Tell HN: Your Android carrier can remotely turn settings on • Hacker News Board

Re: Tell HN: Your Android carrier can remotely turn settings on

#91

Post by kelnos » Mon, Dec 12, 2022, 6:21 PM UTC

warkdarrior wrote: post #78

bjt2n3904 wrote: post #74

Earlier quoted context omitted.

Gotcha. I'll just draft a law saying all devices must automatically unencrypt themselves when they enter my country's borders. Hey, it's the law! You must comply, and for your convenience, your phone will do that automatically for you! Good grief.

If you do not like the regulation, fight to change it. Do not expect your devices to do the fighting for you.

A better response to these laws would be that the device should just stop working if the settings I have selected conflict with local law. The cell towers are free to refuse to allow my phone to connect. They should send some sort of message to me to tell me what I'd need to do in order to comply with local law and be allowed on the network.

But of course, that wouldn't be convenient, and a lot of people would be confused, and that would generate costly support calls, so they'd rather just violate the sanctity of the things we apparently don't really own and put intrusive hooks into "our" hardware and software.

In the case of this particular requirement -- that wireless alerts be enabled -- I would almost certainly just enable them and go about my day. But reaching into my device and changing things without my consent crosses a line.

Re: Tell HN: Your Android carrier can remotely turn settings on

#92

Post by jmole » Mon, Dec 12, 2022, 6:22 PM UTC

I bought a Pixel 7 recently.

When setting up the device, I was asked to insert my SIM card. Usually, I'd have skipped past this screen, but I thought "Ok, let me swap out my SIM", since I was trading in an older device.

Worst mistake ever. Even on an unlocked phone, all the verizon crapware was silently installed in the background. This doesn't happen when you put in the SIM after setting up the phone.

Such a backwards experience.

Re: Tell HN: Your Android carrier can remotely turn settings on

#93

Post by Tomte » Mon, Dec 12, 2022, 6:23 PM UTC

f1shy wrote: post #53

BanjoBass wrote: post #28

Pretty sure they're "required" in Germany and cannot be disabled by the user. You travel to other countries, you abide by their laws. This is no different.

No required. In iOS can be disabled.

The highest level cannot. We just had a nationwide test in Germany a few days ago.

Re: Tell HN: Your Android carrier can remotely turn settings on

#94

Post by kelnos » Mon, Dec 12, 2022, 6:26 PM UTC

N_A_T_E wrote: post #12

IMHO, carrier settings are a small portion and not super impactful part of the phone configuration you see in the settings list. This is actually a somewhat cool feature. Imagine going to another country, jumping on another network and your phone automatically knows what cell bands and towers to connect to. Carriers can't change regular settings like language, lock screen code or background. Just what cell towers you…

> Imagine going to another country, jumping on another network and your phone automatically knows what cell bands and towers to connect to.

They already do that. Or, rather they don't need to "know" anything; a phone with no signal will scan through all the bands it has a radio for, and will find a network to connect to. If a network rejects the connection, it'll move on to another.

This is also something that traditionally has been configurable: you can tell your phone not to do this, if you want, and it will obey your command. But allowing the carrier to change settings on the phone after a connection is established is pretty intrusive, IMO.

Re: Tell HN: Your Android carrier can remotely turn settings on

#95

Post by kornhole » Mon, Dec 12, 2022, 6:26 PM UTC

qbasic_forever wrote: post #51

Wait until your learn what a country or local government/police can do remotely to the baseband firmware of your phone with a court order... 10-20 years ago the FBI was regularly remotely programming firmware to listen in and record cell phone microphones to capture conversations of suspects. IIRC a mafia case hinged on data gathered in this way so it is not some abstract theoretical or crackpot theory ( https://www.…

I rotate burner SIM's. I never make calls with the SIM. Instead I use jmp.chat if I need to use OTA calls or SMS. I am in airplane mode 99% of the time and use WIFI instead of cellular. I never activate cellular near my home. I am always connected to VPN so that the traffic cannot be analyzed. My phone is anonymous without any identifiers. I think all this mitigates the baseband attacks, but tell me if I am missing something.

Re: Tell HN: Your Android carrier can remotely turn settings on

#96

Post by precommunicator » Mon, Dec 12, 2022, 6:29 PM UTC

Similar thing is with call recording, as one of my SIM card is from Germany my phone doesn't allow me to enable call recording, but, as I don't live in Germany, and it's legal to do so here, I have a manufacturer-specific app (3rd party, ofc) that basically runs in background and periodically and on boot, re-enables this setting. Wonder if something similar could be made, or exists for your phone.

Re: Tell HN: Your Android carrier can remotely turn settings on

#97

Post by msingh_5 » Mon, Dec 12, 2022, 6:29 PM UTC

bjt2n3904 wrote: post #56

msingh_5 wrote: post #23

These are emergency broadcast alerts. Different countries have different laws on these - and in some countries you might not even be able to disable them. Just because its listed under "Apps & notifications"/"Wireless emergency alerts", it doesn't mean they are "user settings". Its not necessarily the local "carrier" that turned the settings on, its more that connecting to a cell tower in a particular jurisdiction ca…

Just because another country has a law does not mean my phone should disregard what I told it to do. This absolutely is a user setting. How far we've fallen from sharing the DeCSS flag, to arguing that users shouldn't have control over their devices, and governments and carriers should.

You enter a new country, in case Germany, you're automatically opted in to the emergency broadcast notifications, as any other local laws.

The EU legislation allows "opt out" from level 2/level 3 notifications, but is based on the notion that messages are received "without the need for the public to have to opt-in".

So for compliance sake, you're opted in. Maybe this should only happen the first time you enter EU or a member state, and then either your phone or cell service provider should remember your preference (which is probably not worth the resources to implement for the cell service provider, but maybe your phone already does?).

I'd be interested to see if this already exists, i.e. do you only need to opt out in Germany once? Does that opt-out at EU level?

When your wife disabled notifications, she merely opted out of notifications in whatever jurisdiction she was in (presumably US?), but opting out of something in US doesn't mean you opted out of every other similar law from every other nation state.

Re: Tell HN: Your Android carrier can remotely turn settings on

#98

Post by kelnos » Mon, Dec 12, 2022, 6:29 PM UTC

nicholasjarnold wrote: post #33

> I must say I strongly dislike losing control over my own device. It feels dystopian to me. Even with a rooted device where perhaps you personally coded up the ROM you are still missing a piece which is the binary blob that runs the baseband radio. That firmware is, afaik, not something which exists in any sort of open-source or rootable manner. It's a closed blob running proprietary software on your phone, and it r…

I don't believe this is entirely true anymore. Yes, years ago, the baseband processor (and firmware) had full DMA capabilities to the RAM ostensibly managed by the OS, and could do nefarious things if it wanted to. But I believe nowadays the baseband is a bit more isolated, and communication with it is mediated by the CPU and OS.

Some manufacturers likely still implement the "old" architecture, though.

Re: Tell HN: Your Android carrier can remotely turn settings on

#99

Post by mschuster91 » Mon, Dec 12, 2022, 6:32 PM UTC

tristor wrote: post #76

bjt2n3904 wrote: post #56

Earlier quoted context omitted.

Just because another country has a law does not mean my phone should disregard what I told it to do. This absolutely is a user setting. How far we've fallen from sharing the DeCSS flag, to arguing that users shouldn't have control over their devices, and governments and carriers should.

People keep failing to understand that if you can't make your device do something that is illegal, it's not /your/ device. It's that simple. Politically crafted laws are not physical laws of the universe, they not only can be violated, they often /should/ be violated. Laws are not a moral imperative. This particular law (emergency alerts) might not be an issue, but the fact that your device will follow the government…

It's not the default of the device though.

We need to get rid of those in power who decide on things they have no fucking clue about it. The easiest way to do that is to not just go vote, but educate everyone else about who is running and why they are/are not a good choice. The harder way is also (at least for the US folks) showing up and engaging at primary votes and holding the primary candidates accountable, which takes a lot more effort but has the advantage that your vote is amplified in its effects.

Re: Tell HN: Your Android carrier can remotely turn settings on

#100

Post by xnyanta » Mon, Dec 12, 2022, 6:33 PM UTC

isodev wrote: post #67

michaelt wrote: post #39

Earlier quoted context omitted.

The fact the government issues the alerts doesn't mean the government won't get pressured into sending spammy messages. For example, what politician could turn down the grieving parents of a kidnapped child, when they call for using the emergency alert system for missing children? But if I work from home, and there aren't any kidnapped children in my home, then waking me up at 5am with a missing child alert just inco…

Amber alerts are a well-defined category of messages you can receive. The regulation about what constitutes a legitimate case for an emergency broadcast are very strict and subject to public review, so pretty hard to misuse for unrelated purposes.

Yet, no one is forcing governments to use the system as-designed. In Quebec, on my phone, I can disable quite a few types of cell broadcast alerts like AMBER alerts, Test alerts, etc. The only hidden setting is the one for presidential alerts.

Well guess what? The Quebec government sends every type of alert, even the regular test ones, with the presidential alert severity which makes all of these settings useless and does nothing but irritate the population with spammy messages. Recently, they sent out an AMBER alert that was supposed to be localized in some area and, instead, sent it everywhere in Quebec except for the affected area. This is exactly why people have the right to remain skeptical about alert systems like this one.