CVE-2021-1048 Critical Zero-Day exploit. Patches available from Google

OK. Fair enough.

But we also need to raise awareness of this issue. These are very serious vulnerabilities which are being exploited in the wild, and for which there is a patch. Fairphone users like yourself need to understand that we need this patch today, and that it’s a problem that we don’t have it yet.

If I’m the only one to report this, it stands a lower chance of being prioritized.

2 Likes

Sure you can share here, however as I think already stated above, most people (including myself) don’t care, as most people don’t no any instance where one was hacked and don’t see a real danger

1 Like

image

Well, contacting support seems to have a little issue now.

1 Like

Things that happen…:wink:

You can email direct support@fairphone|dot|com.

I am at pains to add that like previously said not many people have a bad experience, well none that I know.

It will be interesting to know what Fairphone have to say :slight_smile:

1 Like

I’m not sure how to respond to this.

I think maybe you’ve identified the biggest problem we have in cybersecurity.

Did you know that some people use the same password everywhere, for example?

3 Likes

Real attackers go to great pains to be stealthy and to avoid giving you a “bad experience”, at least until they are ready to cash in.

2 Likes

Should have said ‘any experience’ that’s not to say they won’t given how slack most of my acquaintances are regarding not just passwords but providing real detail like DoB, Mother maiden name, favourite, colour, pet, holiday etc.

I always make up stuff for each access hence I have an encrypted file with up to a hundred weird values.

My last job and or my mother was sometimes a beggar sometimes an astronaut:

I have my work email on it.

Right now, in another window I’m reviewing a document on corporate mobile device policy for my boss and for the colleague who wrote it. The boss (CISO) is calling for Android Enterprise as a minimum, even for BSOD use.

So, unless Fairphone can roll these updates out more quickly there’s no chance of receiving the Android Enterprise sign-off, and I will have to get a different phone for at least work email, etc.

Now, I know that loads of people carry around two different phones for this reason, but doesn’t that run counter to the idea of a sustainable mobile device? To my mind, sustainability should be something I can have in both professional and private spheres.

Better, I should be able to make a recommendation for the organization to buy a fleet of Fariphones because Fairphone is aligned with our sustainable development goals. But not only can I not make that recommendation, but worse, my FF3 is about to be banned from work use.

1 Like

Seems to be an ongoing concern

Then why dont you install an OS which is alligne with thos things? There is more then one to use on the fairphone

:rofl: I take it you meant BYOD.

Anyway, good luck arguing with ignorant(/stupid) :slight_smile: its probably best not to waste your time on such.

BYOD or not is a company policy. I am not self employed, so if my boss says I am not allowed BYOD its tough luck, and it goes that way for a lot of people. On top of that, having your work and personal device separated yields some advantages (and some disadvantages).

With regards to quick updates, FP2 was good with that with LineageOS. Fairphone was often among the quickest to apply security updates. At the end of FP2 it fell a bit (but nothing dramatic yet). FP3 is outsoured to Arima, and its no longer as quick with security updates, but you should have a look at how slow Samsung (the market leader on Android) is. I think if you want the quickest updates, its best to apply firmware updates manually and use a custom OS like LineageOS or /e/ or use an other device such as Pixel with GrapheneOS.

Please don’t be rude to the majority that work in the mines, the factories and are the bulk buyers of the technology you want to exploit. :cry:

If someone doesn’t have your specific knowledge are they really stupid? Maybe ignorant of your peculiarity but I imagine everyone can point the finger. :slight_smile:

1 Like

Gee what a surprise its you who’s quoting that particular sentence. Did you notice I wasn’t talking to you? Did you notice I put stupid behind brackets? Now, if you want to know: the problem is lacking knowledge about the subjects and sounding certain of your own PoV with anecdotal evidence such as “I don’t know anyone who’s impacted” [1] which you previously said elsewhere as well. Of course you don’t; if you don’t know how shit smells you’re not gonna observe it.

[1] “I am at pains to add that like previously said not many people have a bad experience, well none that I know.”

With regards to [2]

[2] “most people (including myself) don’t care, as most people don’t no any instance where one was hacked and don’t see a real danger”

is flat out ignorance, and as the saying goes, ignorance is bliss. Why is it ignorance? It lacks any kind of imagination or knowledge of real-world threats.

You want examples? OK, I’ll give two:

  • Sextortion (and other cases where very private data got leaked; a known case involving celebrities is called “The Fappening”)
  • Implants (for example in journalists iPhone’s, but also which involved advanced techniques to avoid detection)

Now, maybe you’re gonna reply: “I don’t know anyone who’s affected by (for example) sextortion”. Maybe you don’t. I do know someone who got an implant on Windows back around ~2004, it was sheer coincidence she found it out because it was malfunctioning, so what must I conclude from this? OTOH, I don’t personally know anyone who’s bike got stolen in Amsterdam. But it sure as hell happens all the time. The key point is: lack of evidence does not equal evidence of the contrary.

1 Like

Yeah, I don’t know why I type S intead of Y.

1 Like

My team is tasked with writing one, so go figure.

I wish. However my boss is quick to point out (rightly) that we can’t make one set of rules for those of us who are ready to take our security into our own hands, and the general population of medical doctors and other professionals who are too busy to learn how to install Lineage OS.

2 Likes

I don’t think @anon9989719 was the one making anti-security arguments. Let’s be nice, please.

1 Like

I’d love to. See above.

1 Like

You roll it out for them, just like a device with MDM is rolled out before them.

Usually a few people are exempt from the main strict policy (for whatever reason). I get you can’t do that for the general users. I did provide an alternative: GrapheneOS on Pixel devices. You get the benefit of being privacy minded, and also quick security fixes. Its available as we speak.

You could wait for FP4 to take off, but nobody knows how its gonna be. However, I hope and expect it to be akin to FP2 in the hay-days because like with FP2, Fairphone do the software development in-house instead of third party (via Arima with FP3).

Yes they did, I quoted them in that post with [1] and [2] (a quote by another person).

So although security is an issue to some degree for just about everyone it’s not the same and I am interested and so follow the topic.

Sure I don’t understand very much of it but calling me or anyone else stupid etc. is well off topic as I see it and provocative.

So are you really surprise it was me that took issue with your dispersions or more that no one else can be bothered.

You are clearly upset not just about security but ~ well I just don’t know and then to add

do you really want to be ignored ???

Given security is a personal issue I see no reason not to comment on how I am effected by it and it would be reasonable for anyone reading my experience to know it isn’t everyone else’s without you calling me ~ whatever you have at your disposal.