Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS and forensic extraction of data (2024)

discuss.grapheneos.org

Post reply on HN
Print view View original

171–180 of 208 posts

Re: GrapheneOS and forensic extraction of data (2024)

#171

Post by cindyllm »

const_cast wrote: post #170
npoc wrote: post #108

Earlier quoted context omitted.

Why's that? A topic as big as this takes quite a lot of refuting. If you're interested in finding the truth, then you'll at least begin watching it to see if it offers any promise.

The trouble with videos is you can just... choose not to include stuff that obviously refutes your argument. The reality is that global warming is definitely happening, and also the Earth is definitely not flat. But it's pretty easy to make a super convincing argument that the Earth is flat - you just don't mention any of the math behind why the Earth is round and then you can have a 5 hour long video filled to the b…

[dead]

Re: GrapheneOS and forensic extraction of data (2024)

#172

Post by const_cast »

subscribed wrote: post #126
colordrops wrote: post #72

Earlier quoted context omitted.

What is the threat model when enabling root on a phone and why can't it be mitigated? Root is enabled on most servers and desktops and we are surviving fine.

This is why most desktops and servers are comparably much less secure. Check why Qubes OS was developed.

In practice, desktops and servers are quiet secure because you don't need to download random closed-source firmware and apps to use your device.

iOS and Android are a security nightmare. Downloading a random-ass executable to pay for parking is asking for trouble. Relying on millions of lines of proprietary Google code that you-don't-know-what-it-does is asking for trouble.

This code could have, and almost certainly does have, spyware, keyloggers, and various other forms of malware. You're simply trusting that it doesn't, because it's unverifiable.

And this doesn't even TOUCH on all the vulnerabilities associated with cellular networks, the baseband, SS7, etc. Good luck auditing that code.

At least on a server I can have some baseline guarantees about what software I'm running and what it's doing. Whereas on a phone, your location could constantly be triangulated, your phone identity spoofed, your cellular traffic sniffed, and on and on and you'd never know.

I mean, just this week we saw a post on here about ICE using fake cell towers to identify protestors. That shit is truly trivial to do, and people have been doing it for almost two decades. You wanna talk CVE? Start with that.

Re: GrapheneOS and forensic extraction of data (2024)

#173

Post by edm0nd »

crossroadsguy wrote: post #164
edm0nd wrote: post #139

Earlier quoted context omitted.

1 - My main phone has a bunch of work stuffs on it and all my authenticator stuffs and etc 2 - I've been raided by the FBI before in my past (used to be blackhat in my 20s but now im whitehat :)) 3 - I lose my phone sometimes. far better to lose a dinky burner phone VS my main phone.

What is your main phone and setup? Also — how well/bad Graphene plays with Play Store (esp wrt safety net checks) apps?

main phone is just a regular Pixel 10 Pro.

Depends on the apps. You wont be able to use a lot of apps like Chase Bank app and etc w GrapheneOS. Lots of errors bc it blocks a ton of shit your banking apps will need or want to use.

Re: GrapheneOS and forensic extraction of data (2024)

#174

Post by pkphilip »

jbstack wrote: post #58
rangerelf wrote: post #52

Earlier quoted context omitted.

You're being willfully dense, I do not believe it's up for debate. Governments that public force to kidnap, torture, murder, "disappear" their own citizens, are bad. Plenty of examples to go around, both historically and currently: China, Russia, México, North Korea, Belarus, the balcans, plenty of African governments, etc. It shouldn't matter that "34% of my neighbors" want me sent to a concentration camp, personall…

Ok, so how do you categorise a country like Norway (typically viewed as a "good" country by most people) which knowingly invests money from its sovereign fund into companies which are linked to the Israeli military which (in many people's view) is currently causing genocide and widespread starvation? At what point does the "good" cross over into the "bad"? Is it ok that having a highly regarded government comes at th…

If you go by examples like that then there are a number of nations you cannot support at all - consider for example that China has the Uyghur concentration camps, US has Guantanamo Bay and now the new prisons in partnership with El Salvador. Belgium got away scottfree with their genocide in Africa, Turkey carried out a genocide in Armenia, France still collects fines from its previous colonies etc.

Re: GrapheneOS and forensic extraction of data (2024)

#175

Post by [deleted] »

const_cast wrote: post #170
npoc wrote: post #108

Earlier quoted context omitted.

Why's that? A topic as big as this takes quite a lot of refuting. If you're interested in finding the truth, then you'll at least begin watching it to see if it offers any promise.

The trouble with videos is you can just... choose not to include stuff that obviously refutes your argument. The reality is that global warming is definitely happening, and also the Earth is definitely not flat. But it's pretty easy to make a super convincing argument that the Earth is flat - you just don't mention any of the math behind why the Earth is round and then you can have a 5 hour long video filled to the b…

[deleted]

Re: GrapheneOS and forensic extraction of data (2024)

#176

Post by captainmuon »

> Cellebrite admits they can not hack GrapheneOS if users had installed updates since late 2022.

So, how do I know that GrapheneOS is not a honeypot for the really big fish?

At this point it seems if you really want to be safe, you have to add obscurity (in addition to conventional best practices). Like changing the pinout on your USB port so the exploit device can't connect.

Re: GrapheneOS and forensic extraction of data (2024)

#177

Post by npoc »

const_cast wrote: post #170
npoc wrote: post #108

Earlier quoted context omitted.

Why's that? A topic as big as this takes quite a lot of refuting. If you're interested in finding the truth, then you'll at least begin watching it to see if it offers any promise.

The trouble with videos is you can just... choose not to include stuff that obviously refutes your argument. The reality is that global warming is definitely happening, and also the Earth is definitely not flat. But it's pretty easy to make a super convincing argument that the Earth is flat - you just don't mention any of the math behind why the Earth is round and then you can have a 5 hour long video filled to the b…

But surely that holds true for any evidence? Much of the video is showing how (and why) the government-funded evidence for global warming is wrong.

Re: GrapheneOS and forensic extraction of data (2024)

#178

Post by jcul »

crossroadsguy wrote: post #164
edm0nd wrote: post #139

Earlier quoted context omitted.

1 - My main phone has a bunch of work stuffs on it and all my authenticator stuffs and etc 2 - I've been raided by the FBI before in my past (used to be blackhat in my 20s but now im whitehat :)) 3 - I lose my phone sometimes. far better to lose a dinky burner phone VS my main phone.

What is your main phone and setup? Also — how well/bad Graphene plays with Play Store (esp wrt safety net checks) apps?

The stuff that I notice not working are:

* Google wallet NFC payments

* Always on now playing

* Always listening OK Google

Android auto used to not work but they added support. Voice commands to Google while driving don't work for me, but may be possible to get working.

Google voice commands work, but you need to open the Google app.

Google wallet works fine for tickets, bar codes etc, just no NFC payments.

Android song search works for me, there's a quick access file for it and it works great. I think pixels normally show what's playing on the lock screen, offline. I think this might be the same thing, triggered manually. Though I'm not sure if it's offline or not.

I'm in Ireland and any backing apps I've tried work fine, PTSB, AIB, revolut, IBKR, Trade Republic. I've had no issues there.

It's a very stable OS IMO, the extra user profiles, being able to choose whether to have Google play or not, and what level of access to give it. I've used it on a pixel 6, which died not too long ago, and now a pixel 9a.

Re: GrapheneOS and forensic extraction of data (2024)

#179

Post by jcul »

As mentioned in the link, Graphene has a lot of additional security feature. It can auto reboot after X hours without being unlocked. You can lock down the usb port to be charge only, or even completely disabled so that the only way to charge is with the device powered off.

Re: GrapheneOS and forensic extraction of data (2024)

#180

Post by hxorr »

drnick1 wrote: post #169
SapporoChris wrote: post #141

Earlier quoted context omitted.

I had issues buying my Pixel from Google. My memory is fuzzy, but I think after I activated my account they said great, We'll let you purchase in a month... A really cautious security model I suppose. I gave up and bought it on Amazon.

What account? You can just walk into a Google store and buy one. Most big cities in the U.S. have one.

The problem is step 0. Be in US
Post reply on HN