3 ms·

Has anyone here looked at the security of Lineage? I know it's a rebrand/fork of Cyanogen, but I don't actually know much about it as a project. It seems to be

Has anyone here looked at the security of Lineage? I know it's a rebrand/fork of Cyanogen, but I don't actually know much about it as a project. It seems to be the only image that works with Waydroid (the Android environment for Linux tablets), but I am not super comfortable entering my passwords into a project I don't know much about.

yellow_lead 3y ago
If you are concerned with security, you might be interested in GrapheneOS. It has some nice added security features, but only works with Pixel phones. This article has some good info about the security of LineageOS, although the biggest complaint comes from the physical security implications of unlocking the bootloader. https://madaidans-insecurities.github.io/android.html https://madaidans-insecurities.github.io/android.html
- bsimpson 3y ago
  Thanks! Since it's running in an emulator, I'm less concerned about bootloader and adb. More concerned about keyloggers, malware, etc.
  - yellow_lead 3y ago
    I think you'll be fine for that purpose, it's a large reputable open source project. It's not impossible that someone has sneaked in a bug or exploit, but I don't think any overt attempts would make it in. Similar to Linux or other large open source projects.
charcircuit 3y ago
LineageOS prioritizes device compatibility and maintainability over security. I do not think this is a good tradeoff to make as normal people don't care about such security until it is too late.
- RedComet 3y ago
  Surely having some vulnerabilities patched is better than having none patched. I don't think the crowd running Lineage is doing so in lieu of the latest iPhone.
- brnt 3y ago
  I think it's wild how universal the idea that a phone is a place for secrets had become. A device you are most likely to lose, break or get stolen by virtue of being outside of your home for much of the day.
  - c0l0 3y ago
    ... and where users are going to use it to do EVERYTHING in their daily digital lives, from doing financial transactions and accessing work email, to playing data-exfiltrating "free" games and surfing porn. And where the only actually viable location for backing up the data stored on it is some Big Tech conglomerate's cloud. I agree it's pretty crazy.
aboringusername 3y ago
Lineage is more about convenience and longevity rather than security and privacy. As another commenter said, Graphene is most suitable for this task if it's a major concern. Take a random device like Google Pixel [1] it runs on a 4.4 kernel, long outdated and no longer maintained by Google. You can explore the code [2] however you are not going to be getting critical security updates (such as those issued by Qualcommm or any closed source blobs/firmware etc, and those released as per the pixel/android security bulletins). Lineage is more about 'hacking' a kernel and making it work with the latest AOSP when the official software support ends. It's more vulnerable to exploits than a continuously supported device (although even devices that are 'in support' by the OEMs can often be depressingly behind things like patches etc). Google is trying to fix this within the ecosystem (GKI, Apex etc) but at least as far as custom ROMs go...yeah, don't store state secrets on such a device ;) [1]: https://wiki.lineageos.org/devices/sailfish/ https://wiki.lineageos.org/devices/sailfish/ [2]: https://github.com/LineageOS/android_kernel_google_marlin https://github.com/LineageOS/android_kernel_google_marlin
- yjftsjthsd-h 3y ago
  > Lineage is more about convenience and longevity rather than security and privacy. As another commenter said, Graphene is most suitable for this task if it's a major concern. Are there devices which graphene supports which aren't fully patched on lineage? AFAIK graphene is just outright not supporting devices without current kernel updates, while lineage does best effort on the long tail, meaning that on the same device they'll have the same kernel.

yellow_lead 3y ago

If you are concerned with security, you might be interested in GrapheneOS. It has some nice added security features, but only works with Pixel phones. This article has some good info about the security of LineageOS, although the biggest complaint comes from the physical security implications of unlocking the bootloader. https://madaidans-insecurities.github.io/android.html https://madaidans-insecurities.github.io/android.html

bsimpson 3y ago
Thanks! Since it's running in an emulator, I'm less concerned about bootloader and adb. More concerned about keyloggers, malware, etc.
- yellow_lead 3y ago
  I think you'll be fine for that purpose, it's a large reputable open source project. It's not impossible that someone has sneaked in a bug or exploit, but I don't think any overt attempts would make it in. Similar to Linux or other large open source projects.

charcircuit 3y ago

LineageOS prioritizes device compatibility and maintainability over security. I do not think this is a good tradeoff to make as normal people don't care about such security until it is too late.

RedComet 3y ago
Surely having some vulnerabilities patched is better than having none patched. I don't think the crowd running Lineage is doing so in lieu of the latest iPhone.
brnt 3y ago
I think it's wild how universal the idea that a phone is a place for secrets had become. A device you are most likely to lose, break or get stolen by virtue of being outside of your home for much of the day.
- c0l0 3y ago
  ... and where users are going to use it to do EVERYTHING in their daily digital lives, from doing financial transactions and accessing work email, to playing data-exfiltrating "free" games and surfing porn. And where the only actually viable location for backing up the data stored on it is some Big Tech conglomerate's cloud. I agree it's pretty crazy.

aboringusername 3y ago

Lineage is more about convenience and longevity rather than security and privacy. As another commenter said, Graphene is most suitable for this task if it's a major concern. Take a random device like Google Pixel [1] it runs on a 4.4 kernel, long outdated and no longer maintained by Google. You can explore the code [2] however you are not going to be getting critical security updates (such as those issued by Qualcommm or any closed source blobs/firmware etc, and those released as per the pixel/android security bulletins). Lineage is more about 'hacking' a kernel and making it work with the latest AOSP when the official software support ends. It's more vulnerable to exploits than a continuously supported device (although even devices that are 'in support' by the OEMs can often be depressingly behind things like patches etc). Google is trying to fix this within the ecosystem (GKI, Apex etc) but at least as far as custom ROMs go...yeah, don't store state secrets on such a device ;) [1]: https://wiki.lineageos.org/devices/sailfish/ https://wiki.lineageos.org/devices/sailfish/ [2]: https://github.com/LineageOS/android_kernel_google_marlin https://github.com/LineageOS/android_kernel_google_marlin

yjftsjthsd-h 3y ago
> Lineage is more about convenience and longevity rather than security and privacy. As another commenter said, Graphene is most suitable for this task if it's a major concern. Are there devices which graphene supports which aren't fully patched on lineage? AFAIK graphene is just outright not supporting devices without current kernel updates, while lineage does best effort on the long tail, meaning that on the same device they'll have the same kernel.