3 ms·
fascinating how GrapheneOS achieves high security level on the same hardware where Google failed to even randomize android's kernel location
by NooneAtAll3 5mo ago
fascinating how GrapheneOS achieves high security level on the same hardware where Google failed to even randomize android's kernel location
- icf80 5mo agogoogle has lost its focus with pixel phones
- Aachen 5mo agoon selling ads or what do you mean their focus used to be that they've lost? I'm not at all negative about more paid features that they've been offering over time, from workspace to youtube to hardware. Still very conflicted about giving Google of all places my custom, but for e.g. phones it's hard to avoid and second-hand the prices are really quite competitive for a tangible hardware product (not a software subscription that you're stuck on). Not bad to shift focus to making these Pixel devices imo, so long as they remain open that is
- StilesCrisis 5mo agoIt's easy to be secure if you just remove features. There's obvious tension here.
- Aachen 5mo agoCould you be any more specific about what features they've removed such that the hardening functions work? Because I think there are none
- StilesCrisis 5mo agoThey're quite open about it. https://grapheneos.org/features#attack-surface-reduction https://grapheneos.org/features#attack-surface-reduction
- mtlmtlmtlmtl 5mo agoYou said removing features. This link is talking about making certain feautures optional and disabled by default, not removing them.
- StilesCrisis 5mo agoDid you happen to notice the phrase "stripping out code" in the first sentence?
- mtlmtlmtlmtl 5mo agoAnd which features have been removed, as you claim? Removing code is not necessarily removing features. I use GOS and I honestly can't think of a missing feature compared to the stock OS, other than stuff not in AOSP in the first place, like gemini.
- deleted 5mo ago[deleted]
- marysol5 5mo agoDisabled, is removed... Removed from operation
- mtlmtlmtlmtl 5mo agoDon't be ridiculous.
- Aachen 5mo ago> disabling optional features by default (NFC, Bluetooth, UWB, etc.), when the screen is locked (USB, USB-C, pogo pins, camera access) and optionally after a timeout (Bluetooth, Wi-Fi). Erm, okay if this makes you think the phones don't have WiFi or NFC or something, you've been misinformed
- jnwatson 5mo agoRandomizing the kernel location is of marginal utility at best. There are so many info leaks that KASLR ends up being only a small speed bump on the way to exploitation. Here's a cool project that inventories all your KASLR info leaks: https://github.com/bcoles/kasld https://github.com/bcoles/kasld
- jeffbee 5mo agoKASLR isn't an effective mitigation against anything, and to me this is part of GrapheneOS's catalog of superficial but meaningless claims.
- ysnp 5mo agoI've not seen someone refer to a portion of GrapheneOS's mitigations as superficial and meaningless before. What might an OS with significant improvements to usable attack surface reduction and exploit mitigations look like to you? What sort of things (given a team of less than a dozen contending with OS updates, upgrades and device support) would you have liked to see implemented?
- saagarjha 5mo agoI feel like people who hate on KASLR are basically the IQ bell curve meme but you haven't really provided much evidence to show which tail you are on.
- aftbit 5mo agoIs Graphene vulnerable to these exploits?
- fulafel 5mo agoThe more interesting question is whether GrapheneOS had this vulnerability. This published exploit sounds to be highly specialized to the specific build options.