Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your phone is about to stop being yours

keepandroidopen.org

Post reply on HN
Print view View original

521–530 of 927 posts

Re: Your phone is about to stop being yours

#521

Post by kuhsaft »

seba_dos1 wrote: post #511
kuhsaft wrote: post #508

Earlier quoted context omitted.

Ah. I see. So the blobs are loaded into the separate microprocessors. Either way, it's the same as pretty much any modern phone, where the modem (and other secondary processors) are running some proprietary firmware and is communicating with the OS processor. I don't see how it's different from running a free open-source ASOP OS. On the mainstream Android devices, the wireless hardware is also isolated and communicat…

Pretty much any modern phone is also full of blobs that run on the main CPU to ensure basic functionality, with only a handful of exceptions. Just consider how many features stop working or get severely degraded on various phones when you use a clean AOSP build on them (provided that you can do it at all in the first place). Android's driver infrastructure effectively encourages non-free blobs in "vendor" partitions,…

> Just consider how many features stop working or get severely degraded on various phones when you use a clean AOSP build on them.

That's mainly because of device trees. The firmware also isn't distributed via separate flash storage on the device, but I don't consider that making a difference. It's still proprietary firmware running on proprietary hardware. On Qualcomm-based Pixel devices, cellular, WiFi, Bluetooth, and GNSS are all isolated and sandboxed.

> It's also interesting that you mention it unprompted, as it's fairly off-topic here

A primary reason people complain about proprietary blobs is security. People claim that the Librem 5 is more open and secure, but it still uses the same proprietary modules as a Pixel running GrapheneOS. Does Librem 5 have signature checks for the firmware and a tamper-proof bootloader to load the firmware and OS, or can someone sell you a compromised Librem 5?

Is it more free, open, and secure than a Pixel running Android? Because, the only difference I'm seeing is how the firmware is stored and Google Play Services. And with GrapheneOS, only how the firmware is stored. Everything else points to a more insecure system with Librem 5.

Re: Your phone is about to stop being yours

#522

Post by shye »

NDlurker wrote: post #30

>Android's openness was never just a feature. It was the promise that distinguished it from iPhone. Millions chose Android for exactly that reason. Google is now revoking that promise unilaterally, on devices already in people's pockets, because they've decided they have enough market dominance and regulatory capture to get away with it. This is why I've stuck with Android for the past 15 years.

> Millions chose Android for exactly that reason

Citation needed.

But even if millions did bought an Android phone for ill-defined defined, about 15 billion Android phones were sold over the years, which could very well make those millions a minority, with most having other reasons for their purchase.

Re: Your phone is about to stop being yours

#523

Post by cesarb »

TFNA wrote: post #352
anonymousiam wrote: post #145

Earlier quoted context omitted.

In my informed opinion, anybody who does banking on their phone is taking a big and unnecessary risk. I wish I could say more.

> anybody who does banking on their phone is taking a big and unnecessary risk It is not necessarily a matter of choice. Besides what the other commenter notes about 2FA, in some countries banks have been removing functionality from their online-banking website, and you can only do certain things in the phone app.

> in some countries banks have been removing functionality from their online-banking website, and you can only do certain things in the phone app.

The most infuriating I've seen, is a bank which removed the anual tax report (which you need to do the anual income tax) from the online-banking website, requiring you to use the phone app... to download a PDF file, which you then have to transfer to the computer anyway so you can print it!

Re: Your phone is about to stop being yours

#524

Post by fragmede »

cesarb wrote: post #523
TFNA wrote: post #352

Earlier quoted context omitted.

> anybody who does banking on their phone is taking a big and unnecessary risk It is not necessarily a matter of choice. Besides what the other commenter notes about 2FA, in some countries banks have been removing functionality from their online-banking website, and you can only do certain things in the phone app.

> in some countries banks have been removing functionality from their online-banking website, and you can only do certain things in the phone app. The most infuriating I've seen, is a bank which removed the anual tax report (which you need to do the anual income tax) from the online-banking website, requiring you to use the phone app... to download a PDF file, which you then have to transfer to the computer anyway so…

Fwiw, iOS lets you print to network attached printers directly, no macOS needed.

Re: Your phone is about to stop being yours

#525

Post by wolvoleo »

scblock wrote: post #220
dtj1123 wrote: post #157

Earlier quoted context omitted.

I'm considering switching to GrapheneOS... What's this about RCS not working?

RCS can be hit or miss on GrapheneOS, but they have made significant progress recently. It requires using Google Messages rather than any other messaging app, and may require enabling an ICC authentication option that is disabled by default. And it may depend on your carrier. RCS is kind of a pain in the butt but the messaging improvements over SMS are substantial which is why I wanted it. When I first tried last fal…

SMS is pretty horrible yes but I don't know anyone that uses it anymore. The only ones I get are spam from my phone provider and some MFA systems that are stuck in the past. Oh and the odd shipping notification.

RCS I didn't even bother to set up. I don't want to use yet another system. If people want to reach me they have WhatsApp, Signal or Telegram to choose from.

Re: Your phone is about to stop being yours

#526

Post by hellcow »

hemc4 wrote: post #513

This is reason I don't use ios. I will be happy to use a new OS forked from android at this point of time. Any suggestions? I don't care where it originates from.

https://furilabs.com/

It runs a modified Debian and can run Android apps in containers. To my knowledge this is the closest we come to "open-source phone that actually works as a phone" today.

Re: Your phone is about to stop being yours

#527

Post by userbinator »

Xunjin wrote: post #16

Let me play out a scenario, imagine to use a Desktop Hardware like a complete built rig, you would need a specific OS like Windows 11 and you could not run Linux on it, just because it's a vendor lock-in. Why is this acceptable for phones but would not for the case above? I know a lot of people don't care, and that's ok, but we should root for an open choice for the users.

> we should root for an open choice for the users

I see what you did there... and agree completely. If you don't have root, it's not yours. All my Androids (none from this decade) are rooted and I plan to keep them that way.

Re: Your phone is about to stop being yours

#528

Post by seba_dos1 »

kuhsaft wrote: post #521
seba_dos1 wrote: post #511

Earlier quoted context omitted.

Pretty much any modern phone is also full of blobs that run on the main CPU to ensure basic functionality, with only a handful of exceptions. Just consider how many features stop working or get severely degraded on various phones when you use a clean AOSP build on them (provided that you can do it at all in the first place). Android's driver infrastructure effectively encourages non-free blobs in "vendor" partitions,…

> Just consider how many features stop working or get severely degraded on various phones when you use a clean AOSP build on them. That's mainly because of device trees. The firmware also isn't distributed via separate flash storage on the device, but I don't consider that making a difference. It's still proprietary firmware running on proprietary hardware. On Qualcomm-based Pixel devices, cellular, WiFi, Bluetooth,…

> That's mainly because of device trees.

Huh? The device tree is the one thing trivially recoverable from the blob. I'm talking about drivers, the same kind as when you install, let's say, the non-free Nvidia driver on a PC. They run as part of the OS and handle various stuff, most commonly comms like VoLTE/VoWiFi, but often also camera ISPs, GPUs, fingerprint readers etc.

> are all isolated and sandboxed

So isolated that you can break them by repartitioning your eMMC/UFS.

> A primary reason people complain about proprietary blobs is security.

The primary reason I care about blobs is freedom and practical aspects that come out of it. Dealing with blobs is always a PITA and severely limits what you can do with the hardware. The peripherals would be nice to have freed, but it's the main CPU and storage that is supposed to be my (the user's) domain and only mine. My Librem 5 came with a GNU/Linux distro on it, but if I wanted to port, say, FreeBSD to it there's all I need to be able to it. I can't do that with an AOSP device fed with blobs from the "vendor" image, at least not without spending years on reverse engineering.

The Librem 5 is one of the handful phones out there that make it this easy. It is also the only one I'm aware about that's still being sold where you have the hardware ECAD and MCAD designs available - and not just to look at, but published on a free license. I think it has earned its bragging rights when it comes to freedom and openness.

> can someone sell you a compromised Librem 5?

Of course, just like any other PC. You want to reflash it before use, obviously.

The SoC supports High Assurance Boot, you can burn your key into its efuses and have it only ever accept software that's cryptographically signed by you.

Re: Your phone is about to stop being yours

#529

Post by fc417fc802 »

dvdkon wrote: post #340
ok123456 wrote: post #328

Earlier quoted context omitted.

Isn't keeping ADB enabled (most people who do this don't enable it and then promptly disable it) a huge security problem? ADB enabled means an adversary can completely own your device and "back it up" by simply plugging it in. This is much worse than nagging about "untrusted sources".

No, there's a trust-on-first-use procedure where you have to accept the computer's key on your phone.

Not only is it TOFU but that comment is doubly wrong because you can't really back up much other than the bulk storage directory without adb root (which requires a custom build, which obviates the issue to begin with).

Re: Your phone is about to stop being yours

#530

Post by pratyushnair01 »

TGower wrote: post #52

This is a wild misrepresentation of the situation. Saying there is no opt-out is just false, they even provide the information on how users can opt-out. The "mandatory 24 hour cooling-off period" is also misleading, it's easy to bypass the cooling-off period with ADB.

You still need Developer's Options enabled and plenty of banking and other apps complain if you do that. Why do I need the Developer's option enabled to run an app I developed myself, to be used by myself? It's clear they're heading to a walled garden and this is just a step towards that.
Post reply on HN