undefined | Better HN

0 pointsdguido11y ago0 comments

I'm surprised they didn't mention how amazingly insecure it is to be running a phone that old. If you're running a private messenger like Signal, you might not want to install it on a device vulnerable to bootrom exploits that negate all the advantages of disk encryption.

0 comments

4 comments · 2 top-level

stormbrew11y ago· 2 in thread

While this is true, they also, through TextSecure, support many android phones that are probably in much worse shape on that front. It's also not like web browsers refuse to use TLS because your computer's running a compromiseable version of Windows.

droopyEyelids11y ago

That analogy sure stopped and made me think. What a sticky issue. SHOULD browsers do that? What if your bank website refused to allow you to sign in from a machine running unpatched XP?

I think right now there might not be enough exploits targeting banking on XP machines to justify that inconvenience, but it seems like a responsable argument could be made for both cases.

stormbrew11y ago

It might seem like a good idea on the surface, but think about the impact this might have on people who can least afford it (consider why people might be using old phones or old operating systems, and what impact lack of access to their bank could have on them for even a day if it's the wrong day), in the name of protecting them from something theoretical.

frabcus11y ago

The idea is to get everyone to routinely use encryption like Signal. This increases the cost of drag-net surveillance, forcing instead more specific targets.

For that scenario, it doesn't matter if you're also vulnerable to direct hacks. You can still help normalise encryption.

j / k navigate · click thread line to collapse