Are the Pixel phones sold from China as good as the used ones sold from the USA?

strcat

Hansel Look at their comment history and you can see they're posting about social media about these topics full time rather than simply something in their free time. You can see from viewing posts rather than comments that they regular post diatribes about GrapheneOS and other privacy projects with fabricated stories and extremely inaccurate claims. They've been going around telling people that GrapheneOS only has 3 minor features along with lying about how our optional sandboxed Google Play feature works, lying about how Google Play services works on the stock OS where it's a highly privileged app deeply integrated into the OS and providing OS components that would otherwise be provided by AOSP among other misinformation they spread. Google Play cannot be fully disabled or you wouldn't have a working OS anymore. They make very clear cut inaccurate claims in their guide and elsewhere. They mislead people and try to promote themselves as an expert but they only have surface level knowledge of a few OS components and aren't a developer with any real knowledge of how the OS works. They do surface level research and then fabricate claims on topics based on their assumptions. You're getting information from someone who really knows less than you (since they believe a lot of their own fabrications and don't realize you can't just jump to conclusions without real research getting facts/evidence) but misleads people into thinking they're an expert.

Hansel

strcat Well Reddit has had bad reputation with subs aimed at subversion and FUD for a long time now (it's far worse than Wikipedia), so I'm not surprised, but this is going to derail the thread so enough said (it's only a matter of time before Reddit will remove your sub for directing here...). So without having tech background, I already give Graphene a lot of credit for the simple fact it hosts its own forum!

I can't research this since I'm very busy, so let me ask it this way: will upgrading from Xiaomi with Android 11 to Pixel 4a with Graphene be a major improvement when using only a handful of closed source apps? I'm using the f-droid apps whenever possible, and otherwise only spotify and a bank app. For comm I use Signal and Telegram mostly. I read there is a lot of malware attacks now which require a user clicking a link, but that practically every Android is backdoored so there's no point trying to protect it from an uninvited big brother snooping other than use desktops.

TommyTran732

Hansel
That guide is actively malicious and is not to be followed at any cost. It spreads a substantial amount of misinformation.

Most of that guide is complete privacy and security theatre. You are not even "degoogling" anything with it.

For starters, do ps -AZ and see the active processes. You will notice that Google Play Services is still actively running in the highly privileged gmscore_app SELinux domain (https://android.googlesource.com/platform/system/sepolicy/+/master/private/gmscore_app.te). Various other apps, including OEM, Google and third party apps, will remain running under the priv_app and system_app SELinux domain. You can see some of the bundled system apps and privileged apps in /system/app and /system/priv-app. You can see their hardcoded permissions in /etc/permissions/whatever-app-here.xml. You cannot revoke privileges like location access from GMSCore or storage access from the Play Store, etc.

Netguard is bypassable via intents and just general local sockets. To see for yourself, get:

Netguard
Orbot
Telegram

Set Netguard to block Telegram and allow Orbot to access the internet. Start up Orbot. Then, set Telegram to use 127.0.0.1:9050 (or whatever port Orbot is running on). Observe that Telegram will be able to access the internet by proxying through Orbot. Malicious apps by competent adversaries can easily find bypasses like these and there is nothing you could do to stop it.

You are about as private with that "guide" as you are if you didn't follow it at all.

F-Droid has various problems on its own that you should be aware of: https://wonderfall.dev/fdroid-issues/

Just by switching to a Pixel, you have a device with longer guaranteed security updates (5 years with the Pixel 6 series and above), a Secure Element (Titan M chip), proper support for verified boot with third party operating systems, and so on.

The goal of GrapheneOS is to increase privacy and security over the stock operating system by both doing low level hardening (hardened_malloc, secure exec spawn, hardened libc, hardened kernel, etc) and putting more control in the user's hand (per-app sensor permission, an actually functioning network permission toggle, Sandboxed Play Services, optional remote attestation, etc). The full list of features can be found here: https://grapheneos.org/features

Note that the goal of the project has never been and will never be to "degoogle". That being said, you have to option to use the operating system without any proprietary Google apps and services if you choose to (this is the default configuration), unlike the guide that you referenced.

Hansel

TommyTran732 Thanks for your reply but I have no time to learn the technical side. I made a foolish mistake when following his guide, wasting many hors and money on new hardware on the way, instead of using a ready made solution. I know there are all sorts of phones aimed at privacy, but they cost twice for the same level of hardware, so you only pay extra for the "flavor".

flawedworld

Hansel GrapheneOS will be an improvement over that device no matter what apps you run on it.

TommyTran732

Hansel
You cannot just make a blanket claim that all Android phones are backdoored without substantiating proofs.

Hansel

TommyTran732 OK, let's settle on hackable. If you follow the news you know there are confirmed cases for malware which can get root privileges on a completely new Android with no user action whatsoever. It's even hard to discover the phone was hacked at all, either because the malware deletes itself after it uploads the phone's contents or because it's hard to detect.
Even if it's not a backdoor, there's effectively no difference. E.g. the government may know about ti and doesn't report to Google on the vulnerability.

matchboxbananasynergy

Hansel That is not something that's unique to Android or phones in general, though.

It's something that applies to all systems. That said, Android comes with great security, so it makes vulnerabilities like that harder. GrapheneOS substantially improves that pre-existing security. Add to that the fact that phones receive actual firmware updates unlike most desktop devices that stop after about a year (even if they even provide them at all in the first place), and it quickly starts to look like a Google Pixel device with GrapheneOS is pretty darn secure.

flawedworld

Hansel Everything can be hacked, GrapheneOS simply significantly raises the bar for adversaries meaning they need to spend more time, money, and resources in order to pull it off.

Hansel

matchboxbananasynergy I'm not sure firmware updates are as important for desktops.
I'm leaning towards remaining with my Android 11 and minimizing my usage of apps, with disabled data when not in use. This seems like a sure way for false sense of security...

flawedworld

Hansel All updates are important on all devices.

Hansel

flawedworld Is there any evidence the cutting edge offensive tools such as Pegasus doesn't penetrate Graphene?

flawedworld

Hansel We aren't aware of any commercial spyware vendors exploiting GrapheneOS. A commercial spyware vendor would likely need to invest substantial time, money and resources into adapting existing exploit chains to work on GrapheneOS. It's not something 99% of people need to care about since unless you are a political figure or investigative journalist etc, it's unlikely someone will waste a multi million dollar exploit chain on you.

Hansel

flawedworld I'm not sure it's true anymore. Reading about the recent list of thousands of numbers from the famous leak even small activists could be targeted with such tools.

flawedworld

Hansel Those are still targeted attacks scoped to a limited set of individuals.

Hansel

flawedworld Not really when you consider the thousands of individuals targeted are probably only a small subset of actual cases.

MetropleX

@Hansel you've provided for an entertaining, informative thread on both sides of the coin. and been provided with generous technically knowledgeable responses to develop a good faith discussion. However each response hasn't been matched in turn with points that provide evidence or validations to your emotive positions and claims.

To continue this appropriately and to avoid concern trolling can I request that you supply evidence etc to backup your concerns going forward so as to provide value to everyone in the community. I for one would love to read specifically what it was that made you want to bring this up in our forum, especially when it isn't particularly pertinent to GrapheneOS and has veered way off your initial question.

To recap: you must ensure you get the G025J variant of the 4a, use a device in production for latest firmware/security updates, don't stay on the Xiaomi with A11 (regardless of OEM re A11 if security is of concern), updates are important, period, not much can protect you from a state level adversary who is determined enough and no evidence of commercial actors targeting GOS. For everything else develop your threat model, behave appropriately and anything else is conjecture without provided evidence.

Themble

Europe is arguing about banning Chinese hardware from their 5G network infrastructure due to security concerns. Could western hardware Made in China, such as GooglePixel Phones, not also be prone to security flaws and backdoors due to the simple fact these devices have been assembled / produced in China?

Max-Zorin

Can the mods rename this thread as it seems to have gotten way off topic from the OP's original question - which from what I understand was buying a Pixel from China (presumably refurbished) as good as buying a used one from the USA.

I clicked on the thread assuming that's what was going to be discussed.

To answer the OP's question. I've bought several refurbished Pixels and Sony phones from Chinese refurbishers. There are reputable ones out there. The work was excellent and I could not tell the phone from brand new. Worked without issue for years.

Having said that, if you live in a large enough city there might be local cell phone shops that have good quality used phones or refurbished phones they do in house. If you have that option, I would investigate that first.