3 ms·

Graphene is probably better on the devices that support both (Pixels), but since hardware support is so (intentionally) limited, it kind of a moot point. Also t

Graphene is probably better on the devices that support both (Pixels), but since hardware support is so (intentionally) limited, it kind of a moot point. Also the Graphene community is kind of obsessed with "security" and does not seem to place much emphasis on freedom/hackability.

kahnclusions 1y ago
Why the scare quotes? Graphene’s focus on security is legitimate and well founded. They are the only phone OS that is consistently safe from hacking by the likes of Cellebrite long after all other androids have fallen.
- udev4096 1y ago
  And having security focused settings by default. For instance, the https://localmess.github.io https://localmess.github.io tracking attempt was prevented on Vanadium (a browser maintained by GOS). Another serious vulnerability from top of my mind was TapTrap (https://taptrap.click/ https://taptrap.click/), which was fixed by GOS [1] few months ago. Android is still vulnerable to it! [1] - https://grapheneos.org/releases#2025070700:~:text=only%20permit%20third%20party%20apps%20to%20use%20custom%20activity%20animations%20for%20transitions%20between%20their%20own%20activities%20to%20prevent%20a%20recently%20disclosed%20Android%20tapjacking%20vulnerability%20branded%20as%20TapTrap https://grapheneos.org/releases#2025070700:~:text=only%20per...
- Borealid 1y ago
  Let's define "more secure" as "preventing a particular behavior that is against the device owner's conscious or unconscious wishes". It would be "more secure" to have a per-application firewall that blocks particular apps from outbound traffic over certain networks or to certain destinations. This prevents a malicious app from consuming roaming data. LineageOS can have that, at the owner's preference. Graphene explicitly forbids it. It would be "more secure" to allow backing up apps and all their data. This would mitigate the damage of ransomware. Graphene, again, forbids it (following google guidelines prioritizing the wishes of an app's developer over the device owner). There are many such examples. Lineage is philosophically owned by the person who installed it onto the phone. Graphene is owned by the Graphene devs, NOT the phone owner. Sometimes the Graphene devs purposefully choose to let software on the device restrict the valid owner of that device.
  - ysnp 1y ago
    >It would be "more secure" to have a per-application firewall that blocks particular apps from outbound traffic over certain networks or to certain destinations. This prevents a malicious app from consuming roaming data. LineageOS can have that, at the owner's preference. Graphene explicitly forbids it. Not sure what is meant by forbidding it? GrapheneOS provides per-app network access control via a user-controllable Network permission which is not implemented in AOSP or LineageOS afaik. They do not forbid using local firewall/filtering apps like RethinkDNS (to enforce mobile data only or Wi-Fi only iirc) and InviZible. They only warn that 'blocks particular apps from outbound traffic ..to certain destinations' cannot be enforced once an app has network access which makes sense to me. >It would be "more secure" to allow backing up apps and all their data. This would mitigate the damage of ransomware. Graphene, again, forbids it (following google guidelines prioritizing the wishes of an app's developer over the device owner). Contact scopes, storage scopes, the sensors permission and the network permission are examples that show precisely the opposite (GrapheneOS prioritises the device owner over the application developers). To my understanding, the backup app built-in to GrapheneOS even 'simulates' a device-to-device transfer mode to get around apps not being comfortable with data being exfiltrated to Google Drive. That being said, I understand they have plans to completely revamp the backup experience once they have the resources to do so.
    - strcat 1y ago
      They're referring to the leaky network toggles in LineageOS for different kinds of networks. GrapheneOS won't include that because it doesn't work correctly and gives people the false impression that it's going to stop apps communicating over those networks when it only stops most (not all) direct connections. LineageOS has the same Seedvault backup system with the same limitations. There are few limitations left since Android 12's API level stopped apps opting out of all backups by redefining it as an opt-out of cloud backups and similarly redefined the file exclusions as only being for cloud backups. The new system supports very explicitly omitting files from device-to-device backups but it has to be explicitly specified that way and few apps do it. The problems with apps opting out of backups due to not wanting cloud backups for space, bandwidth or privacy reasons has been solved for several years now. It doesn't mean all app data is portable between devices, such as Signal encrypting their database with a hardware keystore key making it fundamentally impossible to do backups at a file level for it rather than using their own backup system. See https://news.ycombinator.com/item?id=45562664 https://news.ycombinator.com/item?id=45562664 for a response to the rest of it.
- sotix 1y ago
  I just read that they changed their stance, but for a long time, they were against implementing RCS and said users should be using another tool like Signal. That ignores real world scenarios where users ended up using SMS rather than RCS, which was encrypted with Google messages. Of course, there's more nuance to the discussion, but I found myself a few years ago having gone from encrypted messaging on an iPhone by default to encrypted messaging on stock Android with RCS to unencrypted messaging on GrapheneOS. I thought that was certainly less secure for myself and likely the average user. But they did share valid concerns about their reasoning and most other aspects of the OS certainly have a great focus on security.
  - strcat 1y ago
    GrapheneOS never had a stance against implementing RCS and has supported RCS at an OS level for years. The issue was that the only available RCS app in practice is Google Messages and it requires privileged access for Google Play services, which goes against the sandboxed Google Play approach. We worked around it by making it so that the access granted to Google Messages when it's set as the SMS/MMS/RCS app also applies to Google Play services where part of the implementation is done. iOS does not currently implement end-to-end encryption for RCS. End-to-end encryption for RCS is exclusive to conversations between Google Messages users. Apple has said they'll implement the new MLS end-to-end encryption for RCS but has not done it and has provided no timeline for doing it. It took them a very long time to implement basic RCS support and this will likely take a long time too. Google Messages has not yet moved to the new MLS encryption, but it will need to do that too in order for iOS implementing it to provide end-to-end encryption across them.
    - sotix 1y ago
      I appreciate the response and how you're proactive about following things! That's great to know RCS is now possible on GrapheneOS. That's very pragmatic. For now, I have switched back to iOS due to a significant majority of my contacts using iMessage, so I'm back to encrypted chats again. Hopefully the future of RCS changes things while America struggles with using a unified messenger. I dream of using a dumb phone with RCS.

kahnclusions 1y ago

Why the scare quotes? Graphene’s focus on security is legitimate and well founded. They are the only phone OS that is consistently safe from hacking by the likes of Cellebrite long after all other androids have fallen.

udev4096 1y ago
And having security focused settings by default. For instance, the https://localmess.github.io https://localmess.github.io tracking attempt was prevented on Vanadium (a browser maintained by GOS). Another serious vulnerability from top of my mind was TapTrap (https://taptrap.click/ https://taptrap.click/), which was fixed by GOS [1] few months ago. Android is still vulnerable to it! [1] - https://grapheneos.org/releases#2025070700:~:text=only%20permit%20third%20party%20apps%20to%20use%20custom%20activity%20animations%20for%20transitions%20between%20their%20own%20activities%20to%20prevent%20a%20recently%20disclosed%20Android%20tapjacking%20vulnerability%20branded%20as%20TapTrap https://grapheneos.org/releases#2025070700:~:text=only%20per...
Borealid 1y ago
Let's define "more secure" as "preventing a particular behavior that is against the device owner's conscious or unconscious wishes". It would be "more secure" to have a per-application firewall that blocks particular apps from outbound traffic over certain networks or to certain destinations. This prevents a malicious app from consuming roaming data. LineageOS can have that, at the owner's preference. Graphene explicitly forbids it. It would be "more secure" to allow backing up apps and all their data. This would mitigate the damage of ransomware. Graphene, again, forbids it (following google guidelines prioritizing the wishes of an app's developer over the device owner). There are many such examples. Lineage is philosophically owned by the person who installed it onto the phone. Graphene is owned by the Graphene devs, NOT the phone owner. Sometimes the Graphene devs purposefully choose to let software on the device restrict the valid owner of that device.
- ysnp 1y ago
  >It would be "more secure" to have a per-application firewall that blocks particular apps from outbound traffic over certain networks or to certain destinations. This prevents a malicious app from consuming roaming data. LineageOS can have that, at the owner's preference. Graphene explicitly forbids it. Not sure what is meant by forbidding it? GrapheneOS provides per-app network access control via a user-controllable Network permission which is not implemented in AOSP or LineageOS afaik. They do not forbid using local firewall/filtering apps like RethinkDNS (to enforce mobile data only or Wi-Fi only iirc) and InviZible. They only warn that 'blocks particular apps from outbound traffic ..to certain destinations' cannot be enforced once an app has network access which makes sense to me. >It would be "more secure" to allow backing up apps and all their data. This would mitigate the damage of ransomware. Graphene, again, forbids it (following google guidelines prioritizing the wishes of an app's developer over the device owner). Contact scopes, storage scopes, the sensors permission and the network permission are examples that show precisely the opposite (GrapheneOS prioritises the device owner over the application developers). To my understanding, the backup app built-in to GrapheneOS even 'simulates' a device-to-device transfer mode to get around apps not being comfortable with data being exfiltrated to Google Drive. That being said, I understand they have plans to completely revamp the backup experience once they have the resources to do so.
  - strcat 1y ago
    They're referring to the leaky network toggles in LineageOS for different kinds of networks. GrapheneOS won't include that because it doesn't work correctly and gives people the false impression that it's going to stop apps communicating over those networks when it only stops most (not all) direct connections. LineageOS has the same Seedvault backup system with the same limitations. There are few limitations left since Android 12's API level stopped apps opting out of all backups by redefining it as an opt-out of cloud backups and similarly redefined the file exclusions as only being for cloud backups. The new system supports very explicitly omitting files from device-to-device backups but it has to be explicitly specified that way and few apps do it. The problems with apps opting out of backups due to not wanting cloud backups for space, bandwidth or privacy reasons has been solved for several years now. It doesn't mean all app data is portable between devices, such as Signal encrypting their database with a hardware keystore key making it fundamentally impossible to do backups at a file level for it rather than using their own backup system. See https://news.ycombinator.com/item?id=45562664 https://news.ycombinator.com/item?id=45562664 for a response to the rest of it.
sotix 1y ago
I just read that they changed their stance, but for a long time, they were against implementing RCS and said users should be using another tool like Signal. That ignores real world scenarios where users ended up using SMS rather than RCS, which was encrypted with Google messages. Of course, there's more nuance to the discussion, but I found myself a few years ago having gone from encrypted messaging on an iPhone by default to encrypted messaging on stock Android with RCS to unencrypted messaging on GrapheneOS. I thought that was certainly less secure for myself and likely the average user. But they did share valid concerns about their reasoning and most other aspects of the OS certainly have a great focus on security.
- strcat 1y ago
  GrapheneOS never had a stance against implementing RCS and has supported RCS at an OS level for years. The issue was that the only available RCS app in practice is Google Messages and it requires privileged access for Google Play services, which goes against the sandboxed Google Play approach. We worked around it by making it so that the access granted to Google Messages when it's set as the SMS/MMS/RCS app also applies to Google Play services where part of the implementation is done. iOS does not currently implement end-to-end encryption for RCS. End-to-end encryption for RCS is exclusive to conversations between Google Messages users. Apple has said they'll implement the new MLS end-to-end encryption for RCS but has not done it and has provided no timeline for doing it. It took them a very long time to implement basic RCS support and this will likely take a long time too. Google Messages has not yet moved to the new MLS encryption, but it will need to do that too in order for iOS implementing it to provide end-to-end encryption across them.
  - sotix 1y ago
    I appreciate the response and how you're proactive about following things! That's great to know RCS is now possible on GrapheneOS. That's very pragmatic. For now, I have switched back to iOS due to a significant majority of my contacts using iMessage, so I'm back to encrypted chats again. Hopefully the future of RCS changes things while America struggles with using a unified messenger. I dream of using a dumb phone with RCS.