Ask HN: Can you trust a Chinese phone after replacing the OS?

3 pointsopen14143y ago7 comments

Xiamoi makes some amazing phones at an affordable price point. They also tend to use flagship Snapdragon processors and release the device tree and kernel source making third party ROM support much easier.

I would like to buy one of these phones with the intent of installing ASOP or lineageOS. I don't mind maintaining the kernel branch myself and backporting fixes. I understand that there are proprietary blobs that run in userspace but I would trust these as I would get them from Snapdragon's official BSP website: codeaurora. I would remove anything that isn't necessary.

Since I am very nice in this field, I had a few questions:

1. Is it possible for Xiamoi to place a hardware backdoor? Or would this be near impossible to do at a large scale especially when using an American SoC?

2. I notice that the firmware for various chips are loaded from the Android image on boot. I assume this is because it's cheaper and allows firmware to be updated. Are there any components in a normal phone where the firmware in some read only flash? This would mean flashing a new ROM/OS would not remove this firmware.

Please note, I am looking for reasonable security. I am not a target in any way so it's unlikely I would be targeted specifically. I just don't like the idea of backdoors and/or malware calling home.

7 comments

simonblack3y ago

I just don't like the idea of backdoors and/or malware calling home.

No such phone anywhere in the world. Mind you, not all calling home is nefarious. Unless you call keeping tabs on your spending nefarious. Google makes you a product so that it can make money off your advertising and spending data. Apple is no different.

And if you're connected to the US phone system, you're being watched by the NSA.

If you want some small measure of privacy, I believe that public payphones are probably still out there somewhere.

Oh and by the way, Apple iPhones are Chinese phones. They just have a misleading 'Apple' label stuck on them.

nanumbat3y ago

I can't speak to security, but I bought a Mi Mix 2S some time ago and put LineageOS on it. Definitely check that the frequency bands the phone supports are utilized by your carrier.

(The fastboot screen on that phone has a wee little bear wearing a People's Liberation Army hat. Take from that what you will.)

Spooky233y ago

If it’s cheap, go for it. I wouldn’t spend significant dollars as carriers could banish Chinese phones at any time.

cheaprentalyeti3y ago

You and the OP both say this as if there's an actual American phone out there I can buy.

Ekaros3y ago

And as if you could ever trust phone build or with software from USA...

logotype3y ago

Librem 5 USA, without the case.

1 more reply

j / k navigate · click thread line to collapse