Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS fixes Android VPN leak Google refused to patch

cyberinsider.com

Post reply on HN
Print view View original

101–110 of 142 posts

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#101

Post by rationalist »

zb3 wrote: post #85
zb3 wrote: post #84

Earlier quoted context omitted.

Why is there no Librem 6? Librem 5 is 7 years old, it's a low-end smartphone with a flagship price tag :(

Oh wait they released "Liberty Phone" - still low end(!), this time with absurdly high price.. You can get true linux phone 10x cheaper by buying something that supports PostmarketOS

Your post sounds like you're trying to spread FUD.

Librem says the Liberty phone is the same, it just costs more because it is assembled in the U.S. for people, companies, or governments that don't want it intercepted and modified by a bad actor.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#102

Post by HybridStatAnim8 »

thrownthatway wrote: post #70
izacus wrote: post #47

Earlier quoted context omitted.

10a will get longer support, so why not (unless 9a is significantly cheaper)?

Isn’t part of the point of wanting GrapheneOS is that the official support periods don’t matter?

No, GrapheneOS adheres to the same support period that the OEM provides. End of life devices are insecure and should not be used. Only the OEM can provide the firmware updates necessary for proper support, because the firmware images are signed by the OEM/component manufacturers. All GrapheneOS can do is push the updated firmware.

GrapheneOS has a requirement of a 5-7 year support window from an OEM.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#103

Post by strcat »

1vuio0pswjnm7 wrote: post #56

"In its latest release, GrapheneOS says it has "disable[d] registerQuicConnectionClosePayload optimization to fix VPN leak," effectively neutralizing the attack vector on supported Pixel devices." "GrapheneOS responded by disabling the underlying optimization entirely in release 2026050400." GrapheneOS "fixed" the leak by disabling the optimisation Some HN commenters in the past have praised QUIC and downvoted commen…

QUIC still works fine on GrapheneOS. GrapheneOS only removed a way to ask the OS to close a QUIC connection automatically in case the app dies, etc. It's an optimization from a server perspective since it avoids the server thinking the connections are still open and keeping resources assigned to them until the idle timeout it has configured followed by having to go through a connection shutdown process. It's not an optimization from a client perspective.

GrapheneOS also has fixes for around 5 other VPN leaks and more fixes on the way. Android currently implements VPNs in a way that's prone to leaks due to VPNs being per-profile but profiles not using their own network namespaces yet and also depending on central services for the DNS resolver and various other things which have to properly handle VPN support. We have plans to improve the VPN architecture in the future to make it very resistant to leaks. There will also be support for running apps or groups of apps in VMs which can have even stronger protection against it.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#104

Post by strcat »

amarant wrote: post #92
sfRattan wrote: post #81

Earlier quoted context omitted.

Graphene OS only supports devices for as long as the manufacturer is providing security updates for the phone's firmware. Firmware is binary blob, so there'd be no practical way for anyone else to provide/develop security updates once the manufacturer is no longer providing official updates. Their partnership with Motorola, I think, involves some ability of Graphene OS devs to access/harden/update the firmware, but I…

It can be done, fairphone rather famously did it once. But it is vastly uneconomical, and I doubt anyone is going to start doing it regularly. We really need some kind of regulation demanding firmware support for longer. The EU seems the most likely entity to achieve something like that. Phone vendors can't even control how long they support their own hardware, because the SoC is almost always Qualcomm, and once they…

> It can be done, fairphone rather famously did it once.

No, they ported a new major Android release beyond what the SoC officially supported. They had already stopped providing firmware, kernel or driver security patches long before that point. They did what LineageOS regularly does by porting a new major Android release to hardware not officially supporting it. Unlike LineageOS, they had to convince a company to certify it as meeting the CDD/CTS requirements. Most OEMs including Fairphone have major CDD/CTS violations but yet still get certified in practice so that doesn't really mean as much as you'd think. It's common for Android OEMs to break functionality tested by the CTS and yet somehow they have certification. This is part of why the Play Integrity API's flimsy justification for the highly anti-competitive approach it uses is such nonsense.

Even the Fairphone 5 already lacks standard Linux kernel security patches due to having an end-of-life kernel branch. Fairphone doesn't provide anything close to proper updates.

Qualcomm offers up to 8 years of major Android version updates and basic security patches for their firmware and drivers. They charge money for each year of support. It's there if OEMs are willing to pay for an up-to-date SoC and pay for many years of support.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#105

Post by AJ-1320 »

NewJazz wrote: post #52
jona-f wrote: post #51

I bought a used Pixel 6 for cheap to try out grapheneos. Can't say I like it. UX of lineageos is much better. There is a weird russian doll kind of situation with the package managers going on. There is one builtin "App Store" with only a few basis programs, one of which is another package manager, accrescent, which offers a few more apps, but still not comprehensive at all, so another package manager is needed for w…

I'm really glad calyxos is starting up again. Grapheneos has a lot of cool technical implementation but there are a lot of things that Calyx seems to do in a simpler, more vanilla Android manner.

Not sure where you got Calyx doing stuff in a "simpler, more vanilla Android manner". It's quite the opposite, actually. CalyxOS bundles a whole bunch of useless third party apps which connect to third party services. If you opt-in to installing microG (which is privileged, not in a sandbox), you aren't avoiding Google in the slightest. You're actually opening yourself up more because of how much of a sloppy interpretation microG is while trying to fill in the role of Google Play services. microG exposed location data to apps, even if the permission was explicitly denied. The developers knew about this for years without doing anything about it.

You're safer using a standard Android phone than using an OS as duct-taped together as CalyxOS.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#106

Post by HybridStatAnim8 »

jona-f wrote: post #51

I bought a used Pixel 6 for cheap to try out grapheneos. Can't say I like it. UX of lineageos is much better. There is a weird russian doll kind of situation with the package managers going on. There is one builtin "App Store" with only a few basis programs, one of which is another package manager, accrescent, which offers a few more apps, but still not comprehensive at all, so another package manager is needed for w…

GrapheneOS inherits the user interface of the Android Open Source Project, which is what Pixels stock operating system uses, along with many other OEM forks of android.

GrapheneOSs App Store is present to fulfil the role of the first party appstore that AOSP requires. It also serves to provide updates to first party apps out-of-band, and mirror apps for various case-by-case reasons.

Accrescent is mirrored due to it having a focus on privacy and security. It is currently in alpha and app submissions are closed. They will be open Soon:tm:.

Google play is mirrored for app compatibility with apps that require google play, and for access to the playstore.

The GrapheneOS community favors Obtanium due to its ability to fetch developer-signed apps from places like Github. Fdroid signs and builds nearly every app on the main repository with outdated build infrastructure and poor moderation.

GrapheneOSs security model inherits and builds upon the AOSP security model.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#107

Post by HybridStatAnim8 »

NewJazz wrote: post #52
jona-f wrote: post #51

I bought a used Pixel 6 for cheap to try out grapheneos. Can't say I like it. UX of lineageos is much better. There is a weird russian doll kind of situation with the package managers going on. There is one builtin "App Store" with only a few basis programs, one of which is another package manager, accrescent, which offers a few more apps, but still not comprehensive at all, so another package manager is needed for w…

I'm really glad calyxos is starting up again. Grapheneos has a lot of cool technical implementation but there are a lot of things that Calyx seems to do in a simpler, more vanilla Android manner.

GrapheneOS is more simple and vanilla than CalyxOS. GrapheneOS puts substantial effort into seamless/passive privacy and security features, as well as maintaining feature parity with the Android Open Source Project and with Googles stock Pixel operating system.

CalyxOS is not a private or secure operating system. They have added several 3rd party apps and services, which includes several 3rd party connections. On top of this, several of these services are given problematic, privileged access.

A notable example of this is Android Auto. CalyxOS grants substantial privileged access to this component by default, while GrapheneOS sandboxes it, and exposes 4 opt-in toggles for privileged access. The user may granularly decide what privileged access they wish to grant.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#108

Post by AJ-1320 »

jona-f wrote: post #51

I bought a used Pixel 6 for cheap to try out grapheneos. Can't say I like it. UX of lineageos is much better. There is a weird russian doll kind of situation with the package managers going on. There is one builtin "App Store" with only a few basis programs, one of which is another package manager, accrescent, which offers a few more apps, but still not comprehensive at all, so another package manager is needed for w…

First of all, I would like to state that just because a piece of software is free and open source, does not mean it is inherently more secure or private. "Open source" is merely just a licensing term.

GrapheneOS has the "App Store" to get the most basic apps required for general usage. Accrescent is distributed there because it follows Android's security baseline for being an actual app repository while F-Droid and Aurora Store do not. There really isn't a value in having third parties compiling apps to check for any malicious activity, which F-Droid does. These checks are not reliable and have been bypassed. It's one of the reasons why Wireguard is no longer on F-Droid. If you don't trust an app enough to get it directly from the developer, then don't use the app at all. The privacy and security benefits of GrapheneOS are supposed to be nearly invisible to the average user. Examples include a hardened memory allocator and memory tagging extension to protect from memory corruption bugs, and the ability to install sandboxed Google Play to use Google services without Google having complete control of your device.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#109

Post by surgical_fire »

amarant wrote: post #91
surgical_fire wrote: post #14

Earlier quoted context omitted.

I am patiently waiting for that one. I have been willing to move to GrapheneOS for a while, but I don't feel like buying Google hardware.

Fwiw the pixel phones are excellent hardware.

I don't care. I don't want Google hardware because I despise the company and I'm actively trying to reduce my dependence on Google.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#110

Post by NewJazz »

AJ-1320 wrote: post #105
NewJazz wrote: post #52

Earlier quoted context omitted.

I'm really glad calyxos is starting up again. Grapheneos has a lot of cool technical implementation but there are a lot of things that Calyx seems to do in a simpler, more vanilla Android manner.

Not sure where you got Calyx doing stuff in a "simpler, more vanilla Android manner". It's quite the opposite, actually. CalyxOS bundles a whole bunch of useless third party apps which connect to third party services. If you opt-in to installing microG (which is privileged, not in a sandbox), you aren't avoiding Google in the slightest. You're actually opening yourself up more because of how much of a sloppy interpre…

microG exposed location data to apps, even if the permission was explicitly denied. The developers knew about this for years without doing anything about it.

Care to source this claim?

Post reply on HN