USB options

xmachina

I love the feature to disable the USB, but I want the option to be able to use a USB for recovery in case it's necessary, and I still want AFU completely locked down. Is there a possibility to add an option to enable it only in BFU state?

Dan-cer

Don't know. Just want to add, that I sometimes use an USB adapter to connect via ethernet kabel to a router to avoid WiFi.

xmachina

@GrapheneOS What do you think? I would imagine something like this would benefit many, but I'm also not as familiar with this project and its goals yet.

intron

There is possibly a potential draw back here, which is rather crucial...

Forensic companies would already be aware of USB lockdown, because they are here - of course they are..

When you start getting into the area of 'allowing' a specific device - you are creating an attack surface that large, it basically renders the whole thing as pointless..

There's only very limited ways for a system to identify the connected devices, and also easily tricked, ie 'spoofed'
If anyone performing forensics connects and it wont establish, the default mentality will be that usb is blocked, and to then do step X in that case, which the system could just keep spoofing as an array of devices until a successful hit (it'll be in the manual)
This can be refined even further based on what forensics have seen, eg brand of usb storage you may have in your bag or at your house..

I can't speak for the devs, or anyone except myself, this is just the explanation that comes to my mind :)

xmachina

I have come to realize my original post is ambiguous. My apologies. What I am referring to is on option that would read, in line with the existing options, "Charging-only except before first unlock".

What I want is to be able to use the USB only in such cases as, for instance, there is a screen breakage and I need to unlock my phone. What I don't want is to also have to allow USB when my phone is unlocked as well as in "Charging-only when locked, except before first unlock". I want an option that only allows USB when the phone has just been booted and to prevent USB connections when the phone is AFU such that there is no risk of interacting with untrusted USB when the phone is in an unencrypted state. (I.e.: unlock phone for <reason>, and unknowingly plug in to malicious charger at airport.)

intron

xmachina

This isn't quite what you are looking for..

You can buy relatively cheap <$10 USB 'dongles' or even a basic kit for not much cheaper and solder / assemble your own, that do this very task (block data via not connecting the pins physically), with an added benefit of 'voltage regulation', or at least a 'cap' (stop hardware been 'fried' from an (un)intentional surge)..
I always just thought people kept them plugged into the end of their cable for their 'out-and-about' charger cable, or just use a power bank between (I kind of do both lol)

I can see your point for BFU, though you have to keep in mind, it's only to make it more difficult, not impossible..
Device disassembly is what would be the next step..

I guess perhaps there's a common thought about, when device is unlocked and plugged in - it's to a trusted/safe source or at least mitigations already in place maybe?
Not sure

xmachina

@intron, I have serious responsibilities other than just security. I have things to do and manage, and while we all love to pretend that users are responsible for every security risk they take, the reality is that users, even advanced ones, are idiots that need to be protected from themselves when possible. This is not to discount proper training and awareness, just to say that humans will make mistakes, even those who should know better. (Ex.: How many times have you mistyped a sudo command? Do you know every cable you plug in doesn't have a chip like O.MG cables?)

intron You can buy relatively cheap <$10 USB 'dongles'

I did use Portapow (pure, USB-A to USB-A) data blockers, but I'm phasing those out. The simple reality of it is with things like O.MG cables. there's not a whole bunch these can do, and I don't want to have to inspect everything I plug into my device. Being cognizant of everything I plug into my devices is a cognitive overhead that I don't need and will inevitably be forgotten the one time it's relevant. (Users are idiots; see above.) I currently have my USB set as "Charging-only" in settings, and I'd just like to add an exception for after reboot that would allow me to recover if anything breaks. That is a significantly smaller cognitive overhead and room for error.

intron it's only to make it more difficult, not impossible..
Device disassembly is what would be the next step..

I understand this fully. My main concern is limiting device access when it is unencrypted. The option I am asking for accomplishes exactly this. If an attacker is going to disassemble the device while it is powered on (AFU) and exploit something, good on them, but there's not much I can do at that point.

intron I guess perhaps there's a common thought about, when device is unlocked and plugged in - it's to a trusted/safe source or at least mitigations already in place maybe?

This is exactly the type of assumption that I'm looking to avoid if possible. (Users are idiots; see above.) Unless there's a data blocker that has the data lines cut on the piece going directly into the device's USB port and is at least semi-permanent (there on every connection unless explicitly removed) then user error is a distinct possibility. (Users are idiots; see the pattern?)

*When I say "Users are idiots," I'm not looking to insult anyone. It's just to relay the fact that people aren't experts on security, and they (we) make dumb mistakes. Even the experts on security.

intron

xmachina

I do understand what you mean, along with your points :)

The line (unfortunately, also not specific - in general here) -
Has to be drawn somewhere when it comes to the end user..
The fact is, the very nature of using something like Graphene (which is also my physical preference for heat dissipation) - does fall onto the user..

The dev's are providing a tool, along with some of the most direct and clear documentation I personally have ever seen (I think that alone deserves a lot of credit)..

The more users, the more 'use cases', the more 'situations', 'scenarios' are there, be they currently existing, plausible, potentially plausible, or simply 'unrealistic' (not to be confused with 'under estimated')..

There is a general (possibly unspoken), though very real concept (possibly falls under 'goes without saying' )..
(It's also not limited to GOS or any 'tool' specifically)

Essentially, the realistic, real life implications/threat model an individual (user) potentially faces - the level, along with type of adversary they potentially have - is only known by that individual..
It also can vary in a huge degree not just in severity, but also the legal implications per country, and even down to the activities those individuals are engaged in. eg; legal, grey, illegal - along with ethical, grey, unethical as another factor.

No one else can know, predict, or even accurately 'prepare' for the vast differences potentially possible - that would be 'unrealistic'...

I understand your usage of 'users are idiots' - i get what you mean, although it's not the way i personally think or view it..
It's more about 'adapting' to the situations a user potentially faces..
This also inherently would of existed before they even heard of GOS (i'm referring to the 'intermediate' and above threat models')..
In those scenario's, GOS is merely just one tool, among many used by that individual specific to their needs.

There is a direct correlation as well between trust, paranoia, and real implications faced - the higher the threat model, the more that paranoia would increase and trust decrease.. (rational paranoia - any other form falls out of 'realistic' scope for, obvious reasons heh)

Part of all this is - if facing advanced threats in real life, then the only way of survival in any form is the ability to adapt - it all becomes second nature, it's not inherently conscious, meaning little toll is taken there..

It also would make one rather cautious about every 'tool' they utilise, along with generating plausible scenario's based off their situation and every detail including their implementation of 'tool' ..

This may seem like a 'stretch' to some reading it - it's sort of not though, not at all.

If someone faces intermediate threats and above, or none at all, in the end it all comes down to that person and the amount of focus they give to learning and understanding, along with their level of awareness - their ability to adapt - can and is only dictated by them, them self (to put it bluntly)

(The term 'RTFM' - is a very old one and for good reason :)

xmachina

I think I understand what you're saying, but I don't understand why. I love GrapheneOS and appreciate and respect the devs for their work. It wasn't my intention to say anything but to ask about adding an option under the USB disabling setting in Security and explain why the points in your first response didn't quite fit the solution I was hoping for.

In hindsight I think I over-/poorly explained my reasoning to it's detriment. I should have been simpler and more straightforward. My sincere apologies.