[revelation]

The privacy issue in smartphones isn't the freaking application processor running Android. Sure, that ones terrible enough.

But the actual problem is the baseband processor running completely non-free software, with an enormous attack surface and access to all the interesting periphery (GPS, microphone). There is not just opportunity to compromise your privacy, Qualcomm and others actively implement such features at the behest of governments and carriers.

Oh, and if you plug that enormous hole, you get to the SIM card, yet another processor that you have zero control over, but which has access to enough juicy data to compromise your privacy. I highly recommend everyone to watch a talk from 30C3 by Karsten Nohl, where he shows a live attack on an improperly configured SIM card that remotely implants a Java app on the SIM card which continuously sends your cell ID (your approximate location) to the attacker by short message (without notification to the application processor, e.g. Android or iOS):

http://www.youtube.com/watch?v=5B7XyVWgoxg

Carriers can do this today. (edit: that's a bit nonsensical, because carriers of course already know your cell id. Anyone with the ability to run a fake basestation momentarily (think IMSI catcher) can do this.)

[lazyjones]

Absolutely correct. This is why such a device should isolate the hardware components used for communication from the main CPU/device, consider the former "hostile" and communicate with them using a simple, safe interface (like USB or serial). Using a throwaway external 3G/LTE adapter (USB) would be even better. This way, a compromised baseband processor or SIM card cannot access the host's memory (using DMA like in current smartphones) and as long as the host uses secure encryption, it can still communicate securely (but of course the device will be detected and identified).

[bergie]

I think this is essentially what N900 did. The GSM part was handled as an external modem so that people would be free to have root on the rest of the device.

http://flors.wordpress.com/2009/08/27/software-freedom-lover...

[rdl]

The solution is for your phone to not be a phone. Strip out the baseband entirely, use usb or wifi to a 4G LTE dongle, do VoIP. Extra benefit that you can explicitly know when you're radiating (and thus being location-tracked).

Blackphone is pretty lame, IMO. There's something better coming from a trusted source in weeks, and plenty of work being done on the "there is no phone" phone concept.

[bwooce]

"Strip out the baseband" of a dongle and you won't have a device that can connect to the network, authenticate, shift cells or anything else. It's like stripping the firmware off your disk drive.

Fully support the initiative for an open baseband. One reason it's not open is the (fairly legit) fear that intentional and unintentional DoS attacks would occur, affecting everyone in the area. It's really really simple to be an obnoxious cellular network citizen and it's pretty damn hard to police.

Baseband bugs that impact networks are common too due to the complexity. I saw a function point analysis of GSM vs 3G once, seem to remember 1-2 orders of magnitudes difference. Ahh Function Points, you flawed devil of a management metric.

[rdl]

The idea is that your "high side" device is a phone, with all your apps, etc. It communicates over a well defined interface (USB seems like the best, but bt or wifi could be adequate given certain considerations) to a fully-functional mifi dongle or whatever which does normal cell/public-wifi/etc. functionality. No compromise of the external cell modem can get at high side data. The current "baseband can DMA your main device" is absurd; security processors (only on iOS and BB and maybe WP, really) help a little, but not enough.

Yes, it is two small boxes right now, but there's no reason you couldn't build a "baseband firewall" which puts baseband in one area, a firewall in between, and the regular phone, with only a well defined open interface in between.

[dobbsbob]

Snapdragon and every other baseband coming out has them on an 'all in one' chip which is application CPU and baseband sharing direct memory. Unless you have a microscope you can't build a hw firewall.

Cryptophone uses an older Samsung to do this but has no SIM protection. The firewall isn't foolproof either it only detects extended use of the baseband cpu without the application cpu being busy then shuts down the device, which makes it a brick open to denial of service.

A hardened Android build is fine for most shady activity and avoiding dragnet surveillance. If you are a drug lord or foreign spy use a laptop or tablet with ostel or silent circle, internal mic removed and running hardened free software, your dongle should have TurboSIM or similar wrapper that can be coded to reject OTA updates and not reply to silent tracking SMS. Marlinespike is also working on a new Whispercore, I have a forensics resistant project, and there is of course Cryptophone GSMK. Is the project you're talking about the build that runs Xen then boots Android in phony isolation because the snapdragon chip can still access memory.

Another problem is simply walking around with 2 phones which is an opsec indicator for feds that you are up to something and req targeted surveillance. They have full automated access to every cell tower db to look for this as per snowden docs dumped on cell meta data

[rdl]

The idea is you don't use baseband functionality at all in the main high-side device. It can be a PDA, connected over USB to a separate radio. There's no way the radio can do anything particularly evil except if there are implementation bugs over USB (API problems with whatever interface you build between them, most likely), but at least that can be inspected by end users and problems found/fixed.

These highly-integrated devices are basically inimical to decent security.

No (that project was an earlier version of blackphone/geekphone, actually! from what I've heard)

[chillingeffect]

I believe you have the right idea. To isolate audio/message encryption in one box, stream it via IP to cellular (LTE/4G/etc) towers in another box. Then, the customer puts those two boxes into one box.

It could basically be done today with an Android PDA running VoiP app only, connected over wifi to a cellular hotspot in one's pocket. The next evolution would be to replace the wifi with a wired network.

[dobbsbob]

I just tried this with a Huawei E1762 (casing removed) and a stripped down dongle. Crammed them both into the back of a Nexus and attached it using the case I have for a Seidio Innocell 3800mAh battery extention.

Activated airplane mode to kill the baseband, PPP widget runs fine on 4.2.2. Success. (kernel module loading not avail Android 4.3+ though obviously can build your own, or get a Moto G with native USB OTG support)

[daxelrod]

> Another problem is simply walking around with 2 phones which is an opsec indicator for feds that you are up to something and req targeted surveillance. They have full automated access to every cell tower db to look for this as per snowden docs dumped on cell meta data

Do you happen to have a link? That's pretty terrible for anyone with a work phone and a personal phone.

[homunculus]

"Another problem is simply walking around with 2 phones which is an opsec indicator for feds that you are up to something and req targeted surveillance. They have full automated access to every cell tower db to look for this as per snowden docs dumped on cell meta data"

They, the feds, must be surveilling an awful lot of ordinary citizens because in my day job, delivery driver, I carry two phones. One issued by my company and my personal phone and on days when I'm working with another driver we'd have four phones in one vehicle. I can imagine there are quite a few people who have good reason to carry two phones regularly.

[Digit-Al]

How can having two phones be an indicator that you are up to something? It is extremely common for working professionals to have both a personal mobile and a company mobile these days.

[rdl]

They do really complex analysis of patterns of how phones move, how they're powered up, call history, etc. It's actually really fascinating if you think about it and dig into it a bit, just like being able to largely identify (and sometimes effectively decipher) network traffic through analysis of encrypted message flows.

Just carrying two phones with you isn't the most interesting thing; it's a pair of people who normally have one phone during normal activity, and then at some location turn that phone off and turn on another phone which isn't used for anything except calling the other person briefly and hanging up without saying anything, and then those phones moving closely together, etc.

In my proposed case, there's no actual "second phone" on the cellphone network; your "phone" is a wifi only device which talks to a box which talks over data.

Traffic analysis is one of the things NSA does exceptionally well; the open crypto world is like 5 and maybe NSA is 7, but the open traffic analysis world is more like 2 and NSA is a 9.

[ansible]

Fully support the initiative for an open baseband.

I would love to live in a world where this can happen. But we don't live in that world.

The carriers have paid billions of dollars for exclusive use of their frequency bands. And their hundreds of billions of dollars of revenue depend upon smooth operation of all devices on the network using those bands. They will use whatever means to protect this.

OK, so let's talk to the FCC (and all the other agencies around the world), and get some other frequency band we can use for our totally open phones.

Well... there aren't any open ones left in the good range of approximately 700MHz to 2GHz. This is the part of the frequency spectrum that has decent carrying capacity, good penetration, and not too high power requirements. It is basic physics. Go lower in frequency, and you can't carry enough bits to be useful. Go higher in frequency and you start getting stopped by walls and such.

All the good bands have been allocated in the USA and elsewhere for TV, existing carriers, military, satellite, and so on. At a minimum, you'd need tens of billions to lobby for and buy a decent chunk of spectrum. And you need to get the current users moved off, which they won't like.

All we have left are the 'crap' bands like 2.4GHz (microwave oven interference). 5GHz isn't too bad (not a lot of other interferers) but it is short range with the current regulations. Another open band for unlicensed use at 60GHz gets stopped by walls, air (oxygen)...

[IgorPartola]

I don't understand. If I come to a carrier and say "Here's a codebase for your baseband. It's OSS, well tested, secure, and supported. Buy support from me." why won't they go for it. Surely, an OSS solution is cheaper for them than developing an in-house crap solution that I'm sure it is now.

Also, is there any harm in just open sourcing their baseband code? It seems to me that it's worthless without the license to use the frequency anyways, so who cares if the code is open from a losing business point of view. On the other hand, things like security review are to the carriers' and manufacturers' benefit, no?

[ansible]

If I come to a carrier and say "Here's a codebase for your baseband.

The carriers don't want baseband code, they just want finished products to sell.

It's OSS, well tested, secure, and supported. Buy support from me." why won't they go for it. Surely, an OSS solution is cheaper for them than developing an in-house crap solution that I'm sure it is now.

OK, assuming you get a current-generation baseband chip for free (it actually costs a ton of money to develop) with full documentation, you're still talking hundreds of millions to develop that software. GSM (a 2G technology) is complicated. UMTS / HSPA (one of the 3G techs) is an order of magnitude more complex. LTE (4G) is another order of magnitude more complex than 3G. The baseband code, plus all the testing code, plus all the testing required by the FCC, standards bodies and the carriers is a ton of money.

It costs millions to take an existing chipset (which has already been approved), an existing baseband codebase (which has also already been approved for use with that chipset) and put that into a modem and get that approved.

The chip vendors have their own baseband code now, and they are all in fierce competition with each other. They aren't going to just use your code, and they aren't going to let you use their chips either.

[IgorPartola]

OK, thanks for the explanation. So it sounds like this comes down to vendors competing and not wanting to have their code exposed for fear that others might copy their chip + code when the vender is the one paying all the fees to make the chip + code usable. I guess this is similar to Nvidia vs AMD (vs Intel I suppose), except perhaps even more entrenched and without much hope of a community reverse engineering a solution.

This sucks. Do we have any alternatives? Are there any completely open radio chips in development?

[mietek]

Are you aware of Fabrice Bellard's 4G LTE software base station?

http://bellard.org/lte/

[superuser2]

If it's OSS, then users are empowered to modify the code for their own purposes in ways that degrade or deny service to others.

Code could be released for inspection, but you can't be allowed to actually run modified code on real radios outside of RF-isolated testing facilities.

[npsimons]

Ironically, the market seems to be not optimizing for optimal net revenue (income minus costs, where here you're minimizing costs), but for control. This is partly because of the control freak nature of these companies, partly because the government demands it, but also, again ironically, because of long term thinking: if these companies can lock people out and control them, that helps to guarantee future profits. The free market can sometimes be a cruel bitch bent on the end-user's oppression.

[IgorPartola]

Sounds more like the market is stuck at a local profit maximum instead of a global profit maximum. As in, they think they are making as much profit as they can, but in reality if they invested more into something that's not directly consumer facing they'd be end up making more money in the long run. Except this long term thinking is less appealing than the status quo so they just stick with what they know.

[revelation]

I think theres a misunderstanding here. Nobody wants to buy the actual frequency spectrum or compete with carriers; we just want to control the software and processor that does the GSM, 3G and LTE communication, on whatever frequency.

(That is not to say carriers won't do everything in their power to stop actual open source software and hardware implementations; mobile only works because all the devices behave nicely according to the specification, an attacker could with very little power severely compromise the network. There is just a very large barrier to entry, and dumb, bruteforce solutions can be triangulated.)

[hrjet]

> Fully support the initiative for an open baseband.

How do you ensure that the manufacturer doesn't modify the baseband code?

[tucosan]

> There's something better coming from a trusted source in weeks...

Could you provide more concrete info on what you are referencing there?

[rdl]

Sorry, no -- it's not my product to announce. By way of validation, it's something I'm planning to use personally, even though it doesn't go as far as I'd ultimately like, until something better exists (which I might be involved in; unclear if client devices are the right focus since end users are so picky about non-security aspects of them, and for me, iOS is generally good against non-NSA threats, and NSA isn't my personal adversary.)

[ABNWZ]

>There's something better

Is this IndiePhone by Aral Balkan?

[rdl]

I've never heard of this project or person, but it looks interesting too.

[XorNot]

Except nobody wants to carry a dongle around in their pocket. Your security measure is useless if it's too much hassle to use day-to-day because most of the time (closing in on 100%) it does not matter.

[nfoz]

I carry a SIM card around...

[Canada]

Do tell, what's coming in a few weeks?

[kybernetyk]

Hmm, I'd say the real privacy issue is the user who installs and runs all those Facebook, Twitter, LinkedIn, etc. apps and freely shares his private information with everyone.

You can't really prevent that with technology unless you start to educate kids/users better. But who am I kidding? People will forfeit their private data for shiny stuff as long as there will be shiny stuff and private data.

[brudgers]

There are two different connotations of 'privacy' that are often conflated in discussions about Facebook, Google, etc. Conflating them probably obscures the more important connotation to the benefit of such companies' bottom lines.

The first connotation is the one my mother warned me about. It's Facebook photos of that tequila weekend in Tijuana and those two PM Tuesday tweets from the beach bar when I called in sick to work. These are things that require personal judgement in regard to what I say. Self-control addresses this type of privacy.

The second connotation of privacy is newer, but still nearly twenty years old. It entails concerns regarding information collected about my actions beyond what I explicitly choose to broadcast. It's cookies in the browser [and their more sophisticated descendants]. It's my browser linking my Google+ account to my browsing history at lesbiandwarffurries.com.

Privacy issues of this second type are assumed to be normal when they are considered at all - why doesn't my browser sandbox cookies for each website? Or rather why isn't there a browser that does so? The same logic underpins the Blackphone - sand boxing unrelated parts of the system so that privacy is a matter of personal judgement rather a battle against a technically sophisticated adversary.

[biafra]

> why doesn't my browser sandbox cookies for each website?

You can do that with Fluid.app (http://fluidapp.com/ only for MacOSX) It is a Single-Site-Browser-Generator with the option to have a separate cookie store for each SSB.

I have one instance for facebook, one for Google+ etc.

[aidenn0]

You can disable third-party cookies (I do so), and watch how many websites cease to function.

[brudgers]

I've been running Firefox with Ghostery and NoScript for about four years. I know the consequences.

I only access Facebook from a VM or an old smartphone with no SIM. That's because browsers are designed to circumvent my attempts at privacy and to facilitate the ends of third party cookies.

Using a Git analogy, there is no reason for a single cookie repository. Suppose foo.com injects a third party cookie from bar.com into my data stream. It could sit on the foo.com branch of my cache, so that when I visit baz.com, it does not know about the bar.com cookie, and injects another one [which sits on the baz.com branch of my cache].

When I want to have a single bar.com cookie for foo.com and baz.com, then I merge them and let bar.com sort out any discrepancy. To put it another way, there might be a few websites where I wish to allow a shared persistent Facebook cookie, but I don't want to share that information with every website with a LikeUsOnFacebook widget or share all my browsing with Facebook.

But browsers thwart that process and facilitate tracking. It is by explicit design that browsers break the web when there are attempts at privacy. They are designed to mislead users and be truthful to remote websites rather than vice-versa.

The

[sushirain]

No. The problem is not the common user who just follows common hardware and software. The problem is common hardware and software, which put security last.

[pekk]

That hardware and software are being selected by users. Unless you become the government, your "solutions" will be less preferred and will die. At best you can sell luxury products to paranoid, Howard Hughes types.

[tunap]

And Opt-Ins first.

[na85]

Came here to say this exactly. The world needs an open-source baseband processor/firmware.

[dobbsbob]

Osmocom baseband tried this. Works on older motorola phones, then just buy a turbosim with encrypted voice, sms and code your own OTA blocking. Or use a small tablet with no sim using wifi

[f_salmon]

> But the actual problem is the baseband processor running completely non-free software

True, and once that one will be made open-source too, there's still the NSA tracking mobile phones worldwide and generating all kinds of privacy-invading data based on it:

http://www.washingtonpost.com/world/national-security/nsa-tr...

(And until that is resolved, my mobile phone will stay in flight mode only.)

So once again, while tech may help in the short term, long-term solutions will have to be structural/systemic ones regarding government in general.

[pyre]

> once that one will be made open-source too

The point made elsewhere in this thread is that even an open-source implementation can be exploited. If the baseband is tightly integrated, then that exploit gains the attacker full access.

From a security perspective, even a closed-source baseband could be ok as if it has proper separation from the rest of the system (though open-source would obviously be better).

[treenyc]

by looking at the video I know some of the people in Spain who are involved. They are in Bilbao. We did a consulting project with them in 2009. They are more in the creative educational industry.

I am not sure about the technology, however from look of the video I can say it is mostly aim at non-technology experts, with nice fancy design.

Can I ask what kind of people do we need to design all the chips hardware such as baseband processor, using open source design?

And what are HN opinion on Silent Circle?

[dobbsbob]

Silent Circle is for business use to avoid industrial espionage. If you are an activist or suspected criminal I would imagine they would cooperate with any court order to feed you a malicious update that allows federal access just like Hushmail does. They swear up and down this is impossible but it's a for profit business they arent going to risk it protecting whistleblowers, wanted hackers or enviro activists. Redphone at least you can build it yourself and prevent targeted updates

[reedlaw]

I totally agree that adding privacy features to what is essentially a tracking device isn't addressing the right issues. Why not start out with simply a free, private laptop? Something that uses Coreboot and doesn't require any firmware driver blobs. This is something that so far, only one Chinese company has been able to do, albeit producing only a rather underpowered model [1]. Where are the private laptops that rival the Macbook Pro?

1. https://en.wikipedia.org/wiki/Lemote#Netbook_computers

[ThatGeoGuy]

You appear to have missed the article by the free software foundation where they approved another, fully free computer.

See: http://shop.gluglug.org.uk/

[0xdeadbeefbabe]

Yes, the other OS is way worse. "You can even brick phones permanently" --http://www.osnews.com/story/27416/The_second_operating_syste... which was on hn recently.

[gr3yh47]

the sub-OS was my immediate thought when I saw it is an android device.