Earlier quoted context omitted.
Just to be sure. A Samsung Galaxy S2? This phone is like 15? years old and still in use?
There's not a single feature added to phones during that time worth replacing working device for average user.
[flagged]
Google urges Android phone users to switch off Wi-Fi calling
151–160 of 178 posts
Re: Google urges Android phone users to switch off Wi-Fi calling
#152Earlier quoted context omitted.
Just to be sure. A Samsung Galaxy S2? This phone is like 15? years old and still in use?
There's not a single feature added to phones during that time worth replacing working device for average user.
Fingerprint sensors. I don't miss the times where I had to always enter my passphrase on unlock at all, massive time saver.
Also not being stuck on an ancient version of Android - though I don't know what the custom ROM community for that phone is like, perhaps some soul is still porting newer versions to it.
Re: Google urges Android phone users to switch off Wi-Fi calling
#153Earlier quoted context omitted.
According to Wikipedia the Pixel 2 received security updates for less than 3 years. None of their devices got more than 3 years 3 months of updates. That should be illegal honestly, couldn't be more clear that they don't care about sustainability. https://en.m.wikipedia.org/wiki/Google_Pixel
I still remember when phones did not receive any updates, and the few lucky models required developer tools to manually upload the firmware updates, which most of those few selected models only got one in their lifetime.
Not sure if you’re referring here to the BlackBerry era or right back to side-sliders and razr flips, but either way, both the stakes and the attack surface were way lower back when there were no apps and phones really were just for calling and texting.
Re: Google urges Android phone users to switch off Wi-Fi calling
#154Earlier quoted context omitted.
The iPod Touch Gen 7 lasted just under 3 years from release. They may be better than many others but I just got bit by that one.
> The iPod Touch Gen 7 lasted just under 3 years from release. It was released May 2019, and it just received its latest security update (15.7.3) January 23, 2023. Presumably that is not the last security update for iOS 15.
That’s an important note— getting the latest iOS is nice, but Apple continues to patch the 3-4 most recent versions.
I’m not aware that Android gets anything like this, even in the era of Google Play Services.
Re: Google urges Android phone users to switch off Wi-Fi calling
#155Earlier quoted context omitted.
I find that international roaming is cheaper than ever. Some carriers like T-Mobile (US) and Google Fi include it for free.
There is absolutely no point if wifi calling is free and good enough
SMS-based 2FA, if your carrier doesn't support WiFi texting.
Re: Google urges Android phone users to switch off Wi-Fi calling
#156Earlier quoted context omitted.
A bit silly to link a page about malware that Play Protect prevents, largely local privescs that are being detected by the OS or Google Play beforehand. An average user installing apps from Play Store has nothing to worry about for those. That's kind of the point. It's great for these devices to be patched - I'd love it if Google would take more control over the ecosystem to be able to patch this sort of thing, but i…
Google Play Protect has limited capabilities to protect against in-the-wild exploits of the kind Maddie described. It knows about certain packaged implementations, which means that it can offer some defense from off-the-shelf uses of an exploit, but it definitely does not reduce the risk to anywhere near zero. The only correct way to mitigate against exploits like this is a patch, end of story.
Absolutely, but like I mentioned in the prior post, these are local privescs. You basically need to go out and install malicious apps.
If you can use Windows without it getting full of malware, you can handle unpatched Android LPEs too.
Keep in mind, Webview, browsers, email clients, etc are patched via app update mechanisms.
Re: Google urges Android phone users to switch off Wi-Fi calling
#157Four things of note: 1. I've not seen anyone explain whether this could be exploited by anyone with access to phone lines (i.e. Twilio users) or not and if it would be trivial to try the vuln with every phone number you could find in any DB. If those things are the case, it seems like the chances would be very high that this would be or has already been exploited and affecting every unpatched phone. 2. It seems like…
> It seems like Project Zero mistakenly thought that Google devices were already patched when they made their announcement ("affected Pixel devices have received a fix"). Whoops! Thanks for giving attackers a heads up.
Do you have a source for the fact that Pixel devices don't yet have a fix? The post we're commenting on is actually just blogspam, with its only real source being the initial project zero disclosure [0], which still asserts this to be the case...
[0] https://googleprojectzero.blogspot.com/2023/03/multiple-inte...
Re: Google urges Android phone users to switch off Wi-Fi calling
#158Earlier quoted context omitted.
I've been a (happy) Lineage OS user since 2013, and Pixel 2 is still supported by them, so you can check them out. But note that the security updates provided by Lineage OS only pertain to the Android part, not the modem part. This isn't something that a third party OS vendor can fix, as the modem/firmware updates are supplied by the device vendor. And even those are reliant on their suppliers, so ultimately unless t…
Thanks for that extensive write-up. This is some serious food for thought. Also, I thought I recognised your username. I use at least one of your crates. Thanks for those, too! :)
Glad that you liked my writeup (and my crates)!
Re: Google urges Android phone users to switch off Wi-Fi calling
#159Re: Google urges Android phone users to switch off Wi-Fi calling
#160Earlier quoted context omitted.
I still remember when phones did not receive any updates, and the few lucky models required developer tools to manually upload the firmware updates, which most of those few selected models only got one in their lifetime.
Not sure if you’re referring here to the BlackBerry era or right back to side-sliders and razr flips, but either way, both the stakes and the attack surface were way lower back when there were no apps and phones really were just for calling and texting.
Brew, Symbian, Java ME and Windows CE/ Pocket PC, Palm era.
Plenty of apps and networking in Europe and Asia.