271–280 of 474 posts
Earlier quoted context omitted.
The problem that you don't notice is the lack of security updates.
FWIW, the linked article doesn't track security update status at all. It's graphing percentiles based on API version, which correlates only weakly. A vendor with a correctly patched but old OS would show up as "out of date", but one that missed or is late on important security updates on a recent version is "current".
I've got a 7 or 8 year old Google Nexus phone. Google stopped updating the OS 5 years ago. The only impact I've noticed is that newer apps won't run on and older OS. For me, however, that really isn't a problem since I use it for making and receiving calls and texts, and checking my email. Right now, I'm in no hurry to lay out hundreds for a new phone, Apple or Android, that will be obsoleted in just a couple years w…
Many Android devices of that age and even newer had flaws resulting in the failure to properly validate HTTPS connections as they would accept invalid certificates. As a result, every time I fire up an off the shelf WiFi Pineapple in public and run SSLSplit (not to be confused with Moxies SSLStrip), I get credential after credential, typically starting with e-mail accounts. This is obviously bad because if someone is…
I'm still using a iPhone4 with iOS 5.something on it, it's obviously un-patched or anything like that, the secret is that I don't have any baking applications installed on it nor is my email attached to any recurring payments scheme. The even deeper secret is that I don't have an online baking account set-up with my bank at all, as I don't trust any of the banks with their online security. I chose to eat up the opportunity costs of actually physically going to the the bank over the sometimes illusory security and ease-of-use offered by online banking.
Earlier quoted context omitted.
The problem that you don't notice is the lack of security updates.
You can but hope that once it’s old enough, the hackers will stop worrying about supporting it.
Take a quick look at the Vault7 leaks for a reference.
I've lost hope that Google will ever do anything meaningful about this situation, when they can't even approach the iPhone in updates when their very own Pixel devices. This is despite now having a standard hardware abstraction framework for their devices and having a kernel that will be supported for 6 years. Even so, they can't commit to updating their devices for the time these devices for at least 80% of their lifecycles.
What's a smartphone lifecycle? Well it's certainly not 2 years. The 2 year old phones will not just be thrown into the garbage. They'll either be sold on second hand markets or they'll be given to other family members, who will then use it for at least another 2 years themselves.
Google, and really all makers of "smart" devices, should be supporting hardware at least until only 10-20% of those devices remain in active use. Kind of like how Microsoft couldn't quit supporting Windows XP when it was at 20%, even though it was already like 12 years old. Only when Windows XP got to below 10% or something, Microsoft stopped supporting it for consumers at least, and even then it will be supported until 2019 for enterprise customers.
Ideally this is how all devices should be supported - until they have fewer than 10% of the customers use them anymore. But as an absolute minimum, they should at least follow the 80/20 power Pareto principle, and update the devices until less than 20% of the people use them anymore.
I know this logic isn't totally alien to Google because they are applying it to the supported OS versions by their Play services and APIs for Android.
If 25% of the Pixel 2 devices (which come with Project Treble and a 6-year supported LTS kernel) are still in active use after 3 years, then Google should be supporting the Pixel 2 for at least 4 years (at least with security patches). But as I said, this should be the bare minimum, like something I'd expect from LG. Google should not stop support until fewer than 10% of the Pixel 2 users have stopped using it.
Earlier quoted context omitted.
Security, basically. If you care about your privacy, you should care about security (can't have one with the other). You need updated phone for that.
Security isn't as big of an issue with many of these devices as you might think. Unless it is years out of date, Play Services still gets updates, the system web view still gets updated, Chrome still gets updates, and in many cases the vendor will still roll out an emergency patch if there is something serious.
Earlier quoted context omitted.
That already happened as a result of Equifax. Your SSN is no longer secret...so rejoice, you are free to choose whatever phone you like!
Sadly, the world is not America and most people on this planet are unaffected by the latest problems of America.
Earlier quoted context omitted.
Most phones already come with two persistent implants - the user-antagonistic OS, and the baseband processor! I'm all for trusting computing devices to act as one's agents, but attempting to do so with anything resembling a modern mobile phone is barking up the wrong tree. Even though just having one means taking the location-tracking hit from negligently designed cellular protocols, further exposure can be mitigated…
Your phone will probably turn up in a botnet soon enough, but atleast you had the moral high ground.
How is that number changed by not using public wifi?
I hope that with introduction of project Treble this trend can be reversed, Google is literally forcing these greedy manufacturers to include Treble if they ship devices with Oreo and above, but this doesn't mean we will see updates as frequent as iOS anytime soon, one thing I observed lately is that after announcement of project Treble almost all manufacturers are releasing newer phones with Nougat 7.1, this is funny considering that it's mid November now and Oreo was released way back in August.
People would like to be secure, but they shouldn't have to pay that much for a security patch and they don't want to downgrade their systems.