical control over people. In his comic, Munroe doesn't present the case where the laptop is unencrypted which is often what gets journalists/protesters/spies' data leaked unbeknownst to them, and then their collaborators are killed in a car bomb weeks later.
In the smartphone case, this has to do with manufacturers choosing to encourage low-entropy passwords that can be easily cracked (e.g. 4-digit pin), "secure boot" that isn't really secure, and biometrics that are not used for disk encryption. These are all intentional flaws.
>For manufacturer & government; it depends on which government. If we are talking of the US government; you are right. If we are talking about most smaller authoritarian regimes? Not so much.
North Korea? The government can simply ban phones that aren't backdoored. It's not a question of size, it's a question of technical competence. China, a much larger country than North Korea, is apparently only using user-space malware; you can still buy phones with unlocked bootloaders and run AOSP.
And this assumes that you purchase your device from a manufacturer whose supply chain lies only within the jurisdiction of governments friendly to your interests, and also from a manufacturer that is friendly to your interests. I don't think I can name a single manufacturer I trust that much to control my hardware over the wire with no oversight, merely because all organizations can eventually succumb to corruption.
If a DHS officer can unlock your phone to enable adb support, or if you left debugging support on and did not poweroff your phone, then you have much larger problems.
This patch only targets people who are already able to unlock the device and setup adb debugging.