lberrymage

vor 4 Jahrendiscuss

Yes it does. They ship userdebug builds as production releases, pretend to support devices past their vendor EOL (which is impossible since Lineage can't provide security updates for firmware etc.), ship the F-Droid Privileged Extension (which uses an incorrect approach to implementing unattended updates), don't support locking the bootloader to enable verified boot on many supported devices, etc..

lberrymage

vor 4 Jahrendiscuss

Locking the bootloader (to enable verified boot) isn't only a protection against physical attacks. It also ensures that any deep OS exploit that occurs is not persistent since the base OS is cryptographically verified on boot. This is really important to the security model, because otherwise you have no reliable way to protect against persistent exploits or verify that you're running a genuine release of the OS you think you are.

lberrymage

vor 4 Jahrendiscuss

> How does it handle Doze?

Play Services requires its battery optimization to be set to unrestricted for FCM to work reliably. Other apps keeping a persistent background connection (e.g. Signal w/out Play Services) require the same thing, so this is not specific to Play Services

> FWIW, I have one metric (a rather stupid one, I agree)

Why do you bring it up then? The amount or frequency of data transfer has zero indication of negative privacy impact. What private data could possibly be sent since Play Services doesn't have any privileged access on GrapheneOS?

> "Google services" are 100MB+ proprietary code, sending god knows what to Google

See my above comment.

> I'm guessing you're speaking of microg implementation when you say "roll back the security model".

He has already stated how microG allows signature spoofing which directly directly breaks the Android security model. But CalyxOS breaks the security model further: it also includes the F-Droid and Aurora privileged extensions which give the corresponding apps special privileges to install apps without user interaction. The proper way to do this (without breaking the security model) is to use the Android 12 API for unprivileged, unattended updates.

> Just like the biggest (or maybe second or third, I don't really track that) corporation in the world on their flagship, while they are 50000 times smaller?

It's not okay to stop shipping security updates for 4 months just because someone else is doing it. GrapheneOS shipped those updates with a team of only 5 developers. If CalyxOS cared at all about security and privacy, they would at a bare minimum meet the latest Android patch level and not break the Android security model.

lberrymage

vor 4 Jahrendiscuss

GrapheneOS doesn't automatically connect to Wi-Fi either unless you enable the option. It also has per-connection MAC randomization enabled by default so Wi-Fi is essentially anonymous when you use it anyway.

> you can't tout it *and say it's privacy preserving.

Why? Sandboxed Play Services has no special privileges on GrapheneOS and thus has the same level of access as any other app. How can it invade your privacy if you don't explicitly give it access to private information?

lberrymage

vor 4 Jahrendiscuss

There is no evidence to suggest this. GrapheneOS has multiple systemic privacy and security improvements over the stock OS (e.g. hardened_malloc, toggleable network permission, exec spawning), so it's a much harder target to develop a working exploit for when compared to devices running the stock OS.

lberrymage

vor 4 Jahrendiscuss

> they insist in doing everything themselves because no other project is good enough

They are making an alternative store with better security and privacy properties than both Google Play and F-Droid. Why is this problematic?

> Updates are forced to the latest version of Android

On Pixels (the only devices GrapheneOS supports at the moment), only the latest version of Android receives security updates, so GrapheneOS must stay on the latest version to meet a baseline level of security. Each Android release also comes with security and privacy improvements along with further restrictions to the app sandbox.

> does not seem safe

How is GrapheneOS not safe?

> does not feel stable?

In what way?

> less customization than other ROMs

Yes, because GrapheneOS is not focused on customizability. This will be improved in Android 12L.

> a bit aggressive towards root

Root fundamentally cripples the Android security model, so being a security-focused project, this is the proper stance to take.

Honestly I'm not sure why you're complaining about GrapheneOS in this thread. The article is written about F-Droid by someone who is not a GrapheneOS developer. They pointed out F-Droid's issues and mentioned upcoming alternatives without these issues. I don't see how one of those alternatives is an "exercise in craziness," nor how GrapheneOS itself is relevant to the article.

comments