Do you think a hardware cutoff switch for the camera, like the Librem 5 and PinePhone, is enough to ensure privacy, or would you really want an actual built-in camera cover like is on some laptops (that presumably also kills the power since the system knows whether the camera is covered). The caveat for only having a switch being that you can’t very easily audit the circuitry to check if it’s actually turning off the camera, but the benefit being that it’s easier to implement, has fewer points of failure, and will leave more room for a bigger camera.
Also, would you want separate switches for front and rear facing cameras or are you okay with turning both of them on and off with one switch?
Ideally you would want both.
-
For anything important, redundancy is important.
-
Most covers can still leak some information with various integration time settings.
-
Killswitches need to be trusted, and cannot easily be verifiable at a glance.
-
Killswitches circuitry should place the mechanically isolated switch in series to the camera power line, and on the camera side have an indicator LED in parallel - or a similar arrangement. Other configurations are difficult to trust.
Imo separate switches is not as important as verifiably trusted switches. Separate would be nice, as long as it doesn’t lead to confusion.
That begs the question of how one would check if the cutoff switch is working. If a company like Pine64 or Purism says they have cutoff switches in series to the power, would you trust them? What if the devices were audited by a third party? I wonder if there’s a self-test that can determine if they’re working, which you can run from in the OS itself.
Even if the camera had a cover you can see, that’s not possible for the microphone, radios, etc. Do you think the other components can get away with not having physical indicators of function? Do you consider them significantly less privacy invading than a camera? I mean, in terms of “creep factor,” then yeah, the camera is by far the worst, but if your main concern is confidential information leakage, like if it’s a work computer, the microphone can be just as bad, possibly worse.
I guess you can take the thing apart and follow the traces from the switch to the camera, but I feel like that’s edging on paranoid, unless you’re like a secret agent or something where someone modifying your specific device before shipping to you is part of your threat model.
-
Another thing to consider is that a hardware kill switch can turn off the microphone too. A cover doesn’t usually do much for that.
Do you usually turn off the mic and cameras at the same time? I think I’d prefer if they were two separate killswitches.
I don’t have any kill switches at all on any of my devices, but I think the Librem laptops and phone do both. On a laptop I’d definitely prefer two-in-one. On a phone I’m less sure, seeing as the microphone is kind of essential for the phone-part of the phone, and having to manually turn off the kill switch when you get a call seems like a hassle. It would be cool if the kill switch could signal the phone to accept the call or something, but realistically I don’t think that’s ever going to happen of course.
But if the phone could disable the microphone killswitch, isn’t the whole propose of it ruined?
I’m suggesting the opposite, to have the kill switch signal that the call should be accepted.
It would be cool if the kill switch could signal the phone to accept the call or something, but realistically I don’t think that’s ever going to happen of course.
That’s actually completely doable even if we’re working with the stipulation that power cut off, not just a signal to not use the camera, because you can just wire transistors up to the switch output. A transistor detects the switch output and turns the power on or off accordingly, while the switch output goes on to inform the processor what the state is. No processing needed that could introduce errors into the power cutoff system.
It would also require some software support. Definitely doable, I just don’t think there’s enough interest to actually o it. But I might very well be wrong. And thinking about it further there might already be software support for this kind of thing from the old flip phone lid switches.
I think I could do without a camera altogether so Im OK with a switch handling both (I used the OnePlus 7 Pro for awhile, popup selfish camera that was never used for the win).
I’d honestly just be happy with options that are native and not like a case that offers camera blocks, adding your own etc.
I don’t know what would be best for me, but I havent had devices that offer this minus the PinePhone - and I couldnt use that for my everyday tasks so don’t feel it counts (I also just kept the camera switched off so I didnt cause the OS to freeze/crash with some of the earlier builds).
Omg yes me too. There’s just cameras on eeeeeverything when I don’t even use it.
Okay so, this is complicated.
Kill switches first.
-
There is really no way to verify that the kill switches are working other than the OS telling you so, unless you are experienced enough to verify yourself.
-
Even if you verify that they are properly wired, there’s nothing to say that they don’t stop working at some point.
Now, the phones.
There are no Android phones with kill switches that I’m aware of as of this time. Linux phones are egregiously insecure and should be avoided at all costs. They lack protections for almost any attacks made in the last decade, they lack consistent software updates, any coherent security model, and more. GrapheneOS and iOS are the only two secure mobile OSes, everything else is lackluster. If Graphene is a ten and iOS is a nine, mobile Linux operating systems are well into the negatives.
-
Removed by mod
