Replicant As A Truly Free, Blob-Less Android OS Is Still Facing A Huge Uphill Battle

[pal666]

I use Windows Phone.

it is not something to brag about, lol

[pal666]

my own experiences, YMMV:
replicant:

• none of the above

did you mean no messaging app, no email app and no multimedia player ?

[andyprough]

Hey Michael, this is a bit off-topic, but have you looked at the Fedora 21 "Fedlet" version for Windows x86 tablets? I got the live USB version running on a Toshiba Encore tablet last night - pretty fun to play with. Touch is working great, although wifi isn't working on this tablet (but wifi does work on some Dell Venue tablets I'm hearing).

Adam Williamson from RedHat is helping manage the project:
https://www.happyassassin.net/fedlet...trail-tablets/

[Luke]

Tor Project working on a safe smartphone, found baseband radio to be dangerous

Doesn't support GPU acceleration and the cellular modems?

Then it's more useless than useless.

The Tor Project has been working on a safe smartphone to use with Torbrowser, and one of their conclusions is this: the baseband (3g/4g) radio is unsafe because it uses a separate CPU run entirely in firmware that the OS cannot replace but which can attack the OS. This should be obvious: some of the "attacks" used to root phones so their own users can control them are baseband radio exploits. It's reasonable to assume that manufacturer backdoors and most of the law enforcment backdoors are in the baseband radio firmware. Carrier backdoors might be in the OS instead, simply to safe carriers the trouble of flashing custom firmware to all their devices.

The Tor Project thus believes that a device entirely without a baseband radio must be used. They recommend a wi-fi only tablet used with separate carrier-provided wifi hotspot. Since that hotspot is not on the tablet's bus it cannot attack the tablet's OS any more effectively than any of the other untrusted routers on the entire Internet can. A radio that does not work from the OS, btw, still works in firmware and could be remotely used against the OS. If you can get the device apart you could remove it and set it aside, otherwise you need another device if Tor level safety is needed. So far as Tor is concerned a mutually adversarial relationship between phone subscriber and carrier is assumed, an assumption I have always shared. After all, phone companies make money selling out your privacy, and are subject to laws like CALEA that require backdoors for the cops. Software authors are not subject to such laws in enough countries to block safe hosting for non police friendly projects.

This sort of device won't be able to make conventional phone calls, but broadband-only data plans on wifi hotspots should be able to run VOIP applications, and the carriers won't be able to block them as they don't control the app infrastructure on this sort of device. Text messaging would be limited to Twitter-style web apps, but carrier charges for text are a huge scam anyway, Functionality would be close to a normal phone, except for cops and advertisers trying to track the device. Speaking of tracking, those cell hotspots often lack accurate GPS, as they are not expected to be able to make 911 calls. Thus, tracking is limited in many cases to triangulation. In an urban environment that might not place you in a particular building, thus not be enough for a warrant or a police ambush.

As for GPU acceleration, the most important part of it for a phone is probably video decoding, and that only if the phone's CPU is uinable to play the video formats you expect to encounter by itself. Still, I'd give up even that in return for a phone that cannot be tracked and to which the carrier is blind to the content surfed. At this point I stick with a dumbphone carried batteries-out and treated as a portable payphone.

[pjezek]

orbot?

Good tor app.

[Luke]

Tor on a normal smartphone won't protect from the phone itself

Good tor app.

Using Tor on a normal smartphone should keep police or anyone else from being able to find you by either controlling or spying on the website you are connecting to, but won't protect you from law enforcement or carrier suirveillance of the phone itself. The Tor Project's work is aimed at creating a phone that closes off law enforcement access and phone company access entirely. They have found that this can only be done by separating the cell modem from the computer, so that neither one's firmware can talk to the other beneath the operating system. Thus the requirement for wi-fi and a separate device. This way, the phone company and/or the cops can still spy on the modem (which contains the CALEA back doors, etc) but the modem can only read what the computer sends to it and nothing else. A secure OS on the tablet/phone would simply ignore any carrier/law enforcement queries or attempted attacks coming from the wifi hotspot or from any other of what is always a long chain of untrusted routers.

[stevenc]

did you mean no messaging app, no email app and no multimedia player ?

I meant that it has kept providing the original apps, as of the latest release it hasn't substituted them for Google services.

[l_bratch]

The Tor Project has been working on a safe smartphone to use with Torbrowser, and one of their conclusions is this: the baseband (3g/4g) radio is unsafe because it uses a separate CPU run entirely in firmware that the OS cannot replace but which can attack the OS.

Valid concern for most (all?) current phones, but the Neo900 aims to solve that problem. Link regarding the baseband.

[caligula]

did you mean no messaging app, no email app and no multimedia player ?

Lol, only on moronix forums.. You probably realize Android / Replicant also runs without those binary blob hardware drivers, right? There are tons of free (yes, gpl) software in f-droid, even messaging and email apps or multimedia players. You can have fully functional phone/tablet/dev board with free android stack. The only missing features are those limited by driver availability. E.g. if you don't want GSM, use free wifi & voip. Safer since there's point to point strong encryption. And it's cheaper anyways.