MetropleX [GrapheneOS] ⚡🟣 / MetropleX [GrapheneOS] ⚡🟣 is on Nostr

Freedom is the right of ALL sentient beings.

GrapheneOS Community Moderator
#GrapheneOS
Matrix: @metroplex:grapheneos.org

Discord: https://grapheneos.org/discord
Telegram: https://t.me/GrapheneOS
Matrix: https://matrix.to/#/#community:grapheneos.org

Personal Acct. Views Explicitly My Own
Likes and/or Boosts ≠ Endorsements

Last Notes

2024-01-11 19:30:00 UTC

- reply

CONTINUED
We've currently reported these issues for Pixels and will be filing similar issues with Samsung. We don't have as much leaked information about how they're doing it for Galaxy phones, but we can propose the same generic mitigations eliminating the main classes of vulnerabilities.
Secure element throttling is crucial to secure typical lock methods like a random 6 digit PIN or even a typical passphrase. Non-Pixel/non-iPhone devices are mostly missing it so data isn't safe even at rest for typical lock methods (much less than 7-8 random diceware words).
Pixels have used a secure element for this since the Pixel 2, but the NXP and ARM secure core Titan M1 had a fair number of vulnerabilities. Pixel 6 substantially improved this, so there's more focus on ever at exploiting the OS / firmware while the device isn't at rest.
For nearly any current generation secure element, there will likely eventually be a firmware vulnerability discovered. If you want to completely rule out a brute force, use a strong random passphrase. Can take good advantage of each user profile having separate encryption keys.
GrapheneOS has been heavily focused on securing against remote attacks and also providing privacy/security from apps. Those features make physical exploits harder, but we plan to add more features focused on it alongside auto-reboot and blocking new USB peripherals while locked.
Many apps and operating systems implement insecure duress features which can be bypassed. They do a standard wipe via reboot to recovery, which can be easily interrupted. Our implementation avoids this and will be shipped soon. However, we also proposed it to Android for the API.
Android 12 device admin API for disabling USB data is disappointing, since it's similar to what we already did and doesn't disable data lines.
Our default auto-reboot timer will be reduced from 72 hours. We also plan to add more attack surface reductions and other mitigations.

2023-10-04 19:57:39 UTC

- reply

Fantastic comparison between common alternate OS recommended in the #security and #privacy spheres for #Android devices.
Source: https://eylenburg.github.io/android_comparison.htm
#nevent1q…pdhv

2023-09-24 10:13:52 UTC

- reply

You cannot alter permissions of system components.
https://discuss.grapheneos.org/d/3038-comgoogleandroidiwlan/2

2023-04-09 08:44:33 UTC

- reply

UX is better 😉
Just be aware GrapheneOS and CalyxOS are much different. GrapheneOS is a hardened OS with substantial privacy and security improvements:
https://grapheneos.org/features
CalyxOS is not a hardened OS. It substantially reduces security. It recently went 2 months not shipping standard security patches.
Compatibility with Android apps on GrapheneOS is also much different. GrapheneOS provides our sandboxed Google Play compatibility layer:
https://grapheneos.org/usage#sandboxed-google-play
Can run the vast majority of Play Store apps on GrapheneOS, but not CalyxOS with the problematic microG approach.
CalyxOS uses Google services by default and give them privileged access, even if you don't use microG on CalyxOS.
grapheneos.org/faq#default-c…
Purpose of GrapheneOS is not specifically avoiding Google services but we do avoid using them as the default services.
To clarify, they always use Google services even without microG. They use Google for connectivity checks, network time, attestation key provisioning, SUPL, PSDS (Pixel 6 and 7), eSIM activation and more enabled by default.
Some of these involve sending data and could be considered privacy invasive. GrapheneOS has worked hard to avoid using Google services by default.
https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/ is a 3rd party article explaining some of the substantial differences between GrapheneOS and CalyxOS. It's a common misconception that they're similar. CalyxOS is far more similar to LineageOS than GrapheneOS. There are many other alternate OSes available
privsec.dev/posts/android/choosing-your-android-based-operating-system/ is another article about privacy and security differences between alternative Android-based operating systems. Talks about other alternate operating systems including DivestOS. Unlike most content, these are based on real experience and technical details.