Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google urges Android phone users to switch off Wi-Fi calling

scrippsnews.com

Post reply on HN
Print view View original

81–90 of 178 posts

Re: Google urges Android phone users to switch off Wi-Fi calling

#81

Post by prophesi »

arsome wrote: post #69
prophesi wrote: post #68

Earlier quoted context omitted.

Um, no? Most of the RCE's I'm seeing are at the OS level and would require upgrading to a newer Android OS version that older devices won't have support for.

To fully patch, yes, but the point is that Play Protect is detecting them before installation before they can be exploited, ie: on submission to Play Store or on installation on devices. Yes, this is still a risk - if you tend to install random apks from the internet and disable Play Protect or run across an undetected modification of the relevant exploit code. But most users don't do that.

Gotcha. Still, it's a lot of RCE's coming out per month to depend on blackbox machine learning for something people use every day for their personal/business needs.

Re: Google urges Android phone users to switch off Wi-Fi calling

#82

Post by lotsofpulp »

dangus wrote: post #41

At this point I'd have to say that Wi-Fi calling is a dead feature, putting this particular issue aside. I just don't see the benefit in 2023. It made sense back when cellular networks were less mature. It also made sense when it could cut down on your wireless bill. But all you have to do is walk out of your house while on a phone call and realize how much the feature is degrading overall reliability. The LTE networ…

> But all you have to do is walk out of your house while on a phone call and realize how much the feature is degrading overall reliability.

I have been using wifi calling on ATT with iPhones for many years, and I have no complaints.

Re: Google urges Android phone users to switch off Wi-Fi calling

#83

Post by caconym_ »

armada651 wrote: post #79
caconym_ wrote: post #73

Earlier quoted context omitted.

Are you claiming that unpatched software is more secure than patched software?

He's claiming with the amount of features being added for every security bug fixed in an update a bunch more are added. However that ignores the fact that publicly known exploits are more dangerous for the average user than zerodays.

It ignores a whole lot more than that. For instance, are we seriously going to pretend that the threat landscape in the Windows 98 and XP eras was anything like what it is today?

Well, I'm not. If he wants to daily drive Windows 98 because it had fewer documented RCE vulns, godspeed to him---and he probably will be more secure, just by virtue of good ol' security through obscurity---but that is not a reasonable solution for 99.999howevermanyninesyouwant% of computer users today.

Re: Google urges Android phone users to switch off Wi-Fi calling

#84

Post by Falkon1313 »

dangus wrote: post #41

At this point I'd have to say that Wi-Fi calling is a dead feature, putting this particular issue aside. I just don't see the benefit in 2023. It made sense back when cellular networks were less mature. It also made sense when it could cut down on your wireless bill. But all you have to do is walk out of your house while on a phone call and realize how much the feature is degrading overall reliability. The LTE networ…

Mountainous areas have awful cell service.

And when you're new to an area, your carrier probably has your entire region colored as 'Excellent' on their coverage map, even though the only places you can actually get a signal is if you stand in the middle of the highway interchange out on the west side of town or up on one of the rooftops downtown. You have to ask around among the locals to find out which carrier _actually_ works in your town so you know which to switch to. Until then, wi-fi is your only comm link unless you can still find an old payphone.

And naturally if you're just visiting or passing through, you're not going to want to change carriers every time you stop at a new town.

Re: Google urges Android phone users to switch off Wi-Fi calling

#85

Post by GeekyBear »

ryukafalz wrote: post #43
mikepurvis wrote: post #21

Earlier quoted context omitted.

I guess, but it sure is nice that on Apple hardware you generally don’t need to worry about doing this calculus because they deliver updates in a timely manner to even five year old devices. It bums me out that them doing this hasn’t been effective in shaming everyone else into following suit.

The iPod Touch Gen 7 lasted just under 3 years from release. They may be better than many others but I just got bit by that one.

Every flagship iPhone since 2011 has gotten at least five years of both OS updates and security updates, with some newer devices (including the $399 iPhone SE) getting as many as seven years.

Even after official support completely ends, Apple tends to go back and issue patches for active exploits. The nine year old iPhone 5s just got another security update a couple of months ago.

Re: Google urges Android phone users to switch off Wi-Fi calling

#86

Post by arsome »

caconym_ wrote: post #83
armada651 wrote: post #79

Earlier quoted context omitted.

He's claiming with the amount of features being added for every security bug fixed in an update a bunch more are added. However that ignores the fact that publicly known exploits are more dangerous for the average user than zerodays.

It ignores a whole lot more than that. For instance, are we seriously going to pretend that the threat landscape in the Windows 98 and XP eras was anything like what it is today? Well, I'm not. If he wants to daily drive Windows 98 because it had fewer documented RCE vulns, godspeed to him---and he probably will be more secure, just by virtue of good ol' security through obscurity---but that is not a reasonable solut…

The threat was arguably exponentially worse during the XP era - Windows boxes with a huge default attack surface were directly connected with public facing IPs to a 32-bit IP space that could be trivially brute-forced by worms. There's a reason we haven't seen anything as bad as Blaster in the past decade: NAT.

The rate of finding exploits and what the definition of a vulnerability is really what has changed - now the definition of is much broader while at the same time, exploitability has dropped off due to mitigation in modern operating systems, compilers and CPUs. Overall, we get far more exploits, but far less of significance.

Re: Google urges Android phone users to switch off Wi-Fi calling

#87

Post by ggm »

This is extremely unhelpful headlinese

1) not all phones

2) chipsets in phones vary by where they are sold.

3) only exynos chipset phones are affected. in some economies. sold by some vendors. Not all models with a given name and code number (pixel 7, samsung 22) will be affected. "it depends"

4) not all manufacturers declare their chipset so

5) it is almost impossible for anyone but the cogniscenti to know if they are exposed to the problem, and a huge amount of FUD is flying around right now about exactly which models, which versions, which economy variants are affected, patched, can be patched, will be patched

6) the "turn off" button has been removed from some phones, presumably at the behest of the carriers to have to gatekeep VoLTE and VoWIFI and decide if they want it on or not, and do not always permit users to decide this for themselves.

Re: Google urges Android phone users to switch off Wi-Fi calling

#88

Post by caconym_ »

arsome wrote: post #86
caconym_ wrote: post #83

Earlier quoted context omitted.

It ignores a whole lot more than that. For instance, are we seriously going to pretend that the threat landscape in the Windows 98 and XP eras was anything like what it is today? Well, I'm not. If he wants to daily drive Windows 98 because it had fewer documented RCE vulns, godspeed to him---and he probably will be more secure, just by virtue of good ol' security through obscurity---but that is not a reasonable solut…

The threat was arguably exponentially worse during the XP era - Windows boxes with a huge default attack surface were directly connected with public facing IPs to a 32-bit IP space that could be trivially brute-forced by worms. There's a reason we haven't seen anything as bad as Blaster in the past decade: NAT. The rate of finding exploits and what the definition of a vulnerability is really what has changed - now th…

Yes, it was not my intention to imply that those old operating systems were fundamentally more secure in some way. You're getting at it here: the space has broadened, and asserting that old software is more secure than new software based solely on documented RCE counts is laughable.

Re: Google urges Android phone users to switch off Wi-Fi calling

#89

Post by rubatuga »

wyldfire wrote: post #35
i80and wrote: post #30

Earlier quoted context omitted.

The March 5 security patch finally dropped for Pixel 6's today, yep

... but presumably this isn't true for some customers whose network operator is holding this update hostage. Like mine.

[flagged]

Re: Google urges Android phone users to switch off Wi-Fi calling

#90

Post by jvolkman »

barbazoo wrote: post #31
mikepurvis wrote: post #21

Earlier quoted context omitted.

I guess, but it sure is nice that on Apple hardware you generally don’t need to worry about doing this calculus because they deliver updates in a timely manner to even five year old devices. It bums me out that them doing this hasn’t been effective in shaming everyone else into following suit.

According to Wikipedia the Pixel 2 received security updates for less than 3 years. None of their devices got more than 3 years 3 months of updates. That should be illegal honestly, couldn't be more clear that they don't care about sustainability. https://en.m.wikipedia.org/wiki/Google_Pixel

Qualcomm's lack of support for older chipsets has been blamed for the short lifecycles of these phones. Pixel 6 and 7, which don't use Qualcomm SoCs, both get at least 5 years of security updates.
Post reply on HN