Push/VPN in BFU mode

anyname99

Hi. Have some questions if someone have an expirience

Does push service work in BFU mode ? Telegram / Signal / Whatsapp and etc
Does VPN work in BFU mode ?

Carlos-Anso

anyname99
Apps can elect to be enabled for direct boot, which means they can run before first unlock.

Not many apps do this. I am only aware of a few keyboard apps.

Apps can also elect to have some, or all, data 'device encrypted'. That is available without unlocking the device.

I tried to persuade a Unified Push developer of the merits of them supporting push in BFU state. They did not appear very interested.

user539

All apps are at rest in bfu if i recall correctly

anyname99

user539 for example if we talking about iOS, the push will work in BFU mode
Thats why I'm asking about this
I'm considering switching from iOS to GrapheneOS

DeletedUser69

For simplicity, the way I understand it all system apps and apps with direct boot (can) work in BFU. Your data is at rest since the storage is encrypted if that is what you mean. Sorry for the edits.

user539

That's why in grapheneos bfu with a good password is unhackable.
Depending on your threat level set auto reboot time, so if your device falls in the wrong hands it reboots in bfu.

anyname99

user539 yes, but my questions not about it :))

user539

anyname99

no notifications as apps are at rest. And it can't connect to WiFi without unlocking it.

DeletedUser69

Not many system apps elect to use direct boot, so I retract my previous statement, it is not accurate. Thank you @Carlos-Anso, I shouldn't do guess work.

anyname99

ghm, so VPN not work in BFU mode ?

DeletedUser69

anyname99 likely no, but then again most of the other apps also. That doesn't necessarily include zero-day exploits.

Probably9857

anyname99

A VPN app probably could work in BFU state, it's just that the app developers have not chosen to support that. It has nothing to do with GrapheneOS. Same for any other app, and some will have good reasons not to support it.

Note also:

As long as your VPN is set to block connections without VPN, you will not be leaking anything (at least nothing that wouldn't leak anyway).
I suspect the built-in VPN implementation would work in BFU state, but that is just a guess.

anyname99

DeletedUser69 and modern new protocols VPN also dont work in this OS as I understand. Like VLESS and etc

DeletedUser69

anyname99 with any question there is a motivation behind it and knowing it may help answer it better. I come to an age where I would like to educate people without them having to go through the pain of personal experience. Also know, I am not perfect, far from it. Just finished 5th in BR CODM which btw won't work withoit exploit compatibility mode applied.

anyname99

I think we should /summon someone from dev team :))

anyname99

Probably9857

Yes, I understand this. Thats why I'm asking about VPN in BFU
As I see at official site the built-in VPN is weak for new protocols, like VLESS

DeletedUser69

anyname99 introduce us into your line of thinking. What is your main purpose for using VPN?

Probably9857

anyname99 Yes, I understand this. Thats why I'm asking about VPN in BFU

In case I wasn't clear, what I meant is: in BFU state, when the VPN is not running, any attempted connections will be blocked. So nothing will be leaked. If that is your concern.

anyname99

DeletedUser69 In my understanding, VPN should always be on, of course it should work without leaks. It should work in BFU mode

I am in a country where all types of VPN are blocked except for new protocols, such as VLESS

anyname99

Probably9857 nope, I need that in BFU state the apps should send push as minimal. with VPN connected

Probably9857

anyname99

I can understand that would be nice, but unfortunately it doesn't work that way, and I don't expect that to change.

The apps would have to change. This isn't a GrapheneOS thing. It's AOSP, and it is supported, but the app developers (VPN, and any apps that you care about) would have to implement it.