Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS – Break Free from Google and Apple

blog.tomaszdunia.pl

Post reply on HN
Print view View original

651–660 of 967 posts

Re: GrapheneOS – Break Free from Google and Apple

#651

Post by strcat »

realusername wrote: post #103
scheeseman486 wrote: post #92

Earlier quoted context omitted.

Other way around, actually. It's possible to make concessions to privacy, like providing crash reports, or running applications in sandboxes which limits what they can harvest, while keeping the platform secure. Any privacy you have on a system is reliant on no one tampering with that system and on software behaving itself. Without security, you can't trust the system to implement any privacy.

I also disagree with that, I trust my Linux distribution to behave well much more than I trust any Android platform and it doesn't even have much app sandboxing at all. You can't fix a lack of trust like you have in Android with technical solutions. The flaw in Android is fundamentally a social problem.

There's a massive open source app ecosystem for Android which is far larger than the subset available in F-Droid. Open source does not imply private or trustworthy. Completely trusting applications with access to all your data with no insight in to what they're accessing or sending to services means you wouldn't know if your privacy is being violating anyway.

Re: GrapheneOS – Break Free from Google and Apple

#652

Post by strcat »

RRRA wrote: post #262

Until these OS also start putting forward something like WebOS that tried to get phones back to on open web, there is no breaking the binary format and Appstore monopoly. I wish Europe would have forced that 10 years ago since the US is beyond saving.

There's a huge open source app ecosystem for Android and it has the best support of any major platform for well integrated web applications. There are a bunch of alternatives for getting apps including getting them directly from the developers which has been automated without needing an app store. The linked post talks about using Obtainium for getting apps more directly from developers when possible.

Re: GrapheneOS – Break Free from Google and Apple

#653

Post by realusername »

strcat wrote: post #641
realusername wrote: post #52

Earlier quoted context omitted.

I like GrapheneOS but they fail to understand in this post that the #1 security concern an android user face is the lack of privacy. Sure they have hardened everything but realistically, that's not the main threat for your average user. Their top contribution to android is the sandboxed Google Play, by far.

GrapheneOS is primarily privacy project. It keeps up with important Android updates with major privacy enhancements and very important privacy patches. It builds crucial privacy protections such as Storage Scopes, Contact Scopes, Sensors toggle and much more into the OS. Privacy depends on security so security protections and security patches are part of providing strong privacy too. It's a misconception that Graphen…

The #1 security problem your average Android user face isn't an attack by some Israeli firm but data leaks by advertisers and unless I missed something (it's possible), GrapheneOS does not have an equivalent of ublock origin built into the OS which I'd consider step 1 of fighting the problem.

The "ideal android" in my head would just have a dynamic ruleset to patch/nop tracking libraries as the app loads, which as far as I know, nobody does that, eOS doesn't either. Kind of like Revanced but on steroids and built into Android.

I feel like you can't really fix android anyways, the design is just broken and if you care about security / privacy, you should just use everything in a browser or a Linux distribution.

Sure the work GrapheneOS does is valuable but it's like removing water from a lake with a bucket.

I feel like shielding the mess that Android is into something like an improved Waydroid with a mindset of "yeah let's keep it there and the sane stack for the rest" sounds a better approach to me.

Re: GrapheneOS – Break Free from Google and Apple

#654

Post by subscribed »

budududuroiu wrote: post #48
Myzel394 wrote: post #10

I've been using GrapheneOS for about 3 years now. For the most part, it works very well. I don't have any issues with banking apps, nor any other closed source apps. I'm using two profiles both with sandboxed Google play installed. I'm logged in into my private Google account on the work profile. However, there was one case that lead me to thinking about ditching grapheneos to this day. I installed Uber on my phone a…

I'm a new GrapheneOS user and stopped using Uber as altogether. Taxis aren't that bad where I'm at, and cheaper than Uber

I wish I could stop using them for these rare occasions I need a transport.

Taxi across the town is £20, Uber usually 5-10. There are no other providers.

Taxi from my airport (some 15 miles away) is £60-80, Uber usually £30-ish. Public transportation (2 trains + 2 buses) over £50.

I wish I had an option.

Re: GrapheneOS – Break Free from Google and Apple

#655

Post by subscribed »

zozbot234 wrote: post #110
mentalgear wrote: post #13

This is especially interesting in regard to the recent HN dicussion on spyware by for-profit intel firms having access to Whatsapp, Telegram, Signal, etc. ( https://news.ycombinator.com/item?id=47033976 ) through OS-level no-click hijacks. I wonder how secure GrapheneOS is in that regard, and what the other contenders are?

It's quite secure against casual attacks, but a proprietary mobile platform has inherent issues wrt. withstanding even mildly sophisticated attackers, including mercenary spyware services. You still have a huge attack surface from all sorts of proprietary firmware blobs and hardware IP blocks that are running directly on the SoC. It's not clear that it's really worth even trying to secure it as opposed to just treati…

So if a toy OS is the only one to withstand attacks with Cellebrite, what do you consider not a toy?

Re: GrapheneOS – Break Free from Google and Apple

#656

Post by strcat »

charles_f wrote: post #466

Graphene is very attractive, the two things that prevent me from going are a) using your phone as a credit card, I'm too attached to that now. b) work profile does not work with rooted phones

There are multiple options for tap-to-pay on GrapheneOS in the UK and European Economic Area. It depends on where you are.

Re: GrapheneOS – Break Free from Google and Apple

#657

Post by ysnp »

jeffbee wrote: post #568
Aachen wrote: post #560

Earlier quoted context omitted.

I assume this is all technically correct, but in practice I've not noticed any speed difference between stock Pixel and GrapheneOS. Maybe their Vanadium browser when tab switching, that feels slow, but I wasn't planning on being part of the Chromium monoculture anyway so this doesn't matter to me

That's great and, of course, only your experience matters to the choice of which OS you use. I just don't want people to get the impression there are no tradeoffs. Another tradeoff GrapheneOS makes is because of the way they configure the USB port makes it more possible that you will irreversibly brick your phone by accident. You could say that the USB management is the only really material difference between Android…

I just want to note that I believe the default setting is that data is disabled for the USB port when the phone is locked except after a reboot (before unlocking the phone for the first time), so if you break your screen you have the option to use the keyboard if you reboot the phone.

Re: GrapheneOS – Break Free from Google and Apple

#658

Post by [deleted] »

strcat wrote: post #611
palata wrote: post #344

Earlier quoted context omitted.

> It is wrong to claim that an unlocked bootloader completely breaks the android security model. You seem knowledgeable about this, so I'll take the opportunity to ask: if I install a malicious app and it manages to escape the sandbox and alter the system, my understanding is that it will be detected next time I boot it (because the image hash won't match). Isn't that true? > Signing keys for bootloaders might just n…

> You seem knowledgeable about this, so I'll take the opportunity to ask: if I install a malicious app and it manages to escape the sandbox and alter the system, my understanding is that it will be detected next time I boot it (because the image hash won't match). Isn't that true? They're misrepresenting what has been said by GrapheneOS and also lack a good understanding of it themselves. They're definitely not a goo…

[deleted]

Re: GrapheneOS – Break Free from Google and Apple

#659

Post by InitialLastName »

GoblinSlayer wrote: post #515
abustamam wrote: post #441

Earlier quoted context omitted.

Somewhat unrelated, is there any technical reason certain punctuation might be banned? I can understand maybe not allowing letters with diacritics or other NON-ASCII chars but why would a system reject an @ sign or bracket > for example?

Depending on the protocol they can be url encoded or even helpfully html encoded; the same password can be used over different protocols. It's the best to not use punctuation by default (length supplies more entropy than charset), I add -0 at the end to make dumb password policies happy.

Often, the same ones with limited punctuation also have length limits, so maximizing the character options is the only way to maximize entropy.

Re: GrapheneOS – Break Free from Google and Apple

#660

Post by strcat »

randusername wrote: post #240

How are the cameras on the latest devices running GrapheneOS? My last Android experience was the Oneplus One and the experience left me with the feeling that cameras are just too proprietary to work well once you go tinkering with custom ROMs and camera apps. I'm not a photographer or anything, I just want to quickly point and shoot and get on with whatever I'm doing without thinking too hard.

GrapheneOS has the same camera features and quality as the stock Pixel OS within the same apps. You can use Pixel Camera on GrapheneOS even without sandboxed Google Play in the same profile if you want the full feature set. If you want extremely good cameras, the Pixel 10 Pro and Pixel 10 Pro XL are the best choices. Those provide the highest quality image sensors among the available supported devices and the Pro mode in Pixel Camera. See https://www.dxomark.com/smartphones/ for how those compare to other devices. Our own Camera app will be heavily overhauled to narrow the gap more with the Pixel Camera app but you can already use that especially if you care a lot about this.
Post reply on HN