How worried should I be about security patch levels?

[anon(5689577)]

Just to set this question up, I have an HTC One m8 (AT&T) that is on Android security patch level 2016-03-01 with a software number of 6.20.502.5. The phone is in excellent shape because I take very good care of it. My question has to do with the fact that security updates only come for a certain amount of time on Android and the situation is worse when you use a carrier locked phone. How important is it to have the latest security patch levels? Should we really worry enough to justify buying a new phone every 2-3 years? I honestly don't care as much about having the latest Android version even though it's fun to play with things after updates, but it seems to me to be reckless to leave your customers open for trouble.

 

[Aquila]

Really depends on your security habits and vigilance, but the best recommendation possible is to only buy devices from OEM's that guarantee monthly security updates, every month, for 3 years.

 

[anon(5689577)]

I have to say that I am pretty careful when it comes to what sites I visit and I never click on ads. My plan in the future is to stick with unlocked phones from manufacturers that have good reps for updates or just whatever Google is putting out. I guess I'll just wait till the end of the year and see what goes on sale. The sad thing is that I would love to buy the Nexus 6P but it won't get updates for that much longer and I'm not sure about buying the Pixel as it is a lot of money for a phone that misses on a few of the things that are important to me.

 

[Aquila]

I think you're probably going to be ok, but here is my short list of best strategies:

1. Don't install apps from third party sources. Use the Google Play Store. It has many built in security features that third party sites and stores do not provide.
2. Avoid fishy sites, etc. This is pretty straightforward.
3. Keep your passwords private.
4. Even within the Play Store, some apps are just shady. Anything that's promising to give you paid functionality for free is probably taking something else from you. Read Terms of Service and Privacy Policies.
5. Unsecured WiFi is not your friend. Even at Starbucks. Google devices have a way to make them more secure, but in general - keep your data visible to you only.

Long story short: Shady stuff is shady, common sense is good

 

[anon(5689577)]

I appreciate your advice and this makes me feel better about it. I follow all these points and was just wondering if this is sufficient. My next device will probably come directly from Google, but I like to get the most out of the money I spend and I hate to ditch a phone that works well and is in great shape if I don't really need to yet.

Thanks.

 

[Aquila]

Sounds like you are in good shape to use it longer