5 ms·

privacy != security. And sandboxed Google Play services serve both goals -- it runs the service as a regular android service, not an exceptional one that has a

by gf000 8mo ago

privacy != security. And sandboxed Google Play services serve both goals -- it runs the service as a regular android service, not an exceptional one that has a bunch of extra permissions. So you can allow/restrict it as you seem fit, while not "getting behind" on features/apps that mandate it.

realusername 8mo ago
I disagree, privacy is an essential part of security, if there's no privacy, then there's no security. That's also why I don't keep anything important on my phone as I don't trust what's going on there despite having all the secure features that you would want.
- scheeseman486 8mo ago
  Other way around, actually. It's possible to make concessions to privacy, like providing crash reports, or running applications in sandboxes which limits what they can harvest, while keeping the platform secure. Any privacy you have on a system is reliant on no one tampering with that system and on software behaving itself. Without security, you can't trust the system to implement any privacy.
  - realusername 8mo ago
    I also disagree with that, I trust my Linux distribution to behave well much more than I trust any Android platform and it doesn't even have much app sandboxing at all. You can't fix a lack of trust like you have in Android with technical solutions. The flaw in Android is fundamentally a social problem.
    - scheeseman486 8mo ago
      That reads more as sports team flag wavey thoughts and feelings trust than anything actually backed by objective data.
      - realusername 8mo ago
        That's the difference between trusted computing (Linux distribution) and untrusted computing (Android). If you want something backed by objective data, my phone has an advertising ID built in the OS and my laptop doesn't. My phone had 100s of privacy scandals and my laptop doesn't have one. I do applaud GrapheneOS don't get me wrong but I have a feeling that they are fighting a losing battle.
        Aachen 8mo ago
        What advertising ID is built into the OS?
        realusername 8mo ago
        See https://support.google.com/googleplay/android-developer/answer/6048248?hl=en https://support.google.com/googleplay/android-developer/answ... for Android and https://developer.apple.com/documentation/adsupport/asidentifiermanager/advertisingidentifier https://developer.apple.com/documentation/adsupport/asidenti... for iOS
        Aachen 8mo ago
        You're linking to Google Play's documentation, not Android code itself that GrapheneOS etc. are built upon You can find hardware identifiers exposed by Linux distributions more than by Android itself. That Google adds a nice sauce on top... yeah that's a sorry state of affairs, but an optional layer if you don't use the stock OS if it ships with Google Play edit: but I appreciate looking it up nonetheless! I wasn't completely sure that I hadn't missed that Android (AOSP) includes this now as well
        realusername 8mo ago
        You can't really use Android without the Google Play anyways so that's a moot point, none of the popular apps will work. Google Play is very much a core part of the Android OS. Even EOS and GrapheneOS realized that themselves.
    - strcat 8mo ago
      There's a massive open source app ecosystem for Android which is far larger than the subset available in F-Droid. Open source does not imply private or trustworthy. Completely trusting applications with access to all your data with no insight in to what they're accessing or sending to services means you wouldn't know if your privacy is being violating anyway.
      - drnick1 8mo ago
        The (desktop) Linux security model is different. You trust the distro maintainers in the same way you trust the GOS devs, and instead of "app sandboxing" you use user accounts, containers or VMs to protect personal information. The Android security model makes sense in the context of laypeople using mostly commercial malware on the stock OS however.
        gf000 8mo ago
        > The (desktop) Linux security model is different In that it doesn't really exist. Sure, linux has all the capabilities to do it properly, but defaults matter in security so the way it currently works, basically every program has access to everything actually important (personal files, photos, ssh keys, etc). It just can't upgrade your GPU driver.
        realusername 8mo ago
        Security goes way beyond a technical checklist. I trust my Linux distribution because there's a chain of trust, from the maintainers, the contributors down to the user to make sure that the software is respecting the user. You can't fix the lack of trust you have on Android with just sandboxing.
        gf000 8mo ago
        I do trust the Linux distro maintainers that they don't have nefarious purposes. But they can't and won't verify third party projects' code, nor the huge number of contributors that come and go on any of these projects, or their transitive dependencies. As has been shown, it's almost trivial to get malicious code merged into open source projects, so not really sure where your "trust" comes from. It's not trust, it's naiveness.
strcat 8mo ago
GrapheneOS provides major privacy enhancements including Contact Scopes, Storage Scopes, Sensors toggle, per-connection Wi-Fi privacy via per-connection DHCP state + MAC randomization and far more. It's a privacy project and privacy depends on security so it heavily focuses on protecting against exploitation of privacy and security vulnerabilities too. Privacy and security are not separate things from each other but rather closely tied together and our work is on both for the sake of improving privacy. Our only reason to work on security features is protecting privacy.
- gf000 8mo ago
  I won't argue with you on the project-related part of it, you obviously know best there :) Thank you for all the work! But how would you "rate" for example desktop "GNU/Linux" with this in mind? Quite clearly privacy is important here and none of the major components leak/store unnecessary personal data. But the security story is quite sad, everything runs as the same user so a random `npm install` can just do whatever it wants with my browser caches, ssh keys, etc. I would say that GNU/Linux is privacy-friendly, but has terrible security. Would you not agree here? How does this fit with the "privacy and security are not separate things" part? Genuinely curious about your opinion here, not arguing for the sake of it, they are just not as closely connected in my mind. For example Google has a good track record of having safe practices regarding data storage -- but privacy is not their strong suit/hard to define what it means for a company to begin with.
  - strcat 8mo ago
    > Quite clearly privacy is important It's seriously lacking. There's little work on it. Applications are largely fully trusted with lack of a modern permission model. > none of the major components leak/store unnecessary personal data Many components have privacy issues and have privacy invasive services. > I would say that GNU/Linux is privacy-friendly, but has terrible security. Disagree with an OS which has poor privacy protections against applications and services along with overall lack of systemic work on privacy being privacy friendly. Android Open Source Project without our privacy improvements is more privacy friendly than desktop Linux. There's not much privacy when nearly everything has access to everything and developers do all kinds of things which are bad for privacy. They may not be trying to gather user data but that doesn't mean the services quietly used by many applications are privacy friendly.

by gf000 8mo ago

realusername 8mo ago

I disagree, privacy is an essential part of security, if there's no privacy, then there's no security. That's also why I don't keep anything important on my phone as I don't trust what's going on there despite having all the secure features that you would want.

scheeseman486 8mo ago
Other way around, actually. It's possible to make concessions to privacy, like providing crash reports, or running applications in sandboxes which limits what they can harvest, while keeping the platform secure. Any privacy you have on a system is reliant on no one tampering with that system and on software behaving itself. Without security, you can't trust the system to implement any privacy.
- realusername 8mo ago
  I also disagree with that, I trust my Linux distribution to behave well much more than I trust any Android platform and it doesn't even have much app sandboxing at all. You can't fix a lack of trust like you have in Android with technical solutions. The flaw in Android is fundamentally a social problem.
  - scheeseman486 8mo ago
    That reads more as sports team flag wavey thoughts and feelings trust than anything actually backed by objective data.
    - realusername 8mo ago
      That's the difference between trusted computing (Linux distribution) and untrusted computing (Android). If you want something backed by objective data, my phone has an advertising ID built in the OS and my laptop doesn't. My phone had 100s of privacy scandals and my laptop doesn't have one. I do applaud GrapheneOS don't get me wrong but I have a feeling that they are fighting a losing battle.
      - Aachen 8mo ago
        What advertising ID is built into the OS?
        realusername 8mo ago
        See https://support.google.com/googleplay/android-developer/answer/6048248?hl=en https://support.google.com/googleplay/android-developer/answ... for Android and https://developer.apple.com/documentation/adsupport/asidentifiermanager/advertisingidentifier https://developer.apple.com/documentation/adsupport/asidenti... for iOS
        Aachen 8mo ago
        You're linking to Google Play's documentation, not Android code itself that GrapheneOS etc. are built upon You can find hardware identifiers exposed by Linux distributions more than by Android itself. That Google adds a nice sauce on top... yeah that's a sorry state of affairs, but an optional layer if you don't use the stock OS if it ships with Google Play edit: but I appreciate looking it up nonetheless! I wasn't completely sure that I hadn't missed that Android (AOSP) includes this now as well
        realusername 8mo ago
        You can't really use Android without the Google Play anyways so that's a moot point, none of the popular apps will work. Google Play is very much a core part of the Android OS. Even EOS and GrapheneOS realized that themselves.
  - strcat 8mo ago
    There's a massive open source app ecosystem for Android which is far larger than the subset available in F-Droid. Open source does not imply private or trustworthy. Completely trusting applications with access to all your data with no insight in to what they're accessing or sending to services means you wouldn't know if your privacy is being violating anyway.
    - drnick1 8mo ago
      The (desktop) Linux security model is different. You trust the distro maintainers in the same way you trust the GOS devs, and instead of "app sandboxing" you use user accounts, containers or VMs to protect personal information. The Android security model makes sense in the context of laypeople using mostly commercial malware on the stock OS however.
      - gf000 8mo ago
        > The (desktop) Linux security model is different In that it doesn't really exist. Sure, linux has all the capabilities to do it properly, but defaults matter in security so the way it currently works, basically every program has access to everything actually important (personal files, photos, ssh keys, etc). It just can't upgrade your GPU driver.
        realusername 8mo ago
        Security goes way beyond a technical checklist. I trust my Linux distribution because there's a chain of trust, from the maintainers, the contributors down to the user to make sure that the software is respecting the user. You can't fix the lack of trust you have on Android with just sandboxing.
        gf000 8mo ago
        I do trust the Linux distro maintainers that they don't have nefarious purposes. But they can't and won't verify third party projects' code, nor the huge number of contributors that come and go on any of these projects, or their transitive dependencies. As has been shown, it's almost trivial to get malicious code merged into open source projects, so not really sure where your "trust" comes from. It's not trust, it's naiveness.

strcat 8mo ago

GrapheneOS provides major privacy enhancements including Contact Scopes, Storage Scopes, Sensors toggle, per-connection Wi-Fi privacy via per-connection DHCP state + MAC randomization and far more. It's a privacy project and privacy depends on security so it heavily focuses on protecting against exploitation of privacy and security vulnerabilities too. Privacy and security are not separate things from each other but rather closely tied together and our work is on both for the sake of improving privacy. Our only reason to work on security features is protecting privacy.

gf000 8mo ago
I won't argue with you on the project-related part of it, you obviously know best there :) Thank you for all the work! But how would you "rate" for example desktop "GNU/Linux" with this in mind? Quite clearly privacy is important here and none of the major components leak/store unnecessary personal data. But the security story is quite sad, everything runs as the same user so a random `npm install` can just do whatever it wants with my browser caches, ssh keys, etc. I would say that GNU/Linux is privacy-friendly, but has terrible security. Would you not agree here? How does this fit with the "privacy and security are not separate things" part? Genuinely curious about your opinion here, not arguing for the sake of it, they are just not as closely connected in my mind. For example Google has a good track record of having safe practices regarding data storage -- but privacy is not their strong suit/hard to define what it means for a company to begin with.
- strcat 8mo ago
  > Quite clearly privacy is important It's seriously lacking. There's little work on it. Applications are largely fully trusted with lack of a modern permission model. > none of the major components leak/store unnecessary personal data Many components have privacy issues and have privacy invasive services. > I would say that GNU/Linux is privacy-friendly, but has terrible security. Disagree with an OS which has poor privacy protections against applications and services along with overall lack of systemic work on privacy being privacy friendly. Android Open Source Project without our privacy improvements is more privacy friendly than desktop Linux. There's not much privacy when nearly everything has access to everything and developers do all kinds of things which are bad for privacy. They may not be trying to gather user data but that doesn't mean the services quietly used by many applications are privacy friendly.