201–210 of 372 posts
> https://signal.org/blog/cellebrite-vulnerabilities/ There’s always the hope they are hit back: Cellebrite can develop solutions to automate the hacking of target phones, but in doing so their physical devices are exposed to being hacked as well.
Hahahha. Also is this a common expression “fallen of the back of a truck”?
Earlier quoted context omitted.
The process for migrating eSIMs for me has never been easy and has always taken 1-2 days and repeated contacts with customer service agents to actually work. Compared to the 10 seconds of swapping a physical SIM. I'm sure there isn't an inherent technical reason why eSIM couldn't be just as easy if not more, but I assume it's another case of enshittification.
Agreed, the rest of the comments are delusional. First, you have to contact customer service, which takes a few days to get a response. Then you have to have another device to display the QR code on, which you won't have if you're travelling. They'll send you a QR code you have to scan with the device you're currently on, AND you'll have to do it without an internet connection. Meaning it just doesn't work, at all. A…
Earlier quoted context omitted.
It sounds like you’re talking about the benefits of having both? The new iPhones have only eSIM which is currently a hurdle, especially for the ”tourist SIMs”. OTOH, I’m sure Telcos will shape up their support and iron out the major bugs rather quickly precisely because of this.
> It sounds like you’re talking about the benefits of having both? physical sims make no contribution to any of their points.
That sounds like it would be a physical sim, or am I incorrect?
Earlier quoted context omitted.
Two fixes that would be trivial to backport to mainline Android.
That's definitely not trivial and it's a small fraction of the security features GrapheneOS provides. https://news.ycombinator.com/item?id=45779157 explains several of the relevant features. Using hardware memory tagging for the whole base OS is definitely not trivial, and neither is implementing a much more hardened memory allocator. Our USB protection is not a trivial feature and is much more advanced than the USB…
And even if the USB mitigations were hard to write (thanks for all your work, by the way!), they are surely significantly easier to backport from an open source project.
They couldn't answer the question most on my mind: "We’ve reached out to Google to inquire about why a custom ROM created by volunteers is more resistant to industrial phone hacking than the official Pixel OS. We’ll update this article if Google has anything to say."
GrapheneOS isn't made by volunteers. They have a team of around 10 paid developers. They are a nonprofit foundation that receives donations and uses those to pay developers, infrastructure etc. Ars Technica has update its article to rectify that mistake. It doesn't mention that anymore.
I know strcat is the lead Graphene OS developer, and it seems you and Andromxda are very knowledgeable about the project and very active on this thread.
They couldn't answer the question most on my mind: "We’ve reached out to Google to inquire about why a custom ROM created by volunteers is more resistant to industrial phone hacking than the official Pixel OS. We’ll update this article if Google has anything to say."
Earlier quoted context omitted.
Is it E911 or an A-GPS issue?
GrapheneOS provides PSDS, SUPL (which are enabled by default IIRC) and an optional Wi-Fi based location provider, so there shouldn't be any positioning issues with E911
I do wonder what this guy’s on about, hope he comes back.
Earlier quoted context omitted.
> stuff that's been removed as a "feature" isn't always stuff that nobody wants. Graphene isn't made to cater to what everyone wants. Face ID and fingerprint unlocking so clearly have no place in a hardened OS. "Google OS-level integration is absent" should not be suprising. This said, you ought to be able to have BFU security with stock Android and it's embarrassing Google ships stock vulnerable.
> Graphene isn't made to cater to what everyone wants. I know! My entire point is Graphene wouldn't be a good choice for the stock OS on a mass-market phone. The Graphene devices will be great, but if Google were to replace their stock OS with Graphene there would be problems.
It's very polished and completely usable as a daily driver.
Earlier quoted context omitted.
Google Pay also works with a Pixel watch connected to a GrapheneOS phone, FWIW.
Oh is that right? That's cool. That might be enough to give Graphene another go, especially since Android Car is supported now. Thank you.
Earlier quoted context omitted.
> It sounds like you’re talking about the benefits of having both? physical sims make no contribution to any of their points.
> 2. if I get a tourist sim card at an airport That sounds like it would be a physical sim, or am I incorrect?