5 ms·

“Privacy Protection: No Tracking, No Google” - but the remote attestation and secure boot are based on Titan M: Google designed silicon. So do you trust Google

“Privacy Protection: No Tracking, No Google” - but the remote attestation and secure boot are based on Titan M: Google designed silicon. So do you trust Google or don’t you? Because they built the phone, and wrote the software, and designed the HSM. Nitro ripped out the mics and deleted the play store. Good luck evading the government with that.

fragileone 5y ago
A cryptographic hardware key does not allow tracking you in the same way that Google Play Services does 24/7. GrapheneOS doesn't connect to Google servers unless you opt for it to.
- nicce 5y ago
  > A cryptographic hardware key does not allow tracking you in the same way that Google Play Services does 24/7. Well, with backdoored HSM module tracking is the least of your problems.
- lucideer 5y ago
  > in the same way This is an odd phrasing since a cryptographic hardware key does allow tracking (in a different way), so the fact it's different seems hardly relevant. For example a compromised Titan M could open you up completely to MITM of any network connections your device makes. It could also allow any entities that already have some limited access to your device (i.e. an app restricted via OS perms) to gain broader access to sensitive data on your device.
  - grey-area 5y ago
    There are levels of security - If you need protection against malicious states or corporations specifically targeting you, this isn't good enough for the reasons you point out. If you just want to avoid google tracking you via their various services to show you ads, this is probably sufficient.
    - lucideer 5y ago
      Oh I agree; everything is a matter of making informed compromises. I just thought the phrasing was a bit odd and absolutist, and somewhat misleading. I'd generally put a reasonable amount of trust in a Titan M personally - the risk factor compared to Play Services is minuscule - but I still want to be aware of the mechanisms of risk. Implying it's non-existent doesn't help anyone.
      - imwillofficial 5y ago
        It’s obvious nobody said risks didn’t exist.
        fsflover 5y ago
        > Privacy Protection: No Tracking, No Google
        imwillofficial 5y ago
        So you think they meant no Google at all on or in the device? Because to be clear, we are talking about a Google Phone running a GoogleOS. I fail to see how you can interpret their ad in the way you did while having that context.
      - javajosh 5y ago
        Well, I mean, they are talking about customizing a Pixel 4a, which is made by Google. So I while I think it's reasonable to question the meaning of "No Google", it's clear that Google cannot and will not be taken out of the picture entirely, since they make the hardware.
        joemazerino 5y ago
        Pixels can run without Google involvement. Instead of a phone, think of a Pixel as an empty Pepsi bottle filled with delicious Jolt cola instead.
temptemptemp111 5y ago
True - and hopefully this energy can be put towards groups actually building / modding. Can we get a FOSS Titan-like chip that we can just swap out on the boards? Bulk order from the same manufacturer could be well priced.

fragileone 5y ago

A cryptographic hardware key does not allow tracking you in the same way that Google Play Services does 24/7. GrapheneOS doesn't connect to Google servers unless you opt for it to.

nicce 5y ago
> A cryptographic hardware key does not allow tracking you in the same way that Google Play Services does 24/7. Well, with backdoored HSM module tracking is the least of your problems.
lucideer 5y ago
> in the same way This is an odd phrasing since a cryptographic hardware key does allow tracking (in a different way), so the fact it's different seems hardly relevant. For example a compromised Titan M could open you up completely to MITM of any network connections your device makes. It could also allow any entities that already have some limited access to your device (i.e. an app restricted via OS perms) to gain broader access to sensitive data on your device.
- grey-area 5y ago
  There are levels of security - If you need protection against malicious states or corporations specifically targeting you, this isn't good enough for the reasons you point out. If you just want to avoid google tracking you via their various services to show you ads, this is probably sufficient.
  - lucideer 5y ago
    Oh I agree; everything is a matter of making informed compromises. I just thought the phrasing was a bit odd and absolutist, and somewhat misleading. I'd generally put a reasonable amount of trust in a Titan M personally - the risk factor compared to Play Services is minuscule - but I still want to be aware of the mechanisms of risk. Implying it's non-existent doesn't help anyone.
    - imwillofficial 5y ago
      It’s obvious nobody said risks didn’t exist.
      - fsflover 5y ago
        > Privacy Protection: No Tracking, No Google
        imwillofficial 5y ago
        So you think they meant no Google at all on or in the device? Because to be clear, we are talking about a Google Phone running a GoogleOS. I fail to see how you can interpret their ad in the way you did while having that context.
    - javajosh 5y ago
      Well, I mean, they are talking about customizing a Pixel 4a, which is made by Google. So I while I think it's reasonable to question the meaning of "No Google", it's clear that Google cannot and will not be taken out of the picture entirely, since they make the hardware.
      - joemazerino 5y ago
        Pixels can run without Google involvement. Instead of a phone, think of a Pixel as an empty Pepsi bottle filled with delicious Jolt cola instead.

temptemptemp111 5y ago

True - and hopefully this energy can be put towards groups actually building / modding. Can we get a FOSS Titan-like chip that we can just swap out on the boards? Bulk order from the same manufacturer could be well priced.