Login
You're viewing the front-end.social public feed.

Replies

  • Gloopsies :fedora:gloopsies@fosstodon.org
    Oct 9, 2024, 12:26 AM

    @GrapheneOS

    I don't even know why this is any news to me, I just lived in a naive world where I thought "surely google won't send any personal data home if I don't use any of their services right", I don't know how naive I was, but here we are.

    I just hope that @postmarketOS will succeed in their mission and that there will be a third, private, mobile OS that I can trust, but unfortunately there isn't a different option yet

    #PostmarketOS #Mobile #privacy

    💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 5:08 AM

    @normplum @gloopsies DivestOS is a harm reduction project and not really a hardened OS. It's not a good choice on Pixels where you're ending up with significantly worse overall security from lack of proper patches. eylenburg.github.io/android_co is missing coverage of the fact that LineageOS massively rolls back the security model and has months of delays for patches after yearly and to a lesser extent quarterly releases. That's inherited by DivestOS. Privacy and security are not just about features.

    💬 2🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 5:10 AM

    @normplum @gloopsies GrapheneOS is a lot more stable and provides far broader app compatibility. It's not something niche or hard to use.

    The belief that GrapheneOS has worse compatibility than operating systems using microG isn't correct. We provide much better app compatibility and in a way that preserves privacy and security. The optional Sandboxed Google Play runs in the same sandbox the Play SDK does in apps using it.

    💬 0🔄 0⭐ 0
  • KurtKurt@chaos.social
    Oct 9, 2024, 6:43 AM

    @GrapheneOS instead of bashing other custom ROM, could you please help with banking app? My only idea is: Get a second, unmodified phone. Maybe an iPhone. Keep it powered off and shielded, unless you do banking stuff. @normplum @gloopsies

    💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 7:02 AM

    @Kurt @normplum @gloopsies You should read the information on the DivestOS site which makes it clear that it exists mainly for harm reduction and recommends using GrapheneOS if you can afford to use one of the supported devices. See divestos.org/pages/patch_level and the rest. We're communicating the same thing they tell their users on their site and elsewhere. It's a harm reduction project aimed at people using end-of-life devices because they can't afford new ones. It's not really meant for Pixels.

    💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 7:03 AM

    @Kurt @normplum @gloopsies Since LineageOS introduces substantial delays for migration to new quarterly and yearly releases, DivestOS has those delays. That means there are MONTHS of delays for half of the privacy/security patches for all yearly releases and most quarterly releases when using it on a Pixel. We don't want people using devices without security patches. If you have an issue with that, too bad. We're always going to point out the importance of at least having basic patching done.

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 7:48 AM

    @Kurt @normplum @gloopsies Banking apps work fine on GrapheneOS. Some require the per-app exploit protection compatibility mode. Only banking apps which require a Google certified OS are unavailable. That's a clear choice by those banks to disallow using GrapheneOS or any other non-Google-certified OS to use their apps at all or use certain functionality in their apps. it's not a problem created by GrapheneOS and requires a non-technical solution since spoofing is only a very short term bypass.

    💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 7:54 AM

    @Kurt @normplum @gloopsies If someone MUST have Google Pay and wants to use GrapheneOS, there's the option to use a Pixel Watch or Galaxy Watch for it instead of a whole secondary phone. Pixel Watch technically supports using another OS but we have little interest in supporting it and it would lose Google Pay due to the same anti-competitive Play Integrity API pretend security feature. They allow using a device with no patches for 10 years, so clearly it's not actually about real security.

    💬 2🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 7:56 AM

    @Kurt @normplum @gloopsies Google Pay was designed in a way that's less secure than Apple Pay in order to have it working across all Android devices instead of only initially working on Pixels and then expanding it to other devices by having them add hardware support for it in their trusted execution environment or secure element. To provide some semblance of it not being a major security and fraud risk they used the Play Integrity API to weakly validate a device is has a Google certified OS.

    💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 7:59 AM

    @Kurt @normplum @gloopsies The weak Play Integrity API integrity level is easily spoofed on a case-by-case basis, but it would be easy for them to repeatedly block and therefore totally unacceptable for a production OS. Spoofing weak integrity level required by Google Pay requires pretending to be a device without hardware attestation which is easy for them to detect with fingerprinting with delayed enforcement. They'll require a stronger integrity level at some point. Spoofing doesn't fix it.

    💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 8:01 AM

    @Kurt @normplum @gloopsies There is no viable technical solution to apps trying to disallow using GrapheneOS or any other non-Google-certified-OS. The solution has to be forbidding this at a regulatory level or at least legal victories against the companies enabling and promoting it (Google). The best solution is regulation. Google should not be allowed to block using an alternate OS or encourage others to do it because that's highly anti-competitive and reinforces their monopolies.

    💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 8:02 AM

    @Kurt @normplum @gloopsies Google should absolutely not be allowed to interfere with providing full Android app compatibility with the Play Integrity API anymore. Urgent regulatory action is needed around the world before they further cripple app compatibility in Android compatible operating systems with this. That is not something we can do, only something we can advocate for, and we do. We're in contact with the EU Commission about it for around a year already. They move slowly...

    💬 2🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 8:03 AM

    @Kurt @normplum @gloopsies Google is also misleading regulators about this by presenting anti-competitive as security features despite it clearly having no actual substance for security. So far, their approach is succeeding at reducing app compatibility while not having any antitrust actions taken against them over it yet. That's unlikely to continue because it's such a blatant anti-competitive action without real security value.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 9:00 AM

    @PatrykMis @Kurt @normplum @gloopsies Yes, but we aren't sure on the best way to do it. We're in active communication with the EU Commission and with a couple companies interested in helping with either pressure the EU Commission or take legal action with a lawsuit. It would be too hard to do it on our own but we have help and need more.

    💬 1🔄 0⭐ 0
  • KurtKurt@chaos.social
    Oct 9, 2024, 10:21 AM

    @GrapheneOS how can it be illegal for Google to provide information about the device condition. Or app developers to use that information for decision about provided services. Maybe OS makers should start to provide own integrity attestation api. So an apps can hold lists with trusted OS. @PatrykMis @normplum @gloopsies

    💬 2🔄 0⭐ 0
  • Gloopsies :fedora:gloopsies@fosstodon.org
    Oct 9, 2024, 10:26 AM

    @Kurt @GrapheneOS @PatrykMis @normplum

    The problem this makes is that Google enforces its monopoly over the whole Android ecosystem and blocks anyone else from making a ROM with working apps. The European union is fighting hard against cases like this and there is a great precedent for it to be illegal

    There is a hardware attestation API that can be used by any Android based custom ROMs that follows best security practices and that is probably more secure to use than Google's proprietary APIs

    💬 0🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 10:31 AM

    @gloopsies @Kurt @PatrykMis @normplum It's still not good for apps to use the hardware attestation API for permitting only the stock OS and specific alternate operating systems. It's still a horrible approach. It's what we recommend as an alternative to disallow using alternate operating systems entirely because they can do this without losing anything they think they're getting from doing this check.

    grapheneos.org/articles/attest explains how to allow GrapheneOS while still doing a misguiding thing.

    💬 1🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 10:32 AM

    @gloopsies @Kurt @PatrykMis @normplum The only case where this kind of thing actually makes sense is a basic anti-cheat system for a game. It has no value for trying to stop people recording what's in an app. It has no value for security. It's at best a way to add basic anti-cheat to a game. That is one actually valid case but it doesn't mean cheating isn't possible, just that it would require custom hardware or a bypass for hardware attestation via a leaked key or TEE / secure element exploit.

    💬 0🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 10:28 AM

    @Kurt @PatrykMis @normplum @gloopsies Multiple countries have already found Google's device certification rules and system to be illegal anti-competitive behavior and this is directly based on it. How can it be legal?

    It is clearly breaking competition laws for Google to mark GrapheneOS as not being secure when they're completely capable of verifying it via hardware attestation. It provides far better security than the stock OS. They're allowing operating systems with no patches for years.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • GrapheneOSGrapheneOS@grapheneos.social
    Oct 9, 2024, 5:13 AM

    @gloopsies This article is highly inaccurate and is essentially building narratives out of guesses and assumptions based around real connections. They get many things completely wrong. Network-based location is optional in the initial setup wizard and is a feature used across Android and iOS. Is network location privacy friendly? No, but but it has nothing to do with Pixels or even Android with Google Play specifically. Exists on iOS and elsewhere. It's also a clear choice in the initial setup.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0