Thoughts on potential of increased attack surface by replacing system apps?

DeletedUser88

Do you think the potential increase of attack surface by installing apps to replace system apps (eg. Gallery and keyboard) is enough to avoid installing replacement apps?

I know the GrapheneOS account has previously stated that the default AOSP keyboard has been experiencing bitrot for a while and has increased attack surface due to large portion of code being unnecessarily written in C++.

So would it be worth it to replace these apps with trusted and memory safe apps?

Also, would it be possible for the GrapheneOS team to offer any official recommendations for important system apps lile the keyboard? (I know there are many threads offering recommendations but I would like an official recommendation)

de0u

DeletedUser88 Do you think the potential increase of attack surface by installing apps to replace system apps (eg. Gallery and keyboard) is enough to avoid installing replacement apps?

At present some of the stock apps cannot be removed or disabled because parts of the system depend on their presence.

DeletedUser88 So would it be worth it to replace these apps with trusted and memory safe apps?

Maybe? For example, if there were a keyboard app or a gallery app written in Kotlin with a regular security audit program, that could be stellar, assuming it also supported Direct Boot and a reasonable set of autocorrect dictionaries. Are there any?

DeletedUser88 Would it be possible for the GrapheneOS team to offer any official recommendations for important system apps lile the keyboard? (I know there are many threads offering recommendations but I would like an official recommendation)

At some point they might ship a different keyboard (for example), which would constitute a strong recommendation. But so far the GrapheneOS team, as evidenced by the web site, has steered clear of recommending apps. This is not like other AOSP variants, many of which replace the stock AOSP apps, but GrapheneOS is in many ways not like other AOSP variants.

collector

It all depends on your security needs but in my opinion, it is worth replacing the AOSP apps with trusted open source ones not only because of memory safety but the new apps are ideally more up to date (as in replacing some deprecated API calls with more recent ones)
Also this next part is not security advice, but the new ones are prettier and fit in more with the "new" Android design language which may be worth it for certain people.

DeletedUser88

de0u

de0u At present some of the stock apps cannot be removed or disabled because parts of the system depend on their presence.

Yes, I was not planning on removing or disabling them.

de0u Are there any?

I believe Florisboard will meet all the criteria you listed in the future, according to their roadmap. They do not have regular security audits though. Not sure about a security-focused gallery app. I don't think most developers of these apps have security in mind and prioritize UI and UX instead.

de0u At some point they might ship a different keyboard (for example), which would constitute a strong recommendation.

I believe they are no longer considering shipping third party apps due to various reasons like license incompatibility and that they cannot guarantee the apps will be reasonably secure now or in the future as they do not control the development. I believe the GrapheneOS team will build their own apps in-house as that is the option that makes the most sense but also the one that requires the most resources.

de0u has steered clear of recommending apps

I don't think this will be the case in the future. I read a post by one of the moderators of the forum of potential future plans regarding the device setup screen that do not align with the idea of not recommending apps. From my understanding, there will be an option on the device setup screen that will allow you to choose suggested apps to install on GrapheneOS before the setup is complete.

Accrescent will be the source of these apps and Accrescent will be automatically installed on your device from the Apps repo (Accrescent is supposedly being added to the apps repo) once you select the suggested apps. Of course, the suggested apps need to be available on Accrescent first. However, I believe this was not a firm confirmation of what GrapheneOS plans on doing but more of a discussion that shows GrapheneOS is open to suggesting third party apps.

Of course any moderators can correct me if any information I stated is incorrect or not planned and does not reflect the project's current or future views.