8 ms·
GrapheneOS fixes Android VPN leak Google refused to patch
- unethical_ban 6mo agoI know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?
- boje 6mo agoThat assumes there is pride they have to bother to keep.
- k4rli 6mo agoInterestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.
- mcraiha 6mo agoThere should be at least one Motorola phone before end of the year that has GrapheneOS support.
- HybridStatAnim8 6mo agoMotorola devices with GrapheneOS support will arrive in 2027 or later, not 2026. Likely, the 2027 Signature, Razr fold, and Razr flip, will meet GOSs hardware security requirements.
- oceansky 6mo agoSo far. Other companies surely will make their devices compatible if the market share increases for it
- snapplebobapple 6mo agoFirst motorola grapheneos phone i am buying to get fully off the google pain train. Grapheneos tides me over until a real linux smart phone shows up or i die of old age. Now if home assistant could get thread network join*ng working without an android phone with a google account i could ve fully ris of those eh holes.
- surgical_fire 6mo agoI am patiently waiting for that one. I have been willing to move to GrapheneOS for a while, but I don't feel like buying Google hardware.
- amarant 6mo agoFwiw the pixel phones are excellent hardware.
- surgical_fire 6mo agoI don't care. I don't want Google hardware because I despise the company and I'm actively trying to reduce my dependence on Google.
- SwamyM 6mo agoThat's debatable. Pretty much every generation of the Pixel phones have had some major issues. They've even had to do multiple extended repair/replace programs due to some of them. Heck there is even an ongoing issue where one of their updates has caused multiple generations of their devices to be bricked (and that still hasn't been fixed) - https://www.androidauthority.com/google-pixel-march-update-boot-loop-3655031/ https://www.androidauthority.com/google-pixel-march-update-b... On a technical level, yea, it may be great hardware but in practice, I don't think it is. As an Android user, I wish it were but it's not. Samsung is so much more reliable as an end user (even with their own issues).
- tpm 6mo agoThey have consistently the worst battery endurance of any relevant phone maker since forever.
- winter_blue 6mo agoSadly, Verizon Pixel phones, even after carrier unlocking, seem to be forever blocked from using GrapheneOS.
- neilv 6mo agoCarrier-sold Pixels generally don't have "OEM-unlockable" bootloaders. Your best bet for now is to buy a new Pixel direct from Google, or a used one from eBay that the seller advertises as already having GrapheneOS on it (or otherwise guarantees that the bootloader is unlockable). These ones are worth a lot more than the ones that can only run Google/carrier Android. https://grapheneos.org/install/web#prerequisites https://grapheneos.org/install/web#prerequisites I own two GrapheneOS Pixel 7 units, which should get any Google blob security updates (which GrapheneOS incorporates) through October 2027, and GrapheneOS may still support it with source updates after that. So in a year or so, I might get the GrapheneOS Motorola if it's available, or a later Pixel. (I never buy these new, since I don't want to carry a several hundred dollar phone when a 2 gen old one is still great, thanks to GrapheneOS.) https://support.google.com/pixelphone/answer/4457705 https://support.google.com/pixelphone/answer/4457705
- winter_blue 6mo agoIs this true for all carriers? Or just Verizon? Several Reddit threads say that it's just Verizon. T-Mobile users report being able to bootloader unlock after getting their phones carrier unlocked by T-Mobile.
- HybridStatAnim8 6mo agoOEM/carrier locking tends to only happen in the US. Many carriers permit unlocking after the contract has concluded, but Verizon has always blocked it. Used devices also run the risk of being improperly unlocked and making OEM unlocking remain unavailable. (Used devices may also be Verizon devices.)
- HybridStatAnim8 6mo agoOEM/carrier locking tends to only happen in the US. Many carriers permit unlocking after the contract has concluded, but Verizon has always blocked it. Used devices also run the risk of being improperly unlocked and making OEM unlocking remain unavailable. (Used devices may also be Verizon devices.)
- zb3 6mo agoI don't see a problem with supporting their legitimate hardware or cloud business models. But of course I see a problem supporting their illegitimate adware and spyware business models.
- Cider9986 6mo agoI agree, especially when you are buying for the used market.
- DANmode 6mo agoI’ve seen this repeated here, but: Google's Pixel hardware division likely operates at a loss - or breaks even. and even if every active HN user bought $100-$400 used Pixels from Swappa, meaningless money to them.
- microtonal 6mo agoYep, Pixels for them are entry points to Google One subscriptions, etc. The Pixel 9a is currently 350 Euro in my country, it has the same CPU/GPU (modem differs) that the expensive 9 Pro/Pro XL/Pro Fold had. Factoring in development costs, etc. at that price I cannot imagine it being more than break-even. Also, even Pixel 9a has all the security functions of the flagship that many other Android phones do not have or are just getting, such as the Memory Tagging Extension (MTE), the Titan M2 security processor (no need to rely on TrustZone for secrets), etc.
- SV_BubbleTime 6mo agoWe need to bring back shame. Step one… completely reform MBA programs.
- rexpop 6mo agoCorporations have no pride. They are soulless, psychopathic accountability sinks. What planet are you from?
- bflesch 6mo agoAt some point digital security turns into physical security, and there are national security interests that have fine-tuned their detection logic on these kinds of "buggy" behavior. If you patch it, you'd need to find another way to de-anonymize those users.
- hedora 6mo agoSo, somewhere, some government or organization might want to blow the user into kibble, and that's an important use case? I feel like this should be toward the top of the terms of service for the phone, even above the mandatory arbitration clause.
- like_any_other 6mo agoHow can someone consider unwanted disclosure of personal information a security issue, and work at Google?
- helterskelter 6mo agoThey're paid not to.
- 2ndorderthought 6mo agoIt's a feature for them not a bug. Google is an ad company and an offense contractor they want VPN users leaking packets for both reasons.
- jeroenhd 6mo agoDepends on how you see the role of a VPN. VPNs, at least originally, were designed to provide access to private/business networks across another network. Office to office, home to office, that sort of thing. VPNs were only later turned into some kind of (supposed) security tool. If your take on VPN code is "as long as your phone can reach the office printer over 5G" then this is a tiny bug. QUIC connections aren't being shut down properly, like they weren't before the introduction of the feature. If your take on VPN code is "this wireguard tunnel must keep my identity safe no matter what" or "my security relies on this wireguard tunnel being an exact copy of all traffic exchanged over the internet" then this is a massive problem. I don't think Android VPNs, or any VPN to be honest, were ever designed as a privacy or security measure. Especially not against apps with code execution on the device. The device itself will do all kinds of network interactions, some happening from within the modem chip itself. Closing the bug was a mistake on Google's part, but I can see why they don't consider this a security bug in their bug bounty programme.
- OutOfHere 6mo ago[flagged]
- idovmamane 6mo agoThe technical detail that makes this egregious is that the leak happens in system_server, a privileged process. Android’s own lockdown mode explicitly promises that no traffic bypasses the VPN. When the system itself sends the packet over the physical interface, that promise is broken at the kernel level, not in userspace. Calling this “not security bulletin class” is hard to defend.
- Georgelemental 6mo agoThanks, Claude! Or perhaps Codex? Which type of AI spambot are you?
- nottorp 6mo ago> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions So a VPN isn't a VPN on Android? Regardless of this bug. Do other locked down operating systems act the same?
- Paradigm2020 6mo agoIos does the same, only way around it is if you have an ?enterprise? licence (250+ devices) Mullvad and others reported on that one ages ago
- kqp 6mo agoIs this really true? The Mullvad report a year or so ago was that they didn’t want to turn on no exceptions mode because it breaks network connectivity until reboot if you don’t pause it when updating the app, not that the feature doesn’t exist. They also recently shipped it anyway, opt in and behind a warning.
- Paradigm2020 5mo agoAs a quick chatgpt check and following the links to apple's own site that still seems to be the case... Force “most” traffic through VPN using includeAllNetworks Yes, but imperfect (normal) Yes (supervision) stronger controls are tied to device management / supervision, usually for organization-owned devices. https://developer.apple.com/documentation/NetworkExtension/NEVPNProtocol/includeAllNetworks https://developer.apple.com/documentation/NetworkExtension/N...
- pyaamb 6mo agoa VPN enabled wifi router would suffice as a fallback tho right?
- ranguna 6mo agoFor the very specific case where you are connected to that router, yes.
- zb3 6mo agoStock Android is spyware and adware, back in the day we called such software malicious and removed it, now it's the default.
- whatsupdog 6mo agoWe all agree. But what's the solution? We know 99% of the users don't care. So, the only pressure point is phone manufacturers. I don't have any power to influence anybody significant in this space. I feel helpless.
- realusername 6mo agoThe phones without tracking are so rare that I don't think we can even say that the users do not care, they simply never had the option
- fsflover 6mo agoThe truly independent solution is GNU/Linux. Sent from my Librem 5.
- zb3 6mo agoWhy is there no Librem 6? Librem 5 is 7 years old, it's a low-end smartphone with a flagship price tag :(
- zb3 6mo agoOh wait they released "Liberty Phone" - still low end(!), this time with absurdly high price.. You can get true linux phone 10x cheaper by buying something that supports PostmarketOS
- rationalist 6mo agoYour post sounds like you're trying to spread FUD. Librem says the Liberty phone is the same, it just costs more because it is assembled in the U.S. for people, companies, or governments that don't want it intercepted and modified by a bad actor.
- hedora 6mo ago> Google maintained its position, authorizing public disclosure on April 29. I'm surprised they honored the embargo at that point, and delayed the fix until May. Why not just release immediately?
- c0balt 6mo agoNot damaging their relationship with Google as a vendor most likely. For better or worse, GrapheneOS is depend on Android which is controlled by Google.
- Georgelemental 6mo agoThe researcher who discovered the bug is not affiliated with Graphene
- ignoramous 6mo agoThe issue reported on lowlevel.fun [0] and discussed on GrapheneOS forums [1] does seem like a security issue. It isn't clear why engineers in charge would mark it infeasible as the breach demonstrates more than one failure. 1. A new (albeit "hidden" [2]) network API registerQuicConnectionClosePayload(fd, payload) lets a process set any byte array for the OS to send on its behalf. 2. No ("panaroid networking") permission checks against the calling uid/process when sending that byte array out on a OS-owned UDP socket. 3. Bypassing ("panaroid android") permission checks [3] by simply calling network-related syscalls (or libc/bionic functions) as opposed to Android SDK APIs. These steps essentially amount to app sandbox escape (2,3) and privilege escalation (1,2). I am utterly confused why the Android security team at Google won't take this more seriously. [0] https://lowlevel.fun/posts/tiny-udp-cannon-android-vpn-bypass/ https://lowlevel.fun/posts/tiny-udp-cannon-android-vpn-bypas... [1] https://discuss.grapheneos.org/d/35152-android-always-on-vpn-ip-leak/ https://discuss.grapheneos.org/d/35152-android-always-on-vpn... [2] In as much the code mmap'd into your own process can be "hidden" away. For their exploit though, the author cleverly abuses Binder IPC primitives to reach the "hidden" parts. [3] This bypass probably only works for this one scenario because of #2.
- deleted 6mo ago[deleted]
- fg137 6mo agoSide question: what's a good way of getting a GrapheneOS phone? I have been interested in using GrapheneOS but hesitant about actually getting a Pixel phone. Used phone prices are usually >$300 even for "a" series unless I go back several generations. Whether the device bootloader can be unlocked is also a question. I am definitely not ready to spend $449 on a new Pixel 10a.
- DANmode 6mo ago> unless I go back several generations Yeah, do that. It’ll still be the snappiest phone you’ve ever used.
- mpol 6mo agoYou could wait it out for a bit. There is work underway to support more phone hardware. Which brand was a bit up for speculation.
- Itoldmyselfso 6mo agoIt was announced a while ago to be Mororola: https://motorolanews.com/motorola-three-new-b2b-solutions-at-mwc-2026/ https://motorolanews.com/motorola-three-new-b2b-solutions-at...
- izacus 6mo agoI doubt Motorola will give him a phone cheaper than 449$ though.
- mctt 6mo agoI bought a Pixel 7 from BackMarket to test out GrapheneOS. I have previous positive comments and conversations in my account history.
- mystifyingpoi 6mo agoDon't buy Pixel 10a, 9a is almost exactly the same thing and still sold new.
- 6mo ago
- jona-f 6mo agoI bought a used Pixel 6 for cheap to try out grapheneos. Can't say I like it. UX of lineageos is much better. There is a weird russian doll kind of situation with the package managers going on. There is one builtin "App Store" with only a few basis programs, one of which is another package manager, accrescent, which offers a few more apps, but still not comprehensive at all, so another package manager is needed for which grapheneos people seem to favor obtainium over f-droid, which I find is another strange decision. I much prefer a fully OSS package manager and there is real value in having people compile from the sources externally, maybe even reproducibly so, instead of trusting the github packages. The grapheneos security model seems oddly centralized to me. I can't really comment on the reported privacy and security benefits.
- NewJazz 6mo agoI'm really glad calyxos is starting up again. Grapheneos has a lot of cool technical implementation but there are a lot of things that Calyx seems to do in a simpler, more vanilla Android manner.
- subscribed 6mo agoCalyxOS claims releases are paused[1] and the best you can get is Android 15. How recent are security patches you're getting? Can you even lock the bootloader on your device? [2] [1] https://calyxos.org/ https://calyxos.org/ [2] calyxos.org/lock
- NewJazz 6mo agoNot using it currently but they recently released some test builds of android 16. And yeah aiui bootloader relocking is supported for devices that are compatible. https://old.reddit.com/r/CalyxOS/comments/1t3tdt6/calyxos_progress_report_our_test_build_with/ https://old.reddit.com/r/CalyxOS/comments/1t3tdt6/calyxos_pr...
- subscribed 5mo agoThey released the _test builds_.... now, almost a year since the release, while the beta of Android 17 was released 3 months ago. Right, CalyxOS says that releases are paused so presumably the work is slow. The problem with lagging is that only some of the security patches are backported to older androids, so the project would have to backport remaining ones themselves. Let's be real, no one does that in CalyxOS for all the supported devices. Out of their 15 supported "modern devices" 10 are pixels. Their extended support phones (6 devices) has three pixels as well. Might as well get more modern and secure OS instead (A16 with fixes and working call recording for example) :)
- 1vuio0pswjnm7 6mo ago"In its latest release, GrapheneOS says it has "disable[d] registerQuicConnectionClosePayload optimization to fix VPN leak," effectively neutralizing the attack vector on supported Pixel devices." "GrapheneOS responded by disabling the underlying optimization entirely in release 2026050400." GrapheneOS "fixed" the leak by disabling the optimisation Some HN commenters in the past have praised QUIC and downvoted comments that questioned who QUIC stands to benefit the most Using QUIC may serve the interests of others but for me the tradeoffs are not worth it; I block QUIC traffic QUIC is sometimes on by default in software distributed by Google, like Android, and in some cases there is no option to disable it
- subscribed 6mo agoThis is the path for the graceful closing on the QUIC connection via (IMO) illegitimate/exploitative call, GOS is not disabling QUIC as a whole. QUIC as it is is brilliant, and this is not a feature of the protocol, it's a feature of the surveillance OS (Google's Android). Other than that I checked on the OS before the latest release, and it didn't work anyway.
- deleted 6mo ago[deleted]
- strcat 6mo agoQUIC still works fine on GrapheneOS. GrapheneOS only removed a way to ask the OS to close a QUIC connection automatically in case the app dies, etc. It's an optimization from a server perspective since it avoids the server thinking the connections are still open and keeping resources assigned to them until the idle timeout it has configured followed by having to go through a connection shutdown process. It's not an optimization from a client perspective. GrapheneOS also has fixes for around 5 other VPN leaks and more fixes on the way. Android currently implements VPNs in a way that's prone to leaks due to VPNs being per-profile but profiles not using their own network namespaces yet and also depending on central services for the DNS resolver and various other things which have to properly handle VPN support. We have plans to improve the VPN architecture in the future to make it very resistant to leaks. There will also be support for running apps or groups of apps in VMs which can have even stronger protection against it.
- nunobrito 6mo ago[flagged]
- huflungdung 6mo ago[dead]
- vsgherzi 6mo agoSeems like volunteers and donations? Is there something else I can read to be more informed on this?
- MYEUHD 6mo ago> a governamental VPN and honeypot, a.k.a. Tor. Why is tor a honeypot?
- Root_Denied 6mo agoI wouldn't call it a honeypot, but it's probably compromised by the feds. It was shown a few years back that if you control enough of the exit nodes (more than some specific % that I don't remember off the top of my head) then you can associate traffic across most/all of the Tor network. Since running exit nodes is relatively cheap the assumption was that the feds (or some other state actor) were already doing so. I'd call that materially different than a honeypot though since it wasn't designed for that purpose.
- aucisson_masque 6mo agoYou make a lot of claim yet gives no source or material to back up your claim. Beside, what would be a great distribution beyond grapheneos. iOS isn't, stock Android is much worst, calyxos ? Lineageos ? They are much worst on the security.
- YourDadVPN 6mo agoIs the CalyxOS Vs GrapheneOS shitflinging about to start up again?
- 6mo ago
- bastard_op 6mo agoJust like manifest v3, it's not in their best interests to disallow snooping. It hurts their business model.
- inquirerGeneral 6mo ago[dead]
- bastard_op 6mo agoEven more so, just like meta removing end to end encryption. "Nah dog, we like watching everything you say and do."
- inquirerGeneral 6mo ago[dead]
- mvdtnz 6mo agoGreat, now to go and buy a Google phone so I can use it.