5 ms·

GrapheneOS might be something you like. https://grapheneos.org https://grapheneos.org

ta17711771 6y ago
+1, this all day, over Linux phones with dubious security models/hardware switches that just delay exfiltration if it's going to happen on a non-verified boot device.
Shared404 6y ago
Thank you, this is super interesting and may well wind up being something that I wind up using in the future. I noticed that it only officially supports the Pixel devices. I've always avoided the Pixel devices because I assumed that the firmware was closed source and therefore a privacy issue, especially coming from google. However, the FAQ states "These devices meet the stringent privacy and security standards and have substantial upstream and downstream hardening specific to the devices." Am I mistaken about the Pixel drivers being closed source? If not, how is this statement verified?
- genghizkhan 6y ago
  The author doesn't mean that the drivers are open source. It's impossible to have a device with all drivers open sourced at the moment, hence the Pinephone. From the "supported devices" faq: "Devices need to be meeting the standards of the project in order to be considered as potential targets. In addition to support for installing other operating systems, standard hardware-based security features like the hardware-backed keystores, verified boot, attestation and various hardware-based exploit mitigations need to be available. Devices also need to have decent integration of IOMMUs for isolating components such as the GPU, radios (NFC, Wi-Fi, Bluetooth, Cellular), media decode / encode, image processor, etc., because if the hardware / firmware support is missing or broken, there's not much that the OS can do to provide an alternative. Devices with support for alternative operating systems as an afterthought will not be considered. Devices need to have proper ongoing support for their firmware and software specific to the hardware like drivers in order to provide proper full security updates too. Devices that are end-of-life and no longer receiving these updates will not be supported." Source: https://grapheneos.org/faq#device-support https://grapheneos.org/faq#device-support
  - Shared404 6y ago
    Thank you for the info and being so responsive to my questions. Sorry if I'm slow, this is outside of my normal range and my duckduckgo-fu is weak on this subject. I saw this part of the faq, but it was a bit beyond my comprehension. This is an extremely interesting topic to me however, could you point me toward where I could do better research on the topic? I'll keep looking around myself and post something here if I see it for anyone else who's interested.
    - genghizkhan 6y ago
      Asking questions is not a sin. I will endeavour to answer where I can. :) I'm no expert in this area myself (read as I've been educated by the internet and been too lazy to dig deeper), but I hope this reddit thread[0] leads you to some answers. Daniel Micay is the author of GrapheneOS, formerly CopperheadOS. [0]: https://www.reddit.com/r/GrapheneOS/comments/bddq5u/os_security_ios_vs_grapheneos_vs_stock_android/ https://www.reddit.com/r/GrapheneOS/comments/bddq5u/os_secur...
      - Shared404 6y ago
        Thank you :) This link does seem like a good place to start, thank you much.

+1, this all day, over Linux phones with dubious security models/hardware switches that just delay exfiltration if it's going to happen on a non-verified boot device.

Shared404 6y ago

Thank you, this is super interesting and may well wind up being something that I wind up using in the future. I noticed that it only officially supports the Pixel devices. I've always avoided the Pixel devices because I assumed that the firmware was closed source and therefore a privacy issue, especially coming from google. However, the FAQ states "These devices meet the stringent privacy and security standards and have substantial upstream and downstream hardening specific to the devices." Am I mistaken about the Pixel drivers being closed source? If not, how is this statement verified?

genghizkhan 6y ago
The author doesn't mean that the drivers are open source. It's impossible to have a device with all drivers open sourced at the moment, hence the Pinephone. From the "supported devices" faq: "Devices need to be meeting the standards of the project in order to be considered as potential targets. In addition to support for installing other operating systems, standard hardware-based security features like the hardware-backed keystores, verified boot, attestation and various hardware-based exploit mitigations need to be available. Devices also need to have decent integration of IOMMUs for isolating components such as the GPU, radios (NFC, Wi-Fi, Bluetooth, Cellular), media decode / encode, image processor, etc., because if the hardware / firmware support is missing or broken, there's not much that the OS can do to provide an alternative. Devices with support for alternative operating systems as an afterthought will not be considered. Devices need to have proper ongoing support for their firmware and software specific to the hardware like drivers in order to provide proper full security updates too. Devices that are end-of-life and no longer receiving these updates will not be supported." Source: https://grapheneos.org/faq#device-support https://grapheneos.org/faq#device-support
- Shared404 6y ago
  Thank you for the info and being so responsive to my questions. Sorry if I'm slow, this is outside of my normal range and my duckduckgo-fu is weak on this subject. I saw this part of the faq, but it was a bit beyond my comprehension. This is an extremely interesting topic to me however, could you point me toward where I could do better research on the topic? I'll keep looking around myself and post something here if I see it for anyone else who's interested.
  - genghizkhan 6y ago
    Asking questions is not a sin. I will endeavour to answer where I can. :) I'm no expert in this area myself (read as I've been educated by the internet and been too lazy to dig deeper), but I hope this reddit thread[0] leads you to some answers. Daniel Micay is the author of GrapheneOS, formerly CopperheadOS. [0]: https://www.reddit.com/r/GrapheneOS/comments/bddq5u/os_security_ios_vs_grapheneos_vs_stock_android/ https://www.reddit.com/r/GrapheneOS/comments/bddq5u/os_secur...
    - Shared404 6y ago
      Thank you :) This link does seem like a good place to start, thank you much.