233328

  • 5 Feb
  • Joined Nov 12, 2022

  • something about yourself

  • In F-Droid App vs Aurora Store App

    Dumdum Fdroid is a completely different app store that hosts only open source apps. Its generally recommended to avoid Fdroid for the reasons found here.

    F-Droid is claiming to be freedom and privacy, not security, so in that sense the article is right. F-Droid want to maximize device compatibility by not raising minimum SDK level for example. But that article is definitely exaggerating things. They make a big case about F-Droid signing all packages themselves and how bad that is, just to in a single sentence later admit Google Play is also doing that just the same, unfairly making F-Droid seem less secure than Google Play and thus Aurora. And F-Droid's basic checks against proprietary components and trackers often find things maliciously or unintentionally inserted by developers, which is a big reason I use and trust F-Droid. Eg Organic Map developers got very upset F-Droid flagged their release after they added advertisements with a tracker in their app, and it took months before the developers decided to do an F-Droid release without those. This was in my opinion good, as Organic Map readme claims it is free from ads and trackers. A proprietary an thus unaudited component was also found in Tor Browser. Although developers have neutered it, it is still there, which is why the app is not available in the regular F-Droid repositories.

    F-Droid has also done some limited efforts towards reprodicible builds, but Google Play isn't doing that.

    There are advantages and disadvantages with all app stores, even in the context of GrapheneOS. There are no reasons to specifically avoid F-Droid, as there are not any alternative that is obviously better.

      • In Misunderstanding of time update threshold

        [deleted] [deleted]

        You're misunderstanding what this is controlling. It does not control the rate of time updates.

        Since you agree that there are diminishing returns and setting it to 1ms for example wouldn't be productive

        Setting it to 1ms wouldn't help because it's not that precise due to network jitter. However, it wouldn't hurt to have it set to 1ms. It could potentially be set to 0 to essentially always update the clock after fetching time. We could have done that but it would require testing to make sure the code handles it. Instead, we chose a smaller threshold significantly larger than the difference introduced by any typical network jitter but still quite small.

        fewer updates going all the time

        It doesn't control the rate network time is fetched.

        but if it was updating 3/sec nobody would even bother to change it

        This doesn't control how often time is updated. You're misunderstanding what it controls.

        No reason to update 20 in a single second, but thats just my opinion.

        It never does this. Network time updates are very infrequent, as in many hours between checking. Not clear why you think it's updating at a rate controlled by this. It's not a rate but rather a threshold. It fetches the network time at a frequency not determined by this and then chooses whether to update the system clock with the time it retrieved based on whether the difference was beyond this threshold.

          • In Threema has full disk access withouth granting permissions
          • In Aurora Store on GrapheneOS questions.

            233328 certificate pinning

            Certificate pinning prevents machine-in-the-middle (MITM) attacks. The application "pins" (comes bundled with) an expected certificate, and if the remote certificate doesn't match, then it will reject the network connection. This prevents an adversary from issuing their own certificate for the website, which your local application would otherwise connect to. The downsides are that if you don't update the app for a long time, the certificate might rotate and then you can't connect without updating or re-downloading the app to get a version with a current pinned certificate; and the user can't MITM the connection either to inspect the app to see what data is actually being sent (without disassembling the app, removing the pin check/replacing the cert, etc.).

            • In Private phone location?

              233328 That's not correct for GrapheneOS which doesn't use the standard network time implementation. Please read https://grapheneos.org/faq#default-connections. We don't enable VPN bypass for our own secure network time implementation. NTP is UDP, which often won't work through a VPN service such as with one based on Tor which doesn't support UDP. Relatively accurate time is also needed for certificate verification including to connect to a VPN. Those 2 reasons are likely why they implement the bypass, but the UDP issue isn't applicable to the GrapheneOS HTTPS-based implementation of network time and inaccurate network time causing certificate validation failure is a common issue which should produce an understandable error already.

              • In How to take a photo without unlocking the phone?
              • In Making GrapheneOS mainstream

                mmmm
                I don’t have a clue, but I can’t help wondering what compromises would be proposed.

                Right now, there is no other commercially available Android phone with a Titan chip than a Pixel. I would be very leery of anyone’s claim that theirs was “the same”, even if anyone had one.

                In order to expand and appeal to the general population, I think GrapheneOS would have to become something it isn’t intended to be, and something very different from what it is now, so I would cast one (1) vote for not going mainstream.

                  • In Is installing Google Maps in main profile a smart idea?
                  • In Brave vs Vanadium

                    I tested both browsers for several weeks in a university fingerprinting study (I wanted to leave my fingerprint rather for academical research rather than at fingerprint.com).

                    The study measures the browser fingerprint based on e.g. navigator, audio, canvas, screen, plugin, connection, WEBGL, mathematical constants and much more.

                    The study determines whether the site:

                    • has seen this fingerprint before
                    • if you are the only participant with this fingerprint and
                    • if you can be tracked uniqueliy over time

                    Without Javascript, both browsers performed equally well in my tests according to the standards of the university project.

                    With Javascript enabled, both browsers always left a unique fingerprint.

                    In the categories "seen fingerprint before" and "can be tracked uniqueliy over time", Brave regularly performed better in my case: Vanadium was trackable over time and could be assigned to my previous fingerprints which was not the case with Brave.

                    Better to do your own comparisons than listen to strangers on the Internet: https://browser-fingerprint.cs.fau.de/?lang=en

                    So for most things I use Brave, when I open sites where I'm more concerned with security than privacy I use Vanadium.

                  • In Pixel 6a - voLTE causing extreme battery drain when not enabled by network

                    Hi,
                    (ok, issue solved while writing the message - writing it anyway, for documentation).

                    I'm running GrapheneOs on Pixel 6a (most recent update, stable branch). After some initial tweaking when setting up gos ast summer), weeding out battery-eating apps, I've been quite happy with battery stats ever since.

                    Until ca. a week ago, when the battery started draining quite fast. Loosing 30-40% charge over night.
                    Tried restarting, and leaving only the "owner" profile active,- (which has very few apps installed) and not loggin into my personal profile, where all the apps are. Still the same.

                    using adb shell, and top, I got

                    • system_server 21%
                    • rild_exynos 12%
                    • com.android.phone 10%
                    • com.shannon.imsservice 10%
                    • .ShannonImsService 6%
                    • top 1.6%
                    • servicemanager 1.6%

                    Now, somewhere on these forums, I found a hint that VoLTE might be causing this. So I turned it off. Now, top shows :

                    • rild_exynos 6.6%
                    • com.android.phone 2.0%
                    • system-server 2.0%
                      or less, basically normal, I would think.

                    So, just now, I called a friend, who works in the networks department at the telecom company, to ask him if they had changed something about the voLTE recently. They had not, but he knew that a lot of phones, (including pixels) had recently got a software update enabling voLTE.

                    Then he looked up my phone number, and found out, that voLTE was not enabled for it. He enabled voLTE for my number, I restarted the phone, and now the "top" results looks great (with voLTE enabled). No process eating more than 1%.

                    So he has seen similar behaviour - a number does not have VoLTE enabled, but the phone has it enabled in settings. Then, the phone goes into an endless loop asking for voLTE connection, getting rejected by the network, then asking for it again - this is probably what is causing this high cpu load (but now I'm guessing).

                    Greetings,
                    Indriði

                  • In Google Pixel 7 sensors removing.

                    I dont think it’s overly unusual for someone to want to remove the sensors from their phone, considering the reasons one may chose to use an OS like GOS.

                    Seems to be a bizarre thread currently, where only opinions matter and not actual info, which seems to fly in the face of the nature of the community here.

                    I’m sure the OP is aware and has weighed up the costs of losing waterproofing to ensure privacy, for example.

                    One persons overkill is another’s saved life.

                    • In You can update play store apps without login

                      • [deleted]

                      • Post #9

                      xalaw31044
                      This is not based on any official info, but I'm fairly certain they have automated systems in place to flag registrations for abusive behavior (bots, mostly). If you didn't have a vpn on and used the phone to make it, those are probably two biggest "green" flags for them. Also, just because they don't require phone number instantly, they may do so later on. Many people have posted about that happening to them. I recommed set up TOTP 2FA to maybe avoid it.

                        • In A small feature request for missing emojis in the GrapheneOS keyboard
                        • In How to Receive Update Notification feed for Apps in Google Play?
                        • In Can't locate file

                          233328 Thanks, I did delete the app but apparently didn't uninstall it completely. Now it works! Thank you for the fast answer.

                          • In Hint in installation guide: Play Store needs update Play Services

                            "Have you granted Play Store the permission to install unknown apps in system settings? If you haven't, it might be that the update confirmation screen cannot be shown because of this. "

                            This was the solution, I granted the permission. As far as I remember, I didn't change this rights and think it was the default value of the fresh installed Pixel 6a.
                            Thank you for your patience.

                          • In Do I need Google service for Wechat calls?

                            [deleted] , other8026

                            tl;dr:
                            I think it was a missing "display over other apps" permission.

                            OK, I tried this:

                            Removed 'Exploit protection compatibility mode' on Wechat app.
                            Uninstalled it.
                            Logged into Sandbox profile.
                            Logged into Playstore.
                            Downloaded Wechat.
                            Interesting observation: the reported app size is now 150MB, and not 270MB! Maybe its a regional thing? I see in Aurora the language flips between German, Spanish... maybe due to regional settings underneath for the dummy accounts Aurora uses... Version number is the same however.
                            Swapped profiles back to Owner.
                            Can't see Wechat app! I thought I'd be here? - I also thought apps are installed globally?
                            Reboot phone.
                            Still can't see Wechat in Owner profile.
                            Logged back into Sandbox profile - Wechat is there.
                            @&#^$%!
                            Log out of Sandbox profile with 'End Session'.
                            Back into Owner profile.
                            Go into Manage users.
                            App installs and updates are active for Sandbox.
                            Under Install available apps its possible to install an app from Owner, into Sandbox... (no Wechat here obvs)
                            Click on Owner profile - can only change name...

                            Back into Sandbox.
                            Uninstall Wechat.
                            End session, back into Owner.
                            Install Wechat again. (Didn't run it)
                            What the heck? Install is done, Aurora prompts to OPEN the app, but I can't see the App icon in the app drawer?!
                            Ok, app appeared in drawer but it took a while... Strange
                            Back into Sandbox profile.
                            Back into Play store.
                            Install Wechat again. (Didn't run it)
                            Install took a looong time.
                            I'm hoping this somehow overwrites the App installed from Owner profile??
                            Check App Info for Wechat from App drawer. Version looks ok. App size reported at 0.90GB.
                            End session.
                            Back into Owner profile.
                            Wechat is still there.
                            Check App Info for Wechat from App drawer. Version looks ok. Same.
                            Storage and cache menu option disabled! Cannot check app install size.
                            Hmmm
                            Close App Info. Try again.
                            Check App Info for Wechat from App drawer. Ok, looks better now. Version looks ok, can also see versionCode value now. Same. App size reported at 0.90GB.

                            OK!

                            Run Wechat.
                            Do the stupid convoluted login ritual... SMS actually arrived this time. Imagine that!
                            Ok, logged in.
                            Try voice call. Prompts for permissions. Allow.
                            Wechat restarts :(
                            Checked permissions - allow camera, mic, network, sensors. Set location: ask every time.
                            Enable Exploit protection compatibility mode.
                            Try sending camera shot in wechat - works.
                            Try voice call again. CRASH!
                            Try video call CRASH!

                            Enable Developer Options.
                            Plug into USB again.
                            Check logcat.
                            Still *&^&$% missing flutter lib!!!! :O

                            Log out of Wechat.
                            Back into in Sandbox.
                            Log into Wechat.
                            Allow permissions.
                            Start voice call.
                            Allow more permissions.
                            Call starts!!
                            Permission prompt to display on top of other apps...

                            Whoa! This is different! didn't get this prompt in the Owner profile

                            Allow permission.

                            OK!
                            Back to Owner profile.
                            Search in system Settings for "display over other apps"
                            Enable for Wechat.
                            Back into Wechat, start voice call.

                            IT WORKS!!!!

                            OMG what a PITA!

                            Along the way also tried installing from Aurora with Native installer option selected - it bombed as you might have expected.

                                • In SIGNAL: org.thoughtcrime.securesms

                                  233328 Cool! Thx for that.

                                  So yes I can confirm my wife's P8 has an older version of Signal and yes it does have that as the app domain :)

                                  Looks like a UI name display issue. Defibrillated heart... beating at normal rate again :)

                                  • In My Research Thesis on the Privacy of GrapheneOS vs. Stock Android

                                    Hulk How was your thesis defense, did it go well?

                                    I assume it had very strong exploit mitigations.

                                    • In Protons fundraising is open for entries

                                      Protons fundraising campaign is open for entries again.
                                      Here is a link to the blog post of Proton:
                                      https://proton.me/blog/lifetime-fundraiser-survey-2023

                                      And here is the direct link to the form:
                                      https://form.typeform.com/to/zB7qwhLQ

                                      Please consider to fill the form. If we are lucky like last year GrapheneOS gets chosen, which will help with the general funding.

                                      Thats all, thank you guys for this amazing project and all of your hard work!