3 ms·

> Qualcomm RTOS can do what exactly? The RTOS could be used to leak your location, the fact that you're using a VPN, any nonVPN traffic, and call traffic. FWI

> Qualcomm RTOS can do what exactly? The RTOS could be used to leak your location, the fact that you're using a VPN, any nonVPN traffic, and call traffic. FWIW, I was mistaken and Google uses Samsung radios rather than Qualcomm. Graphine OS runs in the Normal Zone on an ARM SoC while running Trusty OS in the TEE. In order for an App, or Graphine OS to interact with certain hardware it must use the Trusty Lib and Trusty Driver APIs into the TEE. The entire composition and operation of the Trusty OS operates in the "Trust me bro" space and Google's entire business model is built around spying on users. So forgive me if I'm a little skeptical that Graphine OS.

grayhatter 2y ago
Google's business model is selling ads, all the data collection is so they can charge more for the ads they sell. The more you trust the platform, the more info you'll willingly give to Google, the more they can charge for ads. The more you trust your phone, the more you'll use your phone, the more chances Google has to collect information. They don't need to directly "spy" on you using means outside the normal data collection where you give them data. Thus, while I agree the "just trust me bro" attitude is borderline incompetence when it comes to security. I'm unconvinced that Google would take the risk of attempting to spy on anyone out of band. > The RTOS could be used to leak your location, the fact that you're using a VPN, any nonVPN traffic, and call traffic. Yes, it could... so can the default software on android, and so can your ISP (DPI is shockingly powerful). But, what's the risk there? How does knowing the ratio of traffic I send and receive being VPN, or TLS encrypted expose me to additional risk? > So forgive me if I'm a little skeptical that Graphine OS. I haven't looked in a long time so my memory is completely gone, but does GraphineOS not build their own Trusty OS image? https://android-review.googlesource.com/admin/repos/q/filter:trusty https://android-review.googlesource.com/admin/repos/q/filter... What am I missing from why GraphineOS can't be trusted?
- cptskippy 2y ago
  Afaik, Trusty OS is closed source.

grayhatter 2y ago

Google's business model is selling ads, all the data collection is so they can charge more for the ads they sell. The more you trust the platform, the more info you'll willingly give to Google, the more they can charge for ads. The more you trust your phone, the more you'll use your phone, the more chances Google has to collect information. They don't need to directly "spy" on you using means outside the normal data collection where you give them data. Thus, while I agree the "just trust me bro" attitude is borderline incompetence when it comes to security. I'm unconvinced that Google would take the risk of attempting to spy on anyone out of band. > The RTOS could be used to leak your location, the fact that you're using a VPN, any nonVPN traffic, and call traffic. Yes, it could... so can the default software on android, and so can your ISP (DPI is shockingly powerful). But, what's the risk there? How does knowing the ratio of traffic I send and receive being VPN, or TLS encrypted expose me to additional risk? > So forgive me if I'm a little skeptical that Graphine OS. I haven't looked in a long time so my memory is completely gone, but does GraphineOS not build their own Trusty OS image? https://android-review.googlesource.com/admin/repos/q/filter:trusty https://android-review.googlesource.com/admin/repos/q/filter... What am I missing from why GraphineOS can't be trusted?

cptskippy 2y ago
Afaik, Trusty OS is closed source.