4 ms·

127 comments so far with no mention of the partial solution described at the bottom of the article: > take all the Play stuff and move it out of its tight inte

127 comments so far with no mention of the partial solution described at the bottom of the article: > take all the Play stuff and move it out of its tight integration with the low level system and into userland, where it can be sandboxed. That gives you back granular control over all the resources Play Services wants to use, and what data it and the app which use it want to send back. That's the approach GrapheneOS takes, a Pixel-only open source Android distro – OK, ROM – that by many reports hits the sweet spot of maximum control over security with minimal impact on the daily Android experience. > Teamed with a second-hand last-but-one generation Pixel, GrapheneOS raises the seemingly oxymoronic possibility that the most data-tight and user-configurable mobile platform costs less than $200, has negligible environmental impact, and is powered by the data ogre Google itself. > It doesn't matter how badly the FBI, NSA, GCHQ or the dictatorships behave, they can't have your data if you never send it. You'll still have to take care of what you do online and how you do it, but at least you can build that castle on a halfway decent rock.

georgeecollins 3y ago
I don't think that is a workable solution for your average citizen.
- kornhole 3y ago
  I gave one to my sister, mom, and tech challenged partner. They love them. The area that required help was coaching them on operational security by picking better apps/networks and maintaining their firewall settings properly.
  - standardUser 3y ago
    And the millions of people who don't know anyone who knows what half those words mean?
maerF0x0 3y ago
The more important piece highlighted by your comment is "Why should we have to?" They're the one committing crimes, in pursuit of hypothetical crimes we're not committing, and also with very little evidence that what they're doing even helps. They've broken trust and should lose all access.
- cookieperson 3y ago
  I feel like I'm missing a big event or something... What has the FBI done that's worse than what advertising companies have been doing for years?
  - Aerbil313 3y ago
    Heard of PRISM?
  - chaxor 3y ago
    Great point - a good threat model usually targets all companies first, such as FAANG, since they are the worst aggressors, and are well known to be leaky (data dumps of personal info are leaked almost daily now), whereas the government tends to be seemingly less leaky and have more narrow data interests, i.e. less interested in the wide array of data that companies extract from people. It's strange how often the government is the main entity discussed in privacy concerns while completely ignoring the much larger problem of corporations in that area.
    - maerF0x0 3y ago
      > more narrow data interests, Except that the government has instituted dragnets that effectively hoover up the data of everyone https://www.eff.org/deeplinks/2022/06/effs-flagship-jewel-v-nsa-dragnet-spying-case-rejected-supreme-court https://www.eff.org/deeplinks/2022/06/effs-flagship-jewel-v-...
  - kornhole 3y ago
    Much of the big events of lately are more related to mass surveillance, censorship, and election interference. Check out the Twitter Files, Russiagate, and final Durham report on Racket.news. Congress has been holding a special investigation on the weaponization of the federal government related to this but more broadly. Recently FBI admitted to having many operatives in the capitol on January 6. Then you had the recent revelation that the FBI violated rules ~280,000 times by accessing private information without a warrant. There is so much more, but whatever large centralized internet services or data brokers can gather is potentially available to government agencies.
kornhole 3y ago
Yes this is the option striking the best balance of function and security which I have been using for over three years. I have tried other custom operating systems and debloated carrier provided devices, but Graphene tops all the options IMO. The baseband could be exploited for targeted surveillance. First they would need to identify your device. If your device is anonymous and you carefully use your SIM for data only, identification is difficult. Brave and patient folks are working on Linux handsets such as Librem and Pinephone that have fewer attack vectors. I hope to switch to one of those when my Pixel stops receiving updates.
- gjsman-1000 3y ago
  Don't forget about your cellular provider. They can always easily triangulate your location. And if they know where it is at night, almost every night...
cookieperson 3y ago
Are there other trust worthy distros for older not Google android devices? I remember checking out the space half a decade ago and it was dismal. IE, may brick your device, may be malware, may have worse security issues, etc.
- yencabulator 3y ago
  The problem with older hardware is that all the phone kernels are such piles of kludges, and once the manufacturer stops maintaining the kernel fork and/or binary driver blobs, you get no security updates for wifi/bluetooth/baseband bugs.
barbariangrunge 3y ago
Can you use ordinary android apps that way? Or do you end up needing the play store and you lose your security benefits?
anotherevan 3y ago
Would want to use Grapheneos but not being able to do NFC payments with it holds me back. It's just so damned convenient. There's no real alternative to Google Wallet for this that I'm aware of in my part of the world (Australia).
- yencabulator 3y ago
  Get a phone case that lets you have an NFC-capable credit card in the back? Not exactly the same, but might be good enough. (I do appreciate the advantage phones have; you have to unlock the phone first, NFC is not always active.)
  - anotherevan 3y ago
    We're big users of NFC cards in Australia, so have already been using those for years. The convenience factor for me is that I don't have to collect the paper receipts! At the end of the week I just bring up the Google Wallet app's transaction history and enter that data into my home finance tracking software.

georgeecollins 3y ago

I don't think that is a workable solution for your average citizen.

kornhole 3y ago
I gave one to my sister, mom, and tech challenged partner. They love them. The area that required help was coaching them on operational security by picking better apps/networks and maintaining their firewall settings properly.
- standardUser 3y ago
  And the millions of people who don't know anyone who knows what half those words mean?

maerF0x0 3y ago

The more important piece highlighted by your comment is "Why should we have to?" They're the one committing crimes, in pursuit of hypothetical crimes we're not committing, and also with very little evidence that what they're doing even helps. They've broken trust and should lose all access.

cookieperson 3y ago
I feel like I'm missing a big event or something... What has the FBI done that's worse than what advertising companies have been doing for years?
- Aerbil313 3y ago
  Heard of PRISM?
- chaxor 3y ago
  Great point - a good threat model usually targets all companies first, such as FAANG, since they are the worst aggressors, and are well known to be leaky (data dumps of personal info are leaked almost daily now), whereas the government tends to be seemingly less leaky and have more narrow data interests, i.e. less interested in the wide array of data that companies extract from people. It's strange how often the government is the main entity discussed in privacy concerns while completely ignoring the much larger problem of corporations in that area.
  - maerF0x0 3y ago
    > more narrow data interests, Except that the government has instituted dragnets that effectively hoover up the data of everyone https://www.eff.org/deeplinks/2022/06/effs-flagship-jewel-v-nsa-dragnet-spying-case-rejected-supreme-court https://www.eff.org/deeplinks/2022/06/effs-flagship-jewel-v-...
- kornhole 3y ago
  Much of the big events of lately are more related to mass surveillance, censorship, and election interference. Check out the Twitter Files, Russiagate, and final Durham report on Racket.news. Congress has been holding a special investigation on the weaponization of the federal government related to this but more broadly. Recently FBI admitted to having many operatives in the capitol on January 6. Then you had the recent revelation that the FBI violated rules ~280,000 times by accessing private information without a warrant. There is so much more, but whatever large centralized internet services or data brokers can gather is potentially available to government agencies.

kornhole 3y ago

Yes this is the option striking the best balance of function and security which I have been using for over three years. I have tried other custom operating systems and debloated carrier provided devices, but Graphene tops all the options IMO. The baseband could be exploited for targeted surveillance. First they would need to identify your device. If your device is anonymous and you carefully use your SIM for data only, identification is difficult. Brave and patient folks are working on Linux handsets such as Librem and Pinephone that have fewer attack vectors. I hope to switch to one of those when my Pixel stops receiving updates.

gjsman-1000 3y ago
Don't forget about your cellular provider. They can always easily triangulate your location. And if they know where it is at night, almost every night...

cookieperson 3y ago

Are there other trust worthy distros for older not Google android devices? I remember checking out the space half a decade ago and it was dismal. IE, may brick your device, may be malware, may have worse security issues, etc.

yencabulator 3y ago
The problem with older hardware is that all the phone kernels are such piles of kludges, and once the manufacturer stops maintaining the kernel fork and/or binary driver blobs, you get no security updates for wifi/bluetooth/baseband bugs.

barbariangrunge 3y ago

Can you use ordinary android apps that way? Or do you end up needing the play store and you lose your security benefits?

anotherevan 3y ago

Would want to use Grapheneos but not being able to do NFC payments with it holds me back. It's just so damned convenient. There's no real alternative to Google Wallet for this that I'm aware of in my part of the world (Australia).

yencabulator 3y ago
Get a phone case that lets you have an NFC-capable credit card in the back? Not exactly the same, but might be good enough. (I do appreciate the advantage phones have; you have to unlock the phone first, NFC is not always active.)
- anotherevan 3y ago
  We're big users of NFC cards in Australia, so have already been using those for years. The convenience factor for me is that I don't have to collect the paper receipts! At the end of the week I just bring up the Google Wallet app's transaction history and enter that data into my home finance tracking software.