News for hackers. Stuff that matters.
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by endorphone on Monday October 16, 2017 @08:38AM (#15482749)
The Nexus 5 was released 4 years ago. At the same time the iPhone 5C was released. The 5C also won't receive a patch for this.

There is a problem with handset abandonment, but this is true across all vendors, and it does not underline sequence7's claim that this is solely an Android problem.

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by pfg on Monday October 16, 2017 @09:09AM (#15482896)
To be fair, these two examples are both on the extreme end: The Nexus 5 being one of the longest supported Android phones on the market, and the 5C having a rather short support period, compared to other iPhones like the 5S, which was released along with the 5C and got iOS 11. Security updates for the Nexus 5 also stopped shipping about a year earlier. There's still room for improvement for Apple (5 years of security updates seems reasonable), but there's still a large gap.
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by skykooler on Monday October 16, 2017 @10:54AM (#15483604)
Mobile devices also have much less reason to lose support than they used to. In 2010, the difference in hardware between a new phone and a 3-year-old phone was huge - 8 times the RAM, 4 times faster CPU, twice the display resolution, etc. Nowadays, the Nexus 5's specs are on par with midrange phones being released as new. It has all the hardware required to run modern apps. There's no good reason why it can't be supported, besides getting more money from people if they have to buy a new phone every 3 years.
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by gsnedders on Monday October 16, 2017 @10:17AM (#15483328)
Has anyone ever taken a vendor to court on the basis of consumer rights and not providing security updates and the product therefore not being fit for purpose?

For example, under the Consumer Rights Act 2015 in the UK the product must last for as long as a reasonable person would expect it to, and Apple's interpretation of that is five/six years (see https://www.apple.com/uk/legal/statutory-warranty/).

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by techdragon on Monday October 16, 2017 @02:18PM (#15485427)
I'm always tempted by this, I have time, I know people, but the thing is, you agree too far to many contracts by starting to use such a device, that just navigating the initial waters to find a path to sue anyone is a complete non-starter. I'm not able to tilt at this windmill. Hopefully the Purism phone succeeds and I can buy one. Till then ill keep buying a top of the line Apple phone each 4-5 years when support runs out.
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by fphhotchips on Monday October 16, 2017 @03:55PM (#15486164)
If it's anything like Australian Consumer Law, it's really really difficult to sign away those rights. In fact, even attempting to tell a customer that they can sign away those rights can result in company ending fines.
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by bigiain on Monday October 16, 2017 @06:46PM (#15487273)
Hmmm, might have to lead with this line of reasoning when I ask Samsung here in Australia why my S6Edge doesn't have an update for this in a reasonable timeframe...
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by gsnedders on Monday October 16, 2017 @02:41PM (#15485610)
> you agree too far to many contracts by starting to use such a device, that just navigating the initial waters to find a path to sue anyone is a complete non-starter

The Consumer Rights Act 2015 also covers unfair terms in sales contracts (and at least in Scotland EULAs are part of the sales contract, per Beta Computers (Europe) Ltd v Adobe Systems (Europe) Ltd; I don't know the status elsewhere in the UK), and it's quite likely you could just go through most of the possible contractual outs and argue they are unfair terms.

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by DougWebb on Monday October 16, 2017 @09:39AM (#15483061)
The problem is that these aren't phones anymore; they're small computers. They should have support lifetimes that are comparable to desktop computers.
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by pixl97 on Monday October 16, 2017 @09:44AM (#15483105)
> they're small computers.

And they are more expensive than many computers you can buy on the market. 2 years support on a device that can cost $500+ isn't acceptable.

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by maxerickson on Monday October 16, 2017 @11:23AM (#15483832)
And yet people buy them.

We are 4-5 years into the period where people have had sub $300 choices, so there is an alternative to spending $500+ on a device that comes with 2 years of support. Maybe not a fantastic alternative, but the $300-$500 extra that people choose to spend says something about what they care about.

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by Yeroc on Monday October 16, 2017 @04:26PM (#15486385)
Quite frankly I don't think we should be counting elapsed time from when the device was first released but rather to when the device was last sold as new. I have a Sony Z3 first released September 2014, but which I purchased new over a year later in October 2015. The last security update this phone received is the May 2016 one.
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by cgtyoder on Monday October 16, 2017 @02:12PM (#15485367)
> The 5C also won't receive a patch for this.

You don't know that. Apple could very well release an iOS 10 update for this.

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by endorphone on Thursday October 19, 2017 @04:48PM (#15511421)
By that token it's possible the GS2 on Android 4.0.4 might get a patch for this.

But in both cases the stated policy is that the devices will not receive any more updates, either feature or security.

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by macawfish on Monday October 16, 2017 @09:40AM (#15483069)
A lot of phone companies are locking their devices from receiving new kernels. Its dumb and I hate it.