New GOS-user questions

Trena

User2288 regarding this, if I were to operate using only personal hotspot over WiFi, with aeroplane mode switched on, and the personal hotspot was from an iPhone with a SIM card registered in my name, would that matter? Would the pixel essentially remain anonymous (other things being equal)? It’s impossible to buy a SIM card without verification in my country.

User2288

Trena
Yes the pixel would remain anonymous. But this is the same as connecting to any other wifi. Pixel is able to stay anonymous when connecting to a wifi. As long as you are ok with the apps on your pixel seeing that particular IP.

Your iphone would be tracked with your sim as normal. You iphone will see a device connected to it but can only see the random MAC. What part of your traffic it can see i can't speak to.

One caveat however here. I've heard about some wonkyness in regards to hotspots and pixel with graphene. I can't recall what the problem was. vpn getting bypassed maybe?

do look into that.

Trena

User2288 thanks. I’ll take a look. Regarding vpn, I assume if I wanted to use a vpn I’ll need to use it on both devices? Again, all other things being equal and ignoring the potential pitfall you mentioned I should look into.

Clap2Grom673

Trena
User2288

As far as I know, a problem only appears when the pixel (or any other android phone - it's a by design android thing) PROVIDES the hotspot. Then the VPN gets bypassed.

That may not appear if the pixel uses the hotspot but to be totally secure @Trena you would have to research a bit or use - as you said - VPN on both devices.

User2288

Trena
Again, this is an iffy subject and I have no experience with it. I can't comment. Perhaps someone else can help

Carlos-Anso

Trena
As is standard in Android if a GrapheneOS device has an active VPN and is acting as a hotspot then any device connecting to it will not be routed via the VPN. They will need their own VPN setup.

Trena

User2288 ok thanks!

Clap2Grom673

User2288

Yes, i know. I always have airplane mode on - except for when I have to use the cellular network at these few places :)

Trena

Clap2Grom673 thanks for the info!

Trena

Carlos-Anso thanks for the valuable info! My use case was the other way round, iPhone hotspot to GOS. Do you know anything about that set up? I would assume to just put a vpn on both, the same as you suggested if gos was the hotspot.

Carlos-Anso

Clap2Grom673 Is it okay to download and install apps without verifying them?

The new AppVerifier app made by a GrapheneOS community member provides a secure way to verify apps using the apk signing certificate hash. The apk signing certs are used within android to provide secure verification that an app update is from the same source as the installed app.

This is different to checking the file hash mentioned in other posts above.

App verifier includes a growing database of cert hashes for common apps. It checks apps that are already installed against that database. It can also be used to verify apk files before installation.

It is available from github or Accrescent. To ensure good security it is best to verify the fingerprint of either Accrescent or AppVerifier using the methods described in their documentation.

github.com/soupslurpr/AppVerifier

missing-root

Clap2Grom673

I recommend to use F-Droid Basic. Its an F-Droid client that uses modern dependencies.

Accrescent has nearly no apps. There are many developers that dont supply precombiled APKs, sobF-Droid is needed. This is true for a lot of my favourite ones.

With GrapheneOS you are never "security second". Even using the oh so insecure Firefox based Browsers like Torbrowser or Mull, with the Addons

Ublock Origin
noscript (with hardened settings)
"* fingerprint defender" addons for scrambling unique IDs (only on Mull I guess)

So this may be "security second" but Firefox Devs also rewrote big parts into Rust, which was causing many vulnerabilities. So it may be more secure than Chromium, and "Sandbox" may be a Buzzword.

I do not recommend hunting down APKs from the web as its a total mess. But if you verify the first download, the following updates are safe. Its simply horrible for UX, and F-Droid really modernized things.

Carlos-Anso

missing-root
Chromium on android is more secure than firefox, Vanadium even more as it has extra significant security features (type based control flow integrity, full strict site isolation sandboxing) on Pixel 8 and Pixel 8 Pro it also has a big step up by using the memory tagging available in these arm cpus. Currently the only web browser to adopt this major security feature. The limited use of rust in Firefox as a way to address memory safety issues is not at all comparable.

missing-root

Trena you only need a VPN on your trusted phone.

The iphone would otherwise either split tunnel the hotspot traffic anyways, or tunnel it twice somehow, makes no sense.

« Previous Page