New GOS-user questions

Eagle_Owl

Clap2Grom673
You wrote:
“Thanks, that makes sense. I have an additional question about that: Normally you verify the hash, right? When you look at the hash of the downloaded apk you also see who signed it - is that also enough verification?”
That is (my understanding of the) verification.

I download apps directly from GitHub, if their developer is well-known and I get his/her apps and updates faster and the developer also provides the hash value for the file.

To check the hash value (file fingerprint) I use always the app Hash Droid from Hobby One, you find it on F-Droid.
Unfortunately his last version 4.3 is from June 2020, but only 155 kB file size and it works well, like the newer ones from other devs.
The newer ones I found have much bigger file size and are not better – and also not very recent.
So I stick with this little tool and check the hash value of the file after every download and let this app compare it with the download.
Occasionally I look to see if there is a better/newer app for it.

If you trust a software developer, see if they offer their files on GitHub or in their own repository on F-Droid. Use the hash check function anyway.
Install as few apps as possible, this also reduces vulnerability.

User2288

Clap2Grom673 What are these blobs? I was guessing that they are in very simple words parts of the code or something like that. Is this assumption kinda right?

Again in case you missed it this was also talked about somewhat in this thread that you may have already read:
https://discuss.grapheneos.org/d/2299-install-apps-from-gplay-rep-fdoid-rep-or-githubwebsite
@unwat discusses this.

Blobs or "binary blobs" are premade packages of codes that big companies write. These packages allow a lot of functionality which the developer doesn't have to personally write again. So developers include these premade packs of code in their software for their own ease. Some of these blobs are proprietary and could include invasive code. And since we cant see inside them, we can't verify them, so we call them "blobs". These blobs get integrated into the app's source code and get compiled together.

For example the official telegram app provided on playstore and their website includes google "blobs" that allow it to integrate location sharing and rendering the image in the chat using google maps. The "Telegram-FOSS" app available on fdroid has these blobs removed. So its a more foss version of the same telegram app.

Another example is that i think pretty much all apps that use google notification service (fcm?) use google blobs for the notification system. If a person is concerned about this then they should look for a version that doesn't have these.

Clap2Grom673 Normally you verify the hash, right? When you look at the hash of the downloaded apk you also see who signed it - is that also enough verification?

I've never done this so I am not sure. But i believe the program you use for verifying signatures produces a "hash" for any apk you give it, and the app publisher also discloses their app's hash on their website. You compare the two visually and if they are the same then you are good to go.

Clap2Grom673 what's your opinion on invidious and the grayjay app?

Not familiar with grayjay, can't comment.

Invidious is the best thing since sliced bread. Its wonderful. Its a frontend for yt. Basically you can watch youtube with no tracking at all and without the need of vpn or newpipe. Its a great option for browser use for yt. Although yt is starting to crackdown on it. Its speed also lacks some times.

There are also other frontends for other things. Checkout libredirect, and this:
https://github.com/mendel5/alternative-front-ends

User2288

Clap2Grom673 Because I have to tell you this:

You are a deeply sympathetic person! I just want to appreciate that you take your time to answer questions so detailed and easy!

You know how to understand/feel (into) other people's needs and situations - not only mine, also in other threats and this is awesome!

You really helped me a lot already and I'm very thankful for that!

A just wanted to thank you from the bottom of my heart - hope this wasn't too weird or a anything. :)

No its not weird 😊.

Taking the time to leave someone else feeling appreciated for their efforts is the fruit of maturity and wisdom. Thank you for your kind words. I will savour them 😊. Your observation is a sign of your own insightful-ness and your words a testament to your own kindness.

I try my best to help people in the privacy endeavour as my personal commitment to carrying my part of the weight of the social responsibly to this social challenge.

Pass it on someday.

User2288

Clap2Grom673 Basically it's that my sim card provider only can see "this persons connections to cell towers appear only form this three places" or anything like that so I cannot be followed ALL around.

Just FYI, being tracked by cellular towers happens when your radio is on, regardless of whether you have a sim or not. Once you insert a sim with an "identity" then that phone gets permanently connected to that "identity" even if you take the sim out later. So if someone wants to avoid a phone being connected to them then they should never insert a sim that is in their name or paid for under their name "somehow".

So to clarify, being cell tracked is about the radio, not the sim.

Trena

User2288 regarding this, if I were to operate using only personal hotspot over WiFi, with aeroplane mode switched on, and the personal hotspot was from an iPhone with a SIM card registered in my name, would that matter? Would the pixel essentially remain anonymous (other things being equal)? It’s impossible to buy a SIM card without verification in my country.

Clap2Grom673

User2288

Yes, i know. I always have airplane mode on - except for when I have to use the cellular network at these few places :)

User2288

Trena
Yes the pixel would remain anonymous. But this is the same as connecting to any other wifi. Pixel is able to stay anonymous when connecting to a wifi. As long as you are ok with the apps on your pixel seeing that particular IP.

Your iphone would be tracked with your sim as normal. You iphone will see a device connected to it but can only see the random MAC. What part of your traffic it can see i can't speak to.

One caveat however here. I've heard about some wonkyness in regards to hotspots and pixel with graphene. I can't recall what the problem was. vpn getting bypassed maybe?

do look into that.

Trena

User2288 thanks. I’ll take a look. Regarding vpn, I assume if I wanted to use a vpn I’ll need to use it on both devices? Again, all other things being equal and ignoring the potential pitfall you mentioned I should look into.

Clap2Grom673

Trena
User2288

As far as I know, a problem only appears when the pixel (or any other android phone - it's a by design android thing) PROVIDES the hotspot. Then the VPN gets bypassed.

That may not appear if the pixel uses the hotspot but to be totally secure @Trena you would have to research a bit or use - as you said - VPN on both devices.

User2288

Trena
Again, this is an iffy subject and I have no experience with it. I can't comment. Perhaps someone else can help

Carlos-Anso

Trena
As is standard in Android if a GrapheneOS device has an active VPN and is acting as a hotspot then any device connecting to it will not be routed via the VPN. They will need their own VPN setup.

Trena

User2288 ok thanks!

Trena

Clap2Grom673 thanks for the info!

Trena

Carlos-Anso thanks for the valuable info! My use case was the other way round, iPhone hotspot to GOS. Do you know anything about that set up? I would assume to just put a vpn on both, the same as you suggested if gos was the hotspot.

Carlos-Anso

Clap2Grom673 Is it okay to download and install apps without verifying them?

The new AppVerifier app made by a GrapheneOS community member provides a secure way to verify apps using the apk signing certificate hash. The apk signing certs are used within android to provide secure verification that an app update is from the same source as the installed app.

This is different to checking the file hash mentioned in other posts above.

App verifier includes a growing database of cert hashes for common apps. It checks apps that are already installed against that database. It can also be used to verify apk files before installation.

It is available from github or Accrescent. To ensure good security it is best to verify the fingerprint of either Accrescent or AppVerifier using the methods described in their documentation.

github.com/soupslurpr/AppVerifier

missing-root

Clap2Grom673

I recommend to use F-Droid Basic. Its an F-Droid client that uses modern dependencies.

Accrescent has nearly no apps. There are many developers that dont supply precombiled APKs, sobF-Droid is needed. This is true for a lot of my favourite ones.

With GrapheneOS you are never "security second". Even using the oh so insecure Firefox based Browsers like Torbrowser or Mull, with the Addons

Ublock Origin
noscript (with hardened settings)
"* fingerprint defender" addons for scrambling unique IDs (only on Mull I guess)

So this may be "security second" but Firefox Devs also rewrote big parts into Rust, which was causing many vulnerabilities. So it may be more secure than Chromium, and "Sandbox" may be a Buzzword.

I do not recommend hunting down APKs from the web as its a total mess. But if you verify the first download, the following updates are safe. Its simply horrible for UX, and F-Droid really modernized things.

Carlos-Anso

missing-root
Chromium on android is more secure than firefox, Vanadium even more as it has extra significant security features (type based control flow integrity, full strict site isolation sandboxing) on Pixel 8 and Pixel 8 Pro it also has a big step up by using the memory tagging available in these arm cpus. Currently the only web browser to adopt this major security feature. The limited use of rust in Firefox as a way to address memory safety issues is not at all comparable.

missing-root

Trena you only need a VPN on your trusted phone.

The iphone would otherwise either split tunnel the hotspot traffic anyways, or tunnel it twice somehow, makes no sense.

« Previous Page