GrapheneOS version 2024022800 released

Dumdum

[deleted]
There already is... its the 2nd point in the comment you're replying to.

[deleted]

Dumdum Read it again. It also allows other stuff than charging when unlocked. ;)

Grkrz

matchboxbananasynergy so if I do not use any keyboard or do not connect any devices to the USB and I only charge the phone.
The charging only option would be be ideal?

[deleted]

Grkrz yes

Blastoidea

Just got it.

dc32f0cfe84def651e0e

matchboxbananasynergy It's important to keep in mind here that if someone gets access to the device while it's unlocked, they can simply change the option in security settings to "on" etc.

Unless the tidy owner approach is used and the main profile is a secondary user.

qroduco

This may sound like a stupid question but please can someone explain to me why the charging-only except for BFU option in relation to the usb-c port is more secure. Is it because the data is at rest BFU and so any attempted exploit via the usb-c port is more difficult then than AFU?

matchboxbananasynergy

[deleted] sideloading shouldn't be affected in the first place. You're not booted up in the OS when in recovery.

[deleted]

matchboxbananasynergy I see. THX. But since there is a "execpt BFU" mode there should be a "only except bfu"

Croak3114

[deleted] Why? Just set it to charge only in that case.

[deleted]

Croak3114 Well it won't work in BFU then? Or will it?

[deleted]

matchboxbananasynergy .
Probably best for the deafult option to be "Charging-only when locked" because the vast majority of users wont connect anything in BFU. This would reduce attack surface further. And the option would be there for those who need it.

Carlos-Anso

[deleted]

Ability to be able to use USB BFU can allow you to plug in keyboard and mouse. Can be very helpful as it enables you to unlock device if it stops registering touches or somehow no keyboard app will work.

Hat

For those charging their non Tensor Pixel anywhere or for other devices you can use a USB data blocker.
Even computers use USB type C ports to charge the battery (a Power line can be a network).

[deleted]

Carlos-Anso Yes. I made the suggestion with this in mind. As i said, probably less than 2% of users would need this to be enabled. They could do that manually.

de0u

Carlos-Anso Ability to be able to use USB BFU can allow you to plug in keyboard and mouse. Can be very helpful as it enables you to unlock device if it stops registering touches or somehow no keyboard app will work.

[deleted] As i said, probably less than 2% of users would need this to be enabled. They could do that manually.

But if the touch part of the screen breaks, it is then not possible to enable USB BFU manually if it hasn't previously been enabled while the screen is working.

[deleted]

de0u This is a flawed way of thinking. You wouldn't disable encryption for everyone either just so you have a chance to recover your data if you break your screen. This is an obviously exagarated example but you get my point. If you're concerned about breaking your screen, then enable it manually. Fot the other users, give better defaults.

other8026

[deleted] I don't see why allowing devices to connect in BFU is a problem. User data is encrypted, so there's not much the device can do. I agree that it's a good default for the majority of GrapheneOS users. Keep in mind that there are a lot of people with varying degrees of expertise who use GrapheneOS. If changing the default changes how the phone behaves it may result in confusion and possibly complaints. Anyone who doesn't like the default can change it, just like a lot of other GrapheneOS features. I personally have.

[deleted]

other8026 I just don't think its a good default. However, i value the team's and other users' opinions even though we disagree.

[deleted]

As this is a mobile device not a desktop, i dont see why this niche usecase would be considered as default. The arguably small extra attack surface will be there even for users who will never use this.

user

[deleted]

I would say that is more a niche case to have that option enabled than the possibility to damage your device and need a to connect a keyboard to recover your data. The default should not be for extreme niche use case imo but easy enough to change for the higher threat models.

[deleted]

user I respectfully disagree that my proposed alternative would be more niche than the default one. I think the benefits outweigh the cons.

« Previous Page Next Page »