The NSA advises you to turn your phone off and back on once a week

[saagarjha]

I hate lists like these. Not because they don’t contain good information. Some of these are excellent things to do regardless of your personal situation. But a lot of them make absolutely no sense for most people.

Rebooting your phone periodically removes zero day attacks that don’t persist on your device through a restart. People who are at risk of that are a vanishingly small fraction of the population. Those who are targeted with such attacks are often reinfected anyways because attackers are persistent and realize they’ve lost access to the device. Nothing about this is described in the recommendations, it’s just “oh you should do this” with zero threat modeling whatsoever. Then there’s stuff like “don’t use public Wi-Fi” which has been a bogeyman for probably longer than I’ve been alive. It’s not a problem anymore. Basically everything you do these days is using HTTPS. The author of this post goes on to shill VPNs, which are often snake oil that is even worse than the problem they aim to “cure”.

I have no problem with some parts of this list, including the NSA putting their name behind it. It’s good to keep your software up to date. Being cautious in unfamiliar contexts is usually a good trait to have. But when you throw in the other stuff it’s like if the NIH published a list like “oh you should exercise every day and also completely avoid shrimp”. Like yes some parts of it are good, some of this is only relevant to people who are allergic to shellfish. There’s no point, and actually I will say it’s actively harmful, to just publish stuff like this with explaining when it is applicable and the actual security it provides.

[transpute]

For comparison, here is UK's GCHQ NCSC guidance on device security.

Individuals: https://www.ncsc.gov.uk/cyberaware/home

Business: https://www.ncsc.gov.uk/collection/device-security-guidance/... & https://github.com/ukncsc/Device-Security-Guidance-Configura...

[dmix]

> People who are at risk of that are a vanishingly small fraction of the population.

It's probably a million dollars cheaper to buy access to a non-persistent exploit than a full one but those are probably looking for a one-off exfil anyway. And like you said they can just run it again a couple weeks later for new stuff.

but regardless I think most peoples phones batteries die once a week anyway so it's not a big deal

[Fire-Dragon-DoL]

For what is worth, android accumulates minor glitches by running all the time, so rebooting is not a bad idea. These are small bugs, people might not notice them

[transpute]

iOS force-restart key sequence cannot be intercepted by malware, https://www.wikihow.com/Hard-Reset-an-iPhone

Apple Configurator can define WiFi SSID allowlist, so the phone will only connect to known access points.

iOS Lockdown mode blocks a class of attacks and is mostly invisible to UX. It can be disabled for trusted apps and websites.

Brave can disable Javascript by default, and allow on trusted sites.

Since iPhones no longer power off, a faraday bag can be useful in some contexts.

iVerify claims to check for malware, unclear if it's meaningful given iOS restrictions, but the app regularly reminds the user to reboot.

[beretguy]

> iPhones no longer power off

Is this true? I’m still using first se do i don’t know.

[orf]

iVerify looks like total snake oil:

> First and foremost, iVerify Basic is a security scanner that ensures you are using the iPhone's basic security features such as Face/Touch ID and Screen Lock, and are running the latest iOS version. It also runs a device scan that looks for security anomalies and notifies you if something seems out of place.

[akira2501]

My advice to the NSA: Do the work of securing our telecommunications infrastructure so attacks like this aren't so laughably easy to pull off.

That way I don't have to touch the light switch three times and turn my phone on and off while turning in a circle to keep the bad actors away.

:|

[transpute]

Step 1 would be to reverse the merger of the NSA's defensive and offensive missions, which were separate until 2016, https://fedscoop.com/nsa-reorganization-nsa21-august-2016/

[Citizen8396]

The threats these address have nothing to do with telco infrastructure, which the NSA does not run anyway.

[aussieguy1234]

Would this have anything to do with some of the exploits not persisting past reboot? Like the one I run regularly to jailbreak my PS4?

[carom]

Yes, persistence is an additional expense in an exploit and fairly difficult to achieve on an iPhone. The idea with rebooting is that any malware living in memory will be cleared out and the attacker will have to throw the exploit again. Throwing the exploit again carries risk in getting it burnt and iPhone exploits are in the $1m - $2m range.

Given how we generally only reboot our phones for system updates, this is good practice.

[incompatible]

I turn mine off each evening before I go to bed, and turn it back on some time during the next morning. Saves battery power too.

[ars]

You can get virtually of that benefit, without having to wait for the bootup, by using airplane mode each night.

Booting up takes a lot of battery power - I bet if you did airplane mode plus battery saver overnight, you would actually use less power than rebooting it. Try it!

[derwiki]

Out of curiosity, do you have a landline?

I was alerted to a garage break-in because a push to my phone went to my watch, and then I called the police immediately.

[tamimio]

You have an old school alarm I assume?

[bustling-noose]

If your device was compromised then a reboot will essentially not run that piece of software again (iOS) until you probably clicked that link and your device was exploited again (assuming its the same exact environment).

While 'once a week' is very arbitrary, rebooting a device (especially an iPhone) will make it 'safer' than what it was before the reboot in theory at least.

iOS and Android are big and all vulnerabilities aren't reported as there are many in the wild just like any software out there.

Imagine you are at a cafe that had a compromised auth portal where you clicked a bunch of things and there was a payload that exploited a vulnerability and was doing something on your phone. If you rebooted, then likely it's not running again and you may not visit the cafe again either. That way a reboot likely fixed your problem. the alternative is that you wait for that vulnerability to become public, apple or google patch it and then you update it and your device reboots. This could take literally months and that payload is still active until then. I know many people who dont reboot their phones at all unless the battery is dead while updates are also not as common as people think. So many are running iOS 16 even today when their phone says update but they just ignore.

When someone reads all this on HN it sounds not very smart but these lists are designed for people who have no knowledge of tech. Hence you can sell VPNs to these people as well which is where its a bit of an issue on whats right and whats just advertising and selling you stuff. So the outrage is valid but a reboot is actually more beneficial than people think it is.

[nomilk]

Provided it's sound advice, I wonder if an OS setting could automate power down and back up at 3am once a week. Opt-in, preferably.

[jamesponddotco]

GrapheneOS[1] has that option in the security settings. I have mine set up so it automatically reboots the device if I haven't unlocked it in the last 8 hours.

[1]: https://grapheneos.org/

[EasyMark]

I suspect that maybe the most intrusive malware could prevent this or even fake it to the software, better to restart yourself

[yencabulator]

Think of holding down the power key for some seconds as a Secure Attention Key that forces control of the device away from the exploit. Automatic reboot might catch some exploits, but the SAK and trusted boot after it gets (practically) all of them.

[0xDEAFBEAD]

I think a malicious rootkit could just show a fake power down / power up sequence.

[whatindaheck]

Looks like this can be done with Shortcuts.app on iOS.

[uuddlrlrbaba]

Well try owning an iPhone 15 that keeps hanging when you access the files app. Been restarting this thing every 3 or 4 days

[AnonHP]

I have this happening once in a while. I know you didn’t mean to single out iPhone 15, but this issue seems to occur in any device with iOS 17 (and all its minor releases till date). I have had to restart my phone several times because of the Files app not responding.

[salamo]

Not only can you not access your files, but you are voluntarily restarting your phone. It seems pretty secure to me!

[Red_Leaves_Flyy]

Might your phone be owned?

[mensetmanusman]

My iPhone keeps starting the day with a black screen.

I had to learn the new reset sequence: quick volume up, quick volume down, hold power

[transpute]

If that's malware, reinstall the OS via DFU and Apple Configurator.

[omoikane]

Direct link to the best practices document (PDF):

https://s3.documentcloud.org/documents/21018353/nsa-mobile-d...

[ejj28]

Does anyone else feel like this is basically a bunch of nonsense 'advice' designed to lull the public into a false sense of security? Especially considering this is coming from the NSA.

What is any of this supposed to protect against besides potential 0days being used by governments (both foreign and domestic)? It's not like phones are generally extremely vulnerable to the extent that this is necessary, and if you're legitimately under threat of being targeted by someone with access to an arsenal like that of the NSO Group's, this is very weak advice. Not connecting to public wifi and not downloading attachments isn't going to save you when you're hit with a zero-click exploit.

[wheelerwj]

Why is nobody talking about how this is four years old?

[BriggyDwiggs42]

Are the people trying to hack me from the NSA, or are we worried about other bad actors?

[gmoore]

It's really hard to take privacy and security advice from the NSA....

[tpoacher]

Next up: Google's top tips for disabling ads effectively.

[thefz]

The NSA advises you to turn your phone off and back on once a week to reload the spyware they planted, in case it has crashed

[more_corn]

NSA don’t get to be the good guys of infosec. They’ve been the adversaries for decades fighting against good encryption, fighting against good security, illegally capturing data whenever they could. Remember the Snowden leaks? I certainly do. Now they want to pretend none of that ever happened and advise on good security. No. Let’s take it back a couple steps and have some truth and accountability first.

[inopinatus]

Under no circumstances use your phone to place or receive phone calls. Never send or receive email & text messages. Do not install any apps. Leave it powered off at all times. Store your phone in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying "Beware of the leopard"

[hnburnsy]

>Leave it powered off at all times

Powered off, how cute that you think you can actually power off your phone.

>How are iPhones still findable even when turned off >https://www.xda-developers.com/iphone-findable-turned-off/

[yjftsjthsd-h]

Security is confidentiality, integrity, and availability.