Enlarge (credit: Huawei )

Huawei is still making phones, even if the US-China trade war puts most of the stalwart Android component vendors in a complicated relationship with the Chinese tech company. Huawei's new phones are the flagship Huawei P60 Pro slab phone and a flagship foldable, the Huawei Mate X3 .

The trade war makes these phones unique in the world of Android. First, it has a Qualcomm chip, but Huawei isn't allowed to use the latest technology from Qualcomm, so the chip in both of these phones is the "Snapdragon 8+ Gen 1 4G Mobile Platform." Besides being last year's chip, this is a special, Huawei-only version of the chip that is branded as "4G." It has had the 5G bands stripped out of it—both mmWave and sub 6 GHz.

The other oddity is the lack of Google Play apps internationally. Huawei isn't allowed to ship the Google apps due to the export ban. While that's normal in China (where Google Play isn't available), internationally it means the phone is missing standard Google apps like YouTube, Gmail, Google Maps, the Google Assistant, Docs, Search, Photos, and other apps that make Android a competitive consumer OS. Instead of the Google ecosystem, you'll be getting the OS with Huawei Mobile Services , which includes the Huawei AppGallery, Huawei Petal Maps , the Huawei Assistant (which appears just to be a search tool and some widgets, not a voice assistant), Huawei Pay, and Huawei apps for books, music, and video.

Enlarge / Smartphone repairs could be required for up to five years, while other products, like washing machines, may require up to a decade of vendor repairs. (credit: Getty )

Makers of numerous product categories, including TVs, vacuums, smartphones, and tablets, could be required to enable repairs for their products for up to 10 years after purchase, depending on the device type. The European Commission on Wednesday announced a proposal it has adopted that would implement long-term repair requirements on electronics makers, if the European Parliament and Council approve it.

The regulation would apply to any devices with repairability requirements in the EU, including vacuum cleaners, washer-dryers, welding equipment, servers, and data-storage devices. The EU is currently hammering out right to repair requirements for smartphones and tablets.

Already, the EU requires vendors to repair or replace products within two years of purchase for free if the product is defective. The new regulation would require companies to provide a free repair (instead of replacing the product) if doing so would be the same price or cheaper than replacing it.

Researchers have found a major encryption flaw in 100 million Samsung Galaxy phones.

From the abstract:

In this work, we expose the cryptographic design and implementation of Android’s Hardware-Backed Keystore in Samsung’s Galaxy S8, S9, S10, S20, and S21 flagship devices. We reversed-engineered and provide a detailed description of the cryptographic design and code structure, and we unveil severe design flaws. We present an IV reuse attack on AES-GCM that allows an attacker to extract hardware-protected key material, and a downgrade attack that makes even the latest Samsung devices vulnerable to the IV reuse attack. We demonstrate working key extraction attacks on the latest devices. We also show the implications of our attacks on two higher-level cryptographic protocols between the TrustZone and a remote server: we demonstrate a working FIDO2 WebAuthn login bypass and a compromise of Google’s Secure Key Import.

Here are the details:

As we discussed in Section 3, the wrapping key used to encrypt the key blobs (HDK) is derived using a salt value computed by the Keymaster TA. In v15 and v20-s9 blobs, the salt is a deterministic function that depends only on the application ID and application data (and constant strings), which the Normal World client fully controls. This means that for a given application, all key blobs will be encrypted using the same key. As the blobs are encrypted in AES-GCM mode-of-operation, the security of the resulting encryption scheme depends on its IV values never being reused.

Gadzooks. That’s a really embarrassing mistake. GSM needs a new nonce for every encryption. Samsung took a secure cipher mode and implemented it insecurely.

News article .