4 ms·
I don't have anything to do with GrapheneOS (only using it on a phone), but the security of Fairphone is not great, like many other Android phones it does not h
by microtonal 3mo ago
I don't have anything to do with GrapheneOS (only using it on a phone), but the security of Fairphone is not great, like many other Android phones it does not have a separate secure enclave to store secrets, but instead relies on a TrustZone-based TEE, which is often vulnerable to side-channel attacks (e.g. see the recent attack where a lot of MediaTek phones could be decrypted in seconds, even in BFU). Note: iPhone has had a secure enclave since iPhone 5s (2013), Pixel since 3 (Titan M, 2018), and Samsung flagships since S21 (I think? Knox Vault, 2021).
They also do firmware updates very irregularly even though Qualcomm does monthly bulletins and Fairphone's firmware is known to be full of CVEs. They also have a bad history of updating Linux kernels, e.g. Fairphone 4 is on an ancient Linux kernel. Fairphones also miss modern security mitigation techniques like MTE.
To be fair, this applies to many Android phones outside Google Pixel and Samsung flagships.
Aside from that, repairability is nice, but the most common early failures on the Fairphone 6 seem to be broken volume buttons, for which Fairphone does not offer a replacement and an issue where the logic board dies during charging, which is also not user-replaceable.
---
Ps. perhaps you could use substantive arguments the next time? E.g. which points of the GrapheneOS lists of requirements do you think are irrelevant and why are they irrelevant?
- izacus 3mo agoThey're also pretty behind on major OS updates and even bug fixes last I've checked. The software story was very disappointing when I wanted to get one.
- warrantisall 3mo agoHow do they intend to comply with the European CRA act then?
- izacus 3mo agoThat is a question I cannot answer - and CRA is pretty new, so we'll see if anything changes.
- microtonal 3mo agoYep. I was interested in more sovereignty and degoogling to some extend. So I got a Fairphone 6 with /e/OS. It was only until I dug a bit deeper into the OS image and the microG source code that I found worrying things: - Old kernel versions with many known CVEs (applies to both stock an /e/OS). - Old firmware bundles with many known CVEs (applies to both stock an /e/OS). - Old major Android version, so missing fixes for vulnerabilities not marked high/critical (applies to both stock an /e/OS). - Chinese firmware blobs, TCL image processing firmware (applies to both stock an /e/OS). - When using the App Lounge, F-Droid installs go through a proxy (CleanAPK), that Murena does not want to reveal the purpose or owner of. Given Android's trust on first use policy, this could be used to intercept installs and install malicious packages. (/e/OS) - Runs microG privileged. When an app does Google Play Integrity checks, Google's obfuscated DroidGuard blobs run privileged (/e/OS). - Runs many Google apps (e.g. Google Maps) with higher privileges (/e/OS).