Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux phones are more important now than ever

feddit.org

Post reply on HN
Print view View original

511–515 of 515 posts

Re: Linux phones are more important now than ever

#511

Post by c6401 »

masfoobar wrote: post #324
3036e4 wrote: post #308

My next phone will almost certainly be two phones. One cheap and super standard Android phone to just run banking apps and similar that insists on Google Play etc. Locked down and boring, turned off most of the time. Then a second phone for everything else (terminal with sshd, emacs, emulators, media players ... the stuff that allows a phone to be the general purpose computer it should be). Looks increasingly unlikel…

After just submitting my recent post --- I do like your suggestion. Maybe 2 phones are the way forward. Maybe a PAYG phone which stays at home on my network for particular needs like banking. Then a standard phone which is essentially a GNU/Linux distro.... mmm... Emacs on my phone sounds lovely!

> Emacs on my phone sounds lovely!

Meanwhile, you can use it in termux if you are on android right now.

Re: Linux phones are more important now than ever

#512

Post by microtonal »

nicman23 wrote: post #503
63stack wrote: post #302

Earlier quoted context omitted.

Saying that custom roms typically fail attestation is not spreading misinformation, it is very correct, and google is closing the door on it fast. It's possible that this one random rom that you mentioned passes it today, but it might not pass tomorrow.

lol that is not how that works. it is client side. they cannot do anything to block it.

They certainly can. Since Android 8.0, apps can check if a key is stored in a hardware-backed store:

https://developer.android.com/privacy-and-security/security-...

This works by signing an attestation using a hardware-backed key (which is in turn signed by Google). So, there is no way to emulate this in software, because your ROM simply does not have the private key to do so. Part of the attestation is information on whether the booted operating system was signed:

https://source.android.com/docs/security/features/keystore/a...

Again, since this is all hardware-signed, you could only fake this information if you were somehow able to extract the private key from the secure element. The primary weakness is that you could try to patch out the part of the application that asks for this attestation. But they found a solution to that, remote attestation. Instead of the app asking for the attestation, e.g. Google's servers or your bankcan ask for the attestation and for the reasons outlined above, your custom firmware is not able to fake this. If your bank, etc. implemented remote attestation, you can simply do not do banking on your phone anymore.

Re: Linux phones are more important now than ever

#513

Post by mixmastamyk »

schnatterer wrote: post #444

I am surprised that no one criticized kernel architecture as base for a secure mobile OS, yet. Let me heat up the discussion using this quote > The Linux kernel has atrocious security. It has an anti-security architecture, implementation and culture. The Linux kernel is not a good base for building any new operating system with a focus on privacy and security https://grapheneos.social/@GrapheneOS/114665594121762341

It's good enough with app sandboxing, firewalls, storage encryption, etc. Vast majority of us are not CIA operatives.

Re: Linux phones are more important now than ever

#514

Post by nicman23 »

microtonal wrote: post #512
nicman23 wrote: post #503

Earlier quoted context omitted.

lol that is not how that works. it is client side. they cannot do anything to block it.

They certainly can. Since Android 8.0, apps can check if a key is stored in a hardware-backed store: https://developer.android.com/privacy-and-security/security-... This works by signing an attestation using a hardware-backed key (which is in turn signed by Google). So, there is no way to emulate this in software, because your ROM simply does not have the private key to do so. Part of the attestation is information o…

you patch the part of the OS deals with the attestation.

Re: Linux phones are more important now than ever

#515

Post by Hoodedcrow »

ulrikrasmussen wrote: post #505
sterlind wrote: post #466

Earlier quoted context omitted.

it looks like MitID is basically country-wide SSO, isn't it? then isn't MitID collecting every website you authenticate to via the redirect uri?

Yes, but MitID is also only intended to be used in places where you are not anonymous to begin with, so this is actually OK and also gives you access to a central audit log of where your MitID credentials were used. MitID is different from the proposed app-based solution for age verification which is designed to not leave a trail. The age verification app will initially be enrolled using MitID (or perhaps by a physic…

When it comes to age verification - I still don't understand how you'd make it subpoena-proof? Like, the ones I've seen proposed protect you from the site itself getting more data than it should. But what about a government agency subpoenaing the website to see what credential this account was verified with and then comparing with the age-assuring agency's logs?..
Post reply on HN