zlacker

Probably in the long run the only way to go will be to own/carry two devices. A long supported phone with stock firmware and apps you are "forced" to use to interface with the world around you, and a second Linux portable machine where you have your freedom.

>>jwrall+(OP)
You won’t be able to do much with the second. Web sites will force login with google, etc. and only work for attested browsers.

>>jwrall+(OP)
No, it's not "long supported" phone fallacy.

Google and by extension banks, are claiming that the phone on, Android 9, without security updates AT ALL since 2009 is perfectly safe and secure to use.

Meanwhile, really well locked OS, hardened so well some of the improvements were later picked up upstream (both by Google and Apple), running _the_ latest AOSP version and releasing new security updates within hours is not considered safe and secure, despite assuring full chain of trust (including locked bootloader, verified boot, etc).

This is what Play Integrity does.

Of course Android supports better scheme, hardware attestation, but od course Google enforces their iron grip on the ecosystem, and instead uses the outdated, flaved system that certifies only the devices with preinstalled Google services running in the privileged mode. Snooping on everything you do and have.

Thats the reason.

>>CalRob+j2
I don't use Google login any where and have a lot of accounts with many different websites? Youtube and other Goolag ecosystem being the exception, but, of course they are?

>>jwrall+(OP)
I've been doing this for years already, except I split it further to three devices:

1) an old iPhone with 0 personal data on it and in no way linked to my identity, which is used for completely untrustable commercial apps, and rarely even leaves the house.

2) a LineageOS Android which is my daily smartphone for things like camera and GPS, running almost exclusively open source apps, except for unavoidables like WhatsApp which are run in an separate profile

3) a GPD Micro PC running Void Linux, which is roughly the same size as the phone and a true swiss army knife. Its purpose is to reliably do what I want, when I want it. No systemd, for it does not spark joy. It is used for web browsing, note taking, light productivity, and playing movies on the TVs of friends who have overinvested in streaming and dongles only to find that $CHOSEN_MOVIE is not on any of their services.

I am not entirely happy with this state of affairs - too many devices, and still not enough siloing of closed apps like WhatsApp.

>>CalRob+j2
Both Apple and Google decided against implementing device attestation in browsers.

>>42522490

>>antonk+nd
for now*

>>antonk+nd
And Google decided against evil too

>>Unreac+D9
Give it a few years, the google login nag screens are getting pervasive. And old school user/pw login is dying

>>antonk+nd
Apple has been shipping device attestation in their browser for years (Private Access Tokens), with no backlash.

>>subscr+p7
When companies like Google talk about a device being "secure", they don't mean secure from malicious third parties, they mean secure from the user. The device is considered "secure" if the user cannot do anything with it that Google does not approve of.

>>dTal+Qb
Keeping all those devices charged is already too much of a hassle for me to do this.

>>dTal+Qb
It seems to me that they way you have divided up the roles, you actually need 4 devices, because you need one to run commercial apps which are linked to identity (which rules out device 1) and which will only run on a "secure" device (which rules out 2 and 3). For example banking apps.

>>subscr+p7
> Google and by extension banks, are claiming that the phone on, Android 9, without security updates AT ALL since 2009 is perfectly safe and secure to use.

Funnily enough that's actually a good thing in a twisted way. Long term, it will either force manufacturers to become much better with their update support, because apps will refuse to work on non-patched devices... or they won't and we'll all have one of those devices at home rooted through a long known CVE as a proxy for device attestation.

>>bakugo+on
That's it. It is a device secure for Google to:

* Enforce Hardware-DRM * Enforce PlayServices * Enforce apps which don't circumvent their business model e.g. YouTube-Downloaders ("Watch my ad again...") * Payment fees from PlayStore

Taking a look at the dangerous crap in the official Play Store confirms that. It is full of awful and dangerous apps. It was never about the security of the user.

>>jwrall+(OP)
This is what I expressed considering, in another recent thread. Phone does phone things and "necessary" apps. Otherwise, it's a hotspot for the "unhindered" device.

I'd enjoy suggestions as to suitable unhindered devices.

P.S. I just hope we can continue to access / create unhindered devices -- and programs/apps (cough Manifest v3 cough).

>>CalRob+th
> And old school user/pw login is dying

Is it though? Almost every new service has it, and all existing services keep offering it.

>>bakugo+on
This is my exact feeling. Louis Rossman talks so much about this (YouTube). I think the only secure device now is a dumb phone.

I am really learing to live life without the internet anymore. Between the lock in, the privacy risks, and just the hassle, it is easier to act like I am living back in the 1990's and just get used to the "inconvenience" of life without a smartphone. I can leave my smartphone in a faraday bag and just pull it out when I need it, or just wait to be in wifi. (I am homeless living in a minivan so this makes it much harder for me.)

I just do not know how much this will effect GrapheneOS or I would get a Pixel 9a. It seems like it will not, at least for the older phones.

At least we still have linux (for now).

But more and more computer technology is looking like a trap.

If anyone has any recommendations for a dumb phone that will work with AT&T please let me know.

>>Follow+wR
It's been a minute but Nokia was selling dumb phones. I would also just check what at&t sells for very cheap prepaid phones in a physical store - they could tell you what kinda hardware still works?

>>nemoma+lU
Thanks, Ill check these options out!

>>jwrall+(OP)
>> Probably in the long run the only way to go will be to own/carry two devices.

Been doing this for a while. I have a smaller Samsung S22 for the apps I absolutely need that won't run on my Graphene phone. The majority of my day-to-day stuff is handled on my older phone running Graphene.

Been tinkering with Ubuntu Touch, but AFAIK they haven't figured out how to solve the issues with VoLTE yet here in the US but its on my radar to try and make the switch soon.

>>Follow+wR
Look at Sony phones and Sailfish OS

>>antonk+nd
They'll both change their minds at the same politically-opportune time. They're not competitors.

>>dTal+Qb
Wow, that GPD Micro PC looks cool. How well does it perform?

I find void linux super lightweight, can get great battery life out of it on an old thinkpad.

>>bakugo+on
The irony is those are the same words Android users say about Apple & iOS.