Ask HN: Real risk of using an unpatched phone

[osdril]

Reading some discussions on HN, it looks like many people claim that using a phone which no longer receives security updates is a terrible idea because the probability of you getting hacked dramatically increases.

On the other hand, millions of people in the world run unpatched Android phones everyday and yet I cannot find any significant report of them being hacked because of this. It looks like most vulnerabilities are only really exploited in targeted attacks to specific personalities (activists, journalists, etc.) and the ongoing discussion about the topic is mostly speculation.

So, really, how unreasonable am I being in using an unpatched phone? (All the apps and the Play Services are still being regularly updated)

I don't like being forced to replace a still functioning device, but if there's any real high-probability risk I guess it's just the most sensible option.

[ActorNightly]

There aren't really any big exploits anymore that one can target en masse. Most of the exploits that do pop up require not only extremely specific targeting, but also pretty hardcore engineering to actually to stuff with the exploit. To get from something like a double free to a shell isn't exactly straightforward (and in some cases, not even possible).

Ironically enough, even though they are still VERY rare, I believe that fully remote exploits for Apple pop up at a higher frequency, because of how intricately their apps tie into the OS of the phone for performance reasons. Over the years, I seem to remember reading more about them on Project Zero than

[warner25]

I suspect that Apple iOS users are also much more lucrative targets. The Android user base is bigger worldwide, but not in the US and especially not among the affluent and public figures.

Come after Android and you're coming after people like me who have an old $200 budget phone, a $5 per month data plan, and don't even use it for things like banking or mobile payments.

[osdril]

That's reassuring to hear, thank you

[jjgreen]

You cannot hope to bribe or twist, thank God! the British journalist. But, seeing what the man will do unbribed, there's no occasion to.

Humbert Wolfe

[warner25]

I started this "Ask HN" on the topic a year ago: https://news.ycombinator.com/item?id=33197291

People made some interesting points. I still have my head in the sand, and I plan to reevaluate again next fall. Note that I'm an unusually light user of my phone, I'm a nobody, and I don't travel internationally. I'd make different decisions if my phone were the center of my digital life or I felt like I might be targeted.

[osdril]

Very interesting thread, thank you!

I think I'm going to adopt the same strategy as you, since apparently nobody can actually show any meaningful proof of widespread hacks happening..

I must also say that if I feared being a specific hackers' target, I would probably make many different choices in how I use computers/the web, other than upgrading my phone :)