5 ms·

I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?

boje 6mo ago
That assumes there is pride they have to bother to keep.
- k4rli 6mo ago
  Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.
  - mcraiha 6mo ago
    There should be at least one Motorola phone before end of the year that has GrapheneOS support.
    - HybridStatAnim8 6mo ago
      Motorola devices with GrapheneOS support will arrive in 2027 or later, not 2026. Likely, the 2027 Signature, Razr fold, and Razr flip, will meet GOSs hardware security requirements.
  - oceansky 6mo ago
    So far. Other companies surely will make their devices compatible if the market share increases for it
  - snapplebobapple 6mo ago
    First motorola grapheneos phone i am buying to get fully off the google pain train. Grapheneos tides me over until a real linux smart phone shows up or i die of old age. Now if home assistant could get thread network join*ng working without an android phone with a google account i could ve fully ris of those eh holes.
    - surgical_fire 6mo ago
      I am patiently waiting for that one. I have been willing to move to GrapheneOS for a while, but I don't feel like buying Google hardware.
      - amarant 6mo ago
        Fwiw the pixel phones are excellent hardware.
        surgical_fire 6mo ago
        I don't care. I don't want Google hardware because I despise the company and I'm actively trying to reduce my dependence on Google.
        SwamyM 6mo ago
        That's debatable. Pretty much every generation of the Pixel phones have had some major issues. They've even had to do multiple extended repair/replace programs due to some of them. Heck there is even an ongoing issue where one of their updates has caused multiple generations of their devices to be bricked (and that still hasn't been fixed) - https://www.androidauthority.com/google-pixel-march-update-boot-loop-3655031/ https://www.androidauthority.com/google-pixel-march-update-b... On a technical level, yea, it may be great hardware but in practice, I don't think it is. As an Android user, I wish it were but it's not. Samsung is so much more reliable as an end user (even with their own issues).
        tpm 6mo ago
        They have consistently the worst battery endurance of any relevant phone maker since forever.
    - iamtedd 6mo ago
      > Now if home assistant could get thread network join*ng working without an android phone with a google account There is already a way to do this. It's fiddly, but not by much. Once set up it's a much better experience, though. https://www.matteralpha.com/how-to/how-to-use-home-assistant-to-add-matter-devices-without-phone https://www.matteralpha.com/how-to/how-to-use-home-assistant...
  - winter_blue 6mo ago
    Sadly, Verizon Pixel phones, even after carrier unlocking, seem to be forever blocked from using GrapheneOS.
    - neilv 6mo ago
      Carrier-sold Pixels generally don't have "OEM-unlockable" bootloaders. Your best bet for now is to buy a new Pixel direct from Google, or a used one from eBay that the seller advertises as already having GrapheneOS on it (or otherwise guarantees that the bootloader is unlockable). These ones are worth a lot more than the ones that can only run Google/carrier Android. https://grapheneos.org/install/web#prerequisites https://grapheneos.org/install/web#prerequisites I own two GrapheneOS Pixel 7 units, which should get any Google blob security updates (which GrapheneOS incorporates) through October 2027, and GrapheneOS may still support it with source updates after that. So in a year or so, I might get the GrapheneOS Motorola if it's available, or a later Pixel. (I never buy these new, since I don't want to carry a several hundred dollar phone when a 2 gen old one is still great, thanks to GrapheneOS.) https://support.google.com/pixelphone/answer/4457705 https://support.google.com/pixelphone/answer/4457705
      - winter_blue 6mo ago
        Is this true for all carriers? Or just Verizon? Several Reddit threads say that it's just Verizon. T-Mobile users report being able to bootloader unlock after getting their phones carrier unlocked by T-Mobile.
        HybridStatAnim8 6mo ago
        OEM/carrier locking tends to only happen in the US. Many carriers permit unlocking after the contract has concluded, but Verizon has always blocked it. Used devices also run the risk of being improperly unlocked and making OEM unlocking remain unavailable. (Used devices may also be Verizon devices.)
      - HybridStatAnim8 6mo ago
        OEM/carrier locking tends to only happen in the US. Many carriers permit unlocking after the contract has concluded, but Verizon has always blocked it. Used devices also run the risk of being improperly unlocked and making OEM unlocking remain unavailable. (Used devices may also be Verizon devices.)
  - zb3 6mo ago
    I don't see a problem with supporting their legitimate hardware or cloud business models. But of course I see a problem supporting their illegitimate adware and spyware business models.
    - Cider9986 6mo ago
      I agree, especially when you are buying for the used market.
  - DANmode 6mo ago
    I’ve seen this repeated here, but: Google's Pixel hardware division likely operates at a loss - or breaks even. and even if every active HN user bought $100-$400 used Pixels from Swappa, meaningless money to them.
    - microtonal 6mo ago
      Yep, Pixels for them are entry points to Google One subscriptions, etc. The Pixel 9a is currently 350 Euro in my country, it has the same CPU/GPU (modem differs) that the expensive 9 Pro/Pro XL/Pro Fold had. Factoring in development costs, etc. at that price I cannot imagine it being more than break-even. Also, even Pixel 9a has all the security functions of the flagship that many other Android phones do not have or are just getting, such as the Memory Tagging Extension (MTE), the Titan M2 security processor (no need to rely on TrustZone for secrets), etc.
- SV_BubbleTime 6mo ago
  We need to bring back shame. Step one… completely reform MBA programs.
rexpop 6mo ago
Corporations have no pride. They are soulless, psychopathic accountability sinks. What planet are you from?
bflesch 6mo ago
At some point digital security turns into physical security, and there are national security interests that have fine-tuned their detection logic on these kinds of "buggy" behavior. If you patch it, you'd need to find another way to de-anonymize those users.
- hedora 6mo ago
  So, somewhere, some government or organization might want to blow the user into kibble, and that's an important use case? I feel like this should be toward the top of the terms of service for the phone, even above the mandatory arbitration clause.
like_any_other 6mo ago
How can someone consider unwanted disclosure of personal information a security issue, and work at Google?
helterskelter 6mo ago
They're paid not to.
2ndorderthought 6mo ago
It's a feature for them not a bug. Google is an ad company and an offense contractor they want VPN users leaking packets for both reasons.
jeroenhd 6mo ago
Depends on how you see the role of a VPN. VPNs, at least originally, were designed to provide access to private/business networks across another network. Office to office, home to office, that sort of thing. VPNs were only later turned into some kind of (supposed) security tool. If your take on VPN code is "as long as your phone can reach the office printer over 5G" then this is a tiny bug. QUIC connections aren't being shut down properly, like they weren't before the introduction of the feature. If your take on VPN code is "this wireguard tunnel must keep my identity safe no matter what" or "my security relies on this wireguard tunnel being an exact copy of all traffic exchanged over the internet" then this is a massive problem. I don't think Android VPNs, or any VPN to be honest, were ever designed as a privacy or security measure. Especially not against apps with code execution on the device. The device itself will do all kinds of network interactions, some happening from within the modem chip itself. Closing the bug was a mistake on Google's part, but I can see why they don't consider this a security bug in their bug bounty programme.

boje 6mo ago

That assumes there is pride they have to bother to keep.

k4rli 6mo ago
Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.
- mcraiha 6mo ago
  There should be at least one Motorola phone before end of the year that has GrapheneOS support.
  - HybridStatAnim8 6mo ago
    Motorola devices with GrapheneOS support will arrive in 2027 or later, not 2026. Likely, the 2027 Signature, Razr fold, and Razr flip, will meet GOSs hardware security requirements.
- oceansky 6mo ago
  So far. Other companies surely will make their devices compatible if the market share increases for it
- snapplebobapple 6mo ago
  First motorola grapheneos phone i am buying to get fully off the google pain train. Grapheneos tides me over until a real linux smart phone shows up or i die of old age. Now if home assistant could get thread network join*ng working without an android phone with a google account i could ve fully ris of those eh holes.
  - surgical_fire 6mo ago
    I am patiently waiting for that one. I have been willing to move to GrapheneOS for a while, but I don't feel like buying Google hardware.
    - amarant 6mo ago
      Fwiw the pixel phones are excellent hardware.
      - surgical_fire 6mo ago
        I don't care. I don't want Google hardware because I despise the company and I'm actively trying to reduce my dependence on Google.
      - SwamyM 6mo ago
        That's debatable. Pretty much every generation of the Pixel phones have had some major issues. They've even had to do multiple extended repair/replace programs due to some of them. Heck there is even an ongoing issue where one of their updates has caused multiple generations of their devices to be bricked (and that still hasn't been fixed) - https://www.androidauthority.com/google-pixel-march-update-boot-loop-3655031/ https://www.androidauthority.com/google-pixel-march-update-b... On a technical level, yea, it may be great hardware but in practice, I don't think it is. As an Android user, I wish it were but it's not. Samsung is so much more reliable as an end user (even with their own issues).
      - tpm 6mo ago
        They have consistently the worst battery endurance of any relevant phone maker since forever.
  - iamtedd 6mo ago
    > Now if home assistant could get thread network join*ng working without an android phone with a google account There is already a way to do this. It's fiddly, but not by much. Once set up it's a much better experience, though. https://www.matteralpha.com/how-to/how-to-use-home-assistant-to-add-matter-devices-without-phone https://www.matteralpha.com/how-to/how-to-use-home-assistant...
- winter_blue 6mo ago
  Sadly, Verizon Pixel phones, even after carrier unlocking, seem to be forever blocked from using GrapheneOS.
  - neilv 6mo ago
    Carrier-sold Pixels generally don't have "OEM-unlockable" bootloaders. Your best bet for now is to buy a new Pixel direct from Google, or a used one from eBay that the seller advertises as already having GrapheneOS on it (or otherwise guarantees that the bootloader is unlockable). These ones are worth a lot more than the ones that can only run Google/carrier Android. https://grapheneos.org/install/web#prerequisites https://grapheneos.org/install/web#prerequisites I own two GrapheneOS Pixel 7 units, which should get any Google blob security updates (which GrapheneOS incorporates) through October 2027, and GrapheneOS may still support it with source updates after that. So in a year or so, I might get the GrapheneOS Motorola if it's available, or a later Pixel. (I never buy these new, since I don't want to carry a several hundred dollar phone when a 2 gen old one is still great, thanks to GrapheneOS.) https://support.google.com/pixelphone/answer/4457705 https://support.google.com/pixelphone/answer/4457705
    - winter_blue 6mo ago
      Is this true for all carriers? Or just Verizon? Several Reddit threads say that it's just Verizon. T-Mobile users report being able to bootloader unlock after getting their phones carrier unlocked by T-Mobile.
      - HybridStatAnim8 6mo ago
        OEM/carrier locking tends to only happen in the US. Many carriers permit unlocking after the contract has concluded, but Verizon has always blocked it. Used devices also run the risk of being improperly unlocked and making OEM unlocking remain unavailable. (Used devices may also be Verizon devices.)
    - HybridStatAnim8 6mo ago
      OEM/carrier locking tends to only happen in the US. Many carriers permit unlocking after the contract has concluded, but Verizon has always blocked it. Used devices also run the risk of being improperly unlocked and making OEM unlocking remain unavailable. (Used devices may also be Verizon devices.)
- zb3 6mo ago
  I don't see a problem with supporting their legitimate hardware or cloud business models. But of course I see a problem supporting their illegitimate adware and spyware business models.
  - Cider9986 6mo ago
    I agree, especially when you are buying for the used market.
- DANmode 6mo ago
  I’ve seen this repeated here, but: Google's Pixel hardware division likely operates at a loss - or breaks even. and even if every active HN user bought $100-$400 used Pixels from Swappa, meaningless money to them.
  - microtonal 6mo ago
    Yep, Pixels for them are entry points to Google One subscriptions, etc. The Pixel 9a is currently 350 Euro in my country, it has the same CPU/GPU (modem differs) that the expensive 9 Pro/Pro XL/Pro Fold had. Factoring in development costs, etc. at that price I cannot imagine it being more than break-even. Also, even Pixel 9a has all the security functions of the flagship that many other Android phones do not have or are just getting, such as the Memory Tagging Extension (MTE), the Titan M2 security processor (no need to rely on TrustZone for secrets), etc.
SV_BubbleTime 6mo ago
We need to bring back shame. Step one… completely reform MBA programs.

rexpop 6mo ago

Corporations have no pride. They are soulless, psychopathic accountability sinks. What planet are you from?

bflesch 6mo ago

At some point digital security turns into physical security, and there are national security interests that have fine-tuned their detection logic on these kinds of "buggy" behavior. If you patch it, you'd need to find another way to de-anonymize those users.

hedora 6mo ago
So, somewhere, some government or organization might want to blow the user into kibble, and that's an important use case? I feel like this should be toward the top of the terms of service for the phone, even above the mandatory arbitration clause.

like_any_other 6mo ago

How can someone consider unwanted disclosure of personal information a security issue, and work at Google?

helterskelter 6mo ago

They're paid not to.

2ndorderthought 6mo ago

It's a feature for them not a bug. Google is an ad company and an offense contractor they want VPN users leaking packets for both reasons.

jeroenhd 6mo ago

Depends on how you see the role of a VPN. VPNs, at least originally, were designed to provide access to private/business networks across another network. Office to office, home to office, that sort of thing. VPNs were only later turned into some kind of (supposed) security tool. If your take on VPN code is "as long as your phone can reach the office printer over 5G" then this is a tiny bug. QUIC connections aren't being shut down properly, like they weren't before the introduction of the feature. If your take on VPN code is "this wireguard tunnel must keep my identity safe no matter what" or "my security relies on this wireguard tunnel being an exact copy of all traffic exchanged over the internet" then this is a massive problem. I don't think Android VPNs, or any VPN to be honest, were ever designed as a privacy or security measure. Especially not against apps with code execution on the device. The device itself will do all kinds of network interactions, some happening from within the modem chip itself. Closing the bug was a mistake on Google's part, but I can see why they don't consider this a security bug in their bug bounty programme.