Live data from Hacker News

Ask HN: Options for Android phone no longer getting security updates?

news.ycombinator.com

1–10 of 34 posts

Ask HN: Options for Android phone no longer getting security updates?

#1
What can / should I do with an (otherwise perfectly good) Android phone that no longer receives security updates?

Yesterday’s epic thread about blue and green bubbles, which of course branched off into a comparison of iPhones and Androids, made me think about my own phone more than usual. It’s a Moto G Power (2020) running Android 11 that received its last security update in April.

I’m embarrassed to say that I didn’t realize this, or realize that this is Motorola’s policy (one version upgrade and two years of security updates) until yesterday. I admit that this has given me a new perspective on paying $500 for an iPhone SE that might receive updates for 5+ years vs. $200 for a budget Android phone that might get less than 2 years of support from my date of purchase.

Anyway, I’m otherwise perfectly content with the phone. I bought a budget phone in the first place because I’m not a heavy phone user, which makes the thought of buying a new phone that much more painful. My options seem to be:

1. Stick my head in the sand and don’t worry about the lack of security updates for another couple of years. I’m obviously in good company with millions (billions?) of other Android phone owners, but how foolish would this be?

2. Replace it now with a new phone.

3. Maybe go down the rabbit hole of LineageOS or other custom ROMs? Is this viable for a daily driver that I don’t use much but needs to work when I need it? How mature are these compared to, say, the major desktop Linux distros?

Re: Ask HN: Options for Android phone no longer getting security updates?

#2
Keep it, but don't do anything important on it. Don't read your email. Don't read your social media, if you care about your account being taken over. Don't access your bank on it. Use it for phone calls and texting only, and that if you don't care about somebody else reading your texts.

And for me, that's good enough. I don't actually care about someone reading my texts. I simply don't access the internet on my phone. (Cataracts made it hard to focus close enough to read a screen that small. Yes, you can enlarge the text, but then I'd be scrolling my fingers off.) My personal life isn't tabloid material. I don't have any stalkers. (So far as I know - if I do, hi!) So someone could read my contacts, read my texts, and see pictures of my granddaughter and my cat. Under these conditions, I see no reason why I should care very much about the security of my phone.

Am I missing something in my threat model?

Re: Ask HN: Options for Android phone no longer getting security updates?

#3
From my experience (which isn't worth much but I have had similar thoughts about this) I went with a used iPhone 8 last year for around $180 because I thought it was going to get iOS 16, which it did. It's good until September next year (when the next iOS probably comes out) and at that point I will probably get a newer iPhone albeit probably a used one to save money.

On custom ROMS, a security researcher named 'madaidan' states that ROMs such as Lineage are insecure (https://madaidans-insecurities.github.io/security-privacy-ad...) with GrapheneOS being an exception.

On the GrapheneOS website, it recommends getting a Pixel 6 and above which has 5 years of guaranteed full security updates (https://grapheneos.org/faq#recommended-devices).

Louis Rossmann recently released a video talking about GrapheneOS as his daily driver and breaks down some usability misconceptions. (https://www.youtube.com/watch?v=yIZmUINSvQ4)

Re: Ask HN: Options for Android phone no longer getting security updates?

#4
Unfortunately, I don't believe your device is supported by GrapheneOS: https://grapheneos.org/faq#supported-devices

Install LineageOS on it, if it's supported?

https://wiki.lineageos.org/devices/#motorola

But read this about LineageOS, et al to understand the risks: https://madaidans-insecurities.github.io/android.html

Re: Ask HN: Options for Android phone no longer getting security updates?

#5

Keep it, but don't do anything important on it . Don't read your email. Don't read your social media, if you care about your account being taken over. Don't access your bank on it. Use it for phone calls and texting only , and that if you don't care about somebody else reading your texts. And for me, that's good enough. I don't actually care about someone reading my texts. I simply don't access the internet on my pho…

On this line of thinking, one of my concerns is that SMS (to my Google Voice number, which is the app I exclusively use for phone calls and SMS) is the method that many services use for two-step verification, even if my other texts aren't sensitive.

Re: Ask HN: Options for Android phone no longer getting security updates?

#7
If you prefer Android devices, always seek out phones whose bootloader can be unlocked so that you can install another OS on it. This way, you can be assured of Android fork / ports being available for the phone even if the manufacturer stops releasing updates. I highly recommend Sony Open Devices - https://static.developer.sony.com/develop/open-devices/get-s... ... Or checkout the list of supported devices that can run LineageOS (a popular fork of Android) - https://wiki.lineageos.org/devices/

Re: Ask HN: Options for Android phone no longer getting security updates?

#8
post #5

Keep it, but don't do anything important on it . Don't read your email. Don't read your social media, if you care about your account being taken over. Don't access your bank on it. Use it for phone calls and texting only , and that if you don't care about somebody else reading your texts. And for me, that's good enough. I don't actually care about someone reading my texts. I simply don't access the internet on my pho…

On this line of thinking, one of my concerns is that SMS (to my Google Voice number, which is the app I exclusively use for phone calls and SMS) is the method that many services use for two-step verification, even if my other texts aren't sensitive.

Good point. Still... let's say I'm logging on to a website that uses 2FA. They send me an SMS with a one-time code in it. An attacker reads that code. The attacker then has to hijack my browser session on a different device (since I'm not using internet on my phone). For them to do that, they already own my laptop (or maybe my wireless router or my DSL modem), and have been able to correlate them with my phone. That's possible, but at that point I'm pretty much in trouble anyway.

Re: Ask HN: Options for Android phone no longer getting security updates?

#10
https://wiki.lineageos.org/devices/ocean/

A Moto G7 Power like above? Motorola devices can be bootloader unlocked I think.

We have a couple Moto G7 Plus devices and use microG, I use VPN and have a firewall app. Works great. Even notifications can work with apps you choose.

I have been a LineageOS user for awhile. There's no guarantee a particular device will always be maintained but if is, it's not that hard to install. The instructions are pretty clear. I've used it on a old Samsung 3, an Honor5x, Samsung S5, and now Moto G7.

Post reply on HN