At the end of the day you need to trust Qualcomm or MediaTek. The Oracle of the hardware world, with more lawyers than engineers, or... MediaTek.
That's a NOPE for me.
If I were the NSA, that’s where I’d be focussing at least some of the attention of the “exploit people’s phones” department. If you want cellular connectivity, the cellular provider needs a real time way to identify your device and it’s location (at least down to neatest few cell towers accuracy).
(And once I had some capability there, the people running the “most secure basebands/devices would be the ones I kept the closest eye on. I’ve heard my local intelligence service are very interested in phone switch on/off events, because they are a signal that someone might be attempting to evade surveillance, and the rarity of “normal people” switching their phone off (or disconnecting from the cellular network) makes it worthwhile collecting all that “metadata” so they can search it for the “interesting” cases.
WiFi is in a similar position, but at least the diversity is a bit better causing integration tests to fail better when too many bad implementations try to talk to each other.
That leaves all the other chips, which I think are best trusted in a divide and conquer setup where they all have to independently verify their blobs, and not be allowed to mess with each others memory/internal state. It can make them more expensive, but it also compartmentalises them in a way that side-channel attacks within CPU cores are completely mitigated.
Only a very very very small amount of companies in the world will have the capital, expertise and manpower to make devices where enough of the stack can be trusted, and out of all of those, only some actually seem to try:
- Google (mostly for UX, but also to make fat stacks of cash via ads)
- Apple (mostly for UX, but also to make fat stacks of cash via ecosystem)
- Microsoft (console, ARM windows, mostly for DRM, but also UX)
- Sony (console, mostly for DRM, but also UX)
- Nintendo (console, mostly for DRM)
The more a company does _not_ want to get burned on their security/privacy positions and keeps iterating making better designs, the more you _could_ trust them. The only realistic alternative is going back to 80's computing, and nobody has time for that.
You know the answer here, they are not to be trusted.
Samsung phones, for example, have a gpsd, which phones home at random times. This runs as root, ignores vpn settings (so no netguard for you!), and if it is just getting updated agps info, it sure seems to send a lot of data for that.
So no, they don't want a legitly auditable device. Too many questions, you see.
If I’m not a terrorist/sex-trafficker/investigative-journalist, can I reasonably ignore those threats even if I, say, occasionally buy personal use quantities of illegal drugs or down/upload copyright material? (With, I guess, the caveat that I’d need to assume the dealer/torrent site at the other end of those connections isn’t under active surveillance…)
Nation states, especially the US, should be suspected of having compromised everything. Look at all the things Edward Snowden released. Look at the way the NSA has corrupted cryptographic standards in the past (e.g. Dual EC DRBG). There are countless instances of similar situations.
One issue is that software has vulnerabilities and bugs. I’m not talking about the software that users run in sandboxes environments. I’m talking about the sandboxes environments. I’m talking about cryptography implementations. I’m talking about the firmware running in the “trusted” hardware.
The other major issue is as you alluded to: the need to trust vendors and hardware. Without protection and monitoring at the physical level, the user has no way to verify the operation of the giant stack of technology designed to “protect them”. Without the ability to verify operations, how is the user to trust anything? Why do companies tell users to “trust them” without any proof they are trustworthy?
This may seem like a minor point, but this is really the crux of the issue. Building this giant house of cards on top of a (potentially) untrustworthy hardware root of trust does not buy anyone anything. Certainly it does not buy “security”.
Large companies and nation states are the most likely adversaries one wants to be wary of these days (e.g. journalists, whistleblowers, etc.). What good does the technology do them if the supply chain is compromised or vendors are coerced to insert backdoors? These are the threats that actually face people concerned about security, not whether or not their executables are run in a sandboxed VM or not. Great, you’ve stopped the adversary from inserting malicious code into your device after purchase. Good thing for them, they did it prior to or during manufacture.
The technology you alluded to above is mainly useful for protecting company IP from end users, IMO. That’s how I’ve mainly seen it used, and the marketing of “security for the user” is a gimmick to justify the process.
EDIT: I forgot to mention this entire class of security issue since I am used to working on air gapped systems. I don’t care if you are operating in a sandboxed VM with a randomized MAC over a VPN over Tor. If you’re communicating with any other device over the Internet, you have to trust every single other machine along the way. And you shouldn’t.