Live data from Hacker News

Verizon announces plans to install a download-tracking app on its Android phones

eff.org

81–90 of 118 posts

Re: Verizon announces plans to install a download-tracking app on its Android phones

#81

Verizon is the only cell company that has coverage in my home town in central Massachusetts. Thus I have used them all my life. I recently had my first "positive" customer service with experience with Verizon switching to their unlimited plan. My bill dropped significantly. ($120 base -> $80 but really $200 -> $80 because I always go over on data) I just noticed that I have a "phone upgrade" waiting as well. I am an…

Verizon is very big in my town, but I pay $35/month for less-than-wonderful Virgin Mobile. Can't get a signal in the office but it's not worth +$85/month more to me.

Perhaps you can convince your employer to cover/expense your cell phone, as it is necessary for you to perform your job. If they disagree, completely stop using a personal cell phone, and then watch how fast they provide you with one.

Re: Verizon announces plans to install a download-tracking app on its Android phones

#82
post #54

Between the Google play store, Android's general insecurity, and now cell carriers actively pushing spyware, what alternatives exist? And please don't say iOS. It's closed source, which means we really don't know what's going on under the hood. We may trust it today, but one secret court order + an overnight update is all we need to lose everything with iOS. Apple execs may not even be made aware of such an update if…

Been watching CopperheadOS for a while, the best option as far as I know. I will be getting my next phone directly from them to support development. https://copperhead.co/android/

I am ignorant of how this connects to a carrier. Will it work on Verizon's network? Can Verizon install something once it is connected?

Re: Verizon announces plans to install a download-tracking app on its Android phones

#83

Is this truly just an app or is it functionality tied to base OS configuration? If its the former, I should be able to uninstall via root like all the other bloatware crap, correct?

If it is the former, don't forget that having a rooted phone likely puts you in the minority. Most people don't have the patience or confidence in their technical abilities to root their phones.

I understand that. I was just wondering if anything could be done about it.

Re: Verizon announces plans to install a download-tracking app on its Android phones

#84
post #54

Between the Google play store, Android's general insecurity, and now cell carriers actively pushing spyware, what alternatives exist? And please don't say iOS. It's closed source, which means we really don't know what's going on under the hood. We may trust it today, but one secret court order + an overnight update is all we need to lose everything with iOS. Apple execs may not even be made aware of such an update if…

> Would be a great step to have a phone that: Fully open source.

Two problems remaining why this won't happen:

a) Baseband (which in some cases has direct access to the microphone, or worse, DMA link to the CPU, or even worse, integrated into the SoC) firmware

b) Linux kernel. So many manufacturers either blatantly ignore the GPL by not releasing kernel source code, and nearly all of them, instead of cooperating with upstream, fork the kernels and add literal crap on their trees. The horrors I have seen, especially in leaked Mediatek source trees... unimaginable. I can certainly understand why Mediatek does not want to release kernel sources.

Also this is the biggest threat to the Android ecosystem. Either some kernel contributor sues Mediatek and other shoddy OEM/ODMs for enough money that they go down (unlikely), or the kernel forks by manufacturers will go so hard out of sync that new userlands of Android will simply not work with fossilized kernels. Same as in the embedded-Linux world...

I believe a lot of manufacturers operate by "lets either not release code at all or code so shoddy no one else wants to release anything based on it", and thus holding privacy, security and competition hostage. Especially as competition is stuff like cyanogenmod which removes all the nasty tracking/adware whose data sales the OEMs intend to monetize...

Re: Verizon announces plans to install a download-tracking app on its Android phones

#85
post #54

Between the Google play store, Android's general insecurity, and now cell carriers actively pushing spyware, what alternatives exist? And please don't say iOS. It's closed source, which means we really don't know what's going on under the hood. We may trust it today, but one secret court order + an overnight update is all we need to lose everything with iOS. Apple execs may not even be made aware of such an update if…

"Between the Google play store, Android's general insecurity, and now cell carriers actively pushing spyware, what alternatives exist?"

There are no alternatives until we have an open baseband.

Every objection you state in your comment about android (and iOS) is dwarfed by the objections you would have if you truly understood the two other general purpose computers inside your phone that you have no control over - namely, your baseband processor and your SIM card.

Your carrier owns you. Your carrier owns you more deeply than any spyware author ever dreamed of owning you.

Your carrier can upload and run arbitrary java applets onto your SIM card without you ever knowing. Your carrier, depending on which SOC you have and how it is implemented, can access your CPU and memory directly. As in, read the passphrase of your cutesy encrypted chat app as you key it in.

We cannot begin to speak of a secure mobile platform or any kind of open source mobile platform until we have an open baseband and control our own SIM cards. We are very, very far away from this.

In the meantime, you have two choices:

1. treat your mobile device as fully compromised and behave accordingly. This is what I do.

2. Buy a non-cellular mobile device (for instance, the old "samsung galaxy player" devices that have no mobile chipset or SIM card) and insert a cellular modem into the USB port and segregate that function there, and use VOIP software. This actually sounds sort-of workable except for one interesting problem - in addition to handling cellular communications, the baseband also handles voice quality like noise cancellation and so on that also needs to be done in real-time and not interrupted by userland events ... and so your actual voice quality will drop as a result of using VOIP on a handset.

Re: Verizon announces plans to install a download-tracking app on its Android phones

#86
post #85
post #54

Between the Google play store, Android's general insecurity, and now cell carriers actively pushing spyware, what alternatives exist? And please don't say iOS. It's closed source, which means we really don't know what's going on under the hood. We may trust it today, but one secret court order + an overnight update is all we need to lose everything with iOS. Apple execs may not even be made aware of such an update if…

"Between the Google play store, Android's general insecurity, and now cell carriers actively pushing spyware, what alternatives exist?" There are no alternatives until we have an open baseband. Every objection you state in your comment about android (and iOS) is dwarfed by the objections you would have if you truly understood the two other general purpose computers inside your phone that you have no control over - na…

How does iOS and the iPhone handle this SIM card/baseband processor issue? Is there an article that details the exact threat model and defenses in place?

Re: Verizon announces plans to install a download-tracking app on its Android phones

#87
"UPDATE: We have received additional information from Verizon and based on that information we are withdrawing this post while we investigate further. Here is the statement from Kelly Crummey, Director of Corporate Communications of Verizon: 'As we said earlier this week, we are testing AppFlash to make app discovery better for consumers. The test is on a single phone – LG K20 V – and you have to opt-in to use the app. Or, you can easily disable the app. Nobody is required to use it. Verizon is committed to your privacy. Visit www.verizon.com/about/privacy to view our Privacy Policy.'"

Re: Verizon announces plans to install a download-tracking app on its Android phones

#88
post #54

Between the Google play store, Android's general insecurity, and now cell carriers actively pushing spyware, what alternatives exist? And please don't say iOS. It's closed source, which means we really don't know what's going on under the hood. We may trust it today, but one secret court order + an overnight update is all we need to lose everything with iOS. Apple execs may not even be made aware of such an update if…

[deleted]

Re: Verizon announces plans to install a download-tracking app on its Android phones

#89
post #54

Between the Google play store, Android's general insecurity, and now cell carriers actively pushing spyware, what alternatives exist? And please don't say iOS. It's closed source, which means we really don't know what's going on under the hood. We may trust it today, but one secret court order + an overnight update is all we need to lose everything with iOS. Apple execs may not even be made aware of such an update if…

"There are no secure smartphones"

374 points, 441 days ago, 118 comments. Note the discussion about baseband.

https://news.ycombinator.com/item?id=10905643

Re: Verizon announces plans to install a download-tracking app on its Android phones

#90
post #82

Earlier quoted context omitted.

Been watching CopperheadOS for a while, the best option as far as I know. I will be getting my next phone directly from them to support development. https://copperhead.co/android/

I am ignorant of how this connects to a carrier. Will it work on Verizon's network? Can Verizon install something once it is connected?

It will work, right now it only supports a few phones (Nexus 9 WiFi, Nexus 5X, Nexus 6P) with the Pixel and Pixel XL on the way. I don't have a supported phone currently so I haven't been able to test it out but any phone that is capable of connecting to Verizon's network hardware wise should be able to connect using any OS that implements the necessary protocols. The Pixel and Pixel XL use nano SIM cards to connect to a carrier.

If CopperheadOS is installed the only attack vector Verizon could use is the SIM Card, but CopperheadOS implements a lot of security features that could help mitigate the risk:

* Full verified boot, covering all firmware and OS partitions.

* Baseline app isolation via unique uid/gid pairs for each app.

* App permission model including the ability to revoke permissions and supply fake data.

Carriers can not install software on phones connected to the network. Assuming they installed a Carrier configuration application or anything else using the SIM Card you could revoke its permissions or supply fake data, or even create firewall rules to disallow the traffic manually.

More security features:

https://copperhead.co/android/docs/technical_overview

Post reply on HN