Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS fixes Android VPN leak Google refused to patch

cyberinsider.com

Post reply on HN
Print view View original

21–30 of 142 posts

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#21

Post by spr-alex »

unethical_ban wrote: post #12
nottorp wrote: post #7

> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions So a VPN isn't a VPN on Android? Regardless of this bug. Do other locked down operating systems act the same?

MacOS has had instances where their own apps could bypass always-on VPN. I'm not sure if there have been exploits or gaps where traffic could go to arbitrary destinations directly.

this is not an ocassional bug this is still the system design today. privacy gateways upstream of big tech are the way to go on this because privacy isn't their profit center

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#22

Post by neilv »

winter_blue wrote: post #13
k4rli wrote: post #5

Earlier quoted context omitted.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

Sadly, Verizon Pixel phones, even after carrier unlocking, seem to be forever blocked from using GrapheneOS.

Carrier-sold Pixels generally don't have "OEM-unlockable" bootloaders.

Your best bet for now is to buy a new Pixel direct from Google, or a used one from eBay that the seller advertises as already having GrapheneOS on it (or otherwise guarantees that the bootloader is unlockable). These ones are worth a lot more than the ones that can only run Google/carrier Android.

https://grapheneos.org/install/web#prerequisites

I own two GrapheneOS Pixel 7 units, which should get any Google blob security updates (which GrapheneOS incorporates) through October 2027, and GrapheneOS may still support it with source updates after that. So in a year or so, I might get the GrapheneOS Motorola if it's available, or a later Pixel. (I never buy these new, since I don't want to carry a several hundred dollar phone when a 2 gen old one is still great, thanks to GrapheneOS.)

https://support.google.com/pixelphone/answer/4457705

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#23

Post by hedora »

bflesch wrote: post #20
unethical_ban wrote: post #2

I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?

At some point digital security turns into physical security, and there are national security interests that have fine-tuned their detection logic on these kinds of "buggy" behavior. If you patch it, you'd need to find another way to de-anonymize those users.

So, somewhere, some government or organization might want to blow the user into kibble, and that's an important use case?

I feel like this should be toward the top of the terms of service for the phone, even above the mandatory arbitration clause.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#24

Post by like_any_other »

unethical_ban wrote: post #2

I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?

How can someone consider unwanted disclosure of personal information a security issue, and work at Google?

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#26

Post by Cider9986 »

zb3 wrote: post #18
k4rli wrote: post #5

Earlier quoted context omitted.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

I don't see a problem with supporting their legitimate hardware or cloud business models. But of course I see a problem supporting their illegitimate adware and spyware business models.

I agree, especially when you are buying for the used market.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#27

Post by y-c-o-m-b »

winter_blue wrote: post #13
k4rli wrote: post #5

Earlier quoted context omitted.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

Sadly, Verizon Pixel phones, even after carrier unlocking, seem to be forever blocked from using GrapheneOS.

I finally left Verizon after nearly 20 years. I had it with their enshittification, couldn't stand it anymore. I switched to US Mobile and on the Darkstar (AT&T) network. I have no regrets. I caught it on a black friday deal, so I'm paying basically $20/mo for top tier service. You wouldn't have caught me dead with an AT&T service or MVNO years ago because I'd seen so many bad experiences second-hand, but these days it's been a breeze knock on wood

I also did the math and determined buying a new unlocked phone outright on this plan was far cheaper than paying Verizon monthly for one.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#28

Post by ncr100 »

nottorp wrote: post #7

> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions So a VPN isn't a VPN on Android? Regardless of this bug. Do other locked down operating systems act the same?

Terminology like "private" and "trust" differ in meaning from computer land to human convention.

It's a concern to me, because humans often extend their trust to computer trust based upon misunderstanding of the identically spelled words and lack of recognition of differing context.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#29

Post by DANmode »

k4rli wrote: post #5
boje wrote: post #3

Earlier quoted context omitted.

That assumes there is pride they have to bother to keep.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

I’ve seen this repeated here, but:

Google's Pixel hardware division likely operates at a loss - or breaks even.

and even if every active HN user bought $100-$400 used Pixels from Swappa, meaningless money to them.

Post reply on HN