Any way to turn that off? Bluetooth is very insecure.
If you read the article they say there’s a toggle to enable/disable auto Bluetooth on.
In what ways is having bluetooth on but not doing anything insecure?
I mean it was not too long ago there was a bug which could lead to an unauthenticated RCE against Bluetooth on Android.
https://nvd.nist.gov/vuln/detail/CVE-2022-20345
So yea, reducing surface area of attack when a feature is not needed is kinda important.
When we do defcon, Bluetooth is one of the easiest protocols to take control of. It’s funny. It’s also easy to spoof, easy to mess with, and generally very insecure.
I’m curious, what about Bluetooth makes it insecure? Is it that vendors create insecure implementations, like Android, or is it a human issue like connecting to things by default? I recall the Bluetooth spec being unbelievably complex and verbose, which obviously increases risk and makes it harder to audit, but it doesn’t get many updates, and I don’t recall seeing many issues with the spec itself. I mean it’s not like it’s fixing a CVE every quarter like with netty packages.
Its more complex than I can talk about here in any kind of depth, but it comes down to it being a very old protocol. It has known security issues that are just not fixed as it would break backwards compatibility with a lot of devices. So the same issues that were chosen to not be fixed are still out there. You can, with very little effort, take control of just about any Bluetooth device(or partial). Or at least knock it out if commission.
There’s a ton of Honeypot projects. Just the first Google result: https://github.com/andrewmichaelsmith/bluepot
tracking!
People lock their door when lock picks and axes exist. Making criminals work harder to access your belongings is pretty important in a lot of aspects.
Bluetooth has one of the largest network stacks. It’s bigger than Wifi. This means some parts of the stack probably aren’t tested and may have bugs or vulnerabilities. It has duplicate functionality in it. This opens up the possibility that flaws in how different parts interact could lead to vulnerabilities or exploits.
A number of years ago some security researchers did an analysis of the Windows and Linux stacks. They found multiple exploitable vulnerabilities in both stacks. They called their attack blue borne, but it was really a series of attacks that could be used depending on which OS you wanted to target. Some what ironically, Linux was more vulnerable because the Linux kernel implemented more of the protocol than Windows.
What? The kernel only implements HCI - a way to talk to hardware
The Bluetooth stack and its protocols are implemented in BlueZ or on Android in Gabeldorsche
Yeeeaaah, that makes more sense. 😅 That would be a giant gaping vulnerability if everything was in kernel space.
The Google Nearby feature thing (Google’s coming version of Apple Air Tags) will require a constant background Bluetooth scanner to listen for the tags.
My opinion: that stays off. Looking for your lost phone, luggage, or ex-wife? Im not going to help you if i dont know you. Buy a new item, take better care of it.
I’m so fucking sick of it. I just want to go back to old Android and Windows. Fuck both these bloated corps who keep inching away at shit they know goddamn well they’re doing. Seriously. Leave my shit alone. Let me root it and customize and fuck it up as I please. Leave me the fuck alone. /rant
Ha jokes on them I always keep it off. Wired headphones all the way baby
Doing the dishes while listening to podcasts with low battery makes me wish my wireless earphones didn’t break so soon. The amount of times I took my phone out, put it on a table and walked away to tow it off the table is staggering. Or forgetting to turn down the amplifier before unplugging just to get blasted with static noise isn’t something I miss.
Not having to bother with reconnecting bluetooth headphones and instead plugging in a cable is great tho, so I understand everyone who still likes their wired headphones.
nice pfp
Google is taking a page from Apple, iOS does exactly that kind of shit. It’s annoying.
And probably for the same reason. Google is rolling out an update to their device tracking network and if it’s anything like Apple’s, it relies on as many phones as possible having blue tooth enabled.
The UI strings make it pretty clear this is an option the user can choose.
It is informative, but how often does the average person read this kind of information? Especially when they are set on doing something simple, such as turning off Bluetooth. What if you never use the settings menu, and only turn it off from the notification drawer? They never see that information. Not to mention that it’s such a small option (even though it’s a big paragraph) that they make it seem like they don’t want the user to disable it completely.
What they should do, is when the user disables Bluetooth the first time (anywhere on the phone), a pop up is at least shown to instruct the user that it is still scanning in the background. That way the user is informed. OR, hear me out, have background scanning disabled by default and prompt the user to enable it the first time they disable Bluetooth.
Probably Google wants to create a new surveillance web using Bluetooth LTE on devices like Apple did with its AirTags
Did you even read the article? That’s literally what they’re planning.
I know
It will be a really sad day when they kill Termux and Tasker. At the same time, maybe it will be the push for people smarter than me to write a proper competitive OS that we can flash.
Well that’s another serious reason for my next phone to be a Linux one
If you read the article it says there will be a toggle to enable or disable the feature. It’s part of updates to support their “find my device” network
Sorry I’m one of the Lemmy users who sometimes don’t open the links and read sources. It’s really really good if the feature can be completely disabled. Though opt-it might be a little bit better
EDIT: I just read the article and didn’t see the info about disabling the feature. It can be my poor English knowledge though. Could you say where exactly it says about it?
There’s more than one spot that covers it, but one part says “You should be able to ignore the auto-on toggle and disable Bluetooth as usual, though”
I thought it means “you can disable Bluetooth but you will have to disable it every day after it turns on automatically”
That’s what I got out of the article when I read it. Would like to be proven false.
Judging from the amount of upvotes on my comment I can say that your desired scenario is very unlikely to happen
deleted by creator
GrapheneOS is definitely a great choice if this kind of stuff bothers you.
deleted by creator
Trust me. If it’s a problem, they will find a solution. They’re literally the most secure Android ROM out there.
We don’t know if its devs will remove or disable all the privacy invasive features. Though idk that much about it so probably it’s more serious than I think
Any good recommendations?
Maybe someday, everytime someone says “just get a Linux phone” I look a few up and the specs are always piss poor…
Better to just get a pixel and slap GrapheneOS (A privacy and security focused Android fork) on it
We still don’t know if GrapheneOS will disable that feature or not
Unfortunately only a few phones support Linux well and they are either really old (OnePlus 6, Samsung A5 etc) or expensive (PinePhone and FairPhone). Privacy costs a lot nowadays
PinePhone is very cheap. Even PinePhone Pro is mid-range.
Well yea but it’s quite expensive for its specs. You can get the cheapest Android phone for like $80 and it will have better specs than PinePhone Pro
