4 ms·

I know Graphene has innovative security measures, do you happen to know whether that includes anything wrt. phishing or social engineering? (For those who have

by Arnt 3mo ago

I know Graphene has innovative security measures, do you happen to know whether that includes anything wrt. phishing or social engineering? (For those who haven't been following along: this whole affair started with phishing. People were social-engineered into installing an app and a little later their bank accounts were empty. A big issue in various poor countries.)

Aachen 3mo ago
That's one of its primary arguments: besides the hardening against exploits, they're considered such a safe OS because you cannot access your data either and give the wrong app root access. Everything lives in a sandbox. Whether not being able to grant full access to e.g. adb shell, Termux, or Restic is what you want is a personal choice, but it adds a layer of security against any malware that tries to get you to grant them root access This is also the argument they use to try to convince app vendors to add their keys to the allowlist, because the app makers can trust that their DRM will be active (if Netflix sets a "no screen recording" flag, you the user cannot circumvent it by e.g. reading /dev/fb0). It should have broader compatibility than other FOSS Android builds (when running the officially signed version of course, you can't compile it yourself and expect such apps to run there)
- kuschku 3mo ago
  So it doesn't actually do anything to give control of the device back to the user? One of the core tenets of truly free software is that I as user must be able to run, access, edit, and view everything.
  - armadyl 3mo ago
    You are free to make your own build of GrapheneOS with root access and have extremely reduced security. Just don’t expect support on the forums and waste everyone’s time when something happens.
    - kuschku 3mo ago
      "extremely reduced security" That's such a fun statement. Any security measures taken always remove agency from one person and give it to another. iOS takes my control away, and in turn gives that control to Apple. GrapheneOS takes my control away and gives that to the GrapheneOS developers. The "security" you're talking about doesn't prevent certain data from being accessed, it just changes who controls the access. If the user cannot be trusted with their own data, then there is no solution anyway. They'll just tell their private data to a scammer on the phone instead. There is no solution against a user that wants to give their own data away, but if you try to prevent that, the only thing you'll accomplish is destroying general purpose computing.
      - gruez 3mo ago
        >If the user cannot be trusted with their own data, then there is no solution anyway. They'll just tell their private data to a scammer on the phone instead. Security isn't binary. Putting up barriers makes it harder for scammers to steal money. There's a reason why they exploit malware to steal money, rather than asking their victims to send them crypto directly.
        kuschku 3mo ago
        > There's a reason why they exploit malware to steal money, rather than asking their victims to send them crypto directly. The vast majority of scams literally work by them asking their victims to buy cryptocurrency or gift cards directly. Malware is exceedingly rare. You know what would really help against scams? Avoid putting people in situations where they need to decide right now or they'll face punishment. Modern society has created far too many situations where people need to react without being able to think through the consequences. The only reason scams work is because there are enough actual situations with unnecessary life-or-death decisions.
        gruez 3mo ago
        >The vast majority of scams literally work by them asking their victims to buy cryptocurrency or gift cards directly. Malware is exceedingly rare. Source? This article suggests otherwise: https://www.economist.com/interactive/asia/2026/04/10/scam-inc-has-a-new-weapon https://www.economist.com/interactive/asia/2026/04/10/scam-i... Moreover it seems to be limited to south east asia for now. Just because you're in the US and all the scams you're getting is cold calls from microsoft tech support, doesn't mean scams with smartphone malware doesn't exist. >You know what would really help against scams? Avoid putting people in situations where they need to decide right now or they'll face punishment. >The only reason scams work is because there are enough actual situations with unnecessary life-or-death decisions. In other words, "if we had world peace and everyone could hold hands and sing kumbaya, then we won't have to worry about scams!"
jabwd 3mo ago
It is not an OS with bubblewrap, you can still mess up your privacy / security if you want to, that includes phishing and social engineering.
- Aachen 3mo ago
  Is anything bulletproof against the user signing away their data? I think the question was whether it has any measures in this regard, not whether it's impossible to get phished
  - Arnt 3mo ago
    It's complicated… in a sense the bulletproof solutions are the ones that raise the cost of executing the attack above the average take. In another sense even they aren't bulletproof. This particular attack requires getting users to sideload apps that would be rejected by the play store, and most users don't have developer mode enabled. Therefore, the cost of persuading someone to enable developer mode matters. If the procedure to enable developer mode changes from "open settings, scroll down, tap, scroll down, tap seven times" to include e.g. a 96-hour wait for developer mode to be enabled, then the cost of the attack rises by whatever it costs to stay in close contact with the victim for 96 hours, close enough to react if the victim comes close to realising the truth. This isn't a guarantee. You can still get phished even if the phisher has to spend 96 hours in intensive contact with you. Some victims are worth that effort, maybe you are, and maybe the phisher made a mistake and puts in the effort to phish you based on the mistaken assumption that you're a millionaire. There are also other things like that. If Google can ban the keylogger you use quicker than you can deploy new builds, for example. Still no guarantee.
preisschild 3mo ago
> do you happen to know whether that includes anything wrt. phishing or social engineering? Yes. For example if you install an apk from an unknown source (like a random website via browser or messenger) it will warn you what you are about to do and what effects that has. You don't need to block stupid behavior. Just make sure users are well aware of their actions as long as they actually read warnings.
vlian2088 3mo ago
my brother in Christ, people who root their phones don't fall for "Hello sir, I'm sir John from Microsoft, you have virus sir, please do the needful install antivirus and send gift card sir."
- gruez 3mo ago
  Right, instead they download shady magisk modules that promise them free fortnite skins.
- Fnoord 3mo ago
  1) Anyone can fall for a scam. Especially those who believe they wouldn't fall for a scam. This is why ridiculing those who fall for [a] scam is harmful, and serves scammers. 2) You can root a smartphone for someone else's usage. For example, I can install pmOS on a smartphone and hand it over to my kid.
- armadyl 3mo ago
  You’re right, they just fall for installing updates or CLI tools which install compromised dependencies and run wild on a rooted system before getting caught 24 hours later.
  - vlian2088 3mo ago
    on their phones? also, 'rooted' means you have root access, not that you run everything as root.

by Arnt 3mo ago

Aachen 3mo ago

That's one of its primary arguments: besides the hardening against exploits, they're considered such a safe OS because you cannot access your data either and give the wrong app root access. Everything lives in a sandbox. Whether not being able to grant full access to e.g. adb shell, Termux, or Restic is what you want is a personal choice, but it adds a layer of security against any malware that tries to get you to grant them root access This is also the argument they use to try to convince app vendors to add their keys to the allowlist, because the app makers can trust that their DRM will be active (if Netflix sets a "no screen recording" flag, you the user cannot circumvent it by e.g. reading /dev/fb0). It should have broader compatibility than other FOSS Android builds (when running the officially signed version of course, you can't compile it yourself and expect such apps to run there)

kuschku 3mo ago
So it doesn't actually do anything to give control of the device back to the user? One of the core tenets of truly free software is that I as user must be able to run, access, edit, and view everything.
- armadyl 3mo ago
  You are free to make your own build of GrapheneOS with root access and have extremely reduced security. Just don’t expect support on the forums and waste everyone’s time when something happens.
  - kuschku 3mo ago
    "extremely reduced security" That's such a fun statement. Any security measures taken always remove agency from one person and give it to another. iOS takes my control away, and in turn gives that control to Apple. GrapheneOS takes my control away and gives that to the GrapheneOS developers. The "security" you're talking about doesn't prevent certain data from being accessed, it just changes who controls the access. If the user cannot be trusted with their own data, then there is no solution anyway. They'll just tell their private data to a scammer on the phone instead. There is no solution against a user that wants to give their own data away, but if you try to prevent that, the only thing you'll accomplish is destroying general purpose computing.
    - gruez 3mo ago
      >If the user cannot be trusted with their own data, then there is no solution anyway. They'll just tell their private data to a scammer on the phone instead. Security isn't binary. Putting up barriers makes it harder for scammers to steal money. There's a reason why they exploit malware to steal money, rather than asking their victims to send them crypto directly.
      - kuschku 3mo ago
        > There's a reason why they exploit malware to steal money, rather than asking their victims to send them crypto directly. The vast majority of scams literally work by them asking their victims to buy cryptocurrency or gift cards directly. Malware is exceedingly rare. You know what would really help against scams? Avoid putting people in situations where they need to decide right now or they'll face punishment. Modern society has created far too many situations where people need to react without being able to think through the consequences. The only reason scams work is because there are enough actual situations with unnecessary life-or-death decisions.
        gruez 3mo ago
        >The vast majority of scams literally work by them asking their victims to buy cryptocurrency or gift cards directly. Malware is exceedingly rare. Source? This article suggests otherwise: https://www.economist.com/interactive/asia/2026/04/10/scam-inc-has-a-new-weapon https://www.economist.com/interactive/asia/2026/04/10/scam-i... Moreover it seems to be limited to south east asia for now. Just because you're in the US and all the scams you're getting is cold calls from microsoft tech support, doesn't mean scams with smartphone malware doesn't exist. >You know what would really help against scams? Avoid putting people in situations where they need to decide right now or they'll face punishment. >The only reason scams work is because there are enough actual situations with unnecessary life-or-death decisions. In other words, "if we had world peace and everyone could hold hands and sing kumbaya, then we won't have to worry about scams!"

jabwd 3mo ago

It is not an OS with bubblewrap, you can still mess up your privacy / security if you want to, that includes phishing and social engineering.

Aachen 3mo ago
Is anything bulletproof against the user signing away their data? I think the question was whether it has any measures in this regard, not whether it's impossible to get phished
- Arnt 3mo ago
  It's complicated… in a sense the bulletproof solutions are the ones that raise the cost of executing the attack above the average take. In another sense even they aren't bulletproof. This particular attack requires getting users to sideload apps that would be rejected by the play store, and most users don't have developer mode enabled. Therefore, the cost of persuading someone to enable developer mode matters. If the procedure to enable developer mode changes from "open settings, scroll down, tap, scroll down, tap seven times" to include e.g. a 96-hour wait for developer mode to be enabled, then the cost of the attack rises by whatever it costs to stay in close contact with the victim for 96 hours, close enough to react if the victim comes close to realising the truth. This isn't a guarantee. You can still get phished even if the phisher has to spend 96 hours in intensive contact with you. Some victims are worth that effort, maybe you are, and maybe the phisher made a mistake and puts in the effort to phish you based on the mistaken assumption that you're a millionaire. There are also other things like that. If Google can ban the keylogger you use quicker than you can deploy new builds, for example. Still no guarantee.

preisschild 3mo ago

> do you happen to know whether that includes anything wrt. phishing or social engineering? Yes. For example if you install an apk from an unknown source (like a random website via browser or messenger) it will warn you what you are about to do and what effects that has. You don't need to block stupid behavior. Just make sure users are well aware of their actions as long as they actually read warnings.

vlian2088 3mo ago

my brother in Christ, people who root their phones don't fall for "Hello sir, I'm sir John from Microsoft, you have virus sir, please do the needful install antivirus and send gift card sir."

gruez 3mo ago
Right, instead they download shady magisk modules that promise them free fortnite skins.
Fnoord 3mo ago
1) Anyone can fall for a scam. Especially those who believe they wouldn't fall for a scam. This is why ridiculing those who fall for [a] scam is harmful, and serves scammers. 2) You can root a smartphone for someone else's usage. For example, I can install pmOS on a smartphone and hand it over to my kid.
armadyl 3mo ago
You’re right, they just fall for installing updates or CLI tools which install compromised dependencies and run wild on a rooted system before getting caught 24 hours later.
- vlian2088 3mo ago
  on their phones? also, 'rooted' means you have root access, not that you run everything as root.