8 ms·

Consider this (by Graphene OS): https://discuss.grapheneos.org/d/24134-devices-lacking-standard-privacysecurity-patches-and-protections-arent-private https://di

Consider this (by Graphene OS): https://discuss.grapheneos.org/d/24134-devices-lacking-standard-privacysecurity-patches-and-protections-arent-private https://discuss.grapheneos.org/d/24134-devices-lacking-stand... /e/OS community talking about it: https://community.e.foundation/t/article-from-grapheneos-about-e-os/72203 https://community.e.foundation/t/article-from-grapheneos-abo... And then maybe this: https://eylenburg.github.io/android_comparison.htm https://eylenburg.github.io/android_comparison.htm Hope that helps.

realusername 8mo ago
I like GrapheneOS but they fail to understand in this post that the #1 security concern an android user face is the lack of privacy. Sure they have hardened everything but realistically, that's not the main threat for your average user. Their top contribution to android is the sandboxed Google Play, by far.
- gf000 8mo ago
  privacy != security. And sandboxed Google Play services serve both goals -- it runs the service as a regular android service, not an exceptional one that has a bunch of extra permissions. So you can allow/restrict it as you seem fit, while not "getting behind" on features/apps that mandate it.
  - realusername 8mo ago
    I disagree, privacy is an essential part of security, if there's no privacy, then there's no security. That's also why I don't keep anything important on my phone as I don't trust what's going on there despite having all the secure features that you would want.
    - scheeseman486 8mo ago
      Other way around, actually. It's possible to make concessions to privacy, like providing crash reports, or running applications in sandboxes which limits what they can harvest, while keeping the platform secure. Any privacy you have on a system is reliant on no one tampering with that system and on software behaving itself. Without security, you can't trust the system to implement any privacy.
      - realusername 8mo ago
        I also disagree with that, I trust my Linux distribution to behave well much more than I trust any Android platform and it doesn't even have much app sandboxing at all. You can't fix a lack of trust like you have in Android with technical solutions. The flaw in Android is fundamentally a social problem.
        scheeseman486 8mo ago
        That reads more as sports team flag wavey thoughts and feelings trust than anything actually backed by objective data.
        realusername 8mo ago
        That's the difference between trusted computing (Linux distribution) and untrusted computing (Android). If you want something backed by objective data, my phone has an advertising ID built in the OS and my laptop doesn't. My phone had 100s of privacy scandals and my laptop doesn't have one. I do applaud GrapheneOS don't get me wrong but I have a feeling that they are fighting a losing battle.
        Aachen 8mo ago
        What advertising ID is built into the OS?
        realusername 8mo ago
        See https://support.google.com/googleplay/android-developer/answer/6048248?hl=en https://support.google.com/googleplay/android-developer/answ... for Android and https://developer.apple.com/documentation/adsupport/asidentifiermanager/advertisingidentifier https://developer.apple.com/documentation/adsupport/asidenti... for iOS
        Aachen 8mo ago
  - strcat 8mo ago
    GrapheneOS provides major privacy enhancements including Contact Scopes, Storage Scopes, Sensors toggle, per-connection Wi-Fi privacy via per-connection DHCP state + MAC randomization and far more. It's a privacy project and privacy depends on security so it heavily focuses on protecting against exploitation of privacy and security vulnerabilities too. Privacy and security are not separate things from each other but rather closely tied together and our work is on both for the sake of improving privacy. Our only reason to work on security features is protecting privacy.
    - gf000 8mo ago
      I won't argue with you on the project-related part of it, you obviously know best there :) Thank you for all the work! But how would you "rate" for example desktop "GNU/Linux" with this in mind? Quite clearly privacy is important here and none of the major components leak/store unnecessary personal data. But the security story is quite sad, everything runs as the same user so a random `npm install` can just do whatever it wants with my browser caches, ssh keys, etc. I would say that GNU/Linux is privacy-friendly, but has terrible security. Would you not agree here? How does this fit with the "privacy and security are not separate things" part? Genuinely curious about your opinion here, not arguing for the sake of it, they are just not as closely connected in my mind. For example Google has a good track record of having safe practices regarding data storage -- but privacy is not their strong suit/hard to define what it means for a company to begin with.
      - strcat 7mo ago
        > Quite clearly privacy is important It's seriously lacking. There's little work on it. Applications are largely fully trusted with lack of a modern permission model. > none of the major components leak/store unnecessary personal data Many components have privacy issues and have privacy invasive services. > I would say that GNU/Linux is privacy-friendly, but has terrible security. Disagree with an OS which has poor privacy protections against applications and services along with overall lack of systemic work on privacy being privacy friendly. Android Open Source Project without our privacy improvements is more privacy friendly than desktop Linux. There's not much privacy when nearly everything has access to everything and developers do all kinds of things which are bad for privacy. They may not be trying to gather user data but that doesn't mean the services quietly used by many applications are privacy friendly.
- palata 8mo ago
  I think it's more of a marketing claim from less secure systems that "privacy is not security, and GrapheneOS focuses on security while we focus on privacy". GrapheneOS does care about both, quite obviously. And GrapheneOS tends to say that if your security is bad, then it is affecting your privacy too. Whereas others say "sure, we break the Android security model by unlocking the bootloader and signing our system with the Google test keys, but your apps will contact Google through microG instead of the Play Services, so it's more private". Which is worth what it is worth...
  - ForHackernews 8mo ago
    This is only my opinion, but GrapheneOS's approach to privacy seems obtuse to me. They will claim that an unlocked bootloader is a risk, but then turn around and recommend you install proprietary apps GApps in their sandbox. The sandbox doesn't matter if all the private data is in the same sandbox! Reminds me of https://xkcd.com/1200/ https://xkcd.com/1200/
    - gf000 8mo ago
      They recommend you install google play services if you need it. Privacy is in no small part a user-decision - no matter how secure your device is if you just scroll Facebook all day.
    - palata 8mo ago
      Feels like you don't know what "the sandbox" is. It's not "their" sandbox, it's from AOSP. When you run an app on Android, it runs in a sandbox. Meaning that your social media app cannot access the files of your banking app by default. They are "sandboxed". On a normal Android, the Play Services are installed as a system app. It is privileged app that has "system" access. A system app is not sandboxed. GrapheneOS allows you to install the Play Services and the Play Store as "sandboxed" apps in that they run unprivileged, just like WhatsApp or TikTok or your banking app. So running the proprietary Google apps in the sandbox is obviously more private than running them as system apps, wouldn't you say?
      - 8mo ago
- strcat 8mo ago
  GrapheneOS is primarily privacy project. It keeps up with important Android updates with major privacy enhancements and very important privacy patches. It builds crucial privacy protections such as Storage Scopes, Contact Scopes, Sensors toggle and much more into the OS. Privacy depends on security so security protections and security patches are part of providing strong privacy too. It's a misconception that GrapheneOS is focused on security over privacy. It heavily works on privacy features and the work on security features is entirely to protect privacy. There's widespread use of commercial exploit tools and GrapheneOS is proven to provide far better real world protection against those. Most alternate operating systems reduce privacy from AOSP and massively reduce security while GrapheneOS is preserving the baseline and heavily improving both side by side. GrapheneOS is also very focused on usability and app compatibility, making sure to preserve those with the major privacy and security enhancements.
  - realusername 8mo ago
    The #1 security problem your average Android user face isn't an attack by some Israeli firm but data leaks by advertisers and unless I missed something (it's possible), GrapheneOS does not have an equivalent of ublock origin built into the OS which I'd consider step 1 of fighting the problem. The "ideal android" in my head would just have a dynamic ruleset to patch/nop tracking libraries as the app loads, which as far as I know, nobody does that, eOS doesn't either. Kind of like Revanced but on steroids and built into Android. I feel like you can't really fix android anyways, the design is just broken and if you care about security / privacy, you should just use everything in a browser or a Linux distribution. Sure the work GrapheneOS does is valuable but it's like removing water from a lake with a bucket. I feel like shielding the mess that Android is into something like an improved Waydroid with a mindset of "yeah let's keep it there and the sane stack for the rest" sounds a better approach to me.
    - ysnp 8mo ago
      >GrapheneOS does not have an equivalent of ublock origin built into the OS which I'd consider step 1 of fighting the problem. Content filtering is built into the browser. GrapheneOS have always maintained that you cannot prevent an app from exfiltrating data, especially if it has internet access. Enumerating badness is an unsustainable approach they don't want to encourage. Instead they attack the heart of the issue with Storage Scopes/Contact Scopes/Network Permission/Sensors Permission etc. They allow aps to think they have full access when they do not, so you can control exactly what data they get in the first place. Maybe all of the other AOSP projects could contribute App Communication Scopes/Enhanced Clipboard Privacy and other things because this approach makes a lot of sense to me. Like preventing an illness instead of wasting energy treating symptoms. >The "ideal android" in my head would just have a dynamic ruleset to patch/nop tracking libraries as the app loads, which as far as I know, nobody does that, eOS doesn't either. Kind of like Revanced but on steroids and built into Android. Something similar was addressed some years ago as a feature request for GrapheneOS https://github.com/GrapheneOS/os-issue-tracker/issues/284 https://github.com/GrapheneOS/os-issue-tracker/issues/284. To summarise there was no way to do this without an unacceptable security cost to the OS, but this is sort of doable if you run your own userdebug build which you have the power to do.
- MaroonBear 8mo ago
  [dead]

realusername 8mo ago

I like GrapheneOS but they fail to understand in this post that the #1 security concern an android user face is the lack of privacy. Sure they have hardened everything but realistically, that's not the main threat for your average user. Their top contribution to android is the sandboxed Google Play, by far.

gf000 8mo ago
privacy != security. And sandboxed Google Play services serve both goals -- it runs the service as a regular android service, not an exceptional one that has a bunch of extra permissions. So you can allow/restrict it as you seem fit, while not "getting behind" on features/apps that mandate it.
- realusername 8mo ago
  I disagree, privacy is an essential part of security, if there's no privacy, then there's no security. That's also why I don't keep anything important on my phone as I don't trust what's going on there despite having all the secure features that you would want.
  - scheeseman486 8mo ago
    Other way around, actually. It's possible to make concessions to privacy, like providing crash reports, or running applications in sandboxes which limits what they can harvest, while keeping the platform secure. Any privacy you have on a system is reliant on no one tampering with that system and on software behaving itself. Without security, you can't trust the system to implement any privacy.
    - realusername 8mo ago
      I also disagree with that, I trust my Linux distribution to behave well much more than I trust any Android platform and it doesn't even have much app sandboxing at all. You can't fix a lack of trust like you have in Android with technical solutions. The flaw in Android is fundamentally a social problem.
      - scheeseman486 8mo ago
        That reads more as sports team flag wavey thoughts and feelings trust than anything actually backed by objective data.
        realusername 8mo ago
        That's the difference between trusted computing (Linux distribution) and untrusted computing (Android). If you want something backed by objective data, my phone has an advertising ID built in the OS and my laptop doesn't. My phone had 100s of privacy scandals and my laptop doesn't have one. I do applaud GrapheneOS don't get me wrong but I have a feeling that they are fighting a losing battle.
        Aachen 8mo ago
        What advertising ID is built into the OS?
        realusername 8mo ago
        See https://support.google.com/googleplay/android-developer/answer/6048248?hl=en https://support.google.com/googleplay/android-developer/answ... for Android and https://developer.apple.com/documentation/adsupport/asidentifiermanager/advertisingidentifier https://developer.apple.com/documentation/adsupport/asidenti... for iOS
        Aachen 8mo ago
- strcat 8mo ago
  GrapheneOS provides major privacy enhancements including Contact Scopes, Storage Scopes, Sensors toggle, per-connection Wi-Fi privacy via per-connection DHCP state + MAC randomization and far more. It's a privacy project and privacy depends on security so it heavily focuses on protecting against exploitation of privacy and security vulnerabilities too. Privacy and security are not separate things from each other but rather closely tied together and our work is on both for the sake of improving privacy. Our only reason to work on security features is protecting privacy.
  - gf000 8mo ago
    I won't argue with you on the project-related part of it, you obviously know best there :) Thank you for all the work! But how would you "rate" for example desktop "GNU/Linux" with this in mind? Quite clearly privacy is important here and none of the major components leak/store unnecessary personal data. But the security story is quite sad, everything runs as the same user so a random `npm install` can just do whatever it wants with my browser caches, ssh keys, etc. I would say that GNU/Linux is privacy-friendly, but has terrible security. Would you not agree here? How does this fit with the "privacy and security are not separate things" part? Genuinely curious about your opinion here, not arguing for the sake of it, they are just not as closely connected in my mind. For example Google has a good track record of having safe practices regarding data storage -- but privacy is not their strong suit/hard to define what it means for a company to begin with.
    - strcat 7mo ago
      > Quite clearly privacy is important It's seriously lacking. There's little work on it. Applications are largely fully trusted with lack of a modern permission model. > none of the major components leak/store unnecessary personal data Many components have privacy issues and have privacy invasive services. > I would say that GNU/Linux is privacy-friendly, but has terrible security. Disagree with an OS which has poor privacy protections against applications and services along with overall lack of systemic work on privacy being privacy friendly. Android Open Source Project without our privacy improvements is more privacy friendly than desktop Linux. There's not much privacy when nearly everything has access to everything and developers do all kinds of things which are bad for privacy. They may not be trying to gather user data but that doesn't mean the services quietly used by many applications are privacy friendly.
palata 8mo ago
I think it's more of a marketing claim from less secure systems that "privacy is not security, and GrapheneOS focuses on security while we focus on privacy". GrapheneOS does care about both, quite obviously. And GrapheneOS tends to say that if your security is bad, then it is affecting your privacy too. Whereas others say "sure, we break the Android security model by unlocking the bootloader and signing our system with the Google test keys, but your apps will contact Google through microG instead of the Play Services, so it's more private". Which is worth what it is worth...
- ForHackernews 8mo ago
  This is only my opinion, but GrapheneOS's approach to privacy seems obtuse to me. They will claim that an unlocked bootloader is a risk, but then turn around and recommend you install proprietary apps GApps in their sandbox. The sandbox doesn't matter if all the private data is in the same sandbox! Reminds me of https://xkcd.com/1200/ https://xkcd.com/1200/
  - gf000 8mo ago
    They recommend you install google play services if you need it. Privacy is in no small part a user-decision - no matter how secure your device is if you just scroll Facebook all day.
  - palata 8mo ago
    Feels like you don't know what "the sandbox" is. It's not "their" sandbox, it's from AOSP. When you run an app on Android, it runs in a sandbox. Meaning that your social media app cannot access the files of your banking app by default. They are "sandboxed". On a normal Android, the Play Services are installed as a system app. It is privileged app that has "system" access. A system app is not sandboxed. GrapheneOS allows you to install the Play Services and the Play Store as "sandboxed" apps in that they run unprivileged, just like WhatsApp or TikTok or your banking app. So running the proprietary Google apps in the sandbox is obviously more private than running them as system apps, wouldn't you say?
    - 8mo ago
strcat 8mo ago
GrapheneOS is primarily privacy project. It keeps up with important Android updates with major privacy enhancements and very important privacy patches. It builds crucial privacy protections such as Storage Scopes, Contact Scopes, Sensors toggle and much more into the OS. Privacy depends on security so security protections and security patches are part of providing strong privacy too. It's a misconception that GrapheneOS is focused on security over privacy. It heavily works on privacy features and the work on security features is entirely to protect privacy. There's widespread use of commercial exploit tools and GrapheneOS is proven to provide far better real world protection against those. Most alternate operating systems reduce privacy from AOSP and massively reduce security while GrapheneOS is preserving the baseline and heavily improving both side by side. GrapheneOS is also very focused on usability and app compatibility, making sure to preserve those with the major privacy and security enhancements.
- realusername 8mo ago
  The #1 security problem your average Android user face isn't an attack by some Israeli firm but data leaks by advertisers and unless I missed something (it's possible), GrapheneOS does not have an equivalent of ublock origin built into the OS which I'd consider step 1 of fighting the problem. The "ideal android" in my head would just have a dynamic ruleset to patch/nop tracking libraries as the app loads, which as far as I know, nobody does that, eOS doesn't either. Kind of like Revanced but on steroids and built into Android. I feel like you can't really fix android anyways, the design is just broken and if you care about security / privacy, you should just use everything in a browser or a Linux distribution. Sure the work GrapheneOS does is valuable but it's like removing water from a lake with a bucket. I feel like shielding the mess that Android is into something like an improved Waydroid with a mindset of "yeah let's keep it there and the sane stack for the rest" sounds a better approach to me.
  - ysnp 8mo ago
    >GrapheneOS does not have an equivalent of ublock origin built into the OS which I'd consider step 1 of fighting the problem. Content filtering is built into the browser. GrapheneOS have always maintained that you cannot prevent an app from exfiltrating data, especially if it has internet access. Enumerating badness is an unsustainable approach they don't want to encourage. Instead they attack the heart of the issue with Storage Scopes/Contact Scopes/Network Permission/Sensors Permission etc. They allow aps to think they have full access when they do not, so you can control exactly what data they get in the first place. Maybe all of the other AOSP projects could contribute App Communication Scopes/Enhanced Clipboard Privacy and other things because this approach makes a lot of sense to me. Like preventing an illness instead of wasting energy treating symptoms. >The "ideal android" in my head would just have a dynamic ruleset to patch/nop tracking libraries as the app loads, which as far as I know, nobody does that, eOS doesn't either. Kind of like Revanced but on steroids and built into Android. Something similar was addressed some years ago as a feature request for GrapheneOS https://github.com/GrapheneOS/os-issue-tracker/issues/284 https://github.com/GrapheneOS/os-issue-tracker/issues/284. To summarise there was no way to do this without an unacceptable security cost to the OS, but this is sort of doable if you run your own userdebug build which you have the power to do.
MaroonBear 8mo ago
[dead]