Project

General

Profile

OT: question about privacy

Added by Alexander Ofen over 5 years ago

I feel bad posting this question, because of it being slightly off topic and it
is not my intention to anger you. I like the replicant project and I have been
happy to read the information about security and privacy here
http://www.replicant.us/freedom-privacy-security-issues.php

The person(s) that wrote this information surely is quite educated and aware
and I hope that I can ask something that is related to the information.

If I understand correctly often neglected elements that should be better open/free
are the hardware , the modem GSM, the firmware , bootrom, not only the operation system.
Also I think one big point was this:

Modem/GSM etc should always be best separated from the system, because if
the modem/GSM part can "attack" the rest of the system, even when open source and
free is prone to attack.

Now the question/topic here I want to ask is this Raspberry Pi (a somehow opensource minded device)
project for a cellphone http://www.davidhunt.ie/piphone-a-raspberry-pi-based-smartphone/
I wonder how I could find out if the modem/GSM used in that project is separated from
the OS in that case (even though the OS is not necessarily replicant).

I would beg you to accept or tolerate this slight OT which is not so much OT
as it should show that I trust and appreciate the expertise of the replicant community
to be aware of the general concept of cell-phones, beyond only those things related
directly with a replicant running device.

A reason to ask this is also that getting some free hardware is a very hard thing.
There seems to be only Samsung galaxy.... and I am yet not convinced but would
rather like a piphone DIY phone if possible.


Replies (3)

RE: OT: question about privacy - Added by Paul Kocialkowski over 5 years ago

I feel bad posting this question, because of it being slightly off topic and it is not my intention to anger you.

Well your query is not at all off topic, we are happy to address concerns about privacy/security as well as freedom in general. Replicant is, after all, just one way among other to achieve a broader goal.

I like the replicant project and I have been happy to read the information about security and privacy here http://www.replicant.us/freedom-privacy-security-issues.php

I am happy that you found that of interest. The very purpose of this was to give a concise yet complete overview of the current issues we are facing. It felt more useful to write such an article than the give bits and pieces of this during discussions.

The person(s) that wrote this information surely is quite educated and aware and I hope that I can ask something that is related to the information.

You are very much welcome to do so!

If I understand correctly often neglected elements that should be better open/free are the hardware , the modem GSM, the firmware , bootrom, not only the operation system. Also I think one big point was this:
Modem/GSM etc should always be best separated from the system, because if the modem/GSM part can "attack" the rest of the system, even when open source and free is prone to attack.

That's correct. Assuming that the Modem is still running a proprietary operating system (which it is now).

Now the question/topic here I want to ask is this Raspberry Pi (a somehow opensource minded device) project for a cellphone http://www.davidhunt.ie/piphone-a-raspberry-pi-based-smartphone/

Well the Raspberry Pi is not at all a good fit for free software. Despite the fact that documentation and source was released, it still requires proprietary software to boot up and the main CPU is controlled by the VideoCore, which is still running proprietary software. The situation is far from ideal, but all those proprietary bits could be replaced by free code at some point, now that documentation is out.

I wonder how I could find out if the modem/GSM used in that project is separated from the OS in that case (even though the OS is not necessarily replicant).

It depends how things are wired together, but since the modem is not embedded in the SoC, it is likely going to have good modem isolation. The best is probably an USB or serial link between the modem and the rest of the board.
Nevertheless, the Raspberry Pi is not an ideal platform at all regarding freedom (and thus fails at privacy/security).

I would beg you to accept or tolerate this slight OT which is not so much OT as it should show that I trust and appreciate the expertise of the replicant community to be aware of the general concept of cell-phones, beyond only those things related directly with a replicant running device.

Sure, that's what we're trying to do as well. I'll open a research section on our wiki at some point, to list freedom-related information about non-Replicant-related mobile devices.

A reason to ask this is also that getting some free hardware is a very hard thing. There seems to be only Samsung galaxy....

The Samsung Galaxy devices are flawed as they don't allow to run a free bootloader. However, many of them were not proven to have bad modem isolation (see http://www.replicant.us/freedom-privacy-security-issues.php#recommendations).

and I am yet not convinced but would rather like a piphone DIY phone if possible.

There is the GTA04 which comes with very little freedom issues. I found a few other devices that are about as good. Stay tuned as I'll publish more about that soon.

RE: OT: question about privacy - Added by Alexander Ofen over 5 years ago

Very many thanks for the helpful and informative and nice reply to my questions about privacy/security.

I have been indeed under the missconception that raspberry was already much further ahead in terms of opensource
freedom. I will need to look further into this, as it is interesting if the documentation mentioned will enable
to free the device which then would make it surely more ideal to serve as a basis for a mobile-net-linked device.

The point I asked about the modem separation was also very nicely addressed. Thank you very much.
I thanks also for the GTA04 hint which seems to me to be a prefered option yet an unavailable one. But maybe
I just missinterpreted and it is not sold out/ unavailable.

Thank you thank you.
The idea to have more sections/resources related to privacy models would be super!

RE: OT: question about privacy - Added by Paul Kocialkowski over 5 years ago

I thanks also for the GTA04 hint which seems to me to be a prefered option yet an unavailable one. But maybe I just missinterpreted and it is not sold out/ unavailable.

Well, the problem is that it is produced by a small German company and there are not so many orders. As you can guess, producing hardware on such small quantities costs a lot of money, so the devices are very expensive and only produced in batches. The next batch requires more orders than currently placed to be produced. You can grab more information about that at: http://shop.goldelico.com/wiki.php?page=GTA04A5

Replicant is not yet fully ready for the GTA04, but we are working on it. There are also some power management issues (the kernel is not optimized and suspend/resume is somewhat broken for some peripherals), but nothing an external battery cannot overcome.

    (1-3/3)