The userspace OS needs to be where control of any radio (bluetooth, wi-fi, cellular, nfc, uwb etc.) components happens, otherwise it would be difficult to be compliant in terms of regulatory requirements like a working Flight Mode.

Baseband firmware/processors are still making strides in terms of defending against attacks so I don't think we are at the point where backdoors are needed. More likely that undocumented AT commands, plausibly deniable bugdoors and existing memory corruption vulnerabilities are already convenient reality. However, part of that reality is also that once the cellular modem is exploited OTA it is still a massive task to traverse IOMMU restrictions and get device owner data/secrets from the userspace OS. It doesn't even grant visibility into application traffic which has been aggressively TLS encrypted since the mid 2010s.

In modern phones, doesn't the main chip control the baseband chip rather than the other way? What is the threat model?

Obviously since phone calls and text messages are unencrypted the baseband chip could send them elsewhere. But your internet communication should already be encrypted before it hits the baseband chip. So is the threat model Motorola has intentionally introduced a backdoor to leak data from the main chip to the baseband chip?

Graphene doesn't expect to have control of the RF. It makes all the RF stuff happen on the other side of a firewall.

Fairphones are designed and made for Fairphone by T2Mobile which is a Chinese ODM. Fairphones have very poor updates and security. Those devices are incredibly far from meeting the requirements for GrapheneOS and cannot be supported. Fairphones aren't European phones but rather Chinese designed and made devices sold by a European brand. T2Mobile not only designs the hardware but also builds and signs the firmware. Fairphone does very limited engineering and mainly combines AOSP, Google Mobile Services and the firmware/drivers from T2Mobile to make the stock OS. They're not in a position to meet our requirements. T2Mobile doesn't provide good security in practice and would need to greatly improve. Trying to get an ODM to improve security is only realistic with a security-focused organization as their direct customer and Fairphone definitely isn't.

It depends on the level of involvement you're comfortable with. As far as I'm aware, Fairphone are partnered with a Chinese ODM T2 Mobile for the hardware portion of their smartphone products. You can expect they are sourcing the hardware and spares, SoC/subsystem BSP components, peripherals and associated firmware from T2Mobile.

Independence from the Chinese manufacturing hegemony probably means opting for a flagship Samsung, 11-series Pixel or pre-2025 Sony flagship.

I wish fairphone was waterproof, what's the advantage of a repairable phone if a rainy hike will destroy it!

We can solve this if we make a non-Chinese smartphone company. But how?

I probably trust banking the most on a locked-down phone. It is in fact the interests of the state and its monetary system that these systems that implement it are secure.

At the same time, the state has its flaws and I'm questioning whether a top down system can ever really work, not out of some kind of "fuck the man" point of view, but more of an engineering and systems design perspective. If the system is perfectly factored, there are no cross-cutting concerns. But in such a system there is no need to communicate or coordinate laterally, only up and down. This sounds very lonely.

And if this system has a flaw, not a specific flaw, but rather a flaw in the assumption that tree structures with abstraction are a good way to organize systems, it might be impossible to change from let's say a tree with a single root to multiple interacting trees, with multiple roots of authority. Or maybe this is possible if people can learn to exist in multiple seemingly incompatible realities simultaneously?

Why have a compromised phone at all? You're still exposing yourself to telemetry. And if you've ever said anything positive about a Hong Kong democracy activist, you still have to wonder what's going to happen to you if you travel to any country with a mature extradition relationship to China.

I also think it's easy to underestimate your footprint when it comes to ecosystems that involve money in any capacity. No Amazon, Steam, no card information on a Netflix app, no signing in to Google to read a NYT article.

I think either you care about these things categorically or you don't, and I don't think anybody is going to be in the middle space you seem to be envisioning, which is concerned enough about the risks to avoid all banking but still a casual enough attitude about a compromised phone that you're fine with it for uses you consider non-secure.

> The difference is that chinese government is just trying to sell stuff, while USA government is trying to convert all the southern continent into a colony to impose governments and suck up minerals in the meantime.

Fascinating. The propaganda I've been fed is that China is the one hoovering up all the minerals so that they have control over the global supply chain for eg cobalt.

>chinese government is just trying to sell stuff, while USA government is trying to convert all the southern continent into a colony to impose governments and suck up minerals in the meantime.

Are you sure the Chinese government is choosing not to pursue these $evil_intentions[] you ascribe to the US, or are they simply yet unable to?

The problem with whataboutism is the same as it always has been, which is that the critique skips the step of checking whether the person who is concerned about Chinese privacy compromises hinges that position on the innocence of Western companies.

That part is assumed, and the whole argument unravels once its established that the assumption doesn't hold. And then either the tankies show up, or everyone forgets about it until the next thread where the process plays out again.

You’re not wrong about the US but let’s not pretend China is just “trying to sell stuff”. They’ve got their own genocide going on with the Uyghurs and are famous for espionage

No, Motorola Solutions is an entirely different company from Motorola Mobility. Those aren't part of the same company and aren't business partners. Motorola was split into both companies all the way back in 2011. Motorola Mobility was acquired by Google in 2012 and sold to Lenovo in 2014. Motorola Mobility owns the Motorola trademark and Motorola Solutions has a limited perpetual license for it for use with existing classes of products.

I can sort of understand that. If you are an American, arguably the Chinese government is not all that dangerous to you, and worrying about university admissions is about as ugly as your life gets. I expect the Uyghurs have a different perspective on how dangerous the CCP is.