17 ms·

have fairphone looked into supporting GrapheneOS? what exactly is missing there other than "it's not Pixel"?

Telaneo 3mo ago
The hardware doesn't support the relevant security features GrapheneOS requires. https://grapheneos.org/faq#future-devices https://grapheneos.org/faq#future-devices
- NooneAtAll3 3mo ago
  [flagged]
  - Telaneo 3mo ago
    Fairphone hasn't talked about GrapheneOS at all, instead opting to be in bed with Murena and /e/os, so I doubt they've even bothered to read the list of hardware requirements. They didn't bother with the Fairphone 6, which was released barely a year ago.
    - warrantisall 3mo ago
      [flagged]
      - Cider9986 3mo ago
        >GrapheneOS smearing Fairphone as not secure in 3..2..1.. GrapheneOS would love to support more devices, that "smearing" is explaining that a company doesn't make secure devices, which is completely correct criticism. Fairphone for various reasons is not able to or willing to achieve the hardware requirements. It's not easy to create some of the worlds most secure devices.
      - microtonal 3mo ago
        Fairphone 6 does not fulfill the hardware requirements (secure enclave, MTE, etc.), nor software requirements (monthly firmware updates, etc.). So there is nothing that GrapheneOS can do at this point. The ball is in Fairphone's court if they want this, but Fairphone seems more interested to cooperate with /e/OS, whose CEO proclaims security hardening is for pedophiles and spies (thereby fueling the narratives that support chat control and such nonsense). One of the underlying reasons is probably that the Fairphone hardware and software is developed/maintained by a Chinese ODM (T2Mobile), so the question is if Fairphone even has the know-how to make such a phone. Heck, they have failed to fix bugs that have been plaguing people for months (e.g. regular dropping of all connections when using IPv6 on certain routers). Motorola is going to make devices that fulfill the requirements and GrapheneOS is cooperating with them.
        stymaar 3mo ago
        [flagged]
        bornfreddy 3mo ago
        [flagged]
        microtonal 3mo ago
        You conveniently picked a different quote. From the horse's mouth: "Par contre, on a pas une approche "sécurité durcie", on développe pas un téléphone pour les pédo(bip) pour qu'ils puissent échapper à la justice." "However, we do not have a "hardened security" approach, we are not developing a phone for pedophiles so that they can escape justice." Also see: https://infosec.exchange/@Xtreix/116356764298456420 https://infosec.exchange/@Xtreix/116356764298456420
        UnreachableCode 3mo ago
        It's pretty insulting to be called a pedophile for wanting privacy from bad actors.
        stymaar 3mo ago
      - Telaneo 3mo ago
        They've given concrete reasons to not work with them. If Fairphone made devices that fulfilled the requirements, then there wouldn't be any issue.
  - svpk 3mo ago
    That's a pretty concrete list so it's unclear to me what you mean. They're also going to support some of the upcoming Motorola phones so it's not just pixels. I think the short answer of what they'd need to do in a practical way is to release a phone that uses one of the latest Qualcomm processors (those have the required hardware security features), make sure they have at least 5 years of driver support and commit to keeping the phone up to date, allow for relocking the bootloater (they might already do that). And I think that's basically it, the Graphene project would be able to take things from there. Realistically given that they tend to source older/weaker processors for reasons related to their goals it's unlikely they would source a processor with the required security features for their next model, but that's just a guess.
    - grapheneos 3mo ago
      We say 5 years in the requirements but we want 7 and are starting to expect it. Pixels have provided 7 years since the Pixel 8. Qualcomm provides 8 years of support for new platforms and non-Pixel OEMs are using it to begin claiming to provide 7 years of support. However, we need the updates delivered on time and not becoming less frequent over time. For example, Samsung moving to quarterly updates for older devices isn't what we expect.
  - surcap526 3mo ago
    [dead]
warrantisall 3mo ago
[flagged]
- microtonal 3mo ago
  I don't have anything to do with GrapheneOS (only using it on a phone), but the security of Fairphone is not great, like many other Android phones it does not have a separate secure enclave to store secrets, but instead relies on a TrustZone-based TEE, which is often vulnerable to side-channel attacks (e.g. see the recent attack where a lot of MediaTek phones could be decrypted in seconds, even in BFU). Note: iPhone has had a secure enclave since iPhone 5s (2013), Pixel since 3 (Titan M, 2018), and Samsung flagships since S21 (I think? Knox Vault, 2021). They also do firmware updates very irregularly even though Qualcomm does monthly bulletins and Fairphone's firmware is known to be full of CVEs. They also have a bad history of updating Linux kernels, e.g. Fairphone 4 is on an ancient Linux kernel. Fairphones also miss modern security mitigation techniques like MTE. To be fair, this applies to many Android phones outside Google Pixel and Samsung flagships. Aside from that, repairability is nice, but the most common early failures on the Fairphone 6 seem to be broken volume buttons, for which Fairphone does not offer a replacement and an issue where the logic board dies during charging, which is also not user-replaceable. --- Ps. perhaps you could use substantive arguments the next time? E.g. which points of the GrapheneOS lists of requirements do you think are irrelevant and why are they irrelevant?
  - izacus 3mo ago
    They're also pretty behind on major OS updates and even bug fixes last I've checked. The software story was very disappointing when I wanted to get one.
    - warrantisall 3mo ago
      How do they intend to comply with the European CRA act then?
      - izacus 3mo ago
Cider9986 3mo ago
It would take extensive work to achieve the hardware requirements and the capability for an OEM that isn't able to develop their own chips with Memory tagging enforcement (mte) which the Snapdragon 8 Elite used in the upcoming Motorola phones will have. It won't be cheap and it won't be easy. Google has set the bar high with their security features.
izacus 3mo ago
A team of people patching and releasing firmware and hardware drivers to the public on a monthly basis.
- grapheneos 3mo ago
  It would need to provide that for around 7 years. It would need to avoid getting increasingly delayed over time. It would also need to provide the hardware-based security features required by GrapheneOS. That includes a proper secure element with the features we need and fully functional hardware memory tagging usable for all of the kernel and userspace. Motorola Mobility is working on providing what we need for next generation devices. Fairphone repeatedly expressed disinterest and is partnered with a company taking AOSP in the opposite direction from us for privacy and security. Fairphone replaced their own OS with that and it was a major downgrade moving them further away from possibly ever providing what we need.
benrutter 3mo ago
[flagged]
- grapheneos 3mo ago
  /e/ goes in the opposite direction from AOSP for privacy and security compared to GrapheneOS. It lags far behind on providing standard privacy/security patches and protections. It bundles their own privacy invasive services and has many built in Google services with privileged access. /e/ devices do not have reasonable privacy or security. People are much better off with an iPhone if they care about privacy. https://discuss.grapheneos.org/d/24134-devices-lacking-standard-privacysecurity-patches-and-protections-arent-private https://discuss.grapheneos.org/d/24134-devices-lacking-stand...

The hardware doesn't support the relevant security features GrapheneOS requires. https://grapheneos.org/faq#future-devices https://grapheneos.org/faq#future-devices

NooneAtAll3 3mo ago
[flagged]
- Telaneo 3mo ago
  Fairphone hasn't talked about GrapheneOS at all, instead opting to be in bed with Murena and /e/os, so I doubt they've even bothered to read the list of hardware requirements. They didn't bother with the Fairphone 6, which was released barely a year ago.
  - warrantisall 3mo ago
    [flagged]
    - Cider9986 3mo ago
      >GrapheneOS smearing Fairphone as not secure in 3..2..1.. GrapheneOS would love to support more devices, that "smearing" is explaining that a company doesn't make secure devices, which is completely correct criticism. Fairphone for various reasons is not able to or willing to achieve the hardware requirements. It's not easy to create some of the worlds most secure devices.
    - microtonal 3mo ago
      Fairphone 6 does not fulfill the hardware requirements (secure enclave, MTE, etc.), nor software requirements (monthly firmware updates, etc.). So there is nothing that GrapheneOS can do at this point. The ball is in Fairphone's court if they want this, but Fairphone seems more interested to cooperate with /e/OS, whose CEO proclaims security hardening is for pedophiles and spies (thereby fueling the narratives that support chat control and such nonsense). One of the underlying reasons is probably that the Fairphone hardware and software is developed/maintained by a Chinese ODM (T2Mobile), so the question is if Fairphone even has the know-how to make such a phone. Heck, they have failed to fix bugs that have been plaguing people for months (e.g. regular dropping of all connections when using IPv6 on certain routers). Motorola is going to make devices that fulfill the requirements and GrapheneOS is cooperating with them.
      - stymaar 3mo ago
        [flagged]
        bornfreddy 3mo ago
        [flagged]
        microtonal 3mo ago
        You conveniently picked a different quote. From the horse's mouth: "Par contre, on a pas une approche "sécurité durcie", on développe pas un téléphone pour les pédo(bip) pour qu'ils puissent échapper à la justice." "However, we do not have a "hardened security" approach, we are not developing a phone for pedophiles so that they can escape justice." Also see: https://infosec.exchange/@Xtreix/116356764298456420 https://infosec.exchange/@Xtreix/116356764298456420
        UnreachableCode 3mo ago
        It's pretty insulting to be called a pedophile for wanting privacy from bad actors.
        stymaar 3mo ago
    - Telaneo 3mo ago
      They've given concrete reasons to not work with them. If Fairphone made devices that fulfilled the requirements, then there wouldn't be any issue.
- svpk 3mo ago
  That's a pretty concrete list so it's unclear to me what you mean. They're also going to support some of the upcoming Motorola phones so it's not just pixels. I think the short answer of what they'd need to do in a practical way is to release a phone that uses one of the latest Qualcomm processors (those have the required hardware security features), make sure they have at least 5 years of driver support and commit to keeping the phone up to date, allow for relocking the bootloater (they might already do that). And I think that's basically it, the Graphene project would be able to take things from there. Realistically given that they tend to source older/weaker processors for reasons related to their goals it's unlikely they would source a processor with the required security features for their next model, but that's just a guess.
  - grapheneos 3mo ago
    We say 5 years in the requirements but we want 7 and are starting to expect it. Pixels have provided 7 years since the Pixel 8. Qualcomm provides 8 years of support for new platforms and non-Pixel OEMs are using it to begin claiming to provide 7 years of support. However, we need the updates delivered on time and not becoming less frequent over time. For example, Samsung moving to quarterly updates for older devices isn't what we expect.
- surcap526 3mo ago
  [dead]

warrantisall 3mo ago

[flagged]

microtonal 3mo ago
I don't have anything to do with GrapheneOS (only using it on a phone), but the security of Fairphone is not great, like many other Android phones it does not have a separate secure enclave to store secrets, but instead relies on a TrustZone-based TEE, which is often vulnerable to side-channel attacks (e.g. see the recent attack where a lot of MediaTek phones could be decrypted in seconds, even in BFU). Note: iPhone has had a secure enclave since iPhone 5s (2013), Pixel since 3 (Titan M, 2018), and Samsung flagships since S21 (I think? Knox Vault, 2021). They also do firmware updates very irregularly even though Qualcomm does monthly bulletins and Fairphone's firmware is known to be full of CVEs. They also have a bad history of updating Linux kernels, e.g. Fairphone 4 is on an ancient Linux kernel. Fairphones also miss modern security mitigation techniques like MTE. To be fair, this applies to many Android phones outside Google Pixel and Samsung flagships. Aside from that, repairability is nice, but the most common early failures on the Fairphone 6 seem to be broken volume buttons, for which Fairphone does not offer a replacement and an issue where the logic board dies during charging, which is also not user-replaceable. --- Ps. perhaps you could use substantive arguments the next time? E.g. which points of the GrapheneOS lists of requirements do you think are irrelevant and why are they irrelevant?
- izacus 3mo ago
  They're also pretty behind on major OS updates and even bug fixes last I've checked. The software story was very disappointing when I wanted to get one.
  - warrantisall 3mo ago
    How do they intend to comply with the European CRA act then?
    - izacus 3mo ago

Cider9986 3mo ago

It would take extensive work to achieve the hardware requirements and the capability for an OEM that isn't able to develop their own chips with Memory tagging enforcement (mte) which the Snapdragon 8 Elite used in the upcoming Motorola phones will have. It won't be cheap and it won't be easy. Google has set the bar high with their security features.

izacus 3mo ago

A team of people patching and releasing firmware and hardware drivers to the public on a monthly basis.

grapheneos 3mo ago
It would need to provide that for around 7 years. It would need to avoid getting increasingly delayed over time. It would also need to provide the hardware-based security features required by GrapheneOS. That includes a proper secure element with the features we need and fully functional hardware memory tagging usable for all of the kernel and userspace. Motorola Mobility is working on providing what we need for next generation devices. Fairphone repeatedly expressed disinterest and is partnered with a company taking AOSP in the opposite direction from us for privacy and security. Fairphone replaced their own OS with that and it was a major downgrade moving them further away from possibly ever providing what we need.

benrutter 3mo ago

[flagged]

grapheneos 3mo ago
/e/ goes in the opposite direction from AOSP for privacy and security compared to GrapheneOS. It lags far behind on providing standard privacy/security patches and protections. It bundles their own privacy invasive services and has many built in Google services with privileged access. /e/ devices do not have reasonable privacy or security. People are much better off with an iPhone if they care about privacy. https://discuss.grapheneos.org/d/24134-devices-lacking-standard-privacysecurity-patches-and-protections-arent-private https://discuss.grapheneos.org/d/24134-devices-lacking-stand...