Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to secure phone against state actor?

news.ycombinator.com

Post reply on HN
Print view View original

11–17 of 17 posts

Re: How to secure phone against state actor?

#11

Post by cookiengineer »

Opsec mandates to buy throwaway devices for such purposes.

The easiest way to travel state borders is to buy something like an old Dell Latitude (core2duo generation) with libreboot and a LUKS encrypted Linux on it.

Don't take your phone with you, especially if it's necessary for 2FA or can be (ab-)used for recovery of accounts.

Use a phone that's easily reflashable in case it gets compromised. Fairphone 3/3+ or Pinephone come to mind, depending on whether or not you want to deal with mobile Linux. Otherwise Xiamo Redmi Note 8/8T or devices with a MediaTek CPU. MediaTek ARM CPU has developer tools which have been leaked, and is a rootkit that can uninstall/reflash other rootkits :P

Note that there are already some rootkits in the ARM space so you also need to make sure the ARM blob hasn't changed, which is why I would not recommend a device that hasn't been integrated with the upstream kernel or hasn't got their blobs available.

Never use broadcom based wireless Hardware, because of broadpwn and bluepwn. Change the laptop's wifi card to an Atheros one.

Re: How to secure phone against state actor?

#12

Post by quickthrower2 »

brudgers wrote: post #5

To put it in perspective, state actors have departments full of people who spend their work weeks figuring out how to act on behalf of the state and then executing upon those methods. Those people are more organized than you. They are more motivated. They often have the resources to align Apple's and Google's interests with their own. And they are more motivated than you. They are patriotic and surrounded by people w…

They can only target you if they know you are worth targeting though. In some sense a run of the mill phone might be the best bet. Something too fancy and hard to crack will stand out.

Re: How to secure phone against state actor?

#13

Post by quickthrower2 »

aborsy wrote: post #8

Governments (such as Saudi Arabia) often buy expensive hacking software from the companies abroad (such as NSO in Israel), needless to say with citizens tax money. Such software can hack into any phone, even with zero click. A mere phone number would be enough. They also have internal hacking teams and APTs, with own hacking tools. Further, if you are in a country that manufactures key closed source components of the…

What if you remove the sim? Probably they can still hack with the account (apple id, google account) somehow given enough resources.

Re: How to secure phone against state actor?

#15

Post by brudgers »

quickthrower2 wrote: post #12
brudgers wrote: post #5

To put it in perspective, state actors have departments full of people who spend their work weeks figuring out how to act on behalf of the state and then executing upon those methods. Those people are more organized than you. They are more motivated. They often have the resources to align Apple's and Google's interests with their own. And they are more motivated than you. They are patriotic and surrounded by people w…

They can only target you if they know you are worth targeting though. In some sense a run of the mill phone might be the best bet. Something too fancy and hard to crack will stand out.

They don’t have to know anything, because the purpose of the work is to know more when they are done.

Or maybe just to communicate their stance with regard to some matter so others are discouraged.

Don’t bet that they are following rules that respect your integrity.

Re: How to secure phone against state actor?

#17

Post by joshxyz »

grepcat wrote: post #3

The most simple answer is don't. Divorce it from the device, fully encrypt it and transfer it separately from your friend. Then, when traveling, have your friend carry a separate completely clean phone. If he's suspected and the phone is compromised, it won't be found. When you say state actor, it implies that they're efforts are funded with and armed with the vast resources of a nation which means they could manipul…

this. keeps it simple, air gap.
Post reply on HN