indigomadelin 25:24 No user apps whatsoever have access to any hardware identifiers from the phone. Is the DRM ID (with per-app and not per-app-per-profile strategy) considered a hardware ID?
I personally didn't, in the context of the reponse, consider it a hardware ID referencing our documentation/FAQ. While I do appreciate what your getting at, the DRM ID issue has more variables, I wanted to give as high level broad interpretation of things as possible to help the flow of the interview leaving options open for further questions then or for further content and more in-depth issue focused/specific appearances. If the interest is there, as David mentioned he is looking to engage with either myself or the team writ large with a view to drilling down further if the demand is there.
indigomadelin In the How to download apps on GrapheneOS phones section, you could have mentioned that F-Droid as a repository is not recommended because they build and sign apps themselves. Perhaps F-Droid as a client with the IzzyOnDroid repo would be acceptable.
I was specifically asked about F-Droid but my attention was and remains to draw interest to GrapheneOS and by omission of not recommending it believed it to be the best approach. Doing otherwise would have detracted from the positive message I wanted to convey, possibly resulting in unnecessary attention from parties negatively inclined toward us. Obtainium covers F-Droid also be it their main repo or third party ones anyway.
indigomadelin 44:40 You stated that Google FCM doesn't receive push notification data and only sends a wake-up call to the app. However, see https://arxiv.org/abs/2407.10589 and https://www.axios.com/2023/12/06/apple-google-requests-push-notification-data
- While Apple and Google don't generally sit between an app and the servers it connects with, the notifications that an app sends to users typically do flow through those companies' servers.
It is obviously down to how the apps are made and how they format their push messages and what protocols they use to ensure they can't be read in transit. As mentioned above the approach was to talk as high level as possible and not get bogged down in the weeds too much. This was also totally unscripted and off the cuff.