These two links lead me to agree with you, that I can have a great deal of confidence buying a refurbished Pixel, flashing it with GOS, and then verifying it to create trust in the hardware, firmware and OS:
For completeness, one could do a physical inspection, and if desired, actually open the device to look for evidence of having been previously opened. Could also compare the board to images on iFixit or elsewhere.
Anyone know how to tell easily if a Pixel device has been opened? I’ve opened three or so but don’t know how to easily/quickly tell if Pixels have been opened previously.
Does Android do Verified Execution? If not, per my understanding, Verified Boot on a device that’s been in adversarial hands aka “evil maids” (non-certified refurbishers, if your threat model allows for it) leaves it vulnerable.
Unsure since when DICE’s been supported on Pixels and if that matters when it comes to Evil Maid attacks (where adversaries have physical access to a device)?
This is exactly what I meant when I try and buy a “refurbished item” like something extremely intimate as a phone. The phone is probably the most intimate device people use. It’s just disgusting for me to think about another person’s bacteria etc being on a phone.
The security risk is also there as well of course. I’d rather buy a low budget new product instead.
Again, I know people are struggling financially(I’m not so hot at the moment) so please don’t think I’m saying “Poor people suck Roarrrr!”
It seems like the consensus is that buying a used device from like eBay or Swappa is probably safe as long as it works for most people.
What do you think about buying a device like this for the activist/protester threat model? Maybe they are not leading movements, but they may be local organizers or even just participants in local actions. How safe is buying a phone second hand for this group?
I just don’t think it’s worth the privacy/security risk just to save a few dollars. Again, I’m struggling myself but I just don’t think this is a good way to save money…
Why risk all of your security/privacy to save a few dollars???
Dangerous, if not certified. Exhibit A from the crypto-currency world:
Ledger is advising users to avoid purchasing from unauthorized resellers as they run an increased risk of getting counterfeit or modified devices.
The company is also reminding its authorized resellers and distributors to get the products only through authorized channels and to avoid restocking returned products.
Ledger provides a ‘Genuine Check’ mechanism to determine the authenticity of the device; however, it explicitly warns that it cannot detect added implants when the device’s original Secure Element remains intact.
I still can’t believe I got flamed errr I should say firebombed from my caution about key loggers and malware being embedded in refurbished hardware like hard drives:
“Additionally, approximately 17% of examined second-hand devices contained active malware, including keyloggers and spyware designed to steal banking information or monitor activity.”
Costco have/had the pixel 10 pro on offer for a bit more than 500, I think it came out at 600 once discounted. Worth looking to see if it’s available near you as they were brand new and only just superseded
Sounds to me like there are still differences in likelihood and threat profile here.
Some hardware crypto wallet thing is already a massive target, and who knows if even the original hardware is all that secure or trustworthy. The whole crypto scene is already sketchy as hell and the hardware probably looks it before it’s even been modified, making it harder to spot something amiss. Then you go and buy it from some random Asian refurbisher for half the price. Sounds like begging for trouble already.
Far different likelihood to some random refurbished Pixel. Which will also be more difficult to sneak something into and probably have more protections built in as well.
However on the threat profile thing if my life depended on no one ever getting access to anything on the device (if I were someone like Snowden or Assange) then absolutely I’d spend the extra on new sealed in box! It’s just that quite often people act like they are but are only really worried about their credit card / hentai / whatever.
17% implies that it’s a narrow segment of the refurbishment retailers or shops doing this, not ALL refurbished phones, which was the original question.
Where is the figure 17% from? I would absolutely believe that Bob’s Mobile Phone Repair Shop in the seedy side of town, or selling on ebay, would do this, and seem to recall this being a constant threat from those types of shops. As opposed to the 83% of large companies selling refurbished phones who wouldn’t do this because the risk of lawsuits is too high.