[poll: vote now!1!!] 3G paranoia: Discussing solutions

[Granitehead]

 

[_wb_]

I think #4 is enough. If you're paranoid, just don't get the module at all. Being able to switch it off is essential (for power saving / airplane mode), but doing it in software is good enough and most convenient.

My laptop has an external hardware wifi switch and I accidentally switch it off all the time, it sucks. An internal switch is as cumbersome as taking out the SIM card. Just the software switch and the option to not have the module at all should be enough for everyone.

If you're really paranoid, you can never turn the thing on at all (after all, you cannot use it if you don't trust it / the OS), so it's better to not buy the module at all.

 

[Saber]

Interesting post but paranoid, this community, no not really more in the line of mildly concerned at least for the majority of people nesting here. Truth be said, there's always the bad element to protect oneself from out there though. My sister learned just this past weekend someone in Texas(she's NY based) "borrowed" her credit card number to make a purchase. Her number was one of the ones gleamed from the recent Target Retailer security hack.

A very minor concern I have though is with all the holes in Windows and possibly Mac, how secure is using a Debian based handheld PC? As secure as anything else someone will say and I'm sure if someone intrepid wanted in to see my bank account browser login history or whatever, they could quite easily, but how about a less seasoned malefactor? Probably a question that has been answered somewhere already but it's a question I thought I'd throw out there for some who don't know and were curious.

Trimmed post down a bit. Thanks for the info below guys.

 

[_wb_]

GNU/Linux is a few orders of magnitude more secure than Windows. For social engineering exploits (phishing etc) or in case the device gets accessed/stolen physically, the OS security does not matter that much though.

 

[Granitehead]

@Saber: I don't mean "paranoid" in a pejorative way, to make this clear. I consider myself to be quite paranoid.

But what I think is important is a healthy mixture. If it costs me nothing (time, money, anything) then I'm paranoid as hell. But as soon as there is a drawback to being paranoid (and there mostly is) I start compromising.

Edit: But, Saber, please trim down your quote some more, it's too large. ;-)

So, could people in favour of #1 please bring forward their arguments, or have I already convinced them to change their mind?

 

[comradekingu]

Trusting the OS to not be compromised isnt the same as lowering the extent of how potentially bad that could be.

My thoughts are the while a 3g modem at the very least is something not particularly anonymizing to begin with, some tradoffs have to be made.

It is probably true that the great bulk people to care alot for their anonymity wont go the 3g route.

For whoever else, we could make things as smooth as possible.

To be able to set a software controlled LED is nice, also, it doesnt mess with the people who would be really upset not to be able to user control their leds in all settings, of which there are many, and none are exluded

by aforementioned clause.

I justify this by saying if your OS is compromized enough to send out stuff on the 3g, and turn it on to begin with, the attack vector that requires one to also shut off power led and activity led is not feasible in a real world scenario then you are too late if you can only see it happening.

Leds for activity and power is mostly a feature thats convenient for peace of mind in powersaving.

 

[Granitehead]

Trusting the OS to not be compromised isnt the same as lowering the extent of how potentially bad that could be.

I think what you intend to say is this: We should assume the OS is bad and then try to minimize consequences.
Well, yes.

But lets assume the OS is bad.

#1 alone: The OS can't track you all the time, but it can while you turn on the module. It can also save data to send out as soon as that LED is on anyway. It can collect the WiFi network names to send out at that time to try and find out where you went in the meantime. If you are in a rural area that's probably enough to track you quite well. The OS can send out any password or other sensitive data it wants while you use 3G or GPS anyway. Conclusion: You are fucked. Don't just rip out the 3G+GPS module but throw away your Pyra and go live as an eremite.

#2 alone: Compared to #1 the OS has the freedom to track you more easily and send out sensitive data immediately instead of a few hours/minutes/days later. This is worse than #1 if you are actively physically fleeing from the police/military/rich person/company who searches for you to kill you, granted. But I don't think there are a lot of more probable cases where it's much worse than #1. Same conclusion.

#3 alone: Better than #1, but as soon as you turn it on, it can again do anything it wants. Same conclusion as #1 and #2 (because of other factors than 3G too).

#4 alone: OS can do everything. Conclusion: The usual.

Overall conclusion: Assuming the OS is bad: Go live as an eremite or live with it. You can do nothing about it.

 

[Caine]

#3 alone: Better than #1, but as soon as you turn it on, it can again do anything it wants. Same conclusion as #1 and #2 (because of other factors than 3G too).

If we also have a hardware kill-switch for the WiFi then solution #3 will prevent the device from collecting tracking data about you as you go.Sure it can whenever you enable WiFi/3G, but that is a "risk" one has to take when enabling these.

If such a risk is unacceptable, people should simply not get the optional module.

#1 might give some information about tracking features implemented in the hardware itself.

 

[Granitehead]

#3 alone: Better than #1, but as soon as you turn it on, it can again do anything it wants. Same conclusion as #1 and #2 (because of other factors than 3G too).

If we also have a hardware kill-switch for the WiFi then solution #3 will prevent the device from collecting tracking data about you as you go.Sure it can whenever you enable WiFi/3G, but that is a "risk" one has to take when enabling these.

True if we also have a hardware WiFi kill switch. I'll go edit the first post to add this to make it clear.

#1 might give some information about tracking features implemented in the hardware itself.

#2 also, but better.

 

[Caine]

#2 also, but better.

Yes, good point.

 

[Saber]

I think WizardStan put it best in the embedded thread when he said the following: 

that would be a bit annoying, don't you think?

That's why we thought of an indicator in case the module is powered up instead of a killswitch.

This is a major concern for the people requesting it. They are legitimately worried about their game console being used to track them. If it sits in their pocket or backpack or wherever 90% of the day where they cannot see the indicator light then that's 90% of the day where they can be tracked without their knowledge. These people are used to going to extremes to protect themselves. Someone a couple pages back suggested going as far as physically cutting the traces, actually breaking the thing to prevent it from transmitting, and then resoldering it when they wanted to use it.
A switch behind the battery may be a bit annoying, but compared to the extreme measures I've seen some people go through to try and hide themselves it's nothing.

A small three-way switch under the battery not easily accessible feels like the best option. By three-way I mean left position is hardware kill Wifi, middle is kill mobile, and right is obliterate both. Would only need to add complexity to the case plastics in one spot. Maybe they could do it this way for the cautious types. :mellow:

 

[hns]

Some notes on how power control of the module is working:

* the module has an internal FET power switch (to be controlled by an "ignite" GPIO and can be switched off by an AT command). This is required anyways.

* there is a "power on indicator" output that is connected to a GPIO input (to get reliable rfkill status even over power cycles or forced resetting the CPU). This comes for free (just a wire + software).

* we can add a series resistor and measure the voltage drop and convert that into a LED signal - this is the external power monitor. The level where the LED turns on should be ca. 30 mA. This adds some cost.

* a mechanical switch is critical - it must be reliable enough to carry 2-3 Amperes peak current (GSM pulses) if switched on. A good switch adds cost and needs space in the case.

An external electronic FET switch can be used instead. Adds some cost.

* there is also Airplane Mode in which the module does not send anything, although powered on. I assume that this is part of the FCC/FAA certification procedures which include firmware inspection. But this of course assumes a non-compromised firmware.

One thing has not yet been considered at all: if the LED should glow as soon as the module is in operation, it will reduce the standby time (module just listening for incoming calls and SMS, everything else in suspend). This is why I suggest the 30 mA level - but I don't know if that does make the LED indicator useless.

So the more I think about it: if someone does not trust the whole system (including component makers and certification authorities) to some level (you should encrypt your communication data anyways) - leave out the module. And use an external one through USB.

 

[Granitehead]

@, can you confirm some stuff?

1. The external power monitor you describe would be trivial to hook up to the SoC instead of an LED. In that case you could set an extremely low trigger current.

2. An external electronic FET switch is cheaper than a mechanical switch.

Would it be possible to have something like jumpers which you can disconnect?

 

[Saber]

So the more I think about it: if someone does not trust the whole system (including component makers and certification authorities) to some level (you should encrypt your communication data anyways) - leave out the module. And use an external one through USB.

Thank you for the post gta04, but I think they're all aware of the USB pathway though. For some, a tiny toggle switch, a status LED, or both were sought as preventative alternatives to ease valid concerns with the deficiencies in the "system". I guess if the added costs you implied are so exorbitant on an already(for some) luxury pricetagged device, then it's a sensible move on your part.

 

[hns]

@, can you confirm some stuff?

1. The external power monitor you describe would be trivial to hook up to the SoC instead of an LED. In that case you could set an extremely low trigger current.

Yes and no.I have not yet checked how sensitive we can make such a circuit. The issue is that the module needs a connection as short and as low resistance as possible to the battery.

Therefore we need a series resistor that should not have a too high voltage drop (which deteriorates GSM transmission operation). So I would say that we don't want to have more than 0.1V @ 3 A because we risk transmitter malfunctions if the battery is almost discharged but not completely empty.

This means a 33 mOhm resistor with 300 mW max. power dissipation (which is quite a lot - but we are talking about the max. during transmission which drains much more power to get out radio waves).

Now if we want to have it switch on at >3 mA this is 0.1% of the maximum level meaning we want to detect 100uV reliably. If we want to detect 1 mA we need 33uV. Quite a high precision.

We must avoid to have noise on the signal so that there are no false alarms. This might make it not as inexpensive as all hope.

2. An external electronic FET switch is cheaper than a mechanical switch.

Most likeley yes, but I have not yet checked for a specific cheap FET that can carry 3A and has less than the 30 mOhms, but they exist.

Would it be possible to have something like jumpers which you can disconnect?

Standard jumpers are big.
Well, we could add a 0 Ohms resistor between module and battery that can be easily desoldered (dimensions 0805 or 1206). And (EDIT: anyone can) place some mechanical switch or jumper on it and cut a hole in the case.

 

[WizardStan]

Wow. I had no idea it needed that much power. I understand that as just spikes, but those are huge spikes. And to be that sensitive to voltage... I'm afraid and impressed.

 

[comradekingu]

I suppose if you really want to make sure, without having the cost additions or the hassle of doing it yourself, remove the battery.

 

[ZetaNeta]

#5: Short it

Spoiler

Pro #1: Free! Its free!

Pro #2: Most secure solution ever.

Pro #3: You can use it for about ANY function in the Pyra. Wifi, Led, BT, LCD... you name it!

Pro #4: Backwards compatible to OpenPandora

Pro #5: Proper implementation saves the battery.

Pro #6: Takes up almost no space!

Con #1: Unless the contacts are available from outside, you need to take the console apart.

Con #2: F*cked if all we got is BGAs soldered around and not a single contact.

Con #3: Shorting the power on the 3G may burn the rest... but that never happened on any device i been "shorting" unneeded functionality out from.

Con #4: Choose: Soldering iron and a wire or a chewing gum with a paperclip?

Please add me to the main post.

 

[Granitehead]

You are aware the 3G module is an optional feature people pay like $100 extra for?

 

[Saber]

You are aware the 3G module is an optional feature people pay like $100 extra for?

Wonder if something else could be put in it's place on the board in the non-UMTS version. Seems like a waste of space otherwise.