11 ms·
GrapheneOS and forensic extraction of data (2024)
- nithssh 1y agoThe post had some nice structural discussion about digital forensics
- Thorrez 1y ago[2024] And it looks like this is the draft, and it was published on the author's blog here: https://telefoncek.si/2024/05/2024-05-30-grapheneos-and-forensic-extraction-of-data/ https://telefoncek.si/2024/05/2024-05-30-grapheneos-and-fore...
- p0w3n3d 1y agoThere is no such thing like "bad government" and "good government". I mean - it really depends on people's views, therefore we must not blissfully put our data into govt hands because "they will protect us from terrorists and child rapists". What they will do, actually, is that for sure they will abuse innocent citizens at some point of time. They will. Even if they don't, they will. Or maybe they are doing it right now and they need more control to make it easier
- marcofloriano 1y agoNo. When the government fails to delivery what people need (not necessarily wants), you have a bad government. When gangs and bandits (or drugs, or diseases, or whatever) takes on the street, it's not about people's view, it's just bad stuff that the government need to address or there's no point on having a government.
- pona-a 1y agoThe 50s~70s are idealized by many as an American golden age, despite higher reported crime. Law enforcement back then did not have AI-powered surveillance camera networks, widely deployed IMEI stingrays, private data-brokers, or the ability to remotely activate any phone's microphone with 0-click RCE.
- crumpled 1y agoWhat's the 0-click RCE thing?
- dns_snek 1y agoA type of exploit (Remote Code Execution) that can be used to secretly infect your device with spyware without requiring any interaction from you (0-click).
- pona-a 1y agoPegasus [0] and the like — commercial spyware updated with the latest exploit chains, developed in-house or purchased from markets like Zerodium, sold as terrorism-prevention tools to such trustworthy states as Russia, UAE, and Hungary. [0] https://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Pegasus_(spyware)
- __MatrixMan__ 1y agoAgreed. There are problems that governments solve and if a government can't solve them it's a bad one. Maybe consensus shifts (or goes away) about which problems are the domain of government, buy ultimately it's about efficacy against those. The rest is a distraction.
- jbstack 1y agoAside from the fact that there's a subjective definition problem here (how do we decide what people "need"?), I think this an unrealistic view. By this definition, every government that has ever existed or ever will exist is a "bad" government because no government can ever tackle every single problem 100% of the time. Many problems are extremely difficult to solve (e.g. global warming), and others simply cannot be solved without creating other problems. For example, people "need" access to healthcare, but there's essentially an unlimited amount of money you could spend to keep improving healthcare (e.g. opting for increasingly expensive treatments with diminishing returns on health outcomes). The more money you allocate to healthcare, the less you have available to spend on other things that people "need". Sure, you can tax more up to a point, but eventually that tap runs dry and you're forced to reallocate existing resources. As another example, people "need" criminals to be punished in order to be able to live in a safe a crime-free society. People also "need" to not be put in prison when they are innocent. But you can never be 100% sure that a convicted criminal actually committed the crime. Locking up criminals implies by necessity that you will also lock up some innocent people. No government can solve both of these problems simultaneously which means they are all "bad". Even the most competent "good" government ultimately has to select among which "bad" things it is going to allow to continue and which it will solve.
- danans 1y ago> Sure, you can tax more up to a point, but eventually that tap runs dry and you're forced to reallocate existing resources. Since the 1980s, we have been consistently taxing less. If the tap is dry, it isn't because of over-taxation - it's because there's a reservoir of wealth hoarded by the relatively few. A even cursory glance at the trajectory of wealth distribution will make that clear.
- jbstack 1y ago> Since the 1980s, we have been consistently taxing less Who is "we"? We're talking about governments in general ("good" vs "bad" ones), and I have no idea what jurisdiction you are referring to. In any case, I didn't say the tap is dry. I said if you keep raising taxes it will eventually run dry. Or to put it another way, taxes are not an unlimited resource that you can keep increasing as much as you'd like. At some point you'll hit a ceiling where raising taxes any further doesn't produce additional tax revenue. For example, as you raise income tax rates, people have less incentive to advance their careers (e.g. by chasing promotions or improving their skills), and people have more incentive to leave the jurisdiction and go somewhere with lower taxes. Up to a point, the increase in tax rates produces a net extra revenue for the government. Above a certain point, the number of people who stop paying taxes (e.g. by leaving or by working less) outweighs the gains from those who continue to pay. This is why you'll rarely see any government with excessively high top-bracket tax rates (e.g. 60 - 100%), because it results in tax losses.
- dizhn 1y ago"people" being their own citizens. Many governments do not limit their activities to their own people and they have almost opposite rules for their own people vs others. Not that the picture is so clear for their own people either.
- jMyles 1y ago> there's no point on having a government Can we just use this as our point of agreement?
- netdevphoenix 1y agoThis sounds extremely simplistic. Countries are isolated universes. Actions of a government in a country affect other countries. Some problems require multiple governments to work together (see global warming and supply chain issues). Different governments have different priorities at any given time even if they all have roughly the same absolute list of issues
- Rygian 1y ago> therefore we must not blissfully put our data into govt hands Extending this reasoning, we should not blissfully put our data into anyone's hands. Government mission at least have a veneer of public servants, as opposed to private hands whose only real motivation is fiduciary obligations towards the shareholders.
- WinstonSmith84 1y agoit's about the interests of each party. The interest of a government is to control its citizen, either now or at some point in the future. The interest of a private company is to make more money. Between the two, I certainly prefer a private company attempting to monetize my data rather than a government trying to control me either now or in the future. And let's stop the bs about "public servants", even in the EU which is maybe the most democratic bloc in the world, governments are trying to impose a chat control (among other laws restricting freedom). It's just in the nature of governments to control its population
- Rygian 1y agoYou missed a spot: In most situations, private companies will share any data they have about you with the government anyway. And can be compelled by law to do it. So going private is net loss.
- IlikeKitties 1y ago> There is no such thing like "bad government" and "good government". Of course there is, compare the government of Finland to that of North Korea. Just because there are shades of grey and human institutions are generally susceptible to corruption greed an power politics doesn't mean there aren't governments that are different not only in degree but in kind.
- codys 1y agoIt is strange how folks are refusing to admit they can even _evaluate things_ in a bunch of cases. We're seeing that here, but I've also noticed it in other posts on HN: a disagreement with the position of the article is framed not as a distinct examination which comes to different conclusions, but instead commenters claim the post author was foolish in even attempting to evaluate the thing the post is about. To some degree it feels like bits and pieces of anti-intellectualism getting into folks brains: rejecting the idea that folks can think about things at all.
- themaninthedark 1y agoIt feels like a nihilistic take partnered with the view that everyone has a valid viewpoint.
- isaacremuant 1y agoFinland will approve shit like chat control, age verification or covid lockdowns against civil rights. Whataboutism is bullshit. Power corrupts. It doesn't matter if you idealize a government, it's still composed of people who get compromised by money, power and general corruption.
- squigz 1y agoI think this sort of thinking is symptomatic of something very problematic: that if a government doesn't align with your views, it's a bad one. We've forgotten that, in order for a civilization to survive, with many, many viewpoints, we must compromise sometimes.
- Anonyneko 1y agoIt's an interesting argument in theory, but in practice the government in my country of origin actively searches through people's phones to find evidence of wrongthink (e.g. donations or incriminating social media activity), for which they sentence people to incredibly long prison terms. The latest example: https://en.zona.media/article/2025/08/27/irin https://en.zona.media/article/2025/08/27/irin That said, no matter how secure GrapheneOS may be, for this particular threat a permanently clean phone is a necessity.
- IlikeKitties 1y agoIf the reaction to "I'm not unlocking my phone" is being beaten and put into a gulag, no technical solution will help. But countries that have fallen that far off the path are not worth saving anyway.
- mordnis 1y agoMaybe we should have no government, because they always have some information on us which can be abused
- rangerelf 1y agoYou're being willfully dense, I do not believe it's up for debate. Governments that public force to kidnap, torture, murder, "disappear" their own citizens, are bad. Plenty of examples to go around, both historically and currently: China, Russia, México, North Korea, Belarus, the balcans, plenty of African governments, etc. It shouldn't matter that "34% of my neighbors" want me sent to a concentration camp, personally I wouldn't want to end up there. The example you're giving, the whole "it really depends on people's views, ..." is a bad government. And the truth is that it's easy to be a good government: don't be bad. Edit: fixed a word.
- chuckSu 1y agoYou’ve got quite a list of examples there. In 2025 that list of examples should include the US and Israel
- themaninthedark 1y agoTry earlier than that for the US: >In 2015, the Guardian revealed Chicago Police had allegedly employed torture and days-long unlawful detention at the secretive “black site”-like Homan Square facility And the federal government knew and participated. >“When we’re doing joint operations with the federal government, it’s generally — it’s under the supervision of an Assistant U.S. Attorney and they’re merely using our facility because it’s more convenient." https://thegrayzone.com/2025/03/15/feds-used-chicago-black-site/ https://thegrayzone.com/2025/03/15/feds-used-chicago-black-s...
- jbstack 1y agoOk, so how do you categorise a country like Norway (typically viewed as a "good" country by most people) which knowingly invests money from its sovereign fund into companies which are linked to the Israeli military which (in many people's view) is currently causing genocide and widespread starvation? At what point does the "good" cross over into the "bad"? Is it ok that having a highly regarded government comes at the price of dead children? How about the sizeable group of people (e.g. in the US and Israel) who don't believe there is any genocide at all? Doesn't that make the whole thing subjective?
- KyleBerezin 1y agoOr more likely, regardless of intentions, they will accidentally let it fall into a bad actors hands.
- tomtomistaken 1y agoTime for a Bitcoin moment, but for governments.
- DANmode 1y agoDAOs?
- tomtomistaken 1y agoDAO based maybe, yes.
- foofoo12 1y ago> it really depends on people's views. No it does not. It depends on peoples morals.
- dragonwriter 1y ago> > it really depends on people's views. > No it does not. It depends on peoples morals. Morals are a kind of views.
- foofoo12 1y agoIt's the fundamental principles of right and wrong. Morals. It's not just views or kind of.
- dragonwriter 1y agoBeliefs about what is fundamentally right and wrong are, in fact, views.
- attila-lendvai 1y agothen child rape is just a clash of views... you sure you really want to go down that road?
- dragonwriter 1y ago> then child rape is just a clash of views Who said “just”? I'm arguing against minimizing conflicts of views as inherently insignificant, low consequence things.
- foofoo12 1y agoYou can call them views, and you can call your tap water a solution of dihydrogen monoxide with contaminants. It isn't helpful.
- breppp 1y agoOnly someone who never lived under a bad government would claim all governments are equally bad. Only someone who never has seen war would think they need no defense
- Razengan 1y agoIn the past, whenever I read someone say stuff like what I myself say down below, I put them down as a crackpot: But as time goes by and I travel the world, I find it's hard to deny that there are and always were distinct classes within human civilization, though the lines may be blurred here and there, and almost everything within every human society serves to preserve those classes, whether as the direct intentional goal or as a convenient side effect. "Govern" is to "rule" Other commenters mention the lack of government, and pockets of chaos where gangs/bandits/warlords/disasters run rampant, but those too are different classes versus each other, or vacuums where classes have yet to [re]form.
- mrbluecoat 1y agoTL;DR: > Cellebrite admits they can not hack GrapheneOS if users had installed updates since late 2022.
- azalemeth 1y agoI really love Graphene OS but I _wish_ there was a version in which you could get a root shell and extract private data of apps you install when verified as the user. The developers are on record as saying that root blows a hole in their security model (it does!) but if there was _some_ way of doing it safely, so I can modify applications I as the user wish to, it would be my ideal OS. I know I could download and self sign it, but I'd rather not…
- subscribed 1y agoYou can't have a cake and eat it. A root access is a big hole, there's no way mainline will support it. As for the possible way, you answered yourself already (custom keys and images) :)
- imiric 1y ago> A root access is a big hole How so? On Linux, I can add an account to the sudoers list, and have the flexibility to configure the level of security appropriate for my use case. I have yet to experience any security issues (that I'm aware of). Why isn't this possible on my mobile device as well? This absolute stance is not right. Security is not binary, but a spectrum. I should be allowed to have full control over my device without this being a security risk.
- rfoo 1y agoWell, anyone with actual root on a secure (locked, verified boot on) Android phone can hard brick it with a single command. Yes, you can yell at the user telling them it's their fault. Still something you usually do not want to support. I don't think having authorized temporary root is inherently insecure, but on the other hand making sure it is secure could be a huge time sink. Now, the original request here, modifying user app (I'd assume it's not system app) data, is reasonable. Designing a properly authenticated way to allow doing so would be an interesting challenge.
- fsflover 1y ago
- nunobrito 1y ago[flagged]
- Scrubbed4426 1y agoGrapheneOS does not have Tor "directly on the operating system". You are terribly misinformed about all of this it seems.
- nunobrito 1y agoWrong: https://primal.net/e/nevent1qqsq9lsf88umpdunkdzpdthyffys275zva3nrexpx0q2g45a4ve28ngew82e5 https://primal.net/e/nevent1qqsq9lsf88umpdunkdzpdthyffys275z...
- 9029 1y agoWhere does it say the app comes with Graphene???
- nunobrito 1y agoThose are semantics. When you put a knife next to a tomato in the kitchen table, it cannot be argued they are separated. Same thing for directly supporting and even recommending the Tor usage on the phone. Let's please avoid semantic word games. Thank you.
- Luker88 1y agoThis is kinda paranoid speech. GrapheneOS and Tor remain two of the best projects out there for privacy. I'd love to hear of other open alternatives, if any. ..."I don't trust google hardware, but I trust hardware from a dictatorial controlling regime" also does not really help your argument, sorry. Besides, they seem to be working with some OEM to get their own phone out. I'd love to receive daily updates on this, but it's a new development, updates are scarce and this things take time. I hope sometime they'll collaborate with fairphone and others.
- 1y ago
- altonw 1y ago[dead]
- deleted 1y ago[deleted]
- megaloblasto 1y agoI've always found it strange that GrapheneOS only runs on Google hardware. Can anyone explain this choice?
- keerthiko 1y agomost of the explanation from the horse's mouth will be found here: https://grapheneos.org/faq#device-support https://grapheneos.org/faq#device-support
- megaloblasto 1y agoThanks > These devices meet the stringent privacy and security standards and have substantial upstream and downstream hardening specific to the devices It still seems strange. A big part of GrapheneOS is to provide a safeguard from Googles data hoarding, yet it works primarily on Google phones.
- fdsfdsfdsaasd 1y agoYes, a situation that Google is steadily fixing.
- warkdarrior 1y agoConspiracy theory time: GrapheneOS is a skunkworks project from Google, to sell more Pixel hardware.
- subscribed 1y agoConsidering last years development and quite open Google hostility? No. GoS have provided a lot of patches upstream, Some of which were even applied. Despite that they wouldn't get early access to A16 just because. Access EVERY vendor promising to preinstall privileged Google services has. Allegedly Google security team was very happy about that idea, but got vetoed by management.
- rfoo 1y ago> It still seems strange. A big part of GrapheneOS is to provide a safeguard from Googles data hoarding, yet it works primarily on Google phones. That's the most confusing part. IMO GrapheneOS is not mainly about "provide a safeguard from Googles data hoarding", instead this is more like a side quest. GrapheneOS is about creating a mobile OS that is more secure against advanced threats [0] than anything else, including stock Pixel OS and iOS. [0] Currently my rule of thumb is, anyone who can find and write exploits for new memory corruption bugs for the wanted attack surface, or who can buy such capability, qualifies as advanced threat. Hence Cellebrite qualifies as a borderline "advanced threat".
- reactordev 1y agoAs long as the USB port of your phone is used, you can not stop it. This is the backdoor the governments want without having to be tethered. Vote for privacy. Vote against the police state. Vote for freedom. Libertarian rant aside. Governments fund these kinds of operations in secret so they can "effectively do their jobs". There's a ton of subcontractors working on AWS platforms that do analysis of this UFED "dump". (just a zip file of your phones directories). Emails, Phone logs, Carrier settings, Browser History, Text Messages, Cookies, Apps, App Logs, App Data, if it's on your phone, it's in the zip.
- WithinReason 1y ago> As long as the USB port of your phone is used, you can not stop it. According to TFA GrapheneOS can disable the USB port too
- reactordev 1y agoWhich is the only defense when law enforcement takes your phone. GrapheneOS is the only ones that will let you.
- matheusmoreira 1y ago> Vote Sure... Vote "correctly" and then watch the world burn anyway when the politicians start spinning some nonsense about money laundering drug trafficking child molesting terrorists.
- nixgeek 1y agoThis feels like countering insinuations on the Internet with insinuations on the Internet. Cellebrite doesn't publicly publish the latest support matrix so we have no real idea what progress if any they've made against recent iPhones and iOS versions, nor any real detail on how something like Lockdown Mode influences outcomes for their software. Nor does this show anything about Pixel 9 or Pixel 10 and the newest variants of Android OS (which for Pixel 10 makes sense given (2024), but for Pixel 9 does it?). What we do know as both companies disclose this is that Apple implements particularly with Advanced Data Protection enabled significantly more E2EE than Google, and both companies invest significantly through i.e. Apple's SEAR into the security of their hardware, software and platforms. That GrapheneOS exists is great but I don't think this post helps much.
- vqtska 1y agoThere is someone who leaks Cellebrite's support matrix to GrapheneOS dev's and it confirms that they are still unable to exploit it. "Their documentation has explicitly listed GrapheneOS for years due to the high demand from their customers for breaking into it. It shows they were last able to exploit a GrapheneOS release with a 2022 or earlier patch level. We have their June 2025 documentation and could obtain the newer documentation if we ask for it, but we have much bigger priorities than that right now and we would have been contacted by the main person providing it if anything relevant changed." https://x.com/GrapheneOS/status/1965464817914831070 https://x.com/GrapheneOS/status/1965464817914831070
- jeroenhd 1y agoDocuments have been leaked at the beginning of this year: https://osservatorionessuno.org/blog/2025/03/a-deep-dive-into-cellebrite-android-support-as-of-february-2025/#the-february-2025-support-matrix https://osservatorionessuno.org/blog/2025/03/a-deep-dive-int... which do include the Pixel 9. They show GrapheneOS being pretty secure in comparison to other vendors at the very least, with GrapheneOS being marked as unsupported if patched beyond 2022. They also show GrapheneOS beating the stock Google firmware. One reason GrapheneOS fights these threads is by doing what Google doesn't want to do out of user friendliness, like disabling USB in AFU mode. Unlike Google, Samsung, or Apple in non-lockdown mode, GrapheneOS doesn't need to deal with upset users when they need to unlock their phone before hooking it up to their car/display/flash drive/3.5mm jack converter/etc. GrapheneOS also enables security features when compiling the OS that have a performance impact but mitigate security risks. They end up with a slower phone with less battery life that's protected better against extremely uncommon attack vectors. GrapheneOS explained how these security features would've prevented at least one targeted attack from leading to exploitation: https://grapheneos.social/@GrapheneOS/114081909020398165 https://grapheneos.social/@GrapheneOS/114081909020398165 We don't know the current state of Celebrite's capabilities, but the fact they struggled for at least three years last time intel leaked out does paint a good picture for GrapheneOS. I'm sure the GRU and NSA have exploits that can hack even GrapheneOS, but at least they're not the type that makes it into commercially available exploit kits as of now.
- Crontab 1y agoI am probably the only one but the geek in me would love to see an article where digital forensics are used against the most common operating systems in their most secure configuration - just to see how they compare with one another.
- dsign 1y agoThis kinds of make me want to get a pixel and install GrafeneOS there. I'll admit that big companies may have some incentive to protect their users' privacy; but they are an easy legal target. If tomorrow the US or EU pass legislation that mandates a backdoor in all mobile devices, the entire world is screwed.
- into_ruin 1y agoFWIW, the UK recently cited the Investigatory Powers Act of 2016 in an attempt to force Apple to create a backdoor, but Apple refused
- bornfreddy 1y ago> ...but as far as we know Apple refused. Fixed that for you.
- jajuuka 1y agoTo be fair after that came out they disabled ADP for the whole country. If they were willing to go along with it then that would not be the course they would take. Not to mention it's a colossally dumb move to create a back door into your system that anyone can access and can break things like government contracts. Apple is greedy but they aren't suicidal.
- truelson 1y agoMy last pixel (4a) started falling apart after about a year and a half. Is there an android device that's a bit more hardy? I switched back to apple as I was able to use an SE for YEARS. Would love to try running GrapheneOS, though.
- crumpled 1y agoMy wife uses her Pixel 4a to this day. I moved on from mine after some problems, but a factory wipe of the 4a actually fixed all of the problems with mine too. And you know what else is cool? If the screen gets cracked or something doesn't work, you can take it to an independent repair shop and they can fix it.
- Johnny555 1y ago>...because it is doing far more hardening than iOS against these attacks. iPhones also have security element, but the companies developing attacks, had successfully bypassed secure element throttling from Apple for years (and are doing the same with Samsung and Qualcomm Is it true that Pixels are more hardened against brute forcing the security module and that iphones (and other phones) are easily bypassesed by these hacking tools?
- bri3d 1y agoI don't think I agree with this assessment; I have a lot of respect for GrapheneOS but they are very prone to this type of puffery, especially in face of criticism. The information in this and other GrapheneOS articles comes from a leaked copy of the Cellebrite support matrix which is shipped with their end-user (law enforcement) devices, so it's a point-in-time look at one vendor's capabilities in one product line. At the time this article was written, Cellebrite had brute force-based passcode access to iPhones before the iPhone 12 (prior to the Secure Storage Component), and supposedly had support for the iPhone 12 on iOS versions prior to 17 in development (vs. just under research), while they had no access to bruteforce on Android devices using the Titan M2 (Pixel 6 and later). The general trust model is pretty similar: the user's passcode is entangled with (predictable) secure entropy and used to derive a key encryption key which can unlock the filesystem. Firmware running on a secure processor rate-limits passcode attempts. Apple's implementation is well-documented here: https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/web https://support.apple.com/guide/security/secure-enclave-sec5... . Google's implementation is called Weaver and I'm less sure how it works cryptographically, but it seems conceptually similar. For more about the support matrix: https://osservatorionessuno.org/blog/2025/03/a-deep-dive-into-cellebrite-android-support-as-of-february-2025/#the-february-2025-support-matrix https://osservatorionessuno.org/blog/2025/03/a-deep-dive-int... Overall I would say that a modern iPhone running the latest iOS and a modern Pixel running GrapheneOS represent the absolute state of the art in protection, and seem to have pretty similar public support from forensic vendors. The article is right that essentially everything else is junk; hardware vendors by and large seem to really struggle to implement secure software (including ROMs and bootloaders).
- DANmode 1y ago
- t1234s 1y agoI currently use LineageOS on my pixel. Is it worth trying Graphine OS?
- xvfLJfx9 1y agoYes. LineageOS is an insecure mess.
- pavon 1y agoI love the sandboxed Play Services. It works better than microg, and is more secure/private than installing Play Services normally which are your two options on LineageOS. The main downside for me was the limited phone choice. I really liked being able to use a smaller Sony phone with LineageOS, but now that those aren't really available in the US, I had to move to big phone anyway and Pixels aren't the worst option out there.
- notorandit 1y agoThe only thing that comes to my mind is the so-called blobs, the closed source hardware drivers that are needed to make an Android phone work and that run at high privilege level. If GrapheneOS is not tightly sandboxing them, then chances there are that a capable operator can use whatever backdoor each driver offers, mainly the wifi adapter, the baseband modem and the Bluetooth adapter. No matter what GrapheneOS developers have done. Imagine the wifi driver being able to spoof on pin entry procedure.
- matheusmoreira 1y ago> If GrapheneOS is not tightly sandboxing them It is. HN user strcat has posted extremely detailed comments on the matter. https://news.ycombinator.com/threads?id=strcat https://news.ycombinator.com/threads?id=strcat
- gslepak 1y agoThose considering a switch from iOS to GrapheneOS might be interested in this migration guide and review: https://blog.okturtles.org/2024/06/the-ultimate-ios-to-grapheneos-migration-guide-and-review/ https://blog.okturtles.org/2024/06/the-ultimate-ios-to-graph...
- 2716057 1y agoSlightly off-topic: how many people are maintaining GrapheneOS? Suppose Daniel Micay suddenly disappeared from planet earth - is there someone who has the knowledge, access and keys to continue immediately?
- mangologic 1y agohttps://www.reddit.com/r/PrivacyGuides/comments/13spm4d/daniel_micay_steps_down_as_lead_developer_of/ https://www.reddit.com/r/PrivacyGuides/comments/13spm4d/dani... He stepped down as lead dev 2 years ago !!
- 2716057 1y agoThanks, good to know. I was asking because the commit histories of some of the GrapheneOS components scream "mostly one man show". https://github.com/GrapheneOS/Auditor/commits/main/ https://github.com/GrapheneOS/Auditor/commits/main/
- crossroadsguy 1y agoSurely there are competent Apple Photos and Google Photos alternatives like Ente. There are more.
- captainmuon 1y ago> Cellebrite admits they can not hack GrapheneOS if users had installed updates since late 2022. So, how do I know that GrapheneOS is not a honeypot for the really big fish? At this point it seems if you really want to be safe, you have to add obscurity (in addition to conventional best practices). Like changing the pinout on your USB port so the exploit device can't connect.
- j1000 1y agoI thought about this for a moment, reminds me of ANOM company. But isn't GraphaneOS open source? Changing USB pins layout sounds like interesting idea.
- jcul 1y agoAs mentioned in the link, Graphene has a lot of additional security feature. It can auto reboot after X hours without being unlocked. You can lock down the usb port to be charge only, or even completely disabled so that the only way to charge is with the device powered off.