Many Android devices of that age and even newer had flaws resulting in the failure to properly validate HTTPS connections as they would accept invalid certificates. As a result, every time I fire up an off the shelf WiFi Pineapple in public and run SSLSplit (not to be confused with Moxies SSLStrip), I get credential after credential, typically starting with e-mail accounts. This is obviously bad because if someone is using an e-mail account on their phone for banking, an attacker could gain access to account recovery.

These are the sorts of transparent attacks you don't notice and which cannot be mitigated with anti-virus or avoiding downloading sketchy apps. The sketchy stuff is already running on the device in the form of the OS and apps you use within it. Note that a large number of these vectors were never publicly disclosed including a vulnerability with Samsung Knox that I reported. When it was in use, the device would accept any cert.

Isn't it telling that the antifeatures pushed by the updates are so much worse than the threat of data interception?

Most of these "oh no, security!" issues can be mitigated by avoiding public WiFi or using a VPN on them.

VPN can be a problem, especially on these older devices as those services themselves are vulnerable due to underlying OS issues. In terms of WiFi, keep in mind LTE is effectively broken because of the emergency tower redirection implementation. It's possible for attackers to direct devices to their own OpenLTE tower.

https://sourceforge.net/projects/openlte/files/

> keep in mind LTE is effectively broken because of the emergency tower > redirection implementation

And it will fails after only a few message, when the phone modem tries to authenticate the network (MME) and fails. LTE and 3G do have mandatory mutual authentication where the device authenticates the network very early on. It's 2G that's the problem: a 2G network does authenticate the device, but not the other way round, which opens the door to the well known MITM attacks on 2G (stingrays). The worst a LTE/3G rogue cell can do is try to attack the modem during the early non-authenticated messages (send corrupted messages), and waste UE time or jam it. But it can't do MITM.

So if you're paranoid and you can afford it due to good 3G/4G coverage, disable 2G on your handset ;)

A good talk covering the issue:

https://www.youtube.com/watch?v=hNDChDM1hEE

And there are tools to avoid even scanning public wifi networks to prevent e.g. in-store tracking, e.g. Smarter WiFi Manager remembers where you've used wifi before based on cell tower locationing, and disables it elsewhere. Works like a charm for me.

> This is obviously bad because if someone is using an e-mail account on their phone for banking, an attacker could gain access to account recovery.

I'm still using a iPhone4 with iOS 5.something on it, it's obviously un-patched or anything like that, the secret is that I don't have any baking applications installed on it nor is my email attached to any recurring payments scheme. The even deeper secret is that I don't have an online baking account set-up with my bank at all, as I don't trust any of the banks with their online security. I chose to eat up the opportunity costs of actually physically going to the the bank over the sometimes illusory security and ease-of-use offered by online banking.

The difference is that you are a well-read HackerNews enthusiast who comments on threads relating to OS security i.e. one of the 0.001%, whereas > 99% of the people affected have no idea what dangers await an out-of-date device.

The problem that you don't notice is the lack of security updates.

FWIW, the linked article doesn't track security update status at all. It's graphing percentiles based on API version, which correlates only weakly. A vendor with a correctly patched but old OS would show up as "out of date", but one that missed or is late on important security updates on a recent version is "current".

Do vendors distribute security patches?

Right? It may still largely be functional, but I would never trust that device in the open, it's just ripe for a bevy of attacks.

I really wish Google would expand their service lifetime on their own devices, because I feel 2 years is really too short.

Two years is completely too short, even three years if you purchase mid-cycle is not enough.

I own Nexus 5X's on Project Fi, one bootlooped and was replaced, the other still going strong after ~20months. I also have a Pixel XL acquired like 7 months ago, both of those should outlive the updates and giving Google the money directly, they should take care of their customers.

Far from an Apple fan boy, the 2016 MBP and 2017 iPad do not worry me about getting forgotten in the ever ongoing updates.

Two years is too short but once you get on the extended warranty loop you can basically get another 2/4 years of new phones on the cheap.

For the 5X's, the were a great deal, and it would cost more than the phone to get into the extended warranties. Not worth it for our purposes. As long as they keep working, we'll keep using them.

It is 3 years now with the new pixel. Still too little in my opinion.

If you genuinely only use the phone features of the phone, that doesn't matter anywhere near as much. You only need to update if someone finds something like a text messaging buffer overflow. That sort of thing generally makes the news these days.

You can but hope that once it’s old enough, the hackers will stop worrying about supporting it.

When "the hackers" consist of the CIA and NSA, you can be sure that they will not.

Take a quick look at the Vault7 leaks for a reference.

The only impact?

You are a walking vulnerability. KRACK, Blueborne, just to name a few recently highly publicized vulnerabilities.

You are like the perfect exploit, just waiting to get pwned. You are, Bill Harper.

I, like the parent poster, am running the latest update for my phone. Yes, I know I'm a walking vulnerability, but short of purchasing a new phone, there is nothing I can do about it. IIRC, updates for my device were cut off before it was even out of warranty, and I'm sorry, I'm not dropping — I can't drop — $600 every year and a half on new hardware just to get new software. Vendors need to support devices for the actual lifetime of the device.

It's really not your fault. But collectively we should care more about this and hold vendors accountable for continued security of devices they sold us.

AFAIK Microsoft and Red Hat are the only ones who do a good job of patching security bugs on older OSes.

You don't have to drop $600 every year and a half. Which would only be $34 a month over that period.

You can drop $600 every 3 years with google devices and have monthly security updates. You could save $17 every month for that 3 year time to buy the next phone.

If you want to stay secure you will, if it not a priority you wont.

Which is a waste of money for a device that otherwise is fully working.

The beauty of consumist society and digital waste.

Except Google stopped selling $600 devices.

The Pixels are incredibly overpriced given the hardware. I bought a Nexus 6P when they got under $400 and I honestly don't know what I'll do a year from now.

Or you can spend $200 and get a pretty good, non-flagship phone, with software that's (usually almost) as up-to-date as the flagships.

KRACK is essentially irrelevant, the security models of the OS and any sane applications will assume that the network is compromised (e.g. starbucks wifi).

Blueborne on the other hand, is very scary.

Most wifi router vendors have STILL not fixed the KRACK vulnerability. Looks like most companies dont care about user security at all.

From that side, this is why I insist on only buying devices 'supported' by OpenWRT / LEDE.

LEDE, thanks to being open source, had a patch within days, which worked across all supported devices.

I would honestly just prefer the manufacturers 'give up' in house router software and instead contribute to the community software.

KRACK only compromises the client, not the AP (unless you have one in relay mode or something)

So? The issue is on the client side. Unless you use wlan client, or repeater stuff with your AP.

I've got a Samsung S4 laying around that I hadn't used for years (it's 4 1/2 years old). Recently I fired it up just to check some things. As expected, it still runs beautifully for normal Web use across all sites. Other than the small form factor (which some people may prefer), it's easy to see how consumers might stick to older phones.

I'm tempted to dust my old Aviator off and repurpose it as a gba emulator or something.

except for the old android I don't see any problems with my S4, so I'll be using it for another 2 years. And I actually prefer that size, it's easy to use with one hand

I used my S3 until it died on me, a couple of months ago.

The S3 and S4 were pretty nice! Very slow flash, like every other Android back then, but good screens and very capable GPUs. (Since then screen size increases have outpaced GPU speed bumps, so modern phones don't always draw any faster.)

> I've got a 7 or 8 year old Google Nexus phone.

There's probably an Android O ROM out there that someone on XDA has compiled for your device.

Hosted on a dubious server with no guarantee at all there is no malware in it.

It's remarkable how fishy the whole ecosystem around Android ROMs and flashing tools really is.

95% of the posts are in barely comprehensible English. Seemingly every guide tells you to run a random binary from a file sharing host or generic domain.

As a rule, source code is non-existent. Downloads are attributable to a forum handle in the best case. Oh and you have to run it with elevated privileges to both your host computer and the device. Even the shadier warez communities have more accountability and trust.

In my opinion Google has really done a huge disservice by dropping support for their devices so rapidly and condoning planned obsolescence by handset manufacturers. They are directly responsible for channeling a significant fraction of Android users into this mess.

Yep. It's better than it was - most XDA developers understand what a GPL violation is.

I imported my Galaxy S8+ to save over $400AUD on retail. This meant I needed to find a ROM on an obscure site to flash to the phone using a stolen (?) piece of factory software. I can only trust my phone because a Samsung in default configuration won't accept a "modified" update - only one from and signed (?) by Samsung themselves.

Is LineageOS still using "test-keys"? It's been possible to do much better for years: https://mjg59.dreamwidth.org/31765.html

> using a stolen (?) piece of factory software

If you're referring to Odin, there's an open-source alternative in Heimdall (https://www.glassechidna.com.au/heimdall/).

>using a stolen (?) piece of factory software

You mean ODIN! That's probably leaked. Many good memories of that tool.

Android is as mature as Windows XP, every vendor has their own where they customised everything and no-one has a pristine one. And also the pre-installed ROM is also often the same quality as the warez.

I trust the community on XDA composed of actual users and developers who are also users, more than the faceless corporation whose profit largely comes from extracting as much of your personal information as possible and monetising it.

I’d rather trust a faceless corporation with a reputation to keep over a bunch of faceless anonymous dudes on a forum.

They're not anonymous, they're pseudoanonymous, which also means carrying a reputation; and if anyone tries to deceive, the community is not entirely full of idiots, unlike what a lot of others in this subthread seem to imply --- all it takes is for someone to find out and provide proof, and the news will spread widely.

The fact that people seem to be scared of and are basically unwilling to make their own decisions of trust in deference to central authorities says a lot about the state of society today... "distributed trust" and communual free sharing was the norm, until companies started to herd users into their walled gardens and control them by using the "security" argument.

No matter who you choose to trust there are going to be no insurance that vulnerabilities are actually fixed. Its not a magic bullet.

We are talking about a Nexus here so I can't really say that since it's Google but otherwise there's no guarantee that the ROM you have pre-installed does not have malware either.

Well, you’re free to compile the code yourself…

Yes and I'm sure that most people have both the time and the technical acumen to go through every line of the source code and ensure that there are no security vulnerabilities

Yeah, after all there are only several millions of lines of code. When they even share the code used for their builds, which is rare.

It's android, it's entire reason for existence is to be a malware platform.

Why would making and receiving calls and texts and checking email not work on current devices in a couple of years ?

No, the OP means any new phone will just be obsolete again in a couple of years, so why bother if their current obsolete phone is good enough anyway.

Ah, I see :-D. Thank you for the clarification.