[corford]

Moto G5 Plus (though updates might not stretch to 3 years). Here's a review: http://www.trustedreviews.com/reviews/moto-g5-plus

tl;dr: stock android with no bloatware (Nougat, though should get at least the Oreo update), fast Snapdragon 625 CPU, big screen, dual-sim, decent battery, good camera and available for ~$320 (or ~$100 less for the basic G5).

I'm about to swap my ageing Moto G2 for one.

[fulafel]

Moto is poor with updates IME, security patch level lagging 6-10 months.

[corford]

Fair point. Hopefully Lenovo will get better at this. I kind of overlook it since I don't use my phone for anything other than calls/sms, email, light web browsing (99% of the time wikipedia or hn), google maps, whatsapp, uber and taking a few photos. Rightly or wrongly I don't care too much about security since I'm not installing loads of apps and don't use the phone for much (still encrypt it though in case of physical theft).

[fulafel]

If you hook it up to your Google and/or other social media accounts, you should care about security because a compromised phone can compromise your account, spam all your contacts, pwn your Gmail, etc.

Even if you don't use a Google account and install only selected apps, you need an up-to-date OS for web browsing, there are hostile ads even off sites like Reddit due to ad networks funneling bad stuff through. Also there are similarly unsafe ad network content embedded in otherwise reputed apps.