Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google urges Android phone users to switch off Wi-Fi calling

scrippsnews.com

Post reply on HN
Print view View original

61–70 of 178 posts

Re: Google urges Android phone users to switch off Wi-Fi calling

#61

Post by jeffparsons »

Grazester wrote: post #49
jeffparsons wrote: post #4

Well, this was an awkward way to realise my phone hasn't been receiving security updates for years. Apparently Google quietly dropped support for it? The phone is otherwise in excellent condition. Any recommendations for a good third party OS that still supports Pixel 2?

How was this quiet? This is usually published by Google and other web sites when security updates have needed on the Pixel Phones. Given you're a HN user I assume you are fairly tech savvy and knew when you bought your phone it was only going to get security and system updates for 3 years.

I guess I haven't had any time to actively care about this stuff for the last 2.5 years (new parent). So when my phone tells me "Your device is up to date" with the reality in small text further down the page, apparently I am able to miss this.

Sure, I have to take some responsibility for poor digital hygiene or whatever, but I don't think that negates Google's awful management of this. I shouldn't _have_ to be vigilant/proactive to stay safe in something as basic as this.

Aside: Google spams me with all kinds of noise in notifications these days; couldn't they at very least put something in there saying "by the way, your device is now EOL; buy a new one"? Ockham's razor suggests to me that a _lot_ of people are running unsupported devices still, and Google doesn't want the collective backlash of putting that uncomfortable reality in people's faces.

Re: Google urges Android phone users to switch off Wi-Fi calling

#62

Post by orangepurple »

dangus wrote: post #41

At this point I'd have to say that Wi-Fi calling is a dead feature, putting this particular issue aside. I just don't see the benefit in 2023. It made sense back when cellular networks were less mature. It also made sense when it could cut down on your wireless bill. But all you have to do is walk out of your house while on a phone call and realize how much the feature is degrading overall reliability. The LTE networ…

> I just don't see the benefit in 2023

Travel outside the country on a budget

Re: Google urges Android phone users to switch off Wi-Fi calling

#63

Post by orangepurple »

dangus wrote: post #55
readthenotes1 wrote: post #48

Earlier quoted context omitted.

any international travel. i'm in the bahamas now and had a nice conversation with someone who won't install whatsapp. 6 months ago I was in Colombia and was able to take care of some banking problems back home. Plus, texts are delivered and sent while you're away. (And...I do know people in the US who are in cell weak spots that wifi calling solves)

I find that international roaming is cheaper than ever. Some carriers like T-Mobile (US) and Google Fi include it for free.

There is absolutely no point if wifi calling is free and good enough

Re: Google urges Android phone users to switch off Wi-Fi calling

#64

Post by jeffparsons »

josephcsible wrote: post #56
Grazester wrote: post #49

Earlier quoted context omitted.

How was this quiet? This is usually published by Google and other web sites when security updates have needed on the Pixel Phones. Given you're a HN user I assume you are fairly tech savvy and knew when you bought your phone it was only going to get security and system updates for 3 years.

I think it's "quiet" in the sense that they don't send a push notification to affected phones when they're about to go EOL, so you don't know it happens unless you go out of your way to check.

Or put the EOL in the final OS update for that phone, with a permanent status icon / notification warning that the device is EOL. It's not like they decide at their morning stand-up, "hey, Pixel 2 has been out for a while; anyone object to killing it off today?" There's plenty of time to roll that sort of thing out, however it works under the hood.

Re: Google urges Android phone users to switch off Wi-Fi calling

#65

Post by prophesi »

arsome wrote: post #46
prophesi wrote: post #26

Earlier quoted context omitted.

With a cursory search I found CVE-2021-0316. This one's just for bluetooth, but it's an RCE with no user interaction discovered in 2021. Pixel 2 had its last security patch in November 2020.

Yes, it exists, but is it actively exploitable? A cursory search turns up no working exploit code. Given modern exploit mitigations many theoretical vulnerabilities turn out to be nothing-burgers, as far as I can see there's certainly no worm running around popping phones with it. For sure, if you're paranoid or a high-value target, update, buy a new phone. But normal users don't need to care unless there's actually…

Android's security advisory page shows what vulnerabilities have been found in the wild. Security researcher Maddie Stone from Google's Project Zero:

https://twitter.com/maddiestone/status/1395004346996248586

Not sure what to say about encouraging users to throw caution to the wind. We got to this point of such good exploit mitigation because it's good for everyone for these devices to be secured.

Re: Google urges Android phone users to switch off Wi-Fi calling

#67

Post by arsome »

prophesi wrote: post #65
arsome wrote: post #46

Earlier quoted context omitted.

Yes, it exists, but is it actively exploitable? A cursory search turns up no working exploit code. Given modern exploit mitigations many theoretical vulnerabilities turn out to be nothing-burgers, as far as I can see there's certainly no worm running around popping phones with it. For sure, if you're paranoid or a high-value target, update, buy a new phone. But normal users don't need to care unless there's actually…

Android's security advisory page shows what vulnerabilities have been found in the wild. Security researcher Maddie Stone from Google's Project Zero: https://twitter.com/maddiestone/status/1395004346996248586 Not sure what to say about encouraging users to throw caution to the wind. We got to this point of such good exploit mitigation because it's good for everyone for these devices to be secured.

A bit silly to link a page about malware that Play Protect prevents, largely local privescs that are being detected by the OS or Google Play beforehand.

An average user installing apps from Play Store has nothing to worry about for those. That's kind of the point.

It's great for these devices to be patched - I'd love it if Google would take more control over the ecosystem to be able to patch this sort of thing, but it's much worse for users to just throw out otherwise working devices with limited-to-no real-world security issues.

Re: Google urges Android phone users to switch off Wi-Fi calling

#68

Post by prophesi »

arsome wrote: post #67
prophesi wrote: post #65

Earlier quoted context omitted.

Android's security advisory page shows what vulnerabilities have been found in the wild. Security researcher Maddie Stone from Google's Project Zero: https://twitter.com/maddiestone/status/1395004346996248586 Not sure what to say about encouraging users to throw caution to the wind. We got to this point of such good exploit mitigation because it's good for everyone for these devices to be secured.

A bit silly to link a page about malware that Play Protect prevents, largely local privescs that are being detected by the OS or Google Play beforehand. An average user installing apps from Play Store has nothing to worry about for those. That's kind of the point. It's great for these devices to be patched - I'd love it if Google would take more control over the ecosystem to be able to patch this sort of thing, but i…

Um, no? Most of the RCE's I'm seeing are at the OS level and would require upgrading to a newer Android OS version that older devices won't have support for.

Re: Google urges Android phone users to switch off Wi-Fi calling

#69

Post by arsome »

prophesi wrote: post #68
arsome wrote: post #67

Earlier quoted context omitted.

A bit silly to link a page about malware that Play Protect prevents, largely local privescs that are being detected by the OS or Google Play beforehand. An average user installing apps from Play Store has nothing to worry about for those. That's kind of the point. It's great for these devices to be patched - I'd love it if Google would take more control over the ecosystem to be able to patch this sort of thing, but i…

Um, no? Most of the RCE's I'm seeing are at the OS level and would require upgrading to a newer Android OS version that older devices won't have support for.

To fully patch, yes, but the point is that Play Protect is detecting them before installation before they can be exploited, ie: on submission to Play Store or on installation on devices.

Yes, this is still a risk - if you tend to install random apks from the internet and disable Play Protect or run across an undetected modification of the relevant exploit code. But most users don't do that.

Re: Google urges Android phone users to switch off Wi-Fi calling

#70

Post by jeffparsons »

arsome wrote: post #42
jeffparsons wrote: post #24

Earlier quoted context omitted.

Well, I use a web browser on the phone. Chrome et al. are still receiving updates for my phone, but I'm guessing they use some system components that are not receiving updates? So my main worry is something like an ad network loading an exploit. You don't need to be a high value target to get caught in an extremely wide net like that. (Yes, I know: get a better ad blocker, etc. — I'd rather have fewer weak links, tho…

Not really - Android has for many versions now been updating the embedded webview component via play services.

Huh, that's somewhat comforting, I guess. And all image codecs etc. are statically linked?
Post reply on HN