Graphene OS: a security-enhanced Android build

> It doesn't matter that the app is trustworthy, because F-Droid are extremely incompetent with security and the apps you install from F-Droid are signed by F-Droid rather than the developer.

https://discuss.grapheneos.org/d/20212-f-droid-security-in-s... https://discuss.grapheneos.org/d/18731-f-droid-vulnerability...

They also say, if you use F-Droid, at least use F-Droid Basic:

> Dont use the main F-Droid client. Android is pretty strict about SDK versions and as F-Droid targets legacy devices, it is very outdated.

https://discuss.grapheneos.org/d/11439-f-droid-vsor-droid-if...

> If the app is only available on F-Droid / third party F-Droid repo, use F-Droid Basic and use the third party repo rather than the main repo if available. > > If the app is available on Github then install the APK first from Github then auto-update it using Obtanium. Be sure to check the hash using AppVerifier which can be installed from Accrescent (available on the GrapheneOS app store).

https://discuss.grapheneos.org/d/16589-obtainium-f-droid-bas...

By the way, while GrapheneOS recommends Accrescent, I don't use it anymore because they can't even add apps like CoMaps, while some of the apps they actually added are proprietary.

Also "private space" is now available with Android 15 and can provide the same separation within a single user profile.

After opening the application, it complains about being installed through an "insecure method", and bails. Reinstalling through Google Play magically fixes that.

These "security checks" are spreading like measles, so expect to see this sooner or later.

So then what's the point of having a Play Store without Google Play services?

We're of the opinion that there's a growing portion of the population that is becoming more security and privacy conscious, and that's reflected in our userbase, which has been growing consistently over the last few years.

We're not saying we're going to have iPhone's marketshare, but we're constantly growing.

>Now if one is targeted by a really motivated and threatening adversary, I don't think wiping PIN is any better than secondary profile PIN. The moment one chooses to wipe the phone, the adversary could be triggered by the action and harm the victim anyway.

Yes, but at that point, the data is irreversibly rendered inaccessible. There are situations where the data itself is the most important factor, and where the owner of the device being hurt doesn't benefit the adversary now that the data is gone. Of course, as with everything, it depends on one's situation, but the duress PIN feature doesn't involve trickery. It's a way to reliably and quickly do a very specific thing.

I think the main problem is that people can be affected that aren't even using it, which is why it is such a big problem. You can't really hide it's GrapheneOS either, even just by virtue of the features available on the device, you'll be able to deduce what it is.

I understand the idea behind it but it simply isn't realistic to provide and can put people in danger - the very thing it's meant to prevent.

It's not about criminals. It's about the police, government spy agencies, and other knowledgeable threat actors.

The unfortunate thing is that they make security promises which aren't upheld in practice (such as shipping security updates on time), so it doesn't inspire confidence as an OEM you could trust to properly support a device for multiple years.

We're hoping that there will be people who will enjoy a device from the OEM we're in talks with - we know that there are many people who for various reasons don't want a device from Google, so this will at least offer an option for people who want to use GrapheneOS on a non-Google device.

https://discuss.grapheneos.org/d/8439-mte-support-status-for...

> Hardware memory tagging is going to provide a massive increase to protection against remote exploitation for GrapheneOS users. It's the biggest security feature we'll be shipping since we started in 2014.

It provides the ability to tag 16 byte granules of memory with 4-bit tags where only pointers with the correct tag can access the memory. This provides an approximation of memory safety very useful for security.

As an example of how it gets used, our implementation of the system allocators via hardened_malloc tags each allocation with a randomly generated tag excluding the adjacent random tag values and previous random tag value for the slot. It has the standard setup of a single statically reserved tag (zero) used for free memory but adds 3 more dynamic exclusions. This provides deterministic detection of small overflows, linear overflows, many forms of use-after-free and fallback to probabilistic detection of other spatial (bounds) or temporal (use-after-free) memory safety issues. We use a lightly modified variant of the standard MTE integration for PartitionAlloc in our Vanadium browser, but we plan to improve it to match hardened_malloc. We use the standard Linux kernel implementation for the internal Linux kernel allocators which needs a lot of improvement.

> why target requirements that even most desktop computers don't meet?

Desktop computers are far less secure than an iPhone or a Pixel with the stock OS. GrapheneOS exists to provide a higher level of privacy and security than those. GrapheneOS is primarily aimed at mobile devices which are almost entirely 64-bit ARM. Hardware memory tagging (MTE) is a standard ARMv8.5 / ARMv9 feature provided by every standard ARMv9 Cortex core. MTE is only missing with custom CPU cores or cache while cutting this corner.

Pixels are not the only devices providing MTE. Exynos and MediaTek have provided it and Snapdragon should be providing MTE starting at the end of this year. The only reason Snapdragon is late to the party is due to their custom cores/cache.

We're currently working with a major Android OEM towards multiple of their future devices meeting all of our requirements and providing official GrapheneOS support. They view all of our officially listed requirements as completely reasonable and a target they can meet for their next generation of devices.

The purpose of GrapheneOS is providing a high level of privacy and security, not making security less bad for devices people already have. Hardware and firmware security matters quite a lot and software security depends heavily on hardware-based security features including MTE. Nearly all GrapheneOS users buy a device to use GrapheneOS and that would still be the case if we supported several other devices. The vast majority of Android devices lack proper security patches for drivers/firmware, are missing important hardware-based security features and don't provide serious support for using another OS where the security features can be kept intact. Samsung's flagships are closest to meeting our requirements after Pixels but do not allow another OS to use verified boot, important secure element features and more. Samsung permanently cripples their devices if they're unlocked and voids the warranty, unlike Pixels.

The reason we're working with an Android OEM is because existing non-Pixel devices don't provide a base we can use to provide what GrapheneOS offers. It would be missing huge parts of the core features elsewhere and would be worse in significant ways than the stock OS. It would go against what we're trying to achieve to have people buy devices we can't properly secure. Long term support for drivers and firmware is also important because people use devices more than 3 years from launch in practice. Pixels get 7 years of proper support from launch, which is unique. A couple OEMs market their devices as having similarly long support but the updates are significantly delayed and far less complete.

We've had numerous opportunities to work with OEMs where they weren't able to provide our requirements. We simply aren't interested in having a far less secure device with GrapheneOS as the stock OS. We expect our requirements to be met, and we think the OEM we're currently working with is fully capable of providing what we need. It will hopefully be available in 2026 or 2027. The initial goal is not doing better than Pixels, just providing a competitive alternative for people who want to use GrapheneOS on another brand of device.

You can have the best alarm system in the word, if you leave the back door open and anyone can just walk in from the street.

But there is still no way to reset/spoof android device ids, and the apps can reliably identify the user after reinstalls.

The point of the OP is not that it would be better than your solution anyway; rather, if you have a device unsupported by GrapheneOS, Calyx would be better than nothing.

But he didn't. It's clear in his later videos that he was still using GrapheneOS, I believe even for months after the video.

> Better safe than sorry.

People who are familiar with how GrapheneOS updates work wouldn't agree. No identifiers are sent to the update server, so targeted updates aren't possible that way. Also, update servers only host static files. If Rossmann was really that worried, all he'd have to do is use a VPN. But that was all just a huge dramatic act so his video would get more views, and possibly to entertain his fellow Kiwi Farms members.

> Of course he was upset when Rossmann showed his true colors

I saw the chats. You lie. Showing his true colors = not accepting that there is an evil conspiracy and asking for proof. You are completely brainwashed and I will not continue this discussion.

If Calyx is not the next best alternative be invited to link to what you think is the best alternative. I still think it's Calyx.

Your CopperheadOS description is one perspective, one that does not look all that believable now after his mental illness became clear.

I did not share the video, but I would and it is not clickbait.

I will not further respond to you, I don't think this would lead to a fruitful discussion. Kindly think about what kind of trust is necessary to trust in the proper functioning of a device as personal as a modern phone, and think about attack scenarios that could occur when the main developer of your OS is not trustworthy in the slightest.

At the time, Rossmann was mainly using GOS, but due to what he perceived as hostile behavior from GOS toward him through their communication, he opted to stop using GOS (at least on his main device, as he claims).

His rationale was that the behavior of said lead developer was not "rational" and "scary", and since the developer has not only edit access to GOS code but also update publishing infrastructure, Rossmann's data or himself could be targeted through malicious code pushed via an update, for example. While GOS is opensource and malicious code or exploits could be detected by the community, he himself did not have confidence to audit the source code to make sure it was safe, hence his decision to stop using.

By risk factor, I think the grandparent suggests that something similar could happen to someone else using GOS, the risk factor being essentially at the mercy of GOS developer, would they wish to harm said user.

You just don't know what will happen is what I'm saying.

The "he has root" is also a reference to ubuntus shuttleworth.

> another hallucination by the Graphene developer

I'm going to assume that by you saying "another" you mean that there were hallucinations before this one.

What you are doing here is repeating baseless claims that they're crazy, which is complete nonsense. This is exactly the kind of problematic stuff that shows up on Kiwi Farms. Again, Rossmann has an account there and some of his videos seem to be made to appeal to Kiwi Farms users.

Disclaimer, I am a GrapheneOS user. I was introduced to GOS by Louis Rossmann initial 2 or 3 videos talking about giving them a FUTO grant, as well as praising GOS and showing how it easy it was to install, and how it gave back control to the user, and all the good things that GOS genuinely provides.

I have (unfortunately) followed this saga and went down the rabbit hole since the very beginning. To my understanding based on publicly available data, the key "evidence" put forward by GOS developer(s) / community manager would be:

1. Louis Rossmann leaving the now pinned comment "Informative but unfortunate" on TechLore's video on the leadership of GOS. They claim this is Rossmann showing support for Techlore and his community to (allegedly) harassed the (at the time) lead developer of GOS.

2. Louis Rossmann having KiwiFarm account. Yes, KW is a cesspit. However, all of Rossmann's message on the board mostly focus on either addressing misconceptions about himself, or promoting right to repair and similar topic. This can be easily checked, and at no point there is any public evidence of him supporting harassment toward the GOS developers.

3. Louis Rossmann being acquainted with leadership of other de-googling Android OSes (CalyxOS mainly I think) and also giving them a FUTO grant.

Essentially, "guilt by association". I know this because I have asked the community manager (goes by mbananasynergy on HN, and similar aliases on other platforms), and that is what they provided as "evidence" for Rossmann being guilty of harassing or promoting harassment against them (along with mentions of having 2 millions of USD worth of backing and ready to sue Rossmann, which has not materialized as far as know since ~1.5 years ago).

I want to preface by saying that GOS is really a good software, I have been using it for 2 or 3 years since then, and no complaints on that side. My biggest gripe however, is indeed with the leadership and management of the community.

I created a new account instead of posting this with my main because the leadership is in my experience very abrasive, to say the least. I have been banned without appeal from their Mastodon for leaving "thumbs up" smiley on : 1) messages suggesting the GOS devs to do an interview with Rossmann (as he did with other projects that received a FUTO grant) to further spread the word, or 2) messages suggesting to clear up the misunderstanding between the devs and Rossmann.

Any disagreement on their official narrative, or contrary opinion (even in good faith) leads to bans if they are in control of the platform, and accusations of collaborating with groups that harass the developers. Even here, anything contrary to that narrative will receive the usual wall of text describing the poster as sockpuppets, harassers directed by Rossmann, Techlore, CalyxOS, or any other projects GOS developers are beefing with.

I am disappointed by the situation, because I think GOS could have a larger presence and contribute to raising awareness about the importance of data security, but their leadership seems to be a considerable roadblock on that direction.

With SEV-SNP and Intel TDX I think it's possible to build a hardware platform that doesn't require the user to trust the OEM although they still need to trust at least one large American tech company that controls the root of trust.

But I don't think this is ever gonna happen for consumer devices. AFAIK it's only sorta kinda happened for any real-world platforms at all (but maybe someone can correct me).

Ultimately if your threat model includes Google as a potential adversary, and you are not in control of nuclear weapons, you are gonna have to make some serious sacrifices to achieve security IMO. Smartphones are out. (Actually, I guess if you trust China you have a way forward).