<story><title>Our Cellphones Aren&apos;t Safe</title><url>https://www.nytimes.com/2018/12/26/opinion/cellphones-security-spying.html</url></story><parent_chain></parent_chain><comment><author>tptacek</author><text>Counterpoint:&lt;p&gt;In the history of the industry no mass-market computing platform has been safer than the flagship hardware&amp;#x2F;software platforms from Apple and Google --- on no platform does an exploitable vulnerability cost more to obtain, and no platforms have ever been more capable of establishing secure channels between themselves.&lt;p&gt;SS7 is insecure. But operational practices at both the carriers and inside governments rely on those insecurities to get jobs done, and some of those jobs are important and enjoy wide support. Anything we do to shore up the security of SS7 will, almost necessarily, include compromises most of us here will find hateful, and we&amp;#x27;ll be stuck with those compromises for another generation.&lt;p&gt;Rather than &amp;quot;fixing the potholes&amp;quot; in GSM and SS7, we could instead accept that the cell signaling layer is insecure, and route around those weaknesses with application code that can establish end-to-end secure channels accountable only to their users. That&amp;#x27;s pretty close to what Apple has already done with SMS text messaging, which opportunistically upgrades to Apple&amp;#x27;s secure iMessage protocol. We can do even better than that!&lt;p&gt;That&amp;#x27;s what we&amp;#x27;ve done with the Internet, where this approach is called &amp;quot;the end to end argument in system design&amp;quot;. It worked there and will work just as well for telephony.</text></comment>
<story><title>Our Cellphones Aren&apos;t Safe</title><url>https://www.nytimes.com/2018/12/26/opinion/cellphones-security-spying.html</url></story><parent_chain></parent_chain><comment><author>bvinc</author><text>I&amp;#x27;ve always wondered this.  When encryption algorithms are broken, we phase them out for new ones.  When cell tower protocols have weak encryption we don&amp;#x27;t seem to do anything about it.  I hear that edge and 2g protocols are completely unsafe but there&amp;#x27;s not even an option in my phone to disable them.  What gives?</text></comment>