Obviously since phone calls and text messages are unencrypted the baseband chip could send them elsewhere. But your internet communication should already be encrypted before it hits the baseband chip. So is the threat model Motorola has intentionally introduced a backdoor to leak data from the main chip to the baseband chip?
If I understand it correctly (but please do correct me if I am wrong), Qualcomm supplies the baseband OS as a signed binary blob.
Baseband firmware/processors are still making strides in terms of defending against attacks so I don't think we are at the point where backdoors are needed. More likely that undocumented AT commands, plausibly deniable bugdoors and existing memory corruption vulnerabilities are already convenient reality. However, part of that reality is also that once the cellular modem is exploited OTA it is still a massive task to traverse IOMMU restrictions and get device owner data/secrets from the userspace OS. It doesn't even grant visibility into application traffic which has been aggressively TLS encrypted since the mid 2010s.
The entities that are putting in backdoors don't respect the law, and obviously will do what they can to obfuscate the backdoor enough to pass regulatory reviews.
My threat model is precisely entities that don't respect law or are unethical. So, the question then boils down to whether current regulatory review processes can catch such backdoors and the people running these processes cannot be bribed or otherwise forced to skip proper review?
Any practical and secure design for a cellular phone has to assume the network is totally compromised and hostile. From this perspective, adding the radio chip and its software to that category is not actually a huge leap; it is the bare minimum in terms of secure hardware design. GrapheneOS is where the trust is placed, not the baseband, so its source code is more or less not relevant.
I'm pretty uncomfortable with how many smartphones I'd like to buy end up being Chinese owned companies. I wish Fairphone had a better camera, if it did, I'd just buy one of those and call it day.
Independence from the Chinese manufacturing hegemony probably means opting for a flagship Samsung, 11-series Pixel or pre-2025 Sony flagship.
Fairphone is marketed as being a sustainable device with good long term updates and an ethical supply chain. However, the updates are very poor from the beginning and get much worse over time. It isn't clear that the marketing about the supply chain is much more accurate.
What non Chinese manufacture are you looking at? I liked Xperia I for being made in Japan but it’s still Chinese components underneath and as you say there’s no control of all the code.
There’s always Bunnie’s Precursor phone if anyone is interested in commercially developing something reasonably secure and auditable.
At the same time, the state has its flaws and I'm questioning whether a top down system can ever really work, not out of some kind of "fuck the man" point of view, but more of an engineering and systems design perspective. If the system is perfectly factored, there are no cross-cutting concerns. But in such a system there is no need to communicate or coordinate laterally, only up and down. This sounds very lonely.
And if this system has a flaw, not a specific flaw, but rather a flaw in the assumption that tree structures with abstraction are a good way to organize systems, it might be impossible to change from let's say a tree with a single root to multiple interacting trees, with multiple roots of authority. Or maybe this is possible if people can learn to exist in multiple seemingly incompatible realities simultaneously?
I also think it's easy to underestimate your footprint when it comes to ecosystems that involve money in any capacity. No Amazon, Steam, no card information on a Netflix app, no signing in to Google to read a NYT article.
I think either you care about these things categorically or you don't, and I don't think anybody is going to be in the use case you seem to be envisioning, which is concerned enough about the risks to avoid all banking but still a casual enough attitude about a compromised phone that you're fine with it for uses you consider non-secure.
The major problem is banking, although some banks still work with Waydroid, and a few banks have full featured websites that work. But you do have to be more selective.
Is a browser on compromised hardware supposed to be more secure than an app? Amazon, steam etc still risk exposing accounts authorized to make payments using your money. It's easy to think "I just won't use banks" and underestimate the risks of doing anything on compromised hardware, and the answer isn't to play the "what could possibly go wrong" game, it's to not use compromised hardware.
Also when I use my phone to watch something in a focused way, that's a high quality HD screen filling my field of view even better than a theater. The audio isn't quite as good, but the overall experience beats most TV setups. So unless you dismiss Netflix as a whole, I think your notion of the phone experience is overly narrow.
From a latin american POV, it is same-ish as USA manufacturers, they're also tracking everything we do to sell us more unneeded stuff.
The difference is that chinese government is just trying to sell stuff, while USA government is trying to convert all the southern continent into a colony to impose governments and suck up minerals in the meantime. If you ask me if I trust more China or USA, at least China's intentions are clear and direct.
Of course, you people will always have the argument of "national interest" which for us (at least tech-literate people) that's no argument, but still you will find some bootlickers in the mobs.
If we're talking about national interest, it's easy to tell which countries espionage affects us the most.
I have friends who have travelled in the region and described it as a regular place, with muslims just existing there.
That part is assumed, and inevitably the "both can be bad" point is made which neutralizes the whole thing. Until the next thread where the process plays out again.
Are you sure the Chinese government is choosing not to pursue these $evil_intentions[] you ascribe to the US, or are they simply yet unable to?
Still, china are not the ones poisoning people criteria with AI ads and overtaking governments to sell entire countries to US funds.
Not talking about good or bad. I just say south people should defend south's national interest, which is not US interests as it has been demonstrated over the years.
Fascinating. The propaganda I've been fed is that China is the one hoovering up all the minerals so that they have control over the global supply chain for eg cobalt.
US strategy is to pick up a fool with good marketing, inject a lot of money, win an election and rig the law so no contest happens.
So long for the "competitive capitalism" they so much preach about. You know how your politicians work in the inside, what makes you think they are less abusive with people they have no concern about.
This is still much better than handing over control of the entire OS and native apps to Google. The problem with email is that even if you operate your own server, realistically most emails will be sent to Google, Microsoft or Apple.
At this point I might as well code a messaging app called the honest spy.
Honest spy emails transcripts of all your conversations straight to the law enforcement in your jurisdiction.
2. I know it's whataboutism, but from the perspective of a non-US consumer, it doesn't exactly make a difference which country exactly spies on me. I use a Chinese web browser because it covers all my use cases and I don't see a problem with that.