How effective is GrapheneOS is against domestic and foreign surveillance?

KodachromeNomad

Hey everyone!
Wanted to ask this question since I was curious on the effectiveness of GrapheneOS in terms of security (I understand it's a very security driven operating system).

I know that GrapheneOS is good for reducing Google's efforts on surveillance and spying but how effective is it on surveillance from domestic and foreign governments (e.g. NSA's PRISM program or whatever the Ministry of State Security or FSB uses in Russia or China)?

It may sound like a dumb question but I'm just fascinated with the program itself and have it installed on my Google Pixel 4a. Thanks in advance!

Drbeast

KodachromeNomad

I love GOS, but let's not delude ourselves.
If you're connected to a cellular network with a bad actor and cracked certs, they are already spying on you. This applies to both America, China, Russia, etc.

The best option you have is obfuscation. Use Pay-as-you go and buy the sims way away from the airport and keep changing them periodically.

Nothing on the internet is secure or truly anonymous for a state actor with unlimited funds.

ketchup991

Your threat model is such that I'd recommend using it as a dumb phone. No cellular network or wifi.

You're also making the assumption that a country like Russia would treat you humanely if you refused to provide the password to your cellphone if you were under investigation.

Just my two cents.

Kamaehuakanaloa

ketchup991 If either the Russian FSB and Chinese MSS wanted your the data on your phone, they would start hacking body parts off of you until you coughed up your password. GrapheneOS will not protect your against torture. Sorry for the gruesome assessment, but GrapheneOS and other hardened ROMs only work against surreptitious intel gathering efforts, not in person interrogations. That's not a knock against GrapheneOS, it is reality.

abcZ

Kamaehuakanaloa not in person interrogations.

Would be nice to have a few enhancements for this type of application. Special fingerprint or pin that deploys a decoy user and wipes the primary?

MetropleX

Kamaehuakanaloa GrapheneOS and other hardened ROMs

GrapheneOS is not a ROM it is a fully production ready, production grade OS. ROM is a misnomer even when used to describe hobbyist level cherry picking versions of Android but if it is a term that is to be used (ROM/Custom ROM) then it is those that it should be attached to not GrapheneOS.

I know this might sound nitpicky but just want to ensure the OS is represented appropriately and accurately.

dlb

abcZ That is indeed an excellent idea. I hope the Devs will take it in consideration

L8437

abcZ I heard an interview with a graphene developer saying they are working on a duress mode, so if you are forced to type in your password. You can have one that will be set to erase the phone completely

abcZ

Drbeast Who has "cracked certs"?