This is the de-Googled, more secure version of the Android Open Source Project. GrapheneOS, the modified version of Android that is devoid of Google while...
That’s all very nice but not many of us are willing to buy a $1000 phone (or an obsolete Pixel) to get Graphene.
Pixel “a” series phones typically sell for under $500 and support GrapheneOS.
They soon won’t be able to run it on new Pixels, and also the stuff about AOSP updates stops mattering since AOSP itself is nearly dead.
Source for this?
The obsession with security chips (fighting the seized phone attack while comparatively ignoring much more relevant threats) is another misplaced priority. It’s the old notion of “fence post security”, putting a 100 foot fence post in the middle of the desert expecting the attacker to try to climb over it instead of going around it.1
The obsession with security chips is what allows Pixels and iPhones to be the most secure devices on the planet. They have some of the most researched technologies being used here. You’re literally just throwing it away based on…your link to a harry potter book? Seriously, look at the source you just shared. Its not even relevant 😂
And again, I’m amused at the idea of the US and Chinese governments allowing a Motorola (Lenovo) Graphene to be sold if it’s really that secure.
What are they going to do, ban security chips like they tried to ban encryption in the 90s?
We need a de-googled Android fork (maybe Lineage is that) on mass market phones using the hardware that those phones have. Otherwise we’re acquiescing to the notion that Elon Musk deserves more privacy than Joe Schmoe when it should be the other way around.
GrapheneOS and LineageOS are already degoogled… LineageOS is extremely subpar when it comes to security since they dont enforce it onto their hardware. GrapheneOS actually enforces it and wont work unless it has those specific security features. LineageOS doesnt solve the problem you were concerned about in your post.
The obsession with security chips is what allows Pixels and iPhones to be the most secure devices on the planet.
I remember the govt trying to muscle Apple into unlocking someone’s iphone, til they suddenly stopped because they found Cellebrite could unlock it instead. There have been several new iphone generations since then but I haven’t heard about govt muscling anytime recently. So I have to infer they can still unlock iphones. As for Pixels, this is in Dutch but very recent: https://www.omroepbrabant.nl/nieuws/6023856/drievoudige-moord-in-oosterhout-telefoon-van-verdachte-gekraakt
Machine translation of main paragraphs:
The Netherlands Forensic Institute (NFI) has unlocked the Google Pixel phone belonging to 29-year-old Veronica K., according to the prosecutor. “A large number of images of weapons and stacks of cash were found on her phone. There are also a large number of chat messages that can now be read.” K. is alleged to have facilitated the murder by supporting the perpetrators.
The prosecutor expects to receive the first results from the NFI on Thursday. During the hearing, the prosecutor also said there is good reason to hope that the NFI will be able to unlock the Google Pixel phones belonging to the other two suspects as well.
So I think you’re putting too much faith in this stuff. I will ask my crypto homies if they have any recent info about phone attacks though.
More relevantly, most secure devices AGAINST WHAT? You’re talking about a locked phone attack which is the absolute least of most users’ worries. The phone is so insecure in everyday use that the border patrol is near irrelevant. Plus users including paranoids like me don’t have any opsec to speak of. When was the last time you crossed a border with an Android phone anyway? I don’t think I’ve ever done that. Like most people I don’t leave the country that often. Last time I did was before I switched to Android, IIRC. I might have had an analog or 2G flip phone or something. If I travel somewhere again it’s not that big a deal to leave my Android phone at home, as I mentioned before.
Even in the border patrol picture, Graphene and TPM won’t protect you from what used to be called rubber-hose cryptanalysis (xkcd.com/538). They’re defending from the wrong threat.
Look, I understand the advantages of crypto hardware. I’ve programmed it and written simulators for it. But, the way to really keep cryptography in people’s hands is to make it not require special hardware. Thus I’m skeptical that the government hates Graphene, but it really did hate PGP back in the day.
If I get to add new hardware to phones, TPM would be on my list but not at the top. First might be something like POCSAG (plus build out the pager network again) so you can receive text messages without transmitting anything or revealing your location. Second, third, etc. would be in a similar vein.
Pixel “a” series phones typically sell for under $500 and support GrapheneOS.
Source for this?
The obsession with security chips is what allows Pixels and iPhones to be the most secure devices on the planet. They have some of the most researched technologies being used here. You’re literally just throwing it away based on…your link to a harry potter book? Seriously, look at the source you just shared. Its not even relevant 😂
What are they going to do, ban security chips like they tried to ban encryption in the 90s?
GrapheneOS and LineageOS are already degoogled… LineageOS is extremely subpar when it comes to security since they dont enforce it onto their hardware. GrapheneOS actually enforces it and wont work unless it has those specific security features. LineageOS doesnt solve the problem you were concerned about in your post.
This is a start: https://grapheneos.social/@GrapheneOS/117140352254892456
I remember the govt trying to muscle Apple into unlocking someone’s iphone, til they suddenly stopped because they found Cellebrite could unlock it instead. There have been several new iphone generations since then but I haven’t heard about govt muscling anytime recently. So I have to infer they can still unlock iphones. As for Pixels, this is in Dutch but very recent: https://www.omroepbrabant.nl/nieuws/6023856/drievoudige-moord-in-oosterhout-telefoon-van-verdachte-gekraakt
Machine translation of main paragraphs:
So I think you’re putting too much faith in this stuff. I will ask my crypto homies if they have any recent info about phone attacks though.
More relevantly, most secure devices AGAINST WHAT? You’re talking about a locked phone attack which is the absolute least of most users’ worries. The phone is so insecure in everyday use that the border patrol is near irrelevant. Plus users including paranoids like me don’t have any opsec to speak of. When was the last time you crossed a border with an Android phone anyway? I don’t think I’ve ever done that. Like most people I don’t leave the country that often. Last time I did was before I switched to Android, IIRC. I might have had an analog or 2G flip phone or something. If I travel somewhere again it’s not that big a deal to leave my Android phone at home, as I mentioned before.
Even in the border patrol picture, Graphene and TPM won’t protect you from what used to be called rubber-hose cryptanalysis (xkcd.com/538). They’re defending from the wrong threat.
Look, I understand the advantages of crypto hardware. I’ve programmed it and written simulators for it. But, the way to really keep cryptography in people’s hands is to make it not require special hardware. Thus I’m skeptical that the government hates Graphene, but it really did hate PGP back in the day.
If I get to add new hardware to phones, TPM would be on my list but not at the top. First might be something like POCSAG (plus build out the pager network again) so you can receive text messages without transmitting anything or revealing your location. Second, third, etc. would be in a similar vein.