How can I protect my phone against Krack Attacks if no updates are forthcoming? Today, there was disclosure about Krack Attacks that affect WPA2. The attacks are primarily executed against end-point devices (phones, laptops).

In many cases, you can patch your router. The way the vulnerability works, according to the website author:


  This means a patched client can still communicate with an unpatched access point, and vice versa.


In cases where the router is patched, we're cool. But sometimes, I have access to WiFi networks outside of my control, and I can't guarantee they're patched.

For these cases, it makes sense to patch my device -- but (based on the Linux driver source), for my specific phone (and I'm sure many others), I don't forsee updates ever becoming available -- we just don't get updates.

In these cases, what can I do to minimize or mitigate the risk of this attack?

Someone recommended using HTTPS Everywhere, which is (unfortunately) only available in Firefox on Android.
If your phone manufacturer or service provider will not push updates there are a few things you can do (some already mentioned in comments.) From easiest to hardest, these would be:


turn off wifi and only use mobile data (easy but possibly expensive, depending on your plan)
update your own wifi router, and only use wifi on your network and others that are confirmed patched
buy a new phone (They will have updates - could this be an excuse to get a new one?)
use a different kernel. LineageOS is generally leading edge, as Једноруки mentioned, so it will have an update very soon
write your own kernel. Tools exist to help you work on Android kernels, and the update required is publicly documented.


The thing to remember is that currently it is unlikely to happen. Yes, once the exploit is out there and spreading, you'll want to be on a patched phone, but don't panic about it today. And the attack is mitigated by VPN's, https etc.

For technical analysis and up to date security commentary on this, look at the Krack tag on Security Stack Exchange.