this post was submitted on 21 Aug 2023
39 points (95.3% liked)

Asklemmy

43945 readers
1001 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy πŸ”

If your post meets the following criteria, it's welcome here!

  1. Open-ended question
  2. Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
  3. Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
  4. Not ad nauseam inducing: please make sure it is a question that would be new to most members
  5. An actual topic of discussion

Looking for support?

Looking for a community?

~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~

founded 5 years ago
MODERATORS
top 47 comments
sorted by: hot top controversial new old
[–] dan1101@lemm.ee 14 points 1 year ago* (last edited 1 year ago) (1 children)

Totally, look for phones in "excellent" or "mint" condition, read the description carefully, and check the seller's feedback carefully. I've bought 4 or 5 phones on eBay with great results. Every phone I've gotten is indistinguishable from new.

[–] Hazzia@discuss.tchncs.de 3 points 1 year ago

Open Box is also worth checking out. I snagged an Xperia 1 IV for 50% retail price, which was around the same price a lot of "very good" condition used ones were going for. A few months with it now and no issues so far!

[–] applejacks@lemmy.world 7 points 1 year ago (2 children)
[–] Vitaly@feddit.uk 2 points 1 year ago (1 children)
[–] xeddyx@lemmy.nz 2 points 1 year ago

Swappa is US-only, it seems that you're in the UK so forget about Swappa.

[–] quellik@lemmy.ml 1 points 1 year ago (1 children)

+1 Swappa. I bought my first iPhone this way with no issues

[–] colmear@discuss.tchncs.de 3 points 1 year ago* (last edited 1 year ago) (1 children)

But never buy the like new condition. Good is better in this case. I once saw a documentary about swappa using third party replacement parts to refurbish those phones which have far worse quality than the original parts

Edit: I confused swappa with swappie and managed to find thedocumentary I was talking about (it is in German though)

[–] applejacks@lemmy.world 4 points 1 year ago (2 children)

swappa doesn't refurbish anything.

they let people sell their phones.

[–] colmear@discuss.tchncs.de 3 points 1 year ago

Thanks for pointing that out. I confused swappa with swappie

[–] Rouxibeau@lemmy.world 1 points 1 year ago

And alleedly some sellers do as he claimed.

[–] xeddyx@lemmy.nz 7 points 1 year ago

eBay is fine. Just check the seller's reputation first before buying.

If overall positive feedback is greater than 99%, and they've sold hundreds of items, then there's no problem buying from them.

I've bought dozens of phones from eBay over the last two decades, never had any issues.

[–] HowlsSophie@beehaw.org 6 points 1 year ago

Absolutely. I've bought all of my phones from eBay and never had an issue.

Just look through the product info and make absolutely sure it's not a "Bad IMEI" phone. These are usually stolen phones laundered through china, and will not connect with most regular carriers in the US (or in much of the EU)

[–] Saltarello@lemmy.world 4 points 1 year ago (2 children)

I personally would be very wary if eBay as even with a paid check before buying, the seller could potentially take your money then claim on their insurance. The phone then becomes blacklisted (sim no longer works, only works abroad or on wifi). If you confront the seller they could just say a previous owner must have reported it stolen.

CeX used electronics store guarantees against this & also gives a 2 year warranty

[–] xeddyx@lemmy.nz 3 points 1 year ago

This sort of scam would only work for sellers with zero/bad reputation. Only an idiot would buy from a seller like that.

If the overall positive feedback is greater than 99% and they've sold hundreds of items then there's no problem.

I've bought dozens of phones from eBay over the last two decades, never had any issues.

[–] Hazzia@discuss.tchncs.de 3 points 1 year ago

Isn't that an iPhone exclusive concern?

Genuine question; I've only heard of that feature with reference to iPhones.

[–] jetsetdorito@lemm.ee 3 points 1 year ago

Over the past 10 years most of my phones have been used, and I've been way happier with it. Save money for the same thing.

[–] SymphonicResonance@lemmy.world 3 points 1 year ago* (last edited 1 year ago)

Sure . I normally buy top of line flagship phones used. Except for my most recent purchase, they all came from ebay . Most recently I purchased something 'renewed' from Amazon.

Make sure the description says the battery is good and that the photos show the screen in good order . I don't care about scratches/cracks on the back because the thing is going into a case anyways .

[–] patient_tech@lemmy.world 3 points 1 year ago

I’m on about #2 or #3 IPhone from eBay.
No issues, but I always made sure I purchased ones that were in the condition I liked in the photos and also were listed either for the carrier I had in mind or unlocked and then threw in a mvno sim as soon as I’ve got it. eBay is pretty good about processing returns that are legit and I’ve always tried to vet the device the day I received it. Issues with other electronics I’ve filed a notice report immediately and either returned or accepted a partial discount. Looking to sell my old devices on eBay soon. Not going to make a fortune, a few bucks helps, yanno.

[–] Pseudoscience@lemm.ee 2 points 1 year ago

I bought my unlocked phone on Backmarket. Works great so far.

yeah, but also account for the cost of a battery replacement

[–] Pyroglyph@lemmy.world 2 points 1 year ago

I got my last 3 phones used, all were at a great discount, and all lasted about as long as you'd expect a new phone to.

I'll continue buying used until new prices become reasonable again, and even then I will still probably buy used because it's cheaper and helps combat ewaste (if only a little).

[–] MystikIncarnate@lemmy.ca 2 points 1 year ago

Mostly. I'm certain some of the stuff moved on secondary markets is stolen, and if the previous owner did their due diligence, it should be blacklisted by service providers by the device's unique ID.

There's also plenty that are 100% legit and you won't have any trouble whatsoever. I try to stay away from eBay for phones; I go to the local marketplaces, like FB marketplace, Kijiji or Craig's list and do the exchange in person. Being able to look someone in the eyes and ask them why they're getting rid of the phone, in and of itself, can weed out theives.... Not entirely, but mostly. You also get a clean cash transaction, you can look at the device and check it over to ensure it's what was described, get, and likely test any accessories, and do any last minute negotiation that might be required based on what you've found while handling the item.

It's not perfect.... But your only other option is to buy a refurb from a first party seller like your mobile provider, which will probably cost more, it will also likely be carrier locked... But you can rest easy that it wasn't stolen....

I switched to buying directly from manufacturers (in my case, Google) and just plugging in my carrier sim card. I've been happy with that. I also always run with a good case on my phone, usually spigen, and I haven't had any notable damage to my device as a result (which would require an early replacement).

YMMV. Good luck

[–] Extrasvhx9he@lemmy.today 2 points 1 year ago* (last edited 1 year ago)

Depends on the condition and the age but I personally say yes it's worth it especially if its still getting security updates

[–] CalcProgrammer1@lemmy.ml 1 points 1 year ago

I've had good luck buying phones on eBay. I bought a OnePlus 6T last fall that was in box and practically brand new because the 6T has good Linux support, phone arrived and worked great. I just bought a OnePlus 6 because it too is well supported on Linux (postmarketOS) and doesn't have as big of a notch, good condition but minor OLED burn in. Problem is that the previous owner didn't realize that PIN lock remains over factory reset so it was locked. I managed to find an unlock procedure before the seller got back to me with the PIN and it's working fine now (though I think I will stick with Android on this one after all).

[–] LeylaLove@hexbear.net 1 points 1 year ago

Yeah, maybe not ebay. I used Swappa back in the day and that was cool. But phone hardware hasn't improved THAT much in the past 5 years. You can go pretty far back and have a pretty decent phone. Android phones lose their value a lot faster so you can usually get them super cheap. Should probably buy unlocked

[–] zerohash@lemmy.ml 1 points 1 year ago

I never have problems with phones from ebay. Take your time, look and read closely. I buy a lot of the cheap ones for family members who are too rough/careless with their phones, and it's worked out pretty good.

[–] ExLisper@linux.community 1 points 1 year ago

Backmarket?

[–] multicolorKnight@lemmy.ml 1 points 1 year ago

I did. It was perfectly fine, got a new condition, slightly older model phone for about half price. Unlocked.

[–] argv_minus_one@beehaw.org 1 points 1 year ago

Only if you enjoy the thought of the previous owner watching you through its microphone and camera.

Assuming you get a phone at all, and not just a cardboard mockup of one. You all remember β€œP-p-powerbook”, I hope.

[–] reddithalation@sopuli.xyz 1 points 1 year ago

Yeah, I got a perfectly good phone for half the price of buying new

[–] RovingFox@infosec.pub 1 points 1 year ago (1 children)

Personally I'm worried to buy a phone that is filled with spyware and adware.

[–] Nemo@midwest.social 5 points 1 year ago (2 children)
[–] oessessnex@programming.dev 1 points 1 year ago (1 children)

On a phone with spyware installed that wouldn't do anything. There are probably ways to get rid of it, but how can you be sure?

[–] xeddyx@lemmy.nz 4 points 1 year ago (1 children)

By checking whether the bootloader is unlocked or not. If the bootloader is unlocked, then all bets are off, but if the bootloader is locked, you can only run the original, unmodified firmware. Any alternation to the firmware will result in the dm-verity check failing, causing the system to not boot at all. The only data which can be altered is user data, which is wiped in a factory reset. So a factory ressr definitely gets rid of it.

If you're paranoid though, you could always flash the stock firmware downloaded directly from the manufacturer's website, which will override all system partitions, so you can be absolutely sure there's no spyware - besides the spyware included by Google etc of course, or the spyware embedded into the hardware by the chip manufacturers...

[–] argv_minus_one@beehaw.org 1 points 1 year ago

None of this will save you. The boot loader can be replaced with one that merely pretends to be locked and merely pretends to flash the replacement operating system it's sent over the USB port.

If the phone has ever been in the custody of someone you don't trust, you can't trust anything about it.

[–] UprisingVoltage@feddit.it -1 points 1 year ago (1 children)

They said spyware and adware

[–] xeddyx@lemmy.nz 1 points 1 year ago (1 children)
[–] RovingFox@infosec.pub 2 points 1 year ago (1 children)

Those usually are made to persist after factory reset. The phone is rooted and factory reset is modified to not remove the bad software.

[–] xeddyx@lemmy.nz 1 points 1 year ago (1 children)

And rooting the phone requires an unlocked bootloader, which would present a warning when the phone is booted up.

[–] RovingFox@infosec.pub 2 points 1 year ago (1 children)

If you know what you are doing, it won't.

[–] xeddyx@lemmy.nz 1 points 1 year ago* (last edited 1 year ago) (1 children)

Yes it will. There's no way to bypass it, if there is, that would be a serious security flaw - the kind that would get patched very quickly. There have been some phones which had a vulnerable bootloader that allowed this in the past (eg: OnePlus devices), but there's no such exploit available for current generation devices

I'd like to see some sources backing up your claim, which is applicable to current generation phones.

[–] argv_minus_one@beehaw.org 1 points 1 year ago (1 children)

There’s no way to bypass it, if there is, that would be a serious security flaw

Those do happen, but it is probably also possible to unlock the boot loader and then replace the boot loader itself with one that merely pretends to be locked. How would you know the difference?

the kind that would get patched very quickly.

Obviously criminals aren't going to install security patches for vulnerabilities that they are exploiting.

[–] xeddyx@lemmy.nz 0 points 1 year ago (1 children)

but it is probably also possible to unlock the boot loader and then replace the boot loader itself with one that merely pretends to be locked. How would you know the difference?

Sure, in theory, but doing that would require advanced knowledge, it's not something a random shady seller on eBay would do. With skills like that, they could easily get a high paying job, or if they really want to be a criminal, a better option would be getting into something like phishing or cryptolocking, which, skills wise, is easier than writing a custom bootloader.

Obviously criminals aren't going to install security patches for vulnerabilities that they are exploiting.

Which is why the first thing you should do is do a factory reset, update the phone, and do another factory reset. Or an even better option would be to just flash the factory firmware downloaded directly from the vendor.

[–] argv_minus_one@beehaw.org 1 points 1 year ago (1 children)

Sure, in theory, but doing that would require advanced knowledge, it’s not something a random shady seller on eBay would do.

No. Writing the code to do that would require advanced knowledge, but once it's written, any common criminal can use it.

With skills like that, they could easily get a high paying job, or if they really want to be a criminal, a better option would be getting into something like phishing or cryptolocking, which, skills wise, is easier than writing a custom bootloader.

They could use the compromised phone they sell you to phish or ransom you.

Which is why the first thing you should do is do a factory reset, update the phone, and do another factory reset. Or an even better option would be to just flash the factory firmware downloaded directly from the vendor.

All of those only work if the software already on the phone allows them to work. Factory resets, updates, and USB flashing are all implemented by software.

[–] xeddyx@lemmy.nz 1 points 1 year ago* (last edited 1 year ago)

but once it's written, any common criminal can use it.

It's not that simple on ARM world, every device uses a different bootloader and has a different partition layout, different boot image resolutions and different type of warnings. So you'd have to a custom bootloader written for each model you sell, or just pick one model and reduce your audience.

They could use the compromised phone they sell you to phish or ransom you.

It's far more safer to just compromise a website or phish via emails/websites/fake apps, instead of selling malware on eBay and risk getting caught. And way way more easier to just make fake phone calls and pretend to be Microsoft support and then grab their credit cards or install malware on their PCs. So many easier and safer (anonymous) ways to scam people.

All of those only work if the software already on the phone allows them to work. Factory resets, updates, and USB flashing are all implemented by software.

Now you're entering the realm of really hypothetical scenarios here. Sure, what you're describing is theoretically possible, but faking the fastboot firmware is even more advanced than just simply patching the bootloader warning screen. If something like this was happening widely, we'd have heard about it by now. After all, Android phones have been around for 15 years. Now there have been a couple of instances of dodgy no-brand manufacturers/sellers shipping malware, but even these were just simple userland malware, nothing at the firmware level.

If you are that paranoid, then I guess you don't buy any piece of electronics from any retailer, and buy everything directly from the manufacturer always? I suppose you also walk directly to the factory, personally inspect the entire manufacturing and software development of the phone you intend to buy - because you don't trust the supply chain right? Sure, you may trust the manufacturer, but do you really trust the parcel package, the driver, the delivery person? Where do you draw the line exactly? Because in your hypothetical world, anyone can be a hacker right?