GrapheneOS protections against data extraction from locked devices

GrapheneOS

warampos22 No one has ever posted any evidence of any ongoing exploitation of locked GrapheneOS devices or a bypass for Titan M2 rate limiting. Recent Cellebrite Premium documentation shows it can't exploit locked GrapheneOS devices updated past a patch level in 2022 and can't bypass Titan M2 rate limiting even on very outdated devices. You're talking about people making completely unsubstantiated claims which anyone can do about anything.

DeletedUser1191

warampos22 I also had someone who made unsubstantiated claims to me that it can be broken in to in Russia by their authorities. I should ask where they heard it.

They also thought using a desktop would protect them better :( and that the OS doesn't need security features if you don't install untrusted software. So obviously not someone to listen to for that advice but im still curious where he heard the bad-mouthing of GrapheneOS.

If you don't mind sharing, what country are you referring to and where did this rumor start as far as you know?

Norman

warampos22

It's entirely possible that someone used a fake closed-source fork from GOS that was called GOS by buying it from some shady reseller or a police plant, ended up getting compromised and blamed GOS.
There are cases of device extractions being succesful on GOS, but those are exclusively limited to devices which were obtained unlocked or the passcode was shared at which point the device was unlocked.

DeletedUser1041

Norman and people forget there are cameras absolutely everywhere now and if someone types a pin or password in front of one even once it's now at risk. Pin scrambling and a privacy screen protector help but still..

pixel---fold

DeletedUser1191

how else would they ask it for?

pixel---fold

And what about having a special pin that instead of wiping the phone, redirects to a special profile? Like if we created another separate profile and it would simulate a normal phone account? Instead of wiping, so it would be more credible?

DeletedUser1191

pixel---fold not possible afaict due to low level way SSDs work on Pixels.

ToxicArgon

GrapheneOS Sounds too good. However, l've got an android phone which was bought in 2010. It's lying waste with me. If l revive the necessary hardware components, would Graphene OS work on it if l load into it ?

userofgos

ToxicArgon If l revive the necessary hardware components, would Graphene OS work on it if l load into it ?

No. See here: https://grapheneos.org/faq#supported-devices

tplestid

GrapheneOS

Take care wrt Duress password, i originated that patent , probably still owned by BlackBerry.

https://ppubs.uspto.gov/api/pdf/downloadPdf/US-20070015490-A1?source=US-PGPUB&requestToken=eyJzdWIiOiJmMmVjYjQyOS0xNjM4LTQzODYtYjQyMS04Yzg0ZjM0YWRkNTkiLCJ2ZXIiOiJkZmZiZTYyNS00Yjg4LTRhNDItOGFkYS0yY2QyMTE5YTU5ZjQiLCJleHAiOjB9

DeletedUser1191

tplestid me downloading random pdf from
. gov website

This-is-fine.jpg

Secure pdf viewer save me

wizoatk

DeletedUser1191

Of no practical use unless you're interested and familiar with patents. Perhaps, slightly safer links follow.

US Patent (application) US20070015490A1
https://patents.google.com/patent/US20070015490A1/

US Patent (granted) US7665146B2, Current Assignee Malikie Innovations Ltd
https://patents.google.com/patent/US7665146B2/

grayway2

GrapheneOS Apple and Google did a great job and learned from past mistakes.

No BF exploitation in BFU for iPhone 12 and later
No BF exploitation in BFU for Mac with Apple silicon

Titan M2 will remain unbeaten in BFU for the next 3 years if no longer.

Matthai

Regarding the case in which a GrapheneOS user gave border police a duress PIN that triggered the deletion of data from his phone - and he is now facing criminal charges for allegedly destroying property during a lawful search or seizure.

The problem is not GrapheneOS, but the user made a mistake.

The correct approach would be this: when they ask you for your PIN, your answer is "I do not answer questions"*

Then they of course take your phone from you. However in a phone case you have a piece of paper with a number written. Number looks like the PIN code. But it is not. It is actually a duress PIN. But hey, you don't answer questions!

When the police officer asks you if this is the PIN code to unlock your phone, you answer: "I do not answer questions". And if then the police officer enters this PIN himself and the phone is erased... it is not your fault.

See: https://www.youtube.com/watch?v=ul5oC-F-IF0

DeletedUser1191

Matthai two more:

The long classic:

https://youtube.com/watch?v=d-7o9xYp7eE

Short classic:

https://www.reddit.com/r/funny/comments/olecn5/know_your_rights_its_shut_the_fck_up_friday/

Novaliss

Matthai the police officer asks you if this is the PIN code to unlock your phone, you answer: "I do not answer questions"

And since the Duress feature over time gets known by more people, and GrapheneOS being used by more users, we may see some hesitance in this moment to use the code found in the users purse. Maybe a hard thing to quantify though, but it might have this effect.

Matthai

Yes, but you do not answer questions, right? :)

FunkTastic

Matthai I don't answer any questions.

Fangalang

What about a timer triggered wipe after loss of connection from a trusted Bluetooth device? An additional layer of security from theft. This feature should be automatically turned on whenever you are roaming or triggered after a time zone change.

Vexinor

I read whole post and nobody mentioned the best protection in top of everything else.
Police: Give your password!
You: I want my lawyer.
Custom time passed....phone is erased due to not entering the correct password.

This approach fix issues:
You can't be handled as someone that destroyed the evidence.
You are also protected when court forces you to chose between give password or proven guilty by not giving password because no court is fast enough to time limit you may set.

Also, it's nice to lowering 20 to 5 attempts of fingerprint unlock, but it's far from ideal. One attempt is the right spot. No more. I understand that some models have less reliable fingerprint reader and need more than one. On the other way if someone often need 5 attempts to register the finger, he must re-register it because something is wrong already. Why not solution for everyone and add option for how many attempts will the detection be? Someone can set 1, someone 1000 and you will not have to touch this part of code again.

However, since I started to use the GOS, my mind is finally in the rest not worrying about built in spyware on every other phone's OS. Thank you GOS team for that. For fun. Do you saw opposite of GOS? Find 3olqrQtjPfc on youtube.

« Previous Page Next Page »