Xtreix

https://infosec.exchange/@Xtreix

Public Key

npub1hw9kxfgvtdq6whfnsd34g4eg0w46hyxcqnunpztuzm0ehwh0ja6q22j60r

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsthzmry5x9ksd8t5ecxc652u58h2atjrvqf7fs397pdhumhthewaqprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntnmzlg3

Publishing to

relay.momostr.pink

Author Public Key

npub1hw9kxfgvtdq6whfnsd34g4eg0w46hyxcqnunpztuzm0ehwh0ja6q22j60r

Show more details

Last Notes

2026-04-06 08:15:22 UTC

- reply

Duval's statement at 5:07:
“We don't have a hardened security approach, we're not developing a phone so that pedophiles (word censored in the video) can evade justice.
So there aren't any advanced features, like checking if the memory is corrupted, etc, really hardened features that might be useful for presidents, secret agents, and so on...”
The reference to a hardened phone intended for pedophiles is a direct reference to GrapheneOS, the only hardened mobile operating system available, as well as to phones compatible with the project and any other projects or devices that might adopt the same approach. These verbal statements follow a long series of false claims about GrapheneOS on social media.
He then states that this hardening may prove effective, but continues with the fallacious logic that it is useful only for high-value, targeted individuals or criminals, and that lambda people would never need it and would have no reason to use enhanced security to protect their data. He claims that GrapheneOS is for a minority and that /e/OS is for everyone.

2026-04-05 21:32:11 UTC

- reply

"I don't think you should attack frontally others like that whenever"
Gael Duval attack GrapheneOS, GrapheneOS responds to these attacks.
"I understand its CEO and the Murena company might have attack the GrapheneOS project in the past"
It's not in the past, these attacks are recuring, and he does it again in this recent video. Duval has been waging a disinformation campaign against GOS for years.

2026-03-26 20:52:52 UTC

- reply

The French Wikipedia page for GrapheneOS is currently the only accurate one and I am one of the contributors, another community member started rewriting the page, and I joined in. I haven't contributed to the page in quite a while, but everything looks fine to me.
The US page is managed by people hostile to GrapheneOS, as you already know. If you change the content, a member will revert your edit. I’ve tried several times with no success, it’s deplorable.
Attacks from scammers and companies selling snake oil seem to have intensified since the collaboration with Motorola Mobility. It’s absurd how many trolls and malicious people I see on X, and it’s almost impossible to respond to them all. This social network is terrible, I’ve rarely seen so much violent content on a platform, fortunately, there are also people who support the project.

2026-03-25 15:20:24 UTC

- reply

It was Motorola Mobility that reached out to the GrapheneOS project to propose a collaboration, previously, GrapheneOS’s own proposals for collaboration had not come to fruition, given this, Motorola Mobility’s proposal was a golden opportunity, and GrapheneOS was certainly going to accept it.
Fairphone will never be compatible with GrapheneOS. Fairphone has chosen to support and collaborate with for-profit companies that attack the GrapheneOS project (Iodé and Murena). Fairphone has made its own choice and taken a path completely opposite to that of GrapheneOS; they are also opposed to improving the security of their devices.

2026-03-19 17:17:14 UTC

- reply

SailfishOS is a scam who has collaborated with the Russian government before the invasion of Ukraine and continues to have ties to the Russian government. AuroraOS, used by the Russian government, is a fork of SailfishOS.
Curve Pay work well on GrapheneOS for the contactless payment, available for EU users currently, and I recently discovered a interesting a project that look interesting, which is actually in development.
"Are there other alternatives to UA there?"
Unified Attestation is an alternative of Google Play Integrity API, both are abusive, illegal and completely useless.
The AOSP attestation hardware is available since Android 8, is functional, and is neutral.
https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/287#issuecomment-4085348754
https://www.curve.com/
https://walt.is/
https://techcrunch.com/2016/11/29/jollas-sailfish-os-now-certified-as-russias-first-android-alternative/
https://en.wikipedia.org/wiki/Aurora_OS_(Russian_Open_mobile_platform)

2026-03-18 21:27:56 UTC

- reply

It would be great if banking apps could work without Google Play Services; that said, keep in mind that on GrapheneOS, you install Play Services and Google Play as standard, non-privileged apps that run in the hardened sandbox.
This is a significant difference compared to stock Android, where Google Play Services runs as a system app with elevated privileges that you cannot control. MicroG works in the same way and is often mistakenly presented as a more private alternative to Google Play Services.
What cross-app sandboxing doesn't protect is communication between apps based on mutual consent. If you install Instagram and Facebook on the same profile, the apps still only have access to what you authorize them to access, but since they belong to Meta, they could exchange telemetry data with each other.
To stop this, the solution is to use a system-wide secondary profile, which offers excellent isolation but is somewhat cumbersome to use, or the private space, which provides less robust isolation but is easier to use. This decision really depends on your threat model and whether or not you consider plausible communication between these applications to be acceptable.
https://grapheneos.org/usage#sandboxed-google-play

2026-03-18 18:58:29 UTC

- reply

Most banking apps work well on GrapheneOS; check out this list : https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/
The attestation compatibility guide is a good, neutral approach that is not controlled by a centralized authority : https://grapheneos.org/articles/attestation-compatibility-guide
Unified Attestation threatens the compatibility of apps for developers who refuse to participate in their illegal cartels. This seriously undermines the efforts of a project like GrapheneOS, which strives to make as many Android apps as possible compatible with a truly secure and privacy-respecting operating system, one without user accounts, AI, age verification, client-side analysis, or any default Google services nor any other tech companies, etc
We need to support it because there’s no one else doing what GrapheneOS does.

2026-03-18 15:07:03 UTC

- reply

An anti-competitive cartel violates the principle of fair competition not only in Canada but in most countries, including the EU.
https://competition-policy.ec.europa.eu/antitrust-and-cartels_en
Unified Attestation is an initiative with Murena, Iodé, and Volla, three untrustworthy for-profit companies that want to copy Google’s Play Integrity API, which is already abusive and illegal, to manipulate the market and impose their misleading standards.
There is nothing neutral about it, and the fact that it’s “open-source” doesn’t change a thing.

2026-01-14 22:31:07 UTC

- reply

Do not fuel harassment and defamation against the GrapheneOS project and community. You mention names of people who have engaged in a lot of harassment. Louis Rossman is a verified member of the Kiwi Farms community, the Kiwi Farms is responsible for several murders of people they targeted. They used the same tactics against the founder.
Read this : https://infosec.exchange/@npub1uzd…puyd/115876236319557052

2026-01-14 21:54:50 UTC

- reply

NFC work on GrapheneOS, It's the contactless payment via Google Pay that is not working. If you live in EU, Curve Pay work and is recommended, Curve Pay should be made available in the US and Canada.
I do not use ‘Find my device’ apps, so I cannot answer that question.

2025-11-18 10:13:20 UTC

- reply

"Just deal with the fact that no matter how good your product is, there will always be critics. The world is not fair. There will always be differing perspectives."
These are not criticisms, they are attacks and harassment committed by a malicious person and scammer.

2025-09-28 21:12:35 UTC

- reply

I too am disappointed by the lack of security on most Android devices, which is one of the reasons why GrapheneOS is collaborating with a major OEM, and recent changes made by Google have accelerated this need.
But the situation is what it is, and there is no point in not recommending GrapheneOS because of this, or even complaining about it without taking a step back. Google Pixel devices from the 8 series onwards get seven years of security updates from launch, and this period is expected to increase. For example, $499 for a Google Pixel 9a with 7 years of full security updates and all hardware security measures is a very attractive choice and good value for money. you have to look at the price you pay over time rather than the price at the time of purchase, it will also have a higher resale value, paying $200-$300 for a low-end device with hardware that is easily vulnerable to physical and remote attacks, with a broken operating system, tons of bloatware, software bugs, and no software or hardware security updates in less than 7 years is actually very expensive.

2025-09-28 20:48:24 UTC

- reply

Devices that meet these standard security requirements can officially support GrapheneOS: https://grapheneos.org/faq#future-devices
@npub1kwa…e0nj is collaborating with a major OEM to build a subset of devices that meet security requirements to natively support GrapheneOS. We would have an alternative to the Google Pixel, on a device whose hardware is controlled by GrapheneOS.Collaboration with this OEM enables GrapheneOS to provide early access to security patches.
Currently, Google Pixels are the only Android devices that meet standard security requirements. GrapheneOS is a privacy project that enhances security to protect that privacy, so it will not lower its standards by officially supporting a bunch of insecure devices. These devices will require maintenance rather than allowing the project to focus on its core mission, and the project will not be able to offer good privacy/security to users. This is a problem on the part of the manufacturers, not GrapheneOS.
A used Pixel 9a or Google 8a at a good price would be an excellent choice if you are on a limited budget.

2025-08-27 15:25:01 UTC

- reply

That doesn't make any sense for me. Pixel devices, especially generations 8 and 9, are excellent devices for GrapheneOS. They support MTE and have 7 years of full security updates since the launch day. They are very secure Android devices, and we hope that the Pixel 10 will meet the requirements of the GrapheneOS project.
GrapheneOS is working with an OEM to release mobile devices that are natively compatible with GrapheneOS, which is great, but for now, it's not available at all. If all goes well, we hope for 2026-2027, but if you want GrapheneOS now, don't count on devices that don't exist yet and just get a Pixel 8 or 9. Buy used if you don't want to give money to Google, although that makes no sense to me. A common misconception is that GrapheneOS is anti-Google, which is not true. Its goal is to provide a secure and private operating system; ideology has nothing to do with it.

2025-07-19 19:12:02 UTC

- reply

Evoking “jealousy” is a common response when one lacks relevant arguments whereas GrapheneOS does an excellent job of communicating to inform the public about ongoing scams, they are extremely dedicated, and very often respond with answers of several detailed paragraphs, they often respond with more answers than the person asking the question expects in the first place, but I'm sure you do better.
/e/OS are not colleagues of GrapheneOS, and the competitor is iOS that GrapheneOS respects.

2025-02-20 17:14:33 UTC

- reply

It's because of the nonsense willingly spread by a scam artist like Rob Braxman, whom many people listen to with intent, that unfounded rumors are created and spread about legitimate projects like GrapheneOS and Signal, now imagine that a user with a high level of threat model falls for this false marketing that gives him a false sense of security when his life depends on it, this is not normal, people like Braxman should be attacked and his content reported to the community, if I had strong hacking skills with a team to help me, I'd hack his services to break them.
In addition, Rob Braxman is a supporter of Kiwi Farms (and more) which is a community that facilitates and practices online harassment, they target autistic people, trans etc, anyone they deem harmful to society and the ultimate goal is to get the target killed, such as suicide or swatting type attacks, I've been on their forums several times, read the discussion topics and seen the many messages of hate and harassment towards targets, often with always a lot of mockery, it's unacceptable.