In recent interviews, I've gotten questions over if or how I use a smartphone. They're so dangerous for someone like me, so it's quite difficult to give an in-depth answer. But I published a paper with a few years ago discussing some risks:
Conversation
Phone security has been something I've struggled with for a long time. I once spoke with 's about how it's possible to physically remove internal microphones and cameras from a phone, but even that only mitigates a portion of the threat.
32
613
1,837
But as long as your phone is turned on, even with "location permissions" disabled, the radios in the phone that connect it to all the nice things you like are screaming into the air, reporting your presence to nearby cell towers, which then create records that are kept forever.
70
974
2,282
Software is equally important. The iOS and Android operating systems that run on nearly every smartphone conceal uncountable numbers of programming flaws, known as security vulnerabilities, that mean common apps like iMessage or web browsers become dangerous: you can be hacked.
33
521
1,633
If I were configuring a smartphone today, I'd use 's as the base operating system. I'd desolder the microphones and keep the radios (cellular, wifi, and bluetooth) turned off when I didn't need them. I would route traffic through the network.
75
1,041
2,904
This Tweet was deleted by the Tweet author. Learn more
It doesn't support the Nexus 6P anymore since that device doesn't meet the security standards and is also end-of-life without full security updates available. It has never supported it while being known as AndroidHardening or GrapheneOS, only during the previous incarnation.
1
3
This Tweet was deleted by the Tweet author. Learn more
The Librem 5 doesn't meet the basic security expectations of GrapheneOS including having full security updates. It will ship on day one with serious vulnerabilities and no way to fix them. Similarly, it doesn't meet a lot of other standard privacy/security expectations either.
2
1
2
but no phones have full security updates, its very difficult to update kernels and is rarely done on mobile.
1
That's not true. There are upstream LTS kernel branches, and using one of the recent LTS branches makes sense for most production systems: kernel.org. The Android common kernel branches are extended versions of the upstream LTS branches: android.googlesource.com/kernel/common..
The common kernel branches receive more backports of bug fixes (including security fixes) along with some performance improvements and features, particularly security features. In fact, there are often substantial security features landed in the common kernel before mainline.
1
The monthly Android security bulletins include kernel security bugs identified as vulnerabilities, so devices need to ship kernel security updates to claim the latest patch level. The bulletins also include most of the firmware security updates, and other device support code.