Too many perfectly usable phones are put into a questionable security situation by lack of vendor support for keeping key software up to date.
But what’s the actual risk of using an Android phone on a stock ROM without updates? What’s the attack surface?
It seems like most things that’d contact potentially malicious software are web and messaging software, but that’s all done by apps which continue to receive updates (at least until the android version is entirely unsupported) eg. Webview, Firefox, Signal, etc.
So are the main avenues for attack then sketchy apps and wifi points? If one is careful to use a minimal set of widely scrutinised apps and avoid connecting to wifi/bluetooth/etc. devices of questionable provenance is it really taking that much of a risk to continue using a device past EOL?
Or do browsers rely on system libraries that have plausible attack vectors? Perhaps images, video, font etc. rendering could be compromised? At this point though, that stack must be quite hardened and mature, it’d be major news for libjpg/ffmpeg to have a code-execution vulnerability? Plus it seems unlikely that they wouldn’t just include this in webview/Firefox as there must surely be millions of devices in this situation so why not take the easy step of distributing a bit more in the APK?
I’m not at all an Android developer though, perhaps this is very naive and I’m missing something major?
Really appreciate you taking the time to write that. I have a sense of most of that (“defense in depth” and “threat model” are good lenses to think about such things through for sure!) but what I was trying to get a better grasp on was how much risk from automated attack was a normal person without worries of an “advanced persistent threat” taking on by using a device past EOL. Like you say, “Quantifying how much of a difference it makes is not trivial” so I feel less conflicted to know that you’re comfortable with your dad taking that risk.
I would think that the main thing at stake for a typical user isn’t just browsing history or email though but rather identity theft since a successful attacker can use the device to get through 2FA.
Perhaps the best way I can put that concern is that the risk is real but the risk is low. Good common sense operational security measures such as not clicking on things that you’re not familiar with, sticking with a small set of well-known applications from trusted sources, and turning off features or taking away permissions that you don’t need goes a long way to reducing your risk. You cannot eliminate the risk entirely, and while I don’t recommend running without security updates, I don’t think it’s a completely irrational choice. I believe that it’s incorrect to categorically declare that it’s unsafe and unacceptable for any use case.
As I’m sure you can appreciate, security is not a boolean. If you’re no longer getting vendor security updates it’s another risk factor that you need to consider.