Need a secure smartphone? Answer is simple, experts say
Nothing in this world is secure. If you're finding this out for the first time now, well -- sorry.
Not your bank account, your house, or a stock exchange's vast network of computers. Even military units are not safe from hackers. The one thing we all have tucked away in our pockets is a phone. It calls people, it texts people, and if you're really fortunate, you can pay for things on the go, browse the web, and throw imaginary flying birds at ominous-looking pigs.
Because everyone has one, the target on our backs is bigger than ever. Hackers, even nation states, are targeting smartphones to tap into cameras and microphones, but crucially and most of all, your data.
We started with a simple enough question for security researchers: "What is the most secure smartphone today?"
It turns out, it's not as simple as you might think.
But there was one phone maker security researchers, experts, and reporters were leaning towards.
KENNETH WHITE, SECURITY RESEARCHER
Known the world over for his security research, Kenneth White barely missed a beat when he responded to my question with one of his own.
"Secure from what?" he said. And he made a good point.
Everyone has an adversary, whether they know it or not: malware, a vindictive ex-partner, petty theft, criminal hacking, and mass surveillance just to name a few.
"The advice I'd give a curious in-law at a suburban holiday party is probably significantly different than what I would tell a journalist working in a highly sensitive environment," said White. "It's a security first-principles dilemma: the most secure device is likely to be the least useful to the average person."
With that, White said a "disposable pre-paid feature phone" would float to the top of his list, but described it as "not terribly useful" for the web and email access.
Listing his second option, White said the iPod touch (6th generation) with certain features disabled, such as location services and iCloud, and with an always-on virtual private network (VPN) service and third-party apps, like Signal, for voice and messaging. The downside? You need Wi-Fi, otherwise it's basically useless. But for those who need an always-on connection, a prepaid iPhone 6 with a similar configuration would land in third-place in White's view.
If petty theft is the biggest concern, White said a modern Nexus 5 or iPhone 5s or newer with a decent six-digit PIN or more to activate the default full-disk encryption, with an auto-lock after 5 minutes, would be the way to go.
Oh, and don't forget to "update early and often" he said.
JEREMY GILLULA, EFF STAFF TECHNOLOGIST
Gillula, who lives and breathes security and privacy, also took the "it depends" approach.
One of his main criticisms is not about the apps, or the devices themselves. It's the means in which we transmit our data across the networks.
"Cellular voice communications are terribly insecure, especially if you're on 3G or 2G networks -- so the only secure way to communicate is to use a third-party app," said Gillula, a staff technologist at the privacy group the Electronic Frontier Foundation. "Since most end-to-end encrypted apps are available for both platforms, the question of security comes back to which platform is the most secure against attackers being able to break into your phone -- either locally or remotely -- in order to bug it, tap it, or take control of it."
He explained that advanced users can compile their own trusted Android code, whereas iPhones offer software patches that are independent of carriers -- so they are updated more frequently.
Gillula too said Apple's walled garden approach to apps has benefited the platform, but also opens up the prospect of attackers aiming at iPhones because of their popularity.
JOSEPH COX, JOURNALIST
White wasn't the only one to consider one of the newer iPod touch devices. Joseph Cox, a London-based security writer, said it was "the most secure way to communicate."
With an iPod touch, says Cox, users avoid the insecure voice communications issue because it doesn't have a SIM card, and retains the security of the software that runs on iPhones and iPads.
"There are no phone records associated with it, providing a significant privacy advantage over the iPhone and other phones, and making it less of a tracking device in your pocket," he said, writing for Wired.
There's a catch -- a big one. Wi-Fi isn't always accessible, nor is it secure. In any case, you can still use encrypted apps and messaging services that can't be read by anyone else on public Wi-Fi networks, so long as the cryptography in use is strong.
"Whenever you make a decision around security, the most important thing to consider is the adversary you face," said Cox. "But for the vast majority of people who want to be confident that their communications are secure, a properly handled iPod Touch is the best option for now."
DAVID GORODYANKSY, ANCHORFREE CEO
Gorodyansky built AnchorFree, his multi-million dollar company, off the back of providing Hotspot Shield, a free VPN service, to hundreds of millions of users.
With privacy and encryption almost always front of mind, Gorodyansky knows better than anyone how to keep data safe and protected.
Picking up his iPhone during a conversation in our New York newsroom, he said it was the most secure phone for the mass market, but also the most expensive.
"Apple's business isn't selling your data like Google's is," he said. "But that said, we're not going to have the next five billion people buy a $700 device. While the iPhone is great and relatively secure, 85 to 90 percent of people will be on Android," he said.
DAN KAMINSKY, SECURITY RESEARCHER
Famed hacker and security researcher landed squarely in the iPhone camp. In a short email, he explained that in many cases malware will be used to eavesdrop or steal data.
Kaminsky said it's "much harder to get code into an iPhone in the first place," compared to Android, which can install from sources outside the Google Play app store.
LORENZO FRANCESCHI-BICCHIERAI, JOURNALIST
Vice reporter Franceschi-Bicchierai was driven away from Android because of its approach to software updates, which remains one of the best ways to devices keep safe and secure.
As vulnerabilities pop up, they are patched within days or weeks, and rolled out to the masses.
Except, not in Android's case. That's because carriers have to approve most Android updates. The worst part as an Android fan for many years, he stressed that it wasn't Google's fault: the patches are ready to go, but it's the carriers holding things up.
"Some carriers and manufacturers are better than others, it's true, but they all pretty much suck when it comes to pushing updates," he said, writing on tech blog Motherboard, likening it to your computer maker or your internet provider having to approve Windows updates before they're installed.
As a security reporter, he knows all too well the importance of keeping his own personal security up-to-scratch in order to protect others' safety, security, and privacy.
He wasn't kicking Android out altogether though. He said while users can install CyanogenMod, which offers faster patching and better updating, it's only available on a handful of devices so far.
Or, he said, "you can give up, switch to Apple and buy an iPhone," which he did, and still has today.
Meet the world's most secure smartphones (in pictures)
Editor's note: This story was first published December 18, 2015.