Ask Slashdot: How To Safely Use Older Android Phones?

An anonymous reader writes: Like many people reading this site, I have several older phones around as well as my newest, fanciest one; I have a minimal service plan on one of these (my next-to-most-recent), and no service plan (only WI-Fi, as available) on the others. Most of them have some reason or other that I like them, so even without service I've kept them around to act as micro-tablets. Some have a better in-built camera than my current phone, despite being older; some are nice on occasion for being small and pocketable; I like to use one as a GPS in the car without dedicating my phone to that purpose; I can let my young relatives use an older one as a camera, etc. Besides, some people have only one phone at all, and can't reasonably afford a new one -- and that probably means a phone that's not cutting edge. So: in light of the several recent Android vulnerabilities that have come to light, and no reason to think they're the last of these, what's a smart way to use older Android phones? Is CyanoGen Mod any less vulnerable? Should I be worried that old personally identifying information from online transactions is still hanging around somewhere in the phone's recesses? I don't want to toss still-useful hardware, but I know I won't be getting any OS upgrades to 3-year-old phones. How do you use older phones that are not going to get OTA updates to address every security issue?

Comments

CyanogenMod has nightly updates

[Anonymous Coward]

I still have my galaxy s3, which is running CyanogenMod equivalent to Android 5.1.1

I'd imagine that gets security patches.

Re:CyanogenMod has nightly updates

[luca]

But not every device has CyanogenMod available. I found one version for my old phone made by somebody external to CyanogenMod, but since they have stopped development there are no security patches.

Re: CyanogenMod has nightly updates

[Anonymous Coward]

1. Disable automatic retrieval of mms from the messaging app you use (e.g. Hangouts, handcent, messages). If you get any mms messages from an unknown person, delete it without downloading.
2. Root and disable your carriers built in remote assisstant tool (google your phone and carrier to find out how). Or install a custom ROM.

Therapy?

[ErikTheRed]

C'mon, at some point you're just hoarding junk.

Re:Therapy?

[FudRucker]

if it is good hardware why not put a new operating system on it and make it work for a few more years, no sense in filling the landfills up just because the software became obsolete,

the computer i am typing this on was built by me in 2000, i used to dual boot a copy of windows 2000 and Linux Slackware-8 when it was new, today windows is gone and i am running Debian Jessie on it, the hardware is old but it works good so why not put a new operating system on it

Re:Therapy?

[NatasRevol]

Because time is a real cost. Sometimes more than throwing out something old & buying something new.

And time can encompass a lot of issues - build, install, security, speed, opportunity cost.

Re:Therapy?

[gizmo2199]

Hardware hasn't advanced that much, especially on the desktop side, in the last 5 years. You could easily have a zippy Core2 Duo with 8GB of ram and run linux on it, no problem, especially if you aren't doing anything cycle-intensive like model rendering, or video encoding.

It might run hotter than a haswell corei7, but that's about it. What cost are you talking about?

Re:Therapy?

[RR]

if it is good hardware why not put a new operating system on it and make it work for a few more years, no sense in filling the landfills up just because the software became obsolete,

the computer i am typing this on was built by me in 2000, i used to dual boot a copy of windows 2000 and Linux Slackware-8 when it was new, today windows is gone and i am running Debian Jessie on it, the hardware is old but it works good so why not put a new operating system on it

Because you can’t.

The computer I built in 2003 has 1.5GB of RAM and 200GB of storage. This is enough to run Windows 7, though not Windows 8 or 10 because it doesn’t have SSE2 nor NX. With Linux and BSD and various strange options, I have endless choices of what OS I get to run on it.

The typical phone of 2007 has less than 128MB of RAM. You are not running a modern OS on less than 128MB of RAM. Furthermore, while the PC was relatively open, most phones have depressingly closed drivers. Just look at CyanogenMod releases: No gyroscope, or no GPS, or no sound, or very likely most of the hardware not working. That’s if you can get it to boot, or even accept and install a third-party ROM.

Just forget running anything other than iOS on iPhones. Not gonna happen.

Re:Therapy?

[fredgiblet]

To a degree, but there's also support to be considered. Unless you have a flagship model it's not necessarily easy to find an updated OS, and not getting updates can mean having a device that's too insecure to trust.

Re:Therapy?

[TheRaven64]

Around the time CPUs hit 1GHz, I came to the conclusion that almost everything I did on a computer fit into one of two categories:

• Stuff that was already fast enough.
• Stuff that would basically never be fast enough, no matter how much CPU power I throw at it.

Big compile jobs are in the second category. When I'm doing a test build of FreeBSD, I generate around 50GB of object code (for LLVM it's only about 10GB for a debug build). The LLVM build system is nicely parallelised and so could happily consume 3,000 cores (linking would still be a bottleneck, but new linkers are becoming multithreaded) and building FreeBSD for every architecture is a similar proposition. FPGA place and route uses randomised algorithms and can basically consume as much CPU power as you want to throw at it. And, of course, these things grow over time (though a clean build of LLVM has gone from about an hour and a half when I started to under 5 minutes on my current laptop).

For everyday use, an oldish tablet is more than fast enough. For a few things, I'm going to keep complaining about the time it takes for a very long time.

Re:Therapy?

[jandersen]

Because time is a real cost. Sometimes more than throwing out something old & buying something new.

And time can encompass a lot of issues - build, install, security, speed, opportunity cost.

True - but into this yo uhave to factor the time spent on having to replace applications that are no longer available on newer versions. I know of several places that hold on to HW from the 80es, simply because there is no strong reason for replacing it. Some of these systems have uptimes running into years, even 10 - 15 years. My personal record so far has been an old Solaris box, which had run for 7 years - it was rebooted because we need to rewire the server room.

Of course, if you're talking smartphones, perhaps you have to upgrade - but that is only because there are so few options for upgrading the hardware; by design.

Re:Therapy?

[TheRaven64]

My last two laptops have had SSDs. For big compile jobs, use a machine with an SSD and 256GB of RAM. Most of the I/O is serviced entirely from the buffer cache and never even goes to the SSD. It's CPU bound.

Re:Therapy?

[gstoddart]

Wow ... what the hell are you compiling?

Don't get me wrong, I believe you, obviously you've based this on something real. I'm just suddenly slack-jawed at what you've said.

My current desktop (for personal use, not gaming, and never CPU bound) has 16GB of RAM and 8 cores (slow AMD ones because I don't need CPU power, just multi-tasking).

The reason I have this is because it gives me more than enough room for running multiple concurrent tasks, and isn't going to be slow because it's constantly thrashing. In fact the 16GB is mostly future proofing and I've never got anywhere near using all of it. I'll take half the CPU speed and twice the RAM any day.

I can't even begin to wrap my head around what you're compiling in 256GB of RAM and being entirely CPU-bound if your IO is being done that fast.

OK, in fairness, I can't wrap my head around 256GB of RAM. The largest servers I've had direct access to at work cap out at 32GB, and a couple of DB servers (which I don't have direct access to) are in the 72GB range.

Years ago I decided if I was never going to be CPU bound, I sure as hell don't want to be memory/swap bound and have a machine thrashing itself into oblivion. A friend's aunt was looking for a new PC, and she looked at me and said "you're going to tell me to buy the most expensive machine out there" ... I told her "hell no, buy the oldest machine you can buy with double the RAM of an entry level system, and it will last you twice as long". She did, and several years later she still had a machine which worked just fine, and quite possibly still does.

My last machine was 8GB/4 core, so this one at 16GB/8 core was just a natural extension of that. For what I do with it I never really find I'm taxing the CPU that much, but I have gobs of resources to run whatever I feel like without worrying about concurrency. And in 4 years I likely still will be happy with it.

How many CPU cores are you running with that much RAM that you're keeping it CPU bound? I can't even wrap my head around that. The enormity of a compile job needing that much memory boggles my mind.

Re:Therapy?

[TheRaven64]

I do incremental LLVM builds on my laptop quite often. Unless I've changed a header that's included by a lot of things, they're quick, but the LLVM codebase has around 2200 C++ files, many of which are a few thousand lines long. If I'm making invasive changes, testing them on the bigger machine is a lot more pleasant - recompiling 2200 files on 32 cores is a lot faster than on 4+4 (and the Xeon cores are faster than the mobile i7 ones).

As for the RAM, FreeBSD make universe (which builds the base system for all supported target architectures) produces around 50GB of object code (which all wants to stay in the buffer cache so that the linker can read it quickly). Even LLVM by itself produces around 12GB when you do a debug build (which I don't as part of the FreeBSD build, but I do as part of regular LLVM development) and linking that really wants the linker to be pulling in the files from RAM for best performance.

The big machines have a few TBs of spinning rust, a 512GB SSD split between L2ARC and log device, and 256GB of RAM. The log device on the SSD makes a big difference because writes run at linear write to SSD speed, not random write to HDD speed (eventually it gets full if you keep doing it, but there's enough SSD that you rarely see that with out workloads). The big amount of RAM means that most reads are serviced from the OS buffer cache. The L2ARC means that most of the rest come from there.

I should mention that these are multi-user systems, though usually we're doing big compile jobs at random times (unlike on the CI systems, with similar specs, where we're doing them solidly round the clock). We turn on dedup for all home directories, which makes a big difference: everyone can have checkouts of the same source trees without using more disk / L2ARC / ARC space and object code is often deduplicated too. You do notice when more than one person is doing a big build though - the time increase is noticeable, even with enough RAM that neither of you is likely to be touching the disk.

install another operating system

[FudRucker]

hopefully some clever x-google employee or a current google employee will so do some work on the side at home and build a customized debian or slackware port that is easily installed in any android device, most are locked down so this cant happen but i bet somebody has the key to unlocking these android phones that have so far been uncrackable at the firmware/hardware level

Re:install another operating system

[Kernel Kurtz]

Like Linux on Android! ;-)

http://linuxonandroid.org/

Re:install another operating system

[maestroX]

I doubt this will happen with the many proprietary chip drivers and dead batteries after 3 years.
Come to say, why not get a lithium battery standard fitting modern devices.
You know in the old ages, like AAA, AA , C etc.

Re:install another operating system

[viperidaenz]

There is also the problem all the different phones, even the ones that use the same system-on-chip, are configured differently.
Different cell radios, different wifi/bluetooth chips, different touch controllers, different screens, different flash interfaces, multiple sim cards, sd cards, etc.

eg: You might have two phones with the same chipset, but one has a NAND flash chip, the other has eMMC.
It might have the sd card on mmc3 instead of mmc2.
The pinmuxes for the LCD interface may be in a different configuration...

tl;dr; You'd need all the drivers for all the hardware available in all the phones and Device Tree for each phone, unless it's like pretty much every phone in the world, which doesn't run a 4.x kernel, it's going to depend on soc dependent configuration system, like the sunxi FEX files.

Re:install another operating system

[turbidostato]

"hopefully some clever x-google employee or a current google employee will so do some work on the side at home and build a customized debian or slackware port that is easily installed in any android device"

That won't happen. It's not an OS problem but a drivers' one.

Install Firefox OS on it.

[Anonymous Coward]

Install Firefox OS on it. Based on this review, it'll be extremely secure, because you probably won't actually be able to do anything at all with it. Apparently there will be a good chance that the phone's GPS, camera, and other functionality won't work, and if they aren't working then they can't be abused.

Old phones

[Travis Mansbridge]

It's unlikely you can keep anything running a version of Android 4.4 truly secure, and even that won't be secure for much longer. The best idea if you're worried these still have some sensitive personal information on them would be a factory wipe (from the phone's recovery mode, not within the OS as this will leave internal storage in-tact). This should protect you from what most malicious parties are looking for, though if the phone is on your local network there's always the opportunity for them to use the compromised phone as a pivot point to compromise other machines on your network, but you'd probably need to be in someone's crosshairs for them to be doing this.

Re:Old phones

[Travis Mansbridge]

Prior to 4.4*

Re:Old phones

[AmiMoJo]

Actually, the security issues have been vastly over-stated by click-bait driven media. Ever notice how we don't see stories about vast Android bot-nets or millions of people being the victims of exploits? The only successful malware relies on the user enabling installations from other sources and ignoring all the warnings, and even then on any 4.x version the OS will scan the app for known vulnerabilities.

The OP unfortunately doesn't say what version he is running, but my advice would be to install Cyanogen if available (simply to get the latest possible features and minimal bloatware) and not worry about it. If the OP is really paranoid there are anti-virus products for Android, but they are not really necessary.

Re:Old phones

[Travis Mansbridge]

To be fair, some large-scale exploits do not require the installation of non-store apps or ignoring any warnings, in the case of Stagefright I believe all you needed was to have SMS messages routed through Hangouts. Obviously this kind of exploit is patched ASAP on newer devices, but pre-4.4 you're pretty much on your own.

Re:Old phones

[AmiMoJo]

Sure, but Stagefright was not very severe. That's my point - it was made out to be this huge problem, but actually all Android versions since 2.0 have had ASLR enabled in the kernel and it mitigates Stagefright. At worst an attacker could perform a really expensive DOS on your MMS app, but taking over your phone is virtually impossible because every MMS only has a one in tends of thousands chance of guessing the right address.

Re:Old phones

[Anonymous Coward]

Actually, ASLR in a 32 bit device with 2-3 GB of RAM is not that hard to defeat with ROP.

You are going to pop out somewhere recognisable 50-75% of the time.

ASLR on a 64 bit device is a different story. Lots of wilderness in a 64 bit address space.

The real mitigation is not the ASLR, its that only 0.0001% of the population can write ROP exploits....

Re:Old phones

[TheRaven64]

ASLR on a 64 bit device is a different story.

Well, sort of. The blind ROP stuff works by realising that exec triggers re-randomisation, but fork does not. Server processes like nginx are vulnerable because they fork children to replace any that have crashed and each child has the same layout. Even with a 64-bit address space, it's possible to probe (some things, like PLTs, are relatively easy to find and full of gadgets). Unless it's changed recently (I've not been paying attention, so it's possible), Android reduces app startup time by having a zygote process for the Java runtime environment, forking a copy of it, setting the UID / filesystem namespace, and then loading the app. This means that the address space will be different to other devices, but will have the same layout across multiple runs on the same device. BROP does require a two-way communication channel, though it only requires one-bit communication out (did this attempt crash or infinite loop the target?).

The real mitigation is not the ASLR, its that only 0.0001% of the population can write ROP exploits

Anyone can write ROP exploits. You don't need many gadgets to get a Turing-complete execution environment and there are compilers available that will take a binary, derive a Turing-complete virtual machine from them, and compile arbitrary (more or less - in some cases you may have a limited number of jumps, but it's usually more than enough to create a shell) code to run on them.

Re:Jesus Christ...

[Anonymous Coward]

First world problems!

This is Slashdot, everything by definition is a first world concern. If you want to read stories about how to chase down buffalo and antelope to make clothing/food/shelter for the approaching dark months you're on the wrong website.

An image for dedicated use would be nice...

[chaoskitty]

It would be nice if phone vendors didn't treat old phones as if only good for landfills. I know I'll never go back to Android because there's no assurance that even a brand new phone will be upgradable to the latest software even a month later (it's already happened to me). So the idea of just installing the latest OS and installing some specific apps doesn't seem doable.

The inability to upgrade Android phones is a HUGE problem.

Perhaps some enterprising people will create dedicated OS images for various hardware that remove all the cruft and just run specific things. For instance, I'd love to use an old phone as just a navigation system for my car - nothing else. I'd pay for that software if it existed.

Now only if Android vendors and developers knew about software portability...

Re:An image for dedicated use would be nice...

[Cochonou]

People expect to throw away their phone after 2 years. I'm sure you've thrown away other hardware because its OS couldn't be upgraded. Eg.: DVD players, NAS boxes, printers, or even wi-fi repeaters.

I'm pretty sure DVD players and printers are rather long-lived.

Re:An image for dedicated use would be nice...

[AmiMoJo]

The inability to upgrade Android phones is a HUGE problem.

It's only a huge problem to people who don't understand it.

Google delivers updates via Play. Those include the ability to detect and remove apps, even installed outside the Play store, that are malicious. Heavy sandboxing and other preventative measures limit the damage malicious apps can do anyway. It's like the recent Stagefright issue - from the way it was presented you might have expected vast botnets of phones to appear, but in reality it was next to useless as an exploit unless your goal was to do a really slow DoS attack by crashing the Messenger app.

If you must have the latest OS updates, get a Nexus of Cyanogen device. Otherwise you can accept that you might have fewer updates and pay more, but you won't wake up one day and discover your phone has used up your data allowance on a DDoS attack. You will have the features you bought when the phone was new, plus security updates. That's the deal with those phones, and it's only a "problem" because you didn't understand that and bought the wrong one.

Re:An image for dedicated use would be nice...

[wolverine1999]

You know it's a problem when in your local stores the phones ARE already that old and they are still selling them.

micro-tablets

[flacco]

I want a micro-tablet. I want a cell phone without the phone to hold my shopping list, music, and podcasts. I don't want the phone.

Why doe this not exist?

Re: micro-tablets

[Ecuador]

I can lend you my Dell Axim from 2004. Still works great, but I don't use it since my cellphone is a superset of its functionality. Or you can remove the SIM from an android phone. The reason they are cheaper than the PDAs were is that the chipsets are produced in massive volumes since they are now found in everybody's phone. So you aren't actually paying extra for the phone part - on the contrary it discounts the hardware that you can still use as a PDA.

Re: micro-tablets

[ganjadude]

it does. ipod touch

Re: micro-tablets

[Bing Tsher E]

An ipod touch costs 3-4 times as much as a non- contract cheap Android phone for Virgin or Boost or whomever that you never activate. The Android phone also has an SD slot, and you can even skip registering it with Google and sideload or use the Amazon app store if you like. The lonely little niche in the store with the ipod display is an "are you kidding?" deal. Apple probably pays the stores for wasting the space.

My first mobile device was a 32g iPod touch. I would NEVER do that again.

Re: micro-tablets

[ganjadude]

im not saying its a GOOD idea, but it fits the specs he was asking about. I had a 1st gen 8 gig ipod touch before the touch screen takeover of cell phones. like you, never again

Re: micro-tablets

[drinkypoo]

Why doe this not exist?

Not only does it exist, but there's no functional difference between buying that, and buying a GSM phone and not slotting a SIM card except that a small tablet may actually not have the right speaker arrangement to play phone, so if you ever want to use it for VoIP, you may get really pissed off at it.

I think most of the reputable companies have stopped making them for lack of demand, but there's still assloads of el cheapie models straight outta china. Check DX.com or similar.

Re: micro-tablets

[antdude]

What about Android? :P

Re: micro-tablets

[jaa101]

there's no functional difference between buying that, and buying a GSM phone and not slotting a SIM card

Except that a GSM phone with no SIM can call 911 (and/or 112).

Re: micro-tablets

[drinkypoo]

Except that a GSM phone with no SIM can call 911 (and/or 112).

Yes, that's true. Say, in that case, is the call not encrypted? Since there's no SIM involved? Or is there some kind of fallback in there?

Re: micro-tablets

[exomondo]

I want a micro-tablet. I want a cell phone without the phone to hold my shopping list, music, and podcasts. I don't want the phone.

Why doe this not exist?

It does. But most devices include the phone anyway because the cost is trivial and it's not worth it to create the tooling and manufacturing to produce a separate product which is basically the same thing without the phone.

Re: micro-tablets

[drinkypoo]

If you think your entire call was encrypted for privacy reasons, then SIM card encryption wasn't thoroughly explained to you.

If you're going to make assumptions, you're going to waste a lot of time, and impress no one, least of all me.

I've no reason to believe that the SIM encryption lasted any further along the journey than the first piece of phone company equipment.

Nor did I say or suggest otherwise. I didn't go into that much detail.

While working at a phone company years ago, I was told that the "SIM card encryption has not been broken" claim is false.

It probably is false. I was just asking in passing whether there would be any encryption applied to the call in the case where there is no SIM involved.

Re: micro-tablets

[viperidaenz]

Buy a phone. Don't put a simcard in it.
Switch it to flight mode if you're worried about making emergency calls.

Re: micro-tablets

[mcrbids]

I have used my "previous generation" phone in exactly this capacity every time I upgrade to a new phone. Around these parts on Craigslist, a used Samsung Galaxy S3 costs about $50 to $100. There's nothing preventing you from buying one, setting up the wifi, and using it exactly as you mention.

You could even get a MagicJack or Nextiva VOIP or something and use it as for phone service over wifi for very cheap.

Re: micro-tablets

[serviscope_minor]

Why doe this not exist?

Wait what? Which bits of the phone do you *not* want. There's the microphone and speaker parts (then again I often speak with people using skype over wifi on a tablet). There's the modem, but that also gives you data access away from wifi.

In any case, the 3G chipset and microphone and speaker are super cheap. It's unlikely to be profitable for them to split the product line ust to leave off one component.

If you want a mini tablet, buy a phone and nuke the sim card. You can also switch off the cell radio by going into aeroplane mode, then going and switching the wifi on.

Re:Jesus Christ...

[Blaskowicz]

An insecure old phone for rural Africa, where the first application is probably online banking, is not that desirable. Dumb phones are probably more secure and sufficiently poor people are willing to repair them.
Well, millions of discarded smartphones would be ideal too, with people willing to do a LCD replacement job, battery job, soldering a connector etc. but the OS sticks out as the main issue, like that 233MHz iMac I put back in the junk after I failed to boot a linux installer (perhaps something could be done but I didn't know better)

Re:Incentive?

[nnull]

It's amazing how quickly these phones go obsolete and become completely vulnerable to exploits over time. Meanwhile, I have an old PC happily running linux on it for years on end with all the security updates. These phone manufacturers have only themselves to blame for creating this security mess in the first place. Locked bootloaders, locked modem, locked OS. The worst of it? No one is complaining. Until more people start complaining about getting hacked and being a victim of identity theft, nothing will change. And if you use wifi on your phone, your phone essentially is a nice backdoor into your own network behind a firewall.

Re: Jesus Christ...

[savuporo]

The first application is not online banking. The concept of "banking" is not well developed in these areas, much less online banking.
the first application is almost exclusively simply communication. and watching pictures on the net ( no reading - language barrier ). also taking pictures.
I was in southern parts a year or so ago. gave away a phone, footwear and some shirts in person to some kids - they were super grateful.

Re:Incentive?

[gizmo2199]

Just wait until you have pop-over/under adware on android phones that you can't get rid of. I bet you people will start complaining then about security.

It used to exist...

[Dingo.Neal]

...and it was called a Palm Pilot.

Make the device read-only ..

[nickweller]

Is it possible for the hardware manufacturers to put a read-only switch on the device that would protect certain core files from being overwritten?

Re:Make the device read-only ..

[drinkypoo]

It's not just possible, it's easy. It does, however, cost a little bit. You'd need to have the system and the user data area on separate flash devices, so that you could use the hardware write protection on the device. Android already sees these as separate things, even when they're just separate partitions of the same flash, so there's little to no software work to be done there.

Re:Make the device read-only ..

[serviscope_minor]

It also wouldn't work:

"ATTENSHION! Important massage from http://scamsite.ru/yourbank/lo... u r device is insecure and u need to flip the swich so u can upgrayedd u r files!1"

And plenty of people would flip the switch. "it has my bank name. Must be legit, right?"

True story from my last place of work: there was a persistent fishing emailbeing sent round asking for passwords. The IT department sent out a warning message that they never, ever ask for passwords and never send them by email. And if you see a message like this ignore itand delete it!

Well, far too many people read the example scam in the email and replied with their passwords.

Re:Make the device read-only ..

[drinkypoo]

Won't work. The SD card "read only" switch is a soft feature that the interface driver has to honor.

Only you said anything about SD cards. Nobody else in this thread is talking about them. Come back when you know what we're talking about.

Re:Make the device read-only ..

[drinkypoo]

Well, far too many people read the example scam in the email and replied with their passwords.

This is one of those cases where you can't prevent someone shooting themselves in the foot, but you can protect them from being shot by someone else. I think that's worth a switch, but obviously I'm in the minority or it would be a standard feature.

Re:Make the device read-only ..

[serviscope_minor]

Yes, I think you (we, actually, since I'd like one too) are very much in the minority.

Having a switch could actually decrease security. Sure, it prevents critical files getting overwritten, so a reboot would clear out problems. It would also probably stop people upgrading, which means the apps at runtime would remain vulnerable, and they'd just get re-pwned every time they went online.

Often old hardware is more convenient.

[Futurepower(R)]

Wow! CyanogenMod has become amazing since I last looked at it.

New hardware? Steve Jobs got people to believe that, if they don't have the newest version of DTT, Digital Turnip Twaddling, they are horribly disadvantaged.

Buy an Apple watch? For $1,000.00? An Apple employee showed me his watch and said the software was unfinished.

Re:Often old hardware is more convenient.

[fustakrakich]

the software was unfinished.

codenamed 'Schubert'?

Re:Often old hardware is more convenient.

[GTRacer]

I really really wish I had points today. Bravo!

get to the point a little quicker please?

[r-diddly]

Time is being wasted with too much microscopic detail. "In light of the several recent Android vulnerabilities..." is where the question starts. From the first word, all the way down to "...a phone that's not cutting edge" is 148 words (60% of the post) describing trivial concerns and working too hard to explain (thereby only begging the question) why someone would keep old gear. That's why people are saying the problem is trivial and accusing you of holding on to old junk. Me, I applaud old junk, but anyway. Cut those 148 words and replace with, preferably nothing, or you could sum it all up with something like "Old phones still exist because of reasons." (Wow no shit? You mean it's not mandatory to buy every new phone that comes along and toss the old one?)

Turn off

[Noah Haders]

Turn off wifi and cellular. That should keep you safe.

Diminishing returns...

[RealGene]

Older smartphones don't have enough available memory to host the apps released today. Chrome simply won't run right, or even fit on an 8 MB phone, with Cyanogenmod installed and all vendor crap removed.
If you want to do the right thing, donate the phones to any of the countless charities that accept them, take a tax deduction, and donate that amount to another charity.
Making them work for the intended purpose is their problem.
Wipe it (all phones have a factory reset option), remove the SIM, and mail it off.

Why worry?

[amiga3D]

Unless you're using it for banking or some other financial activity does it really matter? If using it as a GPS or like I do as a pocket ebook reader then who cares? I've got an old Samsung Media Player 5 that I use to read books while listening to FM radio through earbuds (It has an FM chip in it!) That way I run the battery down on it instead of my phone. I have wi-fi so if I have a hotspot available I can e-mail if I like or even browse the web and youtube. If it gets hacked so what? I don't use it for anything critical.

Re:Why worry?

[petes_PoV]

Sensible advice.

The problem is not about the phone getting hacked, it's about what exposure that gives you. If you don't have any information on the phone that leads back to the owner, their finances, their location or that gateways into a network that does - then who cares? There would be nothing usable that a hacker (and from what I have read hackers are like dragons: those people who want to see them will do so, they may even exist - but are probably an incorrect explanation for something more mundane, and are useful for scaring gullible people and children, but with sensible precautions and the right medication they simply don't exist for ordinary people doing everyday things) ... that a hacker ... would want or could use.

Re:Why worry?

[DuckDodgers]

My phone is new enough to get security updates and I still don't do any online banking, social media, Amazon shopping, etc... on it for the same reason. I make phone calls, send and receive texts, turn on location services when I need navigation, play casual games, and browse news websites.

I was just about to install Replicant ...

[Ungrounded Lightning]

...on the international Samsung Galaxy S3 I bought for the purpose. (The international version uses a different chipset, which is one of the few supported by Replicant, which is a fully-open CyanogenMod derivative that doesn't use a number of closed binary blobs (if you don't install them yourself to use a couple of the phone's features), some of which are known to have backdoor-capable hooks.)

Then these two flaws came to light.

So I'm waiting for Replicant to figure out whether they're vulnerable and if so what needs to be done to fix that.

As I understand it, the Replicant project is down to mostly one guy with a day job - AND is the closest thing to a fully open-source, pretty much secure, smartpphone load out there. (This is the project that DISCOVERED the Samsung backdoor...) IMHO it would be a good project for those who want to work on a secure-AND-open smartphone to contribute to (or fork from).

Re:I was just about to install Replicant ...

[serviscope_minor]

This seems like something for the FSF. There is of course the problem that there isn't user-respecting hardware out there for the most part. I don't think that's a problem for the FSF: GNU was, after all itself developed on and for entirely non-free operating systems.

From where they're fowarded to Nigeria...

[Ungrounded Lightning]

Safe usage of the old phones is putting them in a container and sending them to rural Africa.

And I bet the rural folks can get a bit of cash by selling them to the scammers in Nigeria.

Why bother to spam you to scam you out of your bank account information if they can get hold of a cellphone you've used to access your accounts. B-)

What? You factory-reset the phone? Do you KNOW if that REALLY clears your personal information beyond all recovery on your phone model?

We need independent Android developers.

[Futurepower(R)]

Extremely good point. We need some way to compensate those who do the work.

All the companies associated with Android seem badly managed. They get themselves involved in conflicts of interest. They do things that are, basically, hostile to the customers.

Google developed Android. Good. Then Google began using Android for more and more control. Bad. In response, companies like Samsung are developing their own cell phone OS versions, and also trying to take too much control.

On this Slashdot page, Google is trying to track me 4 different ways:
Google Tag Services, http://www.googletagservices.c...
Google Analytics
Google AdWords
Google DoubleClick, http://www.google.com/doublecl...

People are beginning to speak very negatively about Google because of the over-reaching corporate tactics.

A Google manager told me that the company doesn't know what to do with all the money it makes from advertising on Google search. So, the problem is not Google being poor.

Re:We need independent Android developers.

[jdschulteis]

A Google manager told me that the company doesn't know what to do with all the money it makes from advertising on Google search. So, the problem is not Google being poor.

Agreed, the problem is not that Google is poor. The problem is that Google is too worried about losing their position as the leading internet ad agency. It is bad for Google if someone else (Facebook?) can offer advertisers better value by having more information, and hence better targeting of ads. However, it is also bad for Google if someone else (Microsoft?!) can offer users better value by having services with better security and privacy.

Safe use of old phone?

[dbIII]

Safe use of old phone?

Externally.

Unfinished software: Worse than alpha.

[Futurepower(R)]

"Unfinished software"

The Apple employee meant that the software was worse than alpha. He indicated that Apple shouldn't have released the Apple Watch before it was finished.

Steve Jobs was very abusive, but he had his good side. He would never have released something so obviously faulty. The Apple employee and I agreed about that.

Re: Unfinished software: Worse than alpha.

[maccodemonkey]

Send my congrats to the Apple employee friend then. For a pre-alpha device, I've been getting plenty of good, stable use out of mine.

What works well for you? Destructive to reputation

[Futurepower(R)]

Yes, it tells the time. The watch shows text messages on an iPhone so that it isn't necessary to take the phone out of a pocket. But, does that justify paying $500 or $1,000?

Would you want your company to suffer the destruction of reputation faced by Apple?

Seven problems facing the Apple Watch

Apple Watch: Issues We Know Of And Possible Fixes.

Opinion: One month later, fixing 15 early Apple Watch problems seems straightforward

These 8 problems with the Apple Watch are 'infuriating'

9 of the biggest complaints about the Apple Watch so far

8 Infuriating Problems With The Apple Watch

First and formost you root it

[Trax3001BBS]

Find a site that supports your device. You can get rooting information and the real answers your looking for, as CyanoGen isn't the only ROM out there; many are made by users who will access that site.

Once rooted (jail broken) you can add a HOSTS file, programs to change the permissions of a program (as any game is going to want your info and out), just a lot more freedom to do what you want.

Older Android devices you need to access your developers options, newer devices you need to get it to show by opening up the (about device) option and I forget just which one but by tapping 7 times on it will work, when you get close to 7 you will start getting warnings.

How I use them......

[Anonymous Coward]

1. I have KODI media server and use them as WiFi remote controllers for controlling KODI.
2. I have an older laptop dedicated to the Van and use them with it as PLEX viewing/listening devices for passengers. The Laptop acts as server and the built in WiFi becomes an Access Point for the phones to connect to. Passengers love it for music or photos or listening to music via headphones for privacy.
3. I own TriggerTrap photo device. Older phones can control camera via Wifi from one phone in my hand to another phone connected directly to TriggerTrap device.
4. Mount one to my handle bar phone holder and use the phones GPS for tracking/logging my bicycle rides.
5. Keep them handy for a Happy Snap if nothing better is available to take a photo. Sort of backup to my current phone.

I am not very concerned that any of my uses is a security problem but I can see that security could be an issue depending on how these phones are used.

I own 5 phones - Nexus S, 2x Samsung Galaxy S4 and 2x Moto G -- I try to get phones that the battery can be replaced by user.

Re:Jesus Christ...

[KGIII]

I still think we need to cluster them all together and make recycled phones do some meaningful computing such as sequencing genomes for rain forest flora and fauna. It seems like a good enough use for them and, when they die, they can be thrown into the recycle bin and have their parts recycled or disposed of properly. Mind you, the only reason I think this is a good idea is because I want to giggle when they try it but I have been promoting this idea for a while now. A cluster of old smart phones being used for meaningful science is surely going to attract some kickstarter funds.

Re:What works well for you? Destructive to reputat

[BVis]

Let's take a look at the 8 "infuriating" things wrong with the Apple Watch, according to HuffPo:

1) I had no trouble buying one. There are a lot of options; surprise! With more options comes more complexity!
2) My setup time consisted of running the Apple Watch app on my phone. That was it. Minutes.
3) This just in: A watch can get dinged up on your wrist. In other news, water is wet.
4) ... obviously if you drop it on concrete the face will break, just like the screen on your phone would. You don't have to be any more careful than you are with your phone.
5) I have not experienced any degradation in my iPhone's battery life. But, I also don't have a basis for a scientific comparison; qualitatively it doesn't feel like a problem.
6) If it won't charge, it's clearly bad hardware, and you can exchange it. Bad hardware happens, unfortunately, this is why there are return policies.
7) I have to agree a (little) bit with this one, it's not clear how stuff is intended to be used sometimes. But once you get used to it, it's no problem. Still, that's a black eye for Apple; ease-of-use is one of their primary selling points.
8) I've experienced the issue described. I have not had the issue with my watch's app screen.

Clearly it's not the smoothest rollout Apple's ever had, but it's not the disaster that people are making it out to be.

Apple gets a bad and distracting reputation

[Futurepower(R)]

"... it's not the disaster that people are making it out to be."

One of the issues is this: "people" are saying negative things. Apple has become a gay-supporting, headphone-selling, watch-making corporation that announces products before they are ready.

Apple's Tim Cook profiled as "most powerful gay man in Silicon Valley"

5 Reasons Apple Headphones Are The Actual Worst. We are all victims.

Exclusive: Corrupt Apple Store Employees Come Forward Across America (12/20/12)

Apple CEO Tim Cook is apparently not someone who can handle being a CEO. A capable CEO would not run a company in a way that gets so much negative or distracting publicity.

Does Tim Cook deserve to be paid so much? "Cook's pay package was valued at $378 million when he became Apple's CEO."

Re:Apple gets a bad and distracting reputation

[BVis]

"gay-supporting"

This has what to do with anything?

Security Cameras anyone?

[ChrisRogers5570]

I have a BUNCH of older phones - somewhere in the neighborhood of (cough, 60, cough) I have started using the oldest of the bunch as wifi security cameras with an app called Alfred (android only) and every time the device senses motion it sends a screen capture to my viewer device (which is a couple phones I actually use with cell/data service.) basically I put one in my front window, on each side of the house and, in my entry way into my home, I plan on putting one more in the garage window, and will put a couple more in the back yard windows, and for those of you with children - perhaps a baby monitor???? And since the devices barely have enough memory to cover google play services, much less other installable apps, this seems like the best way I know how to repurpose them - besides, they cost me less than $10 ea. so WAY cheaper than any IP camera you can buy!

and here, have another reply

[drinkypoo]

Also, you're wrong anyway. The SD card "read only" switch can be connected to a GPIO, but SD card controllers (the chip you use to interface to them) tend to have write enable lines. If you connect a hard switch there, nothing you do in the driver will enable writes... save perhaps loading compromised firmware to the chip. That's still a danger... which is why we need firmware write enable switches!

IPod Touch recently upgraded

[peter303]

They are basically an IPad in a IPhone form factor. I was surprised Apple still made them.

Distracting

[Futurepower(R)]

It's a distraction that causes people to get involved in other things rather than thinking about Apple products.

Re:Distracting

[BVis]

I'm pretty sure that the fact that Tim Cook is gay is not remarkable enough to significantly distract Apple's customer base.

Re:Jesus Christ...

[easyTree]

Apparently there are no second world concerns, slashdot.ru returns 'Nothing here.'

Re:Jesus Christ...

[Wycliffe]

I still think we need to cluster them all together and make recycled phones do some meaningful computing such as sequencing genomes for rain forest flora and fauna. It seems like a good enough use for them and, when they die, they can be thrown into the recycle bin and have their parts recycled or disposed of properly. Mind you, the only reason I think this is a good idea is because I want to giggle when they try it but I have been promoting this idea for a while now. A cluster of old smart phones being used for meaningful science is surely going to attract some kickstarter funds.

The problem with this idea is that it's more effective to buy a single new cpu than it is to try to wire up a bunch of slow unreliable phones.
I have a closet full of 1U servers that are about 7 years old. Today, I can buy a $150 computer that sits in my hand and uses 1/10
the power and is twice as fast. I can buy a single server that uses the same power as one of them that is faster than the entire rack.
If electricity was free AND maintenance was free AND you could network them together for free AND the task you wanted to do was
easy to do in parallel so that you could easily scale horizontally then it might be worth it but none of those conditions hold true.

Re:Jesus Christ...

[KGIII]

Pfft... We'll get a research institute or government funding. We're recycling phones for nature.

Thank you for the well done response, seriously.