6 ms·

The main missing feature is password under duress that would open a different “user”. So even if you’re forced to give away your password they won’t get to the

The main missing feature is password under duress that would open a different “user”. So even if you’re forced to give away your password they won’t get to the real account (some hidden profile or similar). At least hidden profiles would be good enough for basic protection. They have this which wipes your device, but you can get killed under duress. https://discuss.grapheneos.org/d/14722-using-duress-password-example https://discuss.grapheneos.org/d/14722-using-duress-password...

OsrsNeedsf2P 1y ago
I've seen this be requested for years from various mod users. Is it too difficult to implement or something?
- throwaway-0001 1y ago
  They say a hidden profile is not secure enough so not worth implementing. I rather have this hidden profile that would stop 99% of criminals than what they have now. I think their approach to this project is to deliver real security at the cost of features.
mbananasynergy 1y ago
GrapheneOS community manager here. The problem with something like this is that it cannot be reasonably hidden when it would be exposed by someone using basic tools. Our Duress PIN/Password feature doesn't make any attempts to mask itself, precisely because we think doing that only gives people a false sense of security. We think there's a good chance a motivated adversary is going to be familiar with GrapheneOS and its features, and the more mainstream it becomes, the more this can mean "your abusive significant other" rather than someone at the border. The moment people know this feature exists, it can become dangerous even if you don't use it. You can be threatened to unlock, and even if you do, the adversary can choose to not believe you since they can think you're just hiding it. That puts you in a dangerous situation where they think you can provide something that's literally not there. It's a very difficult problem to solve, and we don't think that proposal can solve it.
- throwaway-0001 1y ago
  Tbh I’d say 99% of the criminals won’t know about this. Let’s say someone have you at gunpoint, you can just give your mains profile pass. If they don’t even know there is a secret profile you’re good to go. You’re right, they might assume you’re hiding, but I’d say 99% won’t know what’s even graphene and from those who know I’d say they might force you and you can have 3 sets of bank accounts: Main profile: 100 Secondary: 1000 Terriary: $$$ Also if you hide all traces of grapheneos would be safer too. Nobody even knows is graphene, so they can’t even check what features you have. Again we are talking about 99% of the criminals, not the tech savvy 1%. I’d prefer plausible deniability like Vera crypt than what we have now.
  - mbananasynergy 1y ago
    You can argue most bad people won't know about it - but I would say we can't really know. I think the main problem is that people can be affected that aren't even using it, which is why it is such a big problem. You can't really hide it's GrapheneOS either, even just by virtue of the features available on the device, you'll be able to deduce what it is. I understand the idea behind it but it simply isn't realistic to provide and can put people in danger - the very thing it's meant to prevent.
    - throwaway-0001 1y ago
      But also in your case criminals can threaten you to give access to bank accounts you don’t have. When I say hide, again for 99% of the people. Splash screen, setting spoofing. Sometimes good enough is better than perfect. And even if the attacker can see the other profile you can just say was your friend’s profile and it’s lost. Or better, not sure if possible: export the profile in a file like veracrypt. Then when you need the profile import from this file and would restore the secret profile.
  - AndyMcConachie 1y ago
    > Tbh I’d say 99% of the criminals won’t know about this. It's not about criminals. It's about the police, government spy agencies, and other knowledgeable threat actors.
bugsMarathon88 1y ago
This hyperbole is extreme, and unnecessary. If your life depends on the ability to simulate a fake user on a phone, there are more significant problems than a lack of operating system features, and a general failure to defend in depth.
- kragen 1y ago
  This is a fully general argument against any single thing your life might depend on: seat belts, defibrillators, bulletproof vests, etc. If the only thing protecting you from getting shot to death is a bulletproof vest, clearly a lot has already gone very wrong, and you're likely to die today anyway. But that kind of thinking is exactly what leads to a failure to defend in depth.
Ros23 1y ago
GrapheneOS Discussion Forum: "This site is best viewed in a modern browser with JavaScript enabled. " Security my ass ... To "GrapheneOS community manager" - please fix this. Where is .onion site?
- progval 1y ago
  You can read it just fine with Javascript disabled, though.
- gf000 1y ago
  Security doesn't mean you have to go feed the cows and leave behind everything. In fact, a core aspect of security is having access to a feature in the very first place. A forum, being hosted on the web has absolutely no reason to stay away from the de facto scripting language of the platform. What would be your threat model for that forum? A zero day that would break the whole world?
- ThePowerOfFuet 1y ago
  It's Discourse.
  - mbananasynergy 1y ago
    We use Flarum for our forum, but Discourse similarly only allows one to view forum posts without JavaScript enabled.
- mbananasynergy 1y ago
  It is possible to view the forum without JavaScript being enabled, but not sign in and post. We use Flarum for our forum, and that's a limitation of the platform.
- anthk 1y ago
  Join usenet: https://www.eternal-september.org https://www.eternal-september.org Subscribe to comp.mobile.android. Sadly there's no libre client yet, but Mozilla might release a Thunderbird version with NNTP support.
- 1y ago

OsrsNeedsf2P 1y ago

I've seen this be requested for years from various mod users. Is it too difficult to implement or something?

throwaway-0001 1y ago
They say a hidden profile is not secure enough so not worth implementing. I rather have this hidden profile that would stop 99% of criminals than what they have now. I think their approach to this project is to deliver real security at the cost of features.

mbananasynergy 1y ago

GrapheneOS community manager here. The problem with something like this is that it cannot be reasonably hidden when it would be exposed by someone using basic tools. Our Duress PIN/Password feature doesn't make any attempts to mask itself, precisely because we think doing that only gives people a false sense of security. We think there's a good chance a motivated adversary is going to be familiar with GrapheneOS and its features, and the more mainstream it becomes, the more this can mean "your abusive significant other" rather than someone at the border. The moment people know this feature exists, it can become dangerous even if you don't use it. You can be threatened to unlock, and even if you do, the adversary can choose to not believe you since they can think you're just hiding it. That puts you in a dangerous situation where they think you can provide something that's literally not there. It's a very difficult problem to solve, and we don't think that proposal can solve it.

throwaway-0001 1y ago
Tbh I’d say 99% of the criminals won’t know about this. Let’s say someone have you at gunpoint, you can just give your mains profile pass. If they don’t even know there is a secret profile you’re good to go. You’re right, they might assume you’re hiding, but I’d say 99% won’t know what’s even graphene and from those who know I’d say they might force you and you can have 3 sets of bank accounts: Main profile: 100 Secondary: 1000 Terriary: $$$ Also if you hide all traces of grapheneos would be safer too. Nobody even knows is graphene, so they can’t even check what features you have. Again we are talking about 99% of the criminals, not the tech savvy 1%. I’d prefer plausible deniability like Vera crypt than what we have now.
- mbananasynergy 1y ago
  You can argue most bad people won't know about it - but I would say we can't really know. I think the main problem is that people can be affected that aren't even using it, which is why it is such a big problem. You can't really hide it's GrapheneOS either, even just by virtue of the features available on the device, you'll be able to deduce what it is. I understand the idea behind it but it simply isn't realistic to provide and can put people in danger - the very thing it's meant to prevent.
  - throwaway-0001 1y ago
    But also in your case criminals can threaten you to give access to bank accounts you don’t have. When I say hide, again for 99% of the people. Splash screen, setting spoofing. Sometimes good enough is better than perfect. And even if the attacker can see the other profile you can just say was your friend’s profile and it’s lost. Or better, not sure if possible: export the profile in a file like veracrypt. Then when you need the profile import from this file and would restore the secret profile.
- AndyMcConachie 1y ago
  > Tbh I’d say 99% of the criminals won’t know about this. It's not about criminals. It's about the police, government spy agencies, and other knowledgeable threat actors.

bugsMarathon88 1y ago

This hyperbole is extreme, and unnecessary. If your life depends on the ability to simulate a fake user on a phone, there are more significant problems than a lack of operating system features, and a general failure to defend in depth.

kragen 1y ago
This is a fully general argument against any single thing your life might depend on: seat belts, defibrillators, bulletproof vests, etc. If the only thing protecting you from getting shot to death is a bulletproof vest, clearly a lot has already gone very wrong, and you're likely to die today anyway. But that kind of thinking is exactly what leads to a failure to defend in depth.

Ros23 1y ago

GrapheneOS Discussion Forum: "This site is best viewed in a modern browser with JavaScript enabled. " Security my ass ... To "GrapheneOS community manager" - please fix this. Where is .onion site?

progval 1y ago
You can read it just fine with Javascript disabled, though.
gf000 1y ago
Security doesn't mean you have to go feed the cows and leave behind everything. In fact, a core aspect of security is having access to a feature in the very first place. A forum, being hosted on the web has absolutely no reason to stay away from the de facto scripting language of the platform. What would be your threat model for that forum? A zero day that would break the whole world?
ThePowerOfFuet 1y ago
It's Discourse.
- mbananasynergy 1y ago
  We use Flarum for our forum, but Discourse similarly only allows one to view forum posts without JavaScript enabled.
mbananasynergy 1y ago
It is possible to view the forum without JavaScript being enabled, but not sign in and post. We use Flarum for our forum, and that's a limitation of the platform.
anthk 1y ago
Join usenet: https://www.eternal-september.org https://www.eternal-september.org Subscribe to comp.mobile.android. Sadly there's no libre client yet, but Mozilla might release a Thunderbird version with NNTP support.
1y ago