Live data from Hacker News

Serious flaws in the way Samsung phones encrypt key material in TrustZone

twitter.com

11–20 of 91 posts

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#11
post #4
post #2

I used a Samsung phone for a few months, it gave me the strong impression that they really don't know how to develop software properly.

Their entire value proposition (as marketed by themselves) is as an alternative to Apple. For some people that is enough.

True, Samsung makes a big deal of it. But they don’t actually deserve that title imo. They’re hardly a worthy contender. I am not an apple fan boy, but Samsung is just nowhere close to the apple experience.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#12
post #2

I used a Samsung phone for a few months, it gave me the strong impression that they really don't know how to develop software properly.

Using a Samsung phone now, and you're absolutely right. It's a shitshow.

And let's not forget Tizen, who security researchers basically found to be a joke.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#13

Earlier quoted context omitted.

Was in their ecosystem for about four years before going to Google Pixels - I find your experience to be very true. It was truly night and day.

> before going to Google Pixels Which isn't any better IMO. Most recent Pixels have been a buggy mess from launch. Google doesn't see to give a damn about the quality of their devices which is especially bad considering they come at flagship prices. On the other side, my mom's cheap Samsung A52 has been great so far.

My experience is that Pixel devices are far and away more competent than Samsung in many regards, but with the caveat that Samsung devices ship in a finished, stable state, but Pixel devices ship as if they’re not quite finished. The software is usually OK, but the hardware tends to be lacking in many regards. This is terrible since hardware can’t really be fixed later down the road, at BEST software workarounds can be employed.

The first Pixel was reasonably solid all around and mine lasted quite a while. The Pixel 2 XL’s terrible screen was my first hint that Google was not prepared to carry the torch of a true flagship phone.

That said: I would still often prefer the accidentally broken Pixel phones over the intentionally gimped and bloated Samsung phones. I just can’t buy one at launch, because I have no idea how Google will have fucked it up this time.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#14
post #4

Earlier quoted context omitted.

Their entire value proposition (as marketed by themselves) is as an alternative to Apple. For some people that is enough.

True, Samsung makes a big deal of it. But they don’t actually deserve that title imo. They’re hardly a worthy contender. I am not an apple fan boy, but Samsung is just nowhere close to the apple experience.

Well, I own a few Samsung devices. There is no Samsung experience. I don't bother signing in into a Samsung account or using their store. What for? I already have to be signed in into Google's store to get updates for the apps I must use. Samsung's one is useless and it's not the reason I bought from them. I bought an A40 because it was the smallest Android phone on the market (and yet almost one inch too tall) and a tablet (S5e?) because it had Linux in DeX.

By the way, I keep Google usage minimal. I don't need most of their services. Even YouTube works without an account and I'm using NewPipe most of the time. What I really need is Play, only to update maps, Maps mostly because of satellite images (I use OSMAnd) and Translate as a dictionary. Syncthing and KDE connect deal with backup and file transfer.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#15
post #6

I personally don't like how it's possible to store data on my device without me being able to access the data. Also most of the time these keys are used for DRM. So... good IMO.

Exactly my first thoughts. Key is derived from "user-controlled data". That makes sense, it's my phone, isn't it? Why would the phone need to encrypt data in a way that the user can't access it.

The user positive use is securely booting to a password prompt to decrypt your data. Without this security working, anyone who steals your phone will be able to get all the data you have saved on it.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#16
post #7
post #2

I used a Samsung phone for a few months, it gave me the strong impression that they really don't know how to develop software properly.

It gives me the impression that, even though I paid good money on it, Samsung doesn't see me as owner and will leech as much private data off me as they possibly can.

This is my impression as an unhappy Samsung smart TV owner, despite being a happy owner of an older Samsung "dumb" TV; the reason I bought their crappy smart TV.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#17
post #2

I used a Samsung phone for a few months, it gave me the strong impression that they really don't know how to develop software properly.

I used to have Samsung devices, but the quality just got worse and worse... currently quite happy with my LG V20 but it's on its last legs, and when I replace it I want something with a replaceable battery which is quite a rarity on higher-end phones these days. Am aware of the Librem5, but I still want to be inside the Android and google play ecosystem.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#18
post #7

Earlier quoted context omitted.

It gives me the impression that, even though I paid good money on it, Samsung doesn't see me as owner and will leech as much private data off me as they possibly can.

This is my impression as an unhappy Samsung smart TV owner, despite being a happy owner of an older Samsung "dumb" TV; the reason I bought their crappy smart TV.

LG does the same.

I bought good OLED and still, I had to connect pihole to block ads...

New LG's are even worse. I don't know what I do if my current TV will stop working.

I want only display, I don't want any additional features (ads, personalization etc.).

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#19
post #2

I used a Samsung phone for a few months, it gave me the strong impression that they really don't know how to develop software properly.

On the other hand, I've owned most Nexus devices and loved stock Android at the time but probably won't be leaving the Samsung ecosystem anytime soon. Until the S6 or so I'd agree it was bloated and unreliable but since then it's been a consistent and reliable experience (with great hardware) and it would take a lot to move back to a Pixel.

Re: Serious flaws in the way Samsung phones encrypt key material in TrustZone

#20

Earlier quoted context omitted.

This is my impression as an unhappy Samsung smart TV owner, despite being a happy owner of an older Samsung "dumb" TV; the reason I bought their crappy smart TV.

LG does the same. I bought good OLED and still, I had to connect pihole to block ads... New LG's are even worse. I don't know what I do if my current TV will stop working. I want only display, I don't want any additional features (ads, personalization etc.).

I have two new LG TVs, never connected them to the internet. I do all my media consumption via a ATV and rpi
Post reply on HN