> people would use the word "hacked" a bit more clearly

It gets more clicks though nowadays. Bad password discipline ? It's a hack !

> shoving them over onto 2G networks

Wonder why Android doesn't have a setting to lock on LTE/4G as it does for 3G, maybe in the future when LTE is more widespread.

You can force an Android device to only use LTE, but it's generally hidden from users[1] because it can have side effects some users won't understand. Problem with using LTE only is networks that haven't rolled out VoLTE yet--you won't be able to send/receive phone calls until enabling 3G once again and if you happen to be in an area without LTE, you won't have a connection.

[1] Depending on the device it can be accessed by typing * #* #4636#* #* on the phone dial pad or I have an app (https://github.com/yareally/SignalInfo) that allows access to it as a secondary feature. Most devices nowadays also require root to access it, disable access from the dial pad and some Samsung and LG devices still bar access even with root if you still run stock firmware.

Could be that by default LTE is only a data carrier.

Until you can be reasonably sure that there is VoLTE support everywhere, restricting the phone to LTE service means you lose out on call capability. And that is likely to be a big nono for emergency reasons. After all, a phone without a SIM can still call the national emergency numbers around the world.

> After all, a phone without a SIM can still call the national emergency numbers around the world

This is actually not true in every country

I can't imagine it would be hard to connect to other networks only in the case of emergency dialing.

That's a great point and probably the reason, thanks.

FWIW, the LG G5 and Phoenix from the AT&T Portfolio both have a 2G disablement switch. You should see this in more and more AT&T android devices.

https://twitter.com/PatrickMcCanna/status/728679257568727040

I'd like at least a switch to completely disable 2G (on iPhone as well). In Australia, the last 2G networks will all have shut down by the end of next year. So even now, unless you phone only supports 2G there's absolutely no reason to use it (the 2G is thoroughly redundant at this point so you should never need to drop down to it).

Surely there is outcry at the shutting down of 2G due to the number of senior citizens with their mobile phone from 1995, and all those industrial users of "GSM" communications for automation and alerting?

I thought technologies were in place to allow 2G to share spectrum with newer standards, so the 2G network could remain as a legacy-only network forever?

I remember this being worked on some time ago, but don't recall what happened to it. Might be a switch buried somewhere.

Downgrade attacks are actually very serious. The issue here being not with 4G/LTE in general, but with the strategy of downgrading to insecure networks after failing to connect with a secure one. It's like browsers falling back to insecure ciphers in HTTPS after failing to negotiate secure ones - a serious problem for the system as a whole.

I agree that a true downgrade attack would be a very serious vulnerability in 4G, particularly one like I alluded to that could take the RRC down to EIA0-- but that isn't what's being discussed here, and calling it a vulnerability in LTE is inappropriate, just as calling HTTP fallback in browsers a vulnerability in HTTPS would be inappropriate. The vulnerability, to the extent it exists at all, is on the client, in this case mobile devices and in your example the browser.

HTTP fallback is a vulnerability in websites. It can be solved by using HSTS, or partially solved with secure cookies and redirecting to https.

If a browser disobeys these principles and uses HTTP anyway, that's a serious vulnerability. Same if a phone downgrades to insecure stuff.