In the market for a second-hand phone? Check it's still supported by the vendor – almost a third sold are not
- Reference: 1596184204
- News link: https://www.theregister.co.uk/2020/07/31/nearly_a_third_of_secondhand/
- Source link:
The publication found that 31 per cent of all phones sold via CeX no longer receive security patches. For musicMagpie and SmartFoneStore, those numbers are 20 per cent and 17 per cent respectively.
As a result of the findings, musicMagpie has withdrawn all unsupported units from sale. SmartFoneStore has pledged to warn customers about abandoned mobiles. So far, there's no word from high-street tech buyer CeX.
It's not uncommon for smartphone manufacturers to cease providing software updates after just a year. This is most keenly observed in the Android sphere. To Apple's credit, it continues to support devices as old as the 2015 iPhone 6s.
More than a billion hopelessly vulnerable Android gizmos in the wild that no longer receive security updates – research [1]READ MORE
Google has tried to address this problem with the Android One programme, which is described as the "gold standard" of the platform. It guarantees three years of updates and two operating system upgrades.
However, it has a significant flaw insofar as it's entirely voluntary. Moreover, the decentralised nature of Android means that users are largely at the mercy of vendors, who are perversely incentivised to discontinue devices before their natural lifespan. The logic follows that the shorter the lifespan, the sooner the upgrade.
Unfortunately, existing consumer law doesn't compel vendors to provide patches for a predetermined period of time, as Professor Alan Woodward, a computer science and security specialist at the University of Surrey, lamented.
Woodward told The Reg he thinks it's necessary for governments to take regulatory action, and it's looking more likely that they will. Recent advances in "right to repair" law give credence to this. As an alternative, there could be a market solution that sees punters fork out for additional updates beyond the predetermined lifespan of a product, similar to how Microsoft sells extended support for old versions of Windows.
Javvad Malik, security awareness advocate at KnowBe4, argued that the onus is on manufacturers and resellers to ensure punters are aware of the risks of using unsupported kit.
"Manufacturers and retailers need to be transparent with consumers as to how long software updates will be available for. This should explain in clear terms what this means to the consumer in terms of security, and in terms of usability.
"Another approach that is touted is for manufacturers to open-source old code or place code in escrow, so that when the software is no longer officially supported, or the manufacturer goes out of business, someone else can take the code and continue support."
Regardless of the eventual approach taken, something needs to be done. Speaking to The Register , F-Secure's Fennel Aurora, a global partner product advocate, said the problem predominantly impacts those on lower incomes.
"Most smartphones on the market are not the high-end all-inclusive models," he said. "Rather, most people are limited to cheaper models, which in general have a shorter time to programmed obsolescence, have a much shorter software support duration and are more likely to come pre-installed with privacy-invasive applications."
Liviu Arsene, global cybersecurity researcher at BitDefender, added that those who buy second-hand devices are arguably more motivated by cost, and may lack the technical nous to identify and understand security threats.
"It's likely that for users who opt for purchasing refurbished devices with end-of-life versions of Android, security might not be a priority," he said. "These could be affordable devices for less tech-savvy family members that only use basic functions, such as calling and texting, and not for power users looking for productivity features.
"However, unpatched devices are a security and privacy risk for both the owner and other family members. Since Android devices are equipped with sensors like camera, microphone, GPS, and are even used for online shopping, successful compromise could lead to much more than financial data theft, but also potential extortion and surveillance." ®
Get our [2]Tech Resources
[1] https://www.theregister.com/2020/03/06/1_billion_vulnerable_android_devices_which/
[2] https://whitepapers.theregister.com/
Re: Can someone educate me as to why phones go out of support?
In order to force people to buy new ones. Manufacturers make money by selling phones, not allowing you to use them until they break.
Re: Scratching my head
msknight,
I think there is some justification - in that phone chipsets aren't standardised in the way that PC architecture has been. Which means that it might be more work for the phone manufacturer than just, get Google's latest version of Android and apply to whatever skin/launcher they've put on the thing.
I could be wrong here, but I understand that sometimes the OEMs may need software updates from the chip manufacturers - that they're also not doing. Although if they had the will, they are the customer so could have put it into their contracts - or paid for after-sales service.
Obviously it would be even simpler had Google refused to allow all the vendor customisation (or usually buggering up) of Android - so they didn't have the excuse of not having the resources to apply the patches to the crapware they'd already dropped on their phones. Alternatively Google could just have forced vendors who customised to guarantee 4 years of patching, or no Google Services for them. But Google's record on supporting their own hardware is only about 2-3 years, so they're not exactly paragons of virtue here. Let alone the shit they get up to with end-of-lifeing their IoT stuff.
Google decided to take the easy route and partially get round the problem by shoving increasing amounts of the functionality into Google Play Services. This has the twin advantage that they control the updates, so at least your Chrome browser and other Google apps are up-to-date. And also that Google now have more control of Android, because the open source bits don't have Google Play Sservices - and it's therefore much less valuable without Google. As Huawei may find trying to sell phones into Western markets - obviously de-Googleified Android dominates the Chinese market.
LineageOS?
It would be a nice gesture if these second hand phone sellers were to contribute in some way to LineageOS or equivalent - it's even in their business interest to do so.
Re: LineageOS?
Unfortunately not always the answer.
e.g. I had an old nVidia tablet that stopped receiving official support, so switched to Lineage. Was a bit buggy, but was now getting updates - and then Lineage dropped support. In the end just went back to the working, if old, stock OS.
Maybe one approach would be to allow you to pay for specific items to be supported.
e.g. I pledge a £1 a month to support device xyz, and if somebody commits to supporting it, they get that shiny pound of each user each month.
Re: LineageOS?
LineageOS's problem is not volunteers.
It's that you need intimate and hardware-level knowledge of the device, with suitable drivers, complete functionality, access to secure bootloaders and boot partitions, several devices of each type to test with (okay, they may be able to help there), and lots of potentially-damaging experimentation to get to the point that you can *see* anything on the device, let alone make all the third-party components like cameras, etc. work properly.
LineageOS doesn't really fully support many models at all, and the ones it does are essentially random based on hardware support and software driver availability. Do you have a driver for an obscure, Samsung-phone-only part that only exists in one phone and provides, say, fingerprint reading via the secure enclave? No? I'm sure we could just ask Samsung for it...
LineageOS is a LOT of hard work. No way that even a commercial entity is going to be able to fund or help that in any significant fashion, especially not for even a handful of models going forward onto years-in-the-future OS which won't really work with you (Google aren't going to help out LineageOS any time soon, because then they'd lose control of Android).
It's like Coreboot and other things along that ilk. Complicated. Technical. Working in the dark. No support. Never fully supporting everything. Hindered by basic security. Able to trash the machine permanently at the first mistake. Undocumented.
Throwing a couple of old phones, and even funding a couple of people's salary to do it 40 hours a week, isn't going to make a dent in it.
I have a LineageOS phone. I did it to my S4 Mini, which has a great IR blaster, which I use to turn my gadgets on. That's it. The camera is unreliable, the Wifi isn't great, some of the features don't work at all, and it's 3 or 4 versions of LineageOS behind now, and even then it's "unofficial" LineageOS from a forum post that I didn't care if it worked or not as the phone was headed for the bin anyway. It's never been updated since.
Pretending that LineageOS is the solution to this is crazy. It's just a bunch of amateurs hitting on Android code trying to get it to load on devices without any support whatsoever. They are just as far behind on security updates and OS updates on many models as the official Android for that device, and take out your warranty etc. in the meantime.
There's no business interest there for a reason. They'd end up with a bunch of LineageOS'd phones that were still out of date and couldn't be updated, but where several features of the phone didn't work at all, and they'd be "responsible" because the base Android could have supported them - so when are you going to fix it?!
If the OS isn't supported, install one that is!
I picked up my current daily-use phone from one of the second-hand sites for a quarter of its original list price and installed LineageOS.
Taking unsupported phones off the second-hand market is just adding to landfill.
Re: If the OS isn't supported, install one that is!
Great idea! I've used CyanogenMod/LineageOS and other custom ROMs since my first Android phone - the original Samsung Galaxy S. That was the phone that woke me up to so many problems such as long term support, e-waste, surveillance capitalism, etc. Since then I've ensured every new phone I bought could be immediately reflashed with CM/LOS as soon as it was out of the box. Unfortunately the vast majority of phones talked about in the article are not owned by Reg readers or those of a similar ilk. If I try and explain any of this to "normals" their eyes glaze over and they collapse as their bored brains take leave of their bodies. So sadly, most people won't even do what the article title says, let alone your suggestion, and the problems will continue.
Not supporting updates?
Chances are 75% of the Andriod phones in use don't either. All that removing them from the market does is give people the choice, pay more or take your chances on the likes of eBay, where it may be knackered or stolen.
Rather than the likes of MM stop selling them, just say its no longer supported.
Comment written on a phone bought 2nd hand from MM and hasn't had an update in years.
Re: Not supporting updates?
Indeed,
Once did an emergency purchase of a new cheapo android (existing phone expired) on holiday in UK so from a phone shop.
The phone never received any updates (this was a ZTE, and cannot recall its android version but it was a few behind "current" at the time).
Not an issue for me as when back home ordered a "proper" phone & emergency phone just used for calls & texts to family while on holiday so any security issues would not do much harm.
I'm sure this was not an isolated case, probably lots of "new" stuff in shops that's quite old and been gathering dust and is out of support (or manufacturers CBA to support)
What's the point?
You check it's supported today, tomorrow the manufacturer announced it drops support effective immediately (and the last update they pushed was 9 months ago)
With iPhones: The iPhone 6s is the oldest one that gets new OS versions (iOS 13). But older phones with iOS 12 are still getting security updates.
And generally, it's nice if you get updates, but if money is tight, an older phone that isn't "supported" will usually still be working just fine.
"beyond the predetermined lifespan of a product"
And just what is the "predetermined lifespan" of a mobile phone ? Six months ?
The only valid predetermined lifespan is the amount of time the hardware is supposed to be usable. For me, that is anywhere from 10 to 15 years - supposing your battery can be replaced.
It is obvious that the makers believe that a phone's lifespan is the time until the person buys a new one, ie 2 years on average I'll guess. Which also means that the phone makers completely ignore the resell market. How nice.
Well guess what : I have my Galaxy A3 since 2017 and I'm not changing any time soon.
Phone support needs to update their update strategy.
I have a cluebat to help.
And if that is not enough, I propose a law that states that as long as there is one item still connecting to the network, the maker of that item is required to provide updates.
We're not talking cars, we're talking everything electronic. You made it, you support it until the day nobody uses it any more. Don't come whining about cost - you sold it, you support it.
for manufacturers to open-source old code
this is not going to happen, unless they're forced by law. And even forced by law isn't going to stop them, unless backed by fines. And even fines aren't going to stop them, unless they're BIG fines. And even big fines aren't going to stop them, unless the process to apply those fines is quick. And the "quick" isn't going to happen (I know me intellectual rights and I have the finest lawyers to prove it. Over the next 10 years, in court).
It would be a beautiful world indeed if both processes were tied together, i.e. the moment they stop supporting a handset, they're forced to release the code. In real world, fewer and fewer android handsets can be rooted (by willing owners, not by the 3-letter-agencies and other bad guys)
"most people are limited to cheaper models, which in general have a shorter time"
Another instance of the [1]Captain Samuel Vimes 'Boots' theory of socioeconomic unfairness.
[1] https://medium.com/the-billfold/to-terry-pratchett-who-gave-us-sam-vimes-boots-theory-of-socioeconomic-unfairness-a33858c1c74c
Say what you will about Apple...
But you have to give them this - they do not sell unsupported phones.
I do find it legally contentious that any manufacturer can sell a phone without any support
Scratching my head
This linking the hardware and the software does puzzle me a bit. I've got one of the original Sailfish phones from 2013 and it still receives the patches.
To my mind, this is a problem with the way that phones and their operating systems are put together in the first place. It seems to be a problem that could easily be designed out of the process. I still don't really see the justification in stopping updates going to older phones.
Can someone educate me as to why phones go out of support?