Doubts about using mods on GrapheneOS

RedDeath

Good morning, I previously wrote a comment in the thread "Pixel 10 - Experimental support for GrapheneOS is now available!" thread, in which I mentioned that I had purchased a Google Pixel 10 Pro XL and was waiting for the first stable version of GrapheneOS to be released so that I could enjoy a full user experience with as few bugs and errors as possible. Until then, I am currently using a 2021 Xiaomi Redmi 9 with 4 GB of RAM. Today, I would like to ask a question out of ignorance, out of lack of knowledge. On my Xiaomi Redmi 9, I like to download mods, modified premium versions of applications, so that I can access these types of features completely free of charge without having to pay for any kind of subscription. The website where I download the mods is [removed]. and I was wondering, out of curiosity, how safe it would be to install mods, modified applications on the Google Pixel 10 Pro XL when the first stable version of GrapheneOS is released. As far as I understand, with this ‘sandbox’ and exploit protections, there shouldn't be any problems installing and using mods on a mobile phone with GrapheneOS, especially if, as a preventive measure, I create a secondary profile, a separate profile exclusively for storing these types of applications.

mod note: removed a link to a site with sketchy mods

raccoondad

RedDeath completely free of charge without having to pay for any kind of subscription

This is known as piracy, known for 99% of virus first contacts with a machine. (Hyperbolic) Just to mention.

Downloading and installing untrusted and potentially malicious software is a problem on ANY machine including ones running GrapheneOS

GrapheneOS will not protect you from installing malicious APKs

Novalissoide

RedDeath I like to download mods, modified premium versions of applications, so that I can access these types of features completely free of charge without having to pay

Ok, now we all know that about you.

Linux

RedDeath . On my Xiaomi Redmi 9, I like to download mods, modified premium versions of applications, so that I can access these types of features completely free of charge without having to pay for any kind of subscription. The website where I download the mods is [removed].

Sound very shady and something that should be avoided.

But if you don't give them any permissions, the app sandboxing will probably keep your safe.

RedDeath

raccoondad Of course, in my logic, in my reasoning, I thought that if any application wanted to make changes to my Google Pixel 10 Pro XL with GrapheneOS installed, the operating system, due to its architecture, its options and the way it is made, would probably prevent or protect against applications without permissions making external modifications, which is why I asked.

de0u

RedDeath The GrapheneOS release changelog lists security updates, such as the security patch level and also sometimes specific CVEs. Every time somebody fixes a security bug that means that before the fix there was a security bug!

A fairly small fraction of those are "RCE" (remote code execution), and a much larger fraction are "privilege escalation", which means if somebody can deploy an app containing the exploit onto the device then the app will be able to do things that the permission model ostensibly forbids.

GrapheneOS isn't a magical shield that instantly repels all malware! Running malware on any device, unless a malware researcher is doing it on a carefully isolated device, is always dangerous.

rjo12

RedDeath As others have said, installing "modded" applications presents a security risk - essentially someone has bypassed some protections (e.g. requirements to register) implemented by the original app developer, and potentially added additional malicious code. Such apps are, practically, a primary vector for introducing malware to a device

No matter how secure the operating system, the installation of any malicious app with permissions it requires, presents a security risk. By installing such an app and granting it permissions, the responsible user - i.e. you - effectively weaken any protections offered by the operating system.

In other words, GOS can't be expected to provide a safety net, if you install malicious apps and grant them permissions they request.

Novalissoide

RedDeath It also might be a bit of 'high profile' to describe in detail precisely how that habit is to be carried out. Stay safe out there buddy. 😉

RedDeath

de0u Ok, I understand

MEGAbyter

Installing hacked, free versions of paid apps is a MASSIVE security risk.