How risky is to use non-free wireless network driver?

Question

Intel wireless network adapter in my computer requires a non-free driver to work. I don't want to install non-free software to my debian system. However it is a notebook and without wireless network it is not very useful for me.

I wonder how risky is to install this driver with regard to surveillance. I mean, do you think it is actually possible that wireless network driver may act maliciously and let some authority or third party collect the data my computer transfers via wireless network?

I suspect that such behavior would cause a scandal if detected, therefore it seems unlikely to me to some extent. On the other hand we have become more familiar with scandals about big IT companies in recent years.

Or is this question fundamentally meaningless because hardware may act maliciously by itself and there is nothing we can do about it, which makes using non-free or free driver irrelevant?

Do you think it would be meaningful not to use wireless network hardware installed to my notebook but try instead to find another solution because of this non-free driver?

Answer 1

A closed binary is harder to audit than something you have source for, so technically you add some risk by doing this.

However, you may already be taking equal or greater risks:

• Are you compiling Debian from source yourself or downloading a binary ISO?
• Are you auditing the source code yourself or just assuming someone else has done it, like everyone assumed someone was checking the OpenSSL source.
• If you're building from source, how do you know the compiler is OK?
• As you mention, how do you know someone hasn't tampered with the hardware?
• Is your BIOS open source? (I would have linked to that weird farming laptop Stallman used to use but apparently he has a ThinkPad now.)

As always, you must evaluate your threat model and assess the risk for yourself.

Answer 2

Commercial software, read as in closed source, has not been subjected to the same scrutiny as its free(and open source) counterpart. Unless every instruction or every line of code has been reviewed the possibility that there may be a side functionality that may be categorised as malicious is there.

Richard Stallman shed some light on one of Ubuntu's features that involved uploading user searches to a third party by default, without asking for consent.

Another example I can think of is adware which shipped with lenovo machines. There were also hardware backdoors found on some boxes provided by the same manufacturer.

It's pretty unlikely that you need a proprietary driver for wireless to work. What notebook are you using?

Answer 3

Let's rephrase your question: You are afraid of installing a software driver but are not afraid of plugging closed-source hardware into your network. A software driver can be reverse-engineered rather easily, reverse-engineering a hardware device would require much more effort and equipment. The actual decision to leak data may go either way.

My advice to you would be to read the EULA and privacy policy very carefully, both for the device and the driver. Most companies with semi-competent legal departments would put disclaimers and caveats in small print that shields them from litigation and should in fact alert users to the possible danger.

You should also minimize the closed-source software you install: a driver package, but not superfluous fancy GUI front-ends, for instance.

What's more, you should check where the driver comes from: you'd like TLS secured connection while downloading, checking the certificates against a MITM attack, verifying if the signatures match the package, and reading around on the forums for others' experience.

---

NB: If the data you process are that sensitive that you won't trust the NSA/GCHQ to handle them, buying a laptop that's connected to the Internet and has a wireless card is in itself a reckless act.