is grapheneOS 'worth it'?

GrapheneLover

TrustExecutor

TrustExecutor
I will add to this, GrapheneOS on a Pixel is using the Titan M2 security chip, a very advanced secure element. This is the foundation of GrapheneOS being able to utilize verified boot. This is key. It make it practically impossible for an adversary to persist on the device. Even if they would gain access to the Android operating system, they would not survive reboots as a signature verification is performed every boot, and the key is stored in the Titan M2 security chip.

throwingAway

Eirikr70 finding 0-days is pretty hard no? without it being made public at least. Also GOS seems to be an open source project with quite a few eyes on it, maybe these issues would be easier to spot and/or patch

TrustExecutor

throwingAway From what I read the Pixel device itself, being the reference android device, undergoes a lot of auditing by security auditers, and GrapheneOS adds even more hardening on top of that. The GrapheneOS developers have by the way they hardened the OS and memory allocation mitigated whole classes of 0-day exploits.
Listen to the interview with Gabe where he explains about this: https://youtu.be/WkQ_OCzuLNg

kopolee11

throwingAway Important to remember that GrapheneOS is also available on a non-cellular device (namely the Pixel Tablet), which lacking a modem avoids a lot of the tracking issues that entails. So using GrapheneOS on that device is certainly "worth it", no matter how you slice it.

(Note, it is also worth it on a phone, for all the reasons already mentioned)

throwingAway

kopolee11 OK, for a phone though: if I just don't have a SIM and keep it WIFI only will it also avoid the tracking issues? Also, if I do have it connected to a mobile network, could I mitigate the tracking by having airplane mode on at all times but when I need mobile data?

[deleted]

throwingAway

Activating airplane mode will fully disable the cellular radio transmit and receive capabilities, which will prevent your phone from being reached from the cellular network and stop your carrier (and anyone impersonating them to you) from tracking the device via the cellular radio. The baseband implements other functionality such as Wi-Fi and GPS functionality, but each of these components is separately sandboxed on the baseband and independent of each other. Enabling airplane mode disables the cellular radio, but Wi-Fi can be re-enabled and used without activating the cellular radio again. This allows using the device as a Wi-Fi only device.

https://grapheneos.org/faq#cellular-tracking

You can disable Airplane Mode each time you leave your house but the benefits are marginal over just leaving cellular all the time IMO.

Hb1hf

throwingAway

I think you need to keep bluetooth turned off too. It has a unique ID that will be tracked by your wife/kids/roommate/neighbor/etc's Android or iOS.

Unless of course you're going with the faraday bag. But that just means you'll not going to be using the phone at all.

[deleted]

[deleted] If you want you can get yourself a good faraday sleeve for when you need some privacy. That's what I do. Actually I don't know whether you toggling Airplane Mode generates any signal on telco's side (as in you taking active measures) vs just dropping your phone into a faraday sleeve where you also lose all connectivity. Perhaps anyone more knowledgeable can shed the light on whether there is any difference from a telco perceptive.

Blastoidea

How does Apple “bypass E2EE”?

Graphite

Blastoidea

Most cloud services providers keep E2EE keys so they can facilitate data/account recovery (or comply with LE).
I always ask myself, "can they reset user passwords and 2FA tokens if the user forgets/loses their passwords and backup codes?" And if so, "does the user permanently lose all their data?" If not, then they have the keys.. and it's really about "trusting" them not to abuse them.
Proton, for example, explains their security model very well. The indication is in the fact that it's actually possible to lose your data if you can't find your recovery codes.
https://proton.me/blog/data-recovery-end-to-end-encryption

Blastoidea

Graphite Thank you.

junkanon

I would respectfully suggest that it's definitely worth it. There may be a bell or a whistle here or there that is "missing" but GOS is a secure, totally functional, thoughtfully implemented OS.

Graphene1

This is a long thread and I haven’t read it all so unsure if mentioned but IMO the reduced telemetry via the OS by using GrapheneOS alone is worth it.

« Previous Page