Is it still safe to use as long as apps continue to be updated and is supported by the play store?
How long would you say someone could safely use an Android phone that no longer gets security updates for?
deleted by creator
Every phone has potential unknown vulnerability. The problem is if there are no security updates, they become a security issue when discovered as they won’t be fixed.
Vulnerabilities in current gen phone getting updates exist too. They only get patched when the manufacturer or Google know about them.
The flip side is it’s probably had all the most obvious flaws patched already. Newer phones may not, yet. So be cautious is always a good idea.
Removed by mod
How is uptodown a trusted source?
Removed by mod
To expand on this, most vulnerabilities that require the vendor to actually participate by providing security updates are specific to your hardware configuration. These kinds of vulnerabilities are less attractive to most attackers because of their specificity. Attackers would much prefer to have a vulnerability that applies to many different victims, not just a specific kind. Android has gone to great lengths to update these commonly targeted components regardless of your vendor support status. Unless you believe you would be specifically targeted, the risk is fairly low.
I’m not sure it’s fair to put iPhone down. They do take security very seriously, especially physical security with their formally verified bootloader. Not seeking a flame war. I just didn’t think it was accurate. Are we so sure they don’t have individuals focused on iPhone security at Apple? Compromised devices impact their brand image while the same bugs can be used for jailbreaking. I’m sure it’s very important. I interviewed with a team up there that I believe specialized in just that. Just recently Apple implemented an emergency security patching system for their devices to get security updates out even faster.
Full disclaimer: I use both devices for software development. I have no special preference.
Removed by mod
Removed by mod
Phew. Good thing I’m not actually a machine!
That’s what all machines say
But like, didn’t you reply to it?
That interaction was more like:
“Hey, Bob, where’s the bathroom?”
“As your toaster, I can answer the question you asked Bob. The bathroom is-”
“WHO THE FUCK ASKED YOU?!”
Uh, well… uhhhhhh… oh I’ve got it: I didn’t write the text of the meme so I didn’t speak to it, I memed at it. Q.E.D.
Plot twist: jimmycrackcrack@lemmy.ml is a robot.
I like real Australians better. Bad “bot”, bad!
“Your” phone belongs to some overseas crime ring and they’re letting you borrow it. That’s how insecure it is.
Doesn’t even matter if you install apps or not. Plenty of RCE vulnerabilities crop up that require zero user intervention to exploit.
True that many potential RCEs are found, but I think there are a few points to keep in mind.
- RCE classification is often conservatively assumed when it is theoretically possible even if it is not been demonstrated. Android bulletins appear to assume any memory corruption could be an RCE.
- Remote code is no longer sufficient for privileged control. Next, you have to use it to break out of a restrictive sandbox for whatever service or application you have compromised.
Plenty of RCEs are in privileged components, like the operating system or the baseband firmware.
And yes, it is correct to assume that any attacker-controlled memory corruption is likely an RCE vulnerability.
The baseband firmware is not so privileged anymore. Most new phones, like the Google Pixel 7, have IOMMU to force the baseband to communicate through a very restricted interface to the kernel. Certainly, you can interfere with texts and calls, but a baseband RCE doesn’t yet compromise the data stored on the phone by itself–not to diminish the seriousness or to suggest that we shouldn’t patch such an exploit immediately.
RCE, the “remote” aspect, in the operating system? So directly in the kernel and accessible remotely, such as through the networking code? I’m curious now. Most of the ones I’ve seen are in some other component that is sandboxed. True system-level privilege RCEs seem to be relatively rare. Usually, you get RCE, then you need privilege escalation to do something especially interesting.
Indeed; I’m sometimes able to leverage even a few bits of memory corruption into execution in many cases, though the hardened allocator in Android makes this a serious PITA to arrange to overwrite something useful.
I’m really stubborn about updating my devices and it’ll perhaps bite me in the ass one day but so far it haven’t. My phone has been trying to force the Android 13 update on me for 6 months now and my laptop I’m not going to update any further from MacOS Catalina even though there have been several updates after that.
Why? I don’t fix stuff that’s not broken.
But it is broken, old software is usually riddled with security vulnerabilities
Yeah. That’s why I said it’ll might bite me in the ass one day.
Other than that it all works just fine so I don’t want for fuck with it. My experience with software updates is that they always break something and slow down my devices.
It has already bitten you in the ass. You just don’t realize it yet.
Not updating desktop OS seems pretty crazy to me. Is the reason because it might break some applications you use?
It will break some applications and I don’t like the UI on the new MacOS.
I’ve always used old devices that you often even can’t get updates for so this has always been the norm for me. I know it’s not the smartest thing to do but my great luck has brought me this far so lets see how long it’ll last.
Sounds like Linux might be way. Last OS that a lot of my devices ended up getting have been Linux with how well they run once the majors OS start upping the system requirements.
My next laptop is probably going to be the Framework one so Linux definitely is an option. I’m interested in it but seems a bit tricky to deal with so we’ll see.
Not if but when it bites you, it likely will not be pretty.
You’re rejecting dozens of not hundreds of ways to avoid having bad things happen, just a couple examples being having your identity stolen or losing data. These risks already exist no matter what you do, but they are several times more likely with every few months that you go without security updates.
Besides that, you will eventually be forced to update, either because your device dies and has to be replaced or because of something like software you require refuses to run on your 8 year old OS. When you get that new OS, the jarring effect will be much worse than if you just allowed your devices to evolve as designed. Updates are not a bug, they are an extremely valuable feature.
Your reasoning that it ain’t broke so you don’t fix it leads me to believe you have never written software. All software is inherently broken. Products under development for 30 years still have flaws so fundamental it’s hard to even imagine. I say all of this as someone who has had his hard drive wiped accidentally by software bugs, had email and other accounts randomly hacked, and personally worked with broken ass software from the world leading giants. And as a software developer I can say for sure: all software, no exceptions, is barely working. No matter how solid it it seems, some random weird edge case can cause complete failure
Update your shit. It’s not even that often that stuff breaks in (non Windows at least) OS updates these days
Pirated software breaks almost every time I update.
