Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS and forensic extraction of data (2024)

discuss.grapheneos.org

Post reply on HN
Print view View original

151–160 of 208 posts

Re: GrapheneOS and forensic extraction of data (2024)

#151

Post by imiric »

subscribed wrote: post #129
imiric wrote: post #49

Earlier quoted context omitted.

> A root access is a big hole How so? On Linux, I can add an account to the sudoers list, and have the flexibility to configure the level of security appropriate for my use case. I have yet to experience any security issues (that I'm aware of). Why isn't this possible on my mobile device as well? This absolute stance is not right. Security is not binary, but a spectrum. I should be allowed to have full control over m…

How so? Root can access absolutely everything. Malware capable of getting root can access / exfiltrate anything, use your network, flash your firmware, can persist permanently, can use you as a vector. Shellshock, log4j, Heartbleed. Hundreds of the big profile vulnerabilities that can be exploited on the system in an attempt to obtain root. And then you're cooked. You really think a malware with the root access can't…

I understand the risks, but just because they theoretically exist doesn't mean that they pose an active threat in all scenarios, or that they can't be mitigated.

The idea of locking the system down completely and preventing anyone from accessing it is technically more secure, but it creates many practical issues for tech-savvy people who want full control over their devices, which is the vast majority of the GrapheneOS user base.

If SELinux can mitigate the risks, then sure, let's use that. I don't really care what the technical solution is to this problem.

I'm just saying that:

a) As a user of an OS I want to be allowed full control over my device and not have babyproofed functionality because "it's for my own good". That is the realm of walled garden OSs from most major corporations which I deliberately avoid by using GOS in the first place.

b) My personal threat model doesn't involve using a bunch of untrusted applications, and I'm fine with trading some security for convenience. If the risks from choosing convenience can't be mitigated, then my OS should be flexible enough to allow me to make that choice. Other OSs can do this, so why can't GOS? I'm inclined to believe that there's no technical reason for it, but it's something that maintainers simply don't want to support. Which is fine, it's their project and their prerogative, but then let's not pretend that this is a discussion about security.

Re: GrapheneOS and forensic extraction of data (2024)

#152

Post by nunobrito »

SigRed wrote: post #21
nunobrito wrote: post #11

[flagged]

So you were called out over on Nostr by Final regards the Tor app which you mistakenly took to be integrated when they simply showed the app and it running on the OS, not IN it and decided to come to HN for an anti-Graphene sympathetic ear? The reply you were called out for, for other people's benefit: It's not bundled. It isn't going to be bundled. This is a post showing a work in progress beta app that most users h…

Why would I ever trust a gov agency whose expertise is deceiving their oponents when they publicly announce/leak that a specific hardware is more secure than others for them to break? That is the all the more reason to keep distance.

> Tor app which you mistakenly took to be integrated when they simply showed the app and it running on the OS

Putting the two things together and endorsing is the same as placing a knife and a tomate on the kitchen table and not expecting them to be used together.

That distro is willingly promoting that journalists and other critical crafts use a service directly created/maintained/funded by the same governments they are trying to hide from. There exists I2P which solves all those attack vectors without ambiguities, but for "reasons" it isn't adopted. Ah.. "licensing model" was the reason last time we talked.

> "GrapheneOS has long been suspicious about the revenue values it receives." GrapheneOS Foundation is a registered Canadian non profit that declares it's accounts and has filed accounts registered against them for this year and last year too. Nothing is suspicious.

Is it public somewhere? If not: that is pretty suspicious for a non-profit. Because you endorse Tor (US intelligence-sponsored tool), you endorse Signal (US intelligence sponsored tool) so why don't you go public about where your money is coming from?

About chinese devices let's be realistic: Google™ Pixel devices are also built in China by Foxconn. Reusing your argument: I'm choosing to be spied only by one side of the globe rather than both sides. Yes, my personal preference is to be spied by eastern powers rather than western ones when possible to choose between bad choices.

I'm not alone on this criticism about the hardware and you know it.

Re: GrapheneOS and forensic extraction of data (2024)

#153

Post by nunobrito »

bri3d wrote: post #15
nunobrito wrote: post #11

[flagged]

This is a deeply horrible take. “From a forensic perspective” if one uses a cheap Chinese phone, as you suggest, anyone with one of tens of forensic extraction tools (including the US government!) will immediately own your phone as soon as they plug into it (seriously, as a very public example MediaTek SOCs until very recently all have fatal flaws in the boot ROM). If you use a Google phone, maybe a deeply embedded s…

Your opinion comes as security expert working for a group whose hardware leaked the data for 400 000 people just a few months ago: https://www.techzine.eu/news/security/127456/volkswagen-data...

Maybe your cars could use that tinfoil hat and avoid leaking personal data.

Now on a serious note: there are better odds of staying hidden between the noise of thousand cheap chinese manufacturers than willingly get yourself into the hardware of a very suspicious supplier.

You are correct that it is game over once there is physical access to your hardware, the thing we try to avoid here is guaranteed remote access from the comfort of some servers in Utah.

Re: GrapheneOS and forensic extraction of data (2024)

#155

Post by attila-lendvai »

danans wrote: post #35
jbstack wrote: post #24

Earlier quoted context omitted.

Aside from the fact that there's a subjective definition problem here (how do we decide what people "need"?), I think this an unrealistic view. By this definition, every government that has ever existed or ever will exist is a "bad" government because no government can ever tackle every single problem 100% of the time. Many problems are extremely difficult to solve (e.g. global warming), and others simply cannot be s…

> Sure, you can tax more up to a point, but eventually that tap runs dry and you're forced to reallocate existing resources. Since the 1980s, we have been consistently taxing less. If the tap is dry, it isn't because of over-taxation - it's because there's a reservoir of wealth hoarded by the relatively few. A even cursory glance at the trajectory of wealth distribution will make that clear.

sure, but does government prevent wealth inequality, or maybe the very cause of it?

(research hint: inflation, and that millennia old quote/insight: the more numerous the laws, the more corrupt the government...)

Re: GrapheneOS and forensic extraction of data (2024)

#156

Post by attila-lendvai »

dragonwriter wrote: post #95
foofoo12 wrote: post #93

Earlier quoted context omitted.

It's the fundamental principles of right and wrong. Morals. It's not just views or kind of.

Beliefs about what is fundamentally right and wrong are, in fact, views.

then child rape is just a clash of views... you sure you really want to go down that road?

Re: GrapheneOS and forensic extraction of data (2024)

#157

Post by zahllos »

kelnos wrote: post #120
megaloblasto wrote: post #31

Earlier quoted context omitted.

Thanks > These devices meet the stringent privacy and security standards and have substantial upstream and downstream hardening specific to the devices It still seems strange. A big part of GrapheneOS is to provide a safeguard from Googles data hoarding, yet it works primarily on Google phones.

That doesn't seem odd to me. Google's data hoarding is done in software, not hardware. Remove Google's add-on software and you have a more or less blank slate to work with. I don't see why we'd expect any different.

This is the answer. Google play services and related privileged components are the non-open source blob hoarding data, along with whatever backend services you use from Google. These components are part of the stock android image that comes on the device that's replaced entirely by GrapheneOS.

Naturally if you continue to use Google services then the data hoarding continues.

Re: GrapheneOS and forensic extraction of data (2024)

#158

Post by dragonwriter »

attila-lendvai wrote: post #156
dragonwriter wrote: post #95

Earlier quoted context omitted.

Beliefs about what is fundamentally right and wrong are, in fact, views.

then child rape is just a clash of views... you sure you really want to go down that road?

> then child rape is just a clash of views

Who said “just”? I'm arguing against minimizing conflicts of views as inherently insignificant, low consequence things.

Re: GrapheneOS and forensic extraction of data (2024)

#159

Post by foofoo12 »

dragonwriter wrote: post #95
foofoo12 wrote: post #93

Earlier quoted context omitted.

It's the fundamental principles of right and wrong. Morals. It's not just views or kind of.

Beliefs about what is fundamentally right and wrong are, in fact, views.

You can call them views, and you can call your tap water a solution of dihydrogen monoxide with contaminants. It isn't helpful.

Re: GrapheneOS and forensic extraction of data (2024)

#160

Post by Razengan »

p0w3n3d wrote: post #4

There is no such thing like "bad government" and "good government". I mean - it really depends on people's views, therefore we must not blissfully put our data into govt hands because "they will protect us from terrorists and child rapists". What they will do, actually, is that for sure they will abuse innocent citizens at some point of time. They will. Even if they don't, they will. Or maybe they are doing it right…

In the past, whenever I read someone say stuff like what I myself say down below, I put them down as a crackpot:

But as time goes by and I travel the world, I find it's hard to deny that there are and always were distinct classes within human civilization, though the lines may be blurred here and there, and almost everything within every human society serves to preserve those classes, whether as the direct intentional goal or as a convenient side effect.

"Govern" is to "rule"

Other commenters mention the lack of government, and pockets of chaos where gangs/bandits/warlords/disasters run rampant, but those too are different classes versus each other, or vacuums where classes have yet to [re]form.

Post reply on HN