open letter about the universal right to install any software on any device

[MGlitch]

Originally Posted by haertig

Bad guys aren't necessarily discouraged from doing something just because it is pointless or provides no benefit to them. It's called vandalism. Some people enjoy being cruel and mean.

Bad guys aren't discouraged by laws, we still have them, they aren't necessarily discouraged by security systems, we still use them. And on, and on. Generally speaking basing decisions on the motivations of those who just enjoy being cruel and mean is seldom wise.

[haertig]

Originally Posted by meeera

Can knowing the serial number allow the owner to trace and lock the phone?

The serial number would be assigned by the phone manufacturer - Motorola, Samsung, Apple, etc. - when they build the device. This serial number is not used for call routing. It is used for warranty work and stuff like that.

I think you would probably need the ICCID number of the SIM card to do what you're talking about. This number uniquely identifies the phone on the cellular network. It is used when routing calls to the phone. The ICCID number stays with the SIM card, not with the phone, if the two are separated. Your cellular service provider registers this ICCID number on their network when they activate your phone.

[haertig]

Originally Posted by MGlitch

Bad guys aren't discouraged by laws, we still have them, they aren't necessarily discouraged by security systems, we still use them. And on, and on.

This is true. And it's a good reason to allow people to enable these things if they want (or even make them the default). But it is not a good reason to force everyone to use them and not allow them to be disabled. The choice should be the users, not forced on them by the manufacturer.

Here's a hypothetical and extreme example, for effect. Say a manufacturer wants to make your car more secure by requiring you to enter a code, do a retinal scan, and respond to a two factor authentication to open your car door. This would seem quite secure, and some customers would be tickled pink to have their car protected so well. But other customers might say "Couldn't the criminal just throw a rock through the window and get in that way?" And then decide to disable the excessive security features. I admit, the retinal scan would be more secure. A little. In some circumstances. But I wouldn't want it. It's not for everybody. So let the user choose to enable or disable, not the manufacturer.

The same thing goes for letting users choose to install other software on the devices they bought or not. Manufacturers should not mandate "no you can't!" for everyone.

[tomsem]

Man. Just get a Raspberry Pi.

[meeera]

Originally Posted by haertig

The serial number would be assigned by the phone manufacturer - Motorola, Samsung, Apple, etc. - when they build the device. This serial number is not used for call routing. It is used for warranty work and stuff like that.

I think you would probably need the ICCID number of the SIM card to do what you're talking about. This number uniquely identifies the phone on the cellular network. It is used when routing calls to the phone. The ICCID number stays with the SIM card, not with the phone, if the two are separated. Your cellular service provider registers this ICCID number on their network when they activate your phone.

Right, so all the thief has to do is pop out the SIM.

[meeera]

Originally Posted by haertig

The same thing goes for letting users choose to install other software on the devices they bought or not. Manufacturers should not mandate "no you can't!" for everyone.

How would the user go about installing software that completely prevents anyone else from taking and using their device? People above has said that if the letter of this was followed, that would not be possible.

[Quoth]

Originally Posted by meeera

How would the user go about installing software that completely prevents anyone else from taking and using their device? People above has said that if the letter of this was followed, that would not be possible.

It's possible to have the unique ID not over-writeable. Of thousands of different devices it really only applies to phones and already even if new firmware can't be installed there are ways to change or mask the IMEI now.

CPUs, RAM, Flash and some other devices have have "fuse" based write-once storage for a unique security number to prove source and owner, thus read only. It's very old technology.

Some devices the issue is not your own firmware (tractors, iPhone printers), but makers deliberately preventing 3rd party repairs or consumables.

Some devices need partitioning and may already have more than one CPU and firmware. The modem part of a cable modem+router+WiFi+switch should not be able to be loaded with new firmware.

Some systems might have issues with safety or pollution if users could change the firmware (tumble driers, cookers, vehicle engine management).

It's more complex than the letter suggests. I'm in favour of systems being as open as appropriate, 3rd party repairs and 3rd party consumables. Apple, Archos, Amazon, HP, John Deere are examples of overly locked down consumer gadgets and products. Kobo, Brother, non-Apple Laptops are examples of more open ones.

There is no simple one-size-fits-all solution for every class of product.

[meeera]

Originally Posted by Quoth

CPUs, RAM, Flash and some other devices have have "fuse" based write-once storage for a unique security number to prove source and owner, thus read only. It's very old technology..

To clarify again, I'm not talking about just proving source and owner. I'm talking about the rightful owner being able to remotely lock and track the phone.

[haertig]

Originally Posted by meeera

To clarify again, I'm not talking about just proving source and owner. I'm talking about the rightful owner being able to remotely lock and track the phone.

Which also means that NON rightful owners can potentially remotely lock and track the phone. Hackers are very good at what they do. But that's neither here nor there.

Say both you and I have Amazon Fire tablets. You want yours to be locked down tight so if someone steals it then it will be non-function for them. Turn it into a brick.

But I want to remove Amazon's FireOS from mine and install standard Android instead. I am not concerned about theft because I only use it at home or in secure locations, and it only cost $49 on sale anyway.

We both bought and paid for our tablets. But only one of us is allowed to use the device in the way we want to.

[Leseratte_10]

If the rightful owner has a way to remotely lock (brick) a phone, so does the manufacturer and/or the government by instructing the manufacturer.

I'm fine with the owner being able to remotely track or wipe the phone. I'm not fine with a phone permanently getting locked.

[Quoth]

Originally Posted by meeera

To clarify again, I'm not talking about just proving source and owner. I'm talking about the rightful owner being able to remotely lock and track the phone.

If the rightful owner can do that, so can others. I always disable such features because they have opaque security; they could be misused. The worst cars on the market for security are ones with apps. A wireless keyfob is more secure but less secure than a mechnical only lock. Even ones with only a few feet range can be relayed over a wireless or internet link now.

In reality open source, being able to install your own software and security can be three unrelated things.

[DiapDealer]

Originally Posted by haertig

We both bought and paid for our tablets. But only one of us is allowed to use the device in the way we want to.

Why would anyone spend money on a tablet before finding out if they could actually use the device the way they want to? Caveat Emptor very much applies.

[haertig]

Originally Posted by DiapDealer

Why would anyone spend money on a tablet before finding out if they could actually use the device the way they want to? Caveat Emptor very much applies.

That was simply a hypothetical example used to make the point that a device may be used differently by different users. One persons choice/preference may not be the same as the other persons choice/preference. It wasn't a debate about the pluses/minuses of a Fire tablet.

[DiapDealer]

Originally Posted by haertig

That was simply a hypothetical example used to make the point that a device may be used differently by different users. One persons choice/preference may not be the same as the other persons choice/preference. It wasn't a debate about the pluses/minuses of a Fire tablet.

I understand that. I wasn't looking to debate the plusses/minuses of Fire tablets either. It just didn't seem like a very good hypothetical to me (RE the discussion at hand). The fact that a device is unsuitable for someone's use case while being perfectly usable for another's is pre-buy discovery to be made, not a post-buy discovery. As I said; caveat emptor still very much applies. Someone who has the wherewithal to replace a device's OS also has the wherewithal to find out which device they need to buy so they CAN replace it.

It's never been up to a car manufacturer to eschew putting a clear-coat on their car simply because a buyer might want to buff the paint to higher sheen first. Neither is it up to a device manufacturer to provide a device that someone can repurpose to their heart's content. Caveat emptor.

Don't buy what doesn't suit you (rhetorical). If enough people do the same, there will be a market for devices that suit those people.

[haertig]

Originally Posted by DiapDealer

Don't buy what doesn't suit you (rhetorical).

I'm wondering how you feel about buying a computer and finding out later that it comes with only Microsoft's keys, secure boot enabled, and the user cannot disable secure boot? You probably wouldn't find this out until you went to install Linux on the box.

Granted, most manufacturers/BIOSes allow the customer to disable secure boot. But not all do. And if they don't, I'll bet 95% or more of customers don't know how to hack their way around this and they are stuck with Windows forever. Which was probably Microsoft's plan with their support for secure boot all along. This Windows lock-in is not advertised and is not easily discoverable prior to purchase.

( I imagine you build your own computers as I do mine. But I'm wondering, theoretically, for people that buy their computers, if this would be a caveat emptor situation in your opinion. Personally, I don't think it is, because it's not readily discoverable. )