What an insult! *slap* :P. No I'm not a windows user. and I can set the
root password on my device, but defaults matter. And they matter a lot
if openmoko will become more mass-market. A firewall migth be a bit
heavy, I agree, every watt and cycle should try to be saved, but making
dropbear just listen to the usb interface would be a pretty good
compromise, if that is possible.
However, later on an easily configurable firewall would be almost
essential imho. Connecting to the phone (any port) over the wifi should
(almost?)never be allowed as default. Even if the point with the phone
is that users can do what they want, it doesn't mean that the apps they
install shouldn't be protected. And a firewall is almost the only viable
way. There's no easy way of making all the apps listen to just one
interface, and while host.allow/deny is more lightweight than a
firewall, those don't allow distinguishing of interface.
>
No, not the whole system. But well the user homedir would be basically
what we want to protect, and if it was on it's own partition, there is
kernel support for it already.
I think completely dynamic decryption would be too cumbersone to use. If
you mean that it would need an unlock for every received sms (to get the
contact behind the number) and phone call, it's just unfeasible. If you
want to protect the en/decryption key, it needs a passphrase that is
long enough to be of any benefit. The other option is a PKI enabled SIM,
which would be cool. Hence it should be unlocked only once, at bootup.
The sim pin could also be saved on the encrypted partition (maybe the
pin itself again encrypted with the passphrase, so it's not accessible
easily at runtime) so that the user only needs to authenticate once to
use the phone. There could be then options to forget the encryption key
either locally or via a "magic sms".
No it doesn't. Everything NEEDS to be decrypted automagically when the
phone is on. Otherwise it's just unusable. The whole system shouldn't be
encrypted, that's just waste. But having a personal area decrypted at
startup means that only you can access it at bootup, and one can add the
option of remotely disabling access to it. That is very much security,
way more than phones usually have nowadays, even more than
laptops/desktops, but not too much to make it hard/annoying to use.
The fact that it has package management doesn't mean much in itself. I
think current linux distributions have a pretty good model. A separate
security updates repo, which just releases security patches, and since
these are an security update of the recommended version, they don't
(well shouldn't) break anything, so they can even be pretty safely
applied automatically. Again, defaults matter. If you need to log in,
run opkg update; opkg upgrade I bet that most of the phones never get
patched.
