GrapheneOS – Break Free from Google and Apple • Hacker News Board

Re: GrapheneOS – Break Free from Google and Apple

#511

Post by Aachen » Tue, Feb 17, 2026, 5:29 PM UTC

gf000 wrote: post #290

RRRA wrote: post #262

Until these OS also start putting forward something like WebOS that tried to get phones back to on open web, there is no breaking the binary format and Appstore monopoly. I wish Europe would have forced that 10 years ago since the US is beyond saving.

What binary format?? Go read facebook's "source code", is that any more open than a random apk? If anything, apks decompile quite well.

So long as browsers allow you to open the developer tools and inspect memory etc., they're more open than remote attestation of a stock android or ios device

Decompiling apps only works if you can get the app. I don't understand GP's problem with the apk format either, but you do need to break terms of service to get the files if you don't have a phone with Google services installed. Whether that's ethical or legal is up for debate

Re: GrapheneOS – Break Free from Google and Apple

#512

Post by fsflover » Tue, Feb 17, 2026, 5:31 PM UTC

mentalgear wrote: post #323

zozbot234 wrote: post #110

Earlier quoted context omitted.

It's quite secure against casual attacks, but a proprietary mobile platform has inherent issues wrt. withstanding even mildly sophisticated attackers, including mercenary spyware services. You still have a huge attack surface from all sorts of proprietary firmware blobs and hardware IP blocks that are running directly on the SoC. It's not clear that it's really worth even trying to secure it as opposed to just treati…

Interesting. What are the alternatives to GrapheneOS that you wouldn't consider a "toy" ?

In my understanding, it's not the OS that makes it a toy but the hardware. I guess something with open schematics (Librem 5, Pinephone) should be better, or an open-hardware device like Precursor.

Re: GrapheneOS – Break Free from Google and Apple

#513

Post by NoGravitas » Tue, Feb 17, 2026, 5:32 PM UTC

Zak wrote: post #423

perching_aix wrote: post #411

Earlier quoted context omitted.

Is it not possible to buy a phone in the US without any cellular providers involved? I thought that kind of lock-in was a thing of the past.

It is possible, but many people still buy them from their provider with financing or subsidies. That means people shopping for used Pixels who want to unlock the bootloader need to avoid the special Verizon variant which forbids unlocking the bootloader. This is separate from SIM locking, which forbids use with another carrier. US carriers still do that, but are required to remove the lock after a while if the custom…

Yep. I lost a restocking fee when I bought a used "unlocked" Pixel. Turned out it was not SIM locked, but it was impossible to unlock the bootloader. It was pretty easy to find a bootloader-unlockable Pixel once I knew what to look out for, but the first time I had no idea this was something you had to look out for.

Re: GrapheneOS – Break Free from Google and Apple

#514

Post by palata » Tue, Feb 17, 2026, 5:32 PM UTC

Aachen wrote: post #497

andrewaylett wrote: post #228

Earlier quoted context omitted.

They rely on manufacturer support for device firmware, just like anyone else.

Debian surely doesn't depend on Lenovo or Asus to release OS updates for my laptop. Apparently it's not "everyone else" that needs this but it's some sort of dependency for mobile (qualcomm?) devices I have trouble understanding why this is different on mobile devices. People keep speaking of blobs but that doesn't seem to be a thing in laptop/desktop hardware, unless they mean something like the firmware running on…

Debian does not write the whole software stack running everywhere on your system. So if you want your system to be "supported", as in, "if a security flaw is discovered in a firmware, I want it patched and I want my firmware to be updated", then you need whoever writes that firmware to do it.

That's a dependency: if you want your system to be secure, you depend on the software running on your system to be patched when a security flaw is published.

Re: GrapheneOS – Break Free from Google and Apple

#515

Post by GoblinSlayer » Tue, Feb 17, 2026, 5:34 PM UTC

abustamam wrote: post #441

InitialLastName wrote: post #385

Earlier quoted context omitted.

My favorite is when it must have punctuation, but certain punctuation is silently banned, so I have to keep refreshing my password generator until it gives me an acceptable combination.

Somewhat unrelated, is there any technical reason certain punctuation might be banned? I can understand maybe not allowing letters with diacritics or other NON-ASCII chars but why would a system reject an @ sign or bracket > for example?

Depending on the protocol they can be url encoded or even helpfully html encoded; the same password can be used over different protocols. It's the best to not use punctuation by default (length supplies more entropy than charset), I add -0 at the end to make dumb password policies happy.

Re: GrapheneOS – Break Free from Google and Apple

#516

Post by lawn » Tue, Feb 17, 2026, 5:34 PM UTC

greenie_beans wrote: post #369

haskman wrote: post #235

Been running GrapheneOS for a while on a Pixel 9, and extremely happy with it! Apart from the usual perks of the FOSS ecosystem, there are a few things specific to GrapheneOS that are not immediately apparent but have turned out to work very well - 1. The Pixel camera app works, including all modes and settings. A camera that takes good photos was absolutely a requirement for me, and the FOSS camera apps are not quit…

wish my yubikey would work with bitwarden

My Yubikey works with bitwarden on GrapheneOS using NFC.

Re: GrapheneOS – Break Free from Google and Apple

#517

Post by raddan » Tue, Feb 17, 2026, 5:35 PM UTC

empyrrhicist wrote: post #438

delta_p_delta_x wrote: post #417

Earlier quoted context omitted.

Having more than just alphanumeric characters widens the domain of the password hash function, and this directly increases the difficulty of brute-force cracking. But having a such a small maximum password length is... puzzling, to say the least. I would accept passwords of up to 1 KiB in length. With rainbow tables, even 11-character simple passwords like 'password123' can be trivially cracked, and as the number of…

It's easier for me to remember really long passphrases than even short alphanumeric strings - small maximum password lengths set my teeth on edge. The passwords should be getting hashed anyway right?

The problem is that you never really know what a website operator does with your credentials. Ideally, you have both a unique email and a unique password for each site, because sadly credential stuffing [1] is a thing.

[1] https://en.wikipedia.org/wiki/Credential_stuffing

Re: GrapheneOS – Break Free from Google and Apple

#518

Post by angst_ridden » Tue, Feb 17, 2026, 5:37 PM UTC

abustamam wrote: post #441

InitialLastName wrote: post #385

Earlier quoted context omitted.

My favorite is when it must have punctuation, but certain punctuation is silently banned, so I have to keep refreshing my password generator until it gives me an acceptable combination.

Somewhat unrelated, is there any technical reason certain punctuation might be banned? I can understand maybe not allowing letters with diacritics or other NON-ASCII chars but why would a system reject an @ sign or bracket > for example?

A lot of the restricted stuff is cargo-cult fear of symbols that could be used in SQL-injection or XSS attacks.

A properly-coded system wouldn't care, but the people who write the rules have read old OWASP documents and in there they saw these symbols were somehow involved in big scary hacks that they didn't understand. So it's easier to ban them.

Re: GrapheneOS – Break Free from Google and Apple

#519

Post by 72deluxe » Tue, Feb 17, 2026, 5:38 PM UTC

sandreas wrote: post #177

72deluxe wrote: post #171

Earlier quoted context omitted.

I like Organic Maps because it isn't full of the social things. Every time I open Google Maps it shows that card at the bottom with "what's popular in your area", full of pictures of people's breakfasts and other nonsense. Organic Maps is free of this noise. Also, the desktop client on Linux is quite useful. Alternatives for Windows etc. are Cruiser Maps, a Java application (and also available as an Android app).

All map apps I tested so far were kind of usable but nowhere near Apple or Google maps. Especially for longer trips I often got lost and had to re-navigate by different reasons (voice announcement too late, no lane instructions, etc.). However, I listed it because it is a "usable" alternative that works offline.

I used OrganicMaps for navigation from the UK through France, Germany, Switzerland, back into France and then Spain last year on a 2 week enjoyable camper van trip. It can take a while for routing changes if you ignore it and decide to drive elsewhere, and I don't really use the voice alerts (I just have it on my phone on the dashboard via a magnet), but all in all it worked really well.

Although I would like speed limits shown in MPH in the UK, OrganicMaps' KMH limits were useful on the Continent.

Re: GrapheneOS – Break Free from Google and Apple

#520

Post by shantara » Tue, Feb 17, 2026, 5:39 PM UTC

lejalv wrote: post #397

72deluxe wrote: post #171

Earlier quoted context omitted.

I like Organic Maps because it isn't full of the social things. Every time I open Google Maps it shows that card at the bottom with "what's popular in your area", full of pictures of people's breakfasts and other nonsense. Organic Maps is free of this noise. Also, the desktop client on Linux is quite useful. Alternatives for Windows etc. are Cruiser Maps, a Java application (and also available as an Android app).

> I like Organic Maps Does anybody know of a project that offers public transport routing? Ideally with real time information, but I can live with only using schedules or even just average passage interval. The other general sticking point for me is the reviews, but I could invite more serendipity to my restaurant search.

FWIW Organic Maps are aware of this issue. In the poll on their mastodon account, lack of public transit information was voted as number one missing feature. As far as I’m aware, they are looking into integrating the public APIs for it wherever possible.