GrapheneOS fixes Android VPN leak Google refused to patch • Hacker News Board

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#11

Post by Paradigm2020 » Sat, May 09, 2026, 4:43 PM UTC

nottorp wrote: post #7

> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions So a VPN isn't a VPN on Android? Regardless of this bug. Do other locked down operating systems act the same?

Ios does the same, only way around it is if you have an ?enterprise? licence (250+ devices)

Mullvad and others reported on that one ages ago

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#12

Post by unethical_ban » Sat, May 09, 2026, 4:44 PM UTC

nottorp wrote: post #7

> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions So a VPN isn't a VPN on Android? Regardless of this bug. Do other locked down operating systems act the same?

MacOS has had instances where their own apps could bypass always-on VPN. I'm not sure if there have been exploits or gaps where traffic could go to arbitrary destinations directly.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#13

Post by winter_blue » Sat, May 09, 2026, 4:48 PM UTC

k4rli wrote: post #5

boje wrote: post #3

Earlier quoted context omitted.

That assumes there is pride they have to bother to keep.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

Sadly, Verizon Pixel phones, even after carrier unlocking, seem to be forever blocked from using GrapheneOS.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#14

Post by surgical_fire » Sat, May 09, 2026, 4:52 PM UTC

snapplebobapple wrote: post #10

k4rli wrote: post #5

Earlier quoted context omitted.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

First motorola grapheneos phone i am buying to get fully off the google pain train. Grapheneos tides me over until a real linux smart phone shows up or i die of old age. Now if home assistant could get thread network join*ng working without an android phone with a google account i could ve fully ris of those eh holes.

I am patiently waiting for that one. I have been willing to move to GrapheneOS for a while, but I don't feel like buying Google hardware.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#15

Post by iamtedd » Sat, May 09, 2026, 4:58 PM UTC

snapplebobapple wrote: post #10

k4rli wrote: post #5

Earlier quoted context omitted.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

First motorola grapheneos phone i am buying to get fully off the google pain train. Grapheneos tides me over until a real linux smart phone shows up or i die of old age. Now if home assistant could get thread network join*ng working without an android phone with a google account i could ve fully ris of those eh holes.

> Now if home assistant could get thread network join*ng working without an android phone with a google account

There is already a way to do this. It's fiddly, but not by much. Once set up it's a much better experience, though.

https://www.matteralpha.com/how-to/how-to-use-home-assistant...

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#16

Post by mmooss » Sat, May 09, 2026, 4:58 PM UTC

nottorp wrote: post #7

> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions So a VPN isn't a VPN on Android? Regardless of this bug. Do other locked down operating systems act the same?

How hard would it be to fix the system_server (and any other) bypass?

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#17

Post by zb3 » Sat, May 09, 2026, 5:01 PM UTC

Stock Android is spyware and adware, back in the day we called such software malicious and removed it, now it's the default.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#18

Post by zb3 » Sat, May 09, 2026, 5:04 PM UTC

k4rli wrote: post #5

boje wrote: post #3

Earlier quoted context omitted.

That assumes there is pride they have to bother to keep.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

I don't see a problem with supporting their legitimate hardware or cloud business models. But of course I see a problem supporting their illegitimate adware and spyware business models.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#19

Post by rexpop » Sat, May 09, 2026, 5:06 PM UTC

unethical_ban wrote: post #2

I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?

Corporations have no pride. They are soulless, psychopathic accountability sinks.

What planet are you from?

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#20

Post by bflesch » Sat, May 09, 2026, 5:12 PM UTC

unethical_ban wrote: post #2

I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?

At some point digital security turns into physical security, and there are national security interests that have fine-tuned their detection logic on these kinds of "buggy" behavior.

If you patch it, you'd need to find another way to de-anonymize those users.