is Graphene a “big name”? They talk a big game and are probably one of the biggest alternative phone OSes but all results I can find are putting them at 250k users and less than 2% of the Android market share.
But, more importantly: Do they at all care about US government contracts? Red Had have RHEL. ubuntu have whatever they call their premium OS for enterprise users. Google and Apple are obvious.
“More secure” is a minefield of marketing and intentionally misleading the populace. In a “perfect” world, everyone would believe that just putting something in a txt file protects it from The Government. Its akin to how so much media has pushed the “if you’re a cop you have to tell me” myth.
But mostly I see it listed more as a way to build up precedent/probable cause. I forget which country it was, but Graphene was specifically listed as being used by criminals/drug dealers. Whether that is true or not isn’t the point. The point is that now, using Graphene, counts against you for the purposes of pressing charges or taking you to a black site.
Which is the reality of a lot of laws. Let’s say it is declared illegal to have the text of Animorphs 01 in your possession. Cops aren’t going to be going door to door to find out if you are a Friend of Katherine. But if they raid your home because they decided you are a drug dealer or a dissident and find it? That is an extra charge. Or their suspicion that you had it is the entire reason they raided in the first place.
Which IS the reality with a lot of “decency” laws. That isn’t to say they are all evil (CSAM being pretty universally accepted as being banned for a reason) but it is important to always understand how enforceable a law is and whether it actually changes anything.
“More secure” is a minefield of marketing and intentionally misleading the populace.
Here is the popular phone cracking company Cellebrite’s leaked slides showing them telling the people they’re selling their tools to that they can’t as easily (if at all, depending on device state) crack GrapheneOS as they can stock Android:
https://grapheneos.social/@GrapheneOS/112462758257739953 (This is just a well-summarized and explained post from GrapheneOS themselves, but the original leak was independent of them, and the slides and final interpretation are no different from what GrapheneOS is showing, thus I wouldn’t consider this just “marketing”)
Objectively, if you have a GrapheneOS phone, and you plug it into a Cellebrite machine, it will not have its data extracted if it’s before first unlock, or after first unlock but on the lock screen. (as long as you’ve updated your security patches since like 2022, which most GrapheneOS phones will be) A stock Android phone, or even many iPhones were not as resistant to brute forces or even full file system extractions as a Pixel with GrapheneOS.
GrapheneOS also has additional features that can make the cracking process even more difficult, such as disabling USB even after first unlock when on the lock screen, automatically rebooting after set period to return the phone to BFU state, or setting a duress PIN that wipes the phone, which could be triggered via a brute force before the real PIN is guessed.
Also, in case you want to look at the diagrams in the post more since they don’t really explain all the acronyms, here’s a key:
BFU (Before first unlock - essentially when you’ve restarted the phone but not put in the PIN/password yet. When fingerprint unlock will not work)
AFU (After first unlock - after you’ve put in your PIN/Password, fingerprint gets enabled at this point. Using the “Lockdown” button from the power menu on GrapheneOS disables fingerprint and appears to be BFU, but isn’t fully in BFU state and should still be considered AFU just in case)
FFS (Full Filesystem extraction, essentially dumping literally every single possible file, app data, etc)
BF (Brute Force, basically just spamming the PIN/Password to try and crack it. GrapheneOS is essentially never vulnerable to this due to the Pixel’s secure element, and it’s the same for newer Pixels with stock Android too, though those tend to still be vulnerable to FFS)
“Up to late 2022 SPL” (“Secondary Program Loader” version, which most GrapheneOS phones will have updated by now as long as they’re running a GrapheneOS version released after 2022. As you can probably tell, 2022 is referencing the (late part of the) year that version was from. It’s essentially what helps to load programs on the device)
I forget which country it was, but Graphene was specifically listed as being used by criminals/drug dealers.
In their case, it was more about Pixel phones in general being used by criminals, and GrapheneOS being their OS of choice which made cracking them harder, rather than GrapheneOS itself being considered criminal or suspicious, but I get where you’re coming from.
You could also be referring to the UK, but that was regarding a journalist with GrapheneOS, but the charge was refusing to unlock his phones. And yes, I said phones, because he was also carrying an iPhone, and they wanted that password too. So in this case the charge wasn’t GrapheneOS-specific.
There’s also France, who was going after GrapheneOS because they wanted an encryption backdoor, but GrapheneOS just said no, so they told police to consider any Pixel with GrapheneOS “suspicious”, but not to consider it a crime in itself. (nor did they have the legal authority to do so) GrapheneOS actually migrated all their server infrastructure out of France as a result of this.
The point is that now, using Graphene, counts against you for the purposes of pressing charges or taking you to a black site.
Generally speaking, even in those areas, this (fortunately) just isn’t true. You are more likely to be considered suspicious in Catalonia if you have… a Pixel, GrapheneOS or not. You’re likely to be criminally charged in the UK… if you don’t give up your password, GrapheneOS or not. And you’re likely to be considered “suspicious” in France… but can’t be charged with anything for it, and the only way they’ll know if you have GrapheneOS installed is if you were already arrested for something else and had your phone seized.
Practically speaking, it’s better to support an OS that protects your data, but could increase the risk of you getting in trouble for protecting your data, than an OS that doesn’t protect your data, and gives it all to the authorities, making whether or not you’re considered criminal pointless. After all, you could voluntarily unlock your GrapheneOS phone in any of these jurisdictions and stop facing any of these possible consequences, and it would carry the same implication as a non-GrapheneOS phone that does it whether you provide your PIN/password or not.
So this:
That is an extra charge.
Just isn’t (at least currently) the case, since no regions currently doing anything against GrapheneOS have made the act of having GrapheneOS installed in itself a crime.
Not to say this couldn’t change, and you’re totally valid in assuming that governments will try to push this, but at least currently, using GrapheneOS will not in itself increase the chance of you going to a black site.
Genuine question:
is Graphene a “big name”? They talk a big game and are probably one of the biggest alternative phone OSes but all results I can find are putting them at 250k users and less than 2% of the Android market share.
But, more importantly: Do they at all care about US government contracts? Red Had have RHEL. ubuntu have whatever they call their premium OS for enterprise users. Google and Apple are obvious.
Frankly I think they are the largest os vendor that is going to take a principled stance on this.
GrapheneOS has a deal with a hardware manufacturer, Motorola. I’d consider this refusal to be a big deal on those grounds alone
Big name for government backed hacking tools to list them separately on supported devices / OS cause it’s more secure.
“More secure” is a minefield of marketing and intentionally misleading the populace. In a “perfect” world, everyone would believe that just putting something in a txt file protects it from The Government. Its akin to how so much media has pushed the “if you’re a cop you have to tell me” myth.
But mostly I see it listed more as a way to build up precedent/probable cause. I forget which country it was, but Graphene was specifically listed as being used by criminals/drug dealers. Whether that is true or not isn’t the point. The point is that now, using Graphene, counts against you for the purposes of pressing charges or taking you to a black site.
Which is the reality of a lot of laws. Let’s say it is declared illegal to have the text of Animorphs 01 in your possession. Cops aren’t going to be going door to door to find out if you are a Friend of Katherine. But if they raid your home because they decided you are a drug dealer or a dissident and find it? That is an extra charge. Or their suspicion that you had it is the entire reason they raided in the first place.
Which IS the reality with a lot of “decency” laws. That isn’t to say they are all evil (CSAM being pretty universally accepted as being banned for a reason) but it is important to always understand how enforceable a law is and whether it actually changes anything.
Here is the popular phone cracking company Cellebrite’s leaked slides showing them telling the people they’re selling their tools to that they can’t as easily (if at all, depending on device state) crack GrapheneOS as they can stock Android:
https://grapheneos.social/@GrapheneOS/112462758257739953 (This is just a well-summarized and explained post from GrapheneOS themselves, but the original leak was independent of them, and the slides and final interpretation are no different from what GrapheneOS is showing, thus I wouldn’t consider this just “marketing”)
Objectively, if you have a GrapheneOS phone, and you plug it into a Cellebrite machine, it will not have its data extracted if it’s before first unlock, or after first unlock but on the lock screen. (as long as you’ve updated your security patches since like 2022, which most GrapheneOS phones will be) A stock Android phone, or even many iPhones were not as resistant to brute forces or even full file system extractions as a Pixel with GrapheneOS.
GrapheneOS also has additional features that can make the cracking process even more difficult, such as disabling USB even after first unlock when on the lock screen, automatically rebooting after set period to return the phone to BFU state, or setting a duress PIN that wipes the phone, which could be triggered via a brute force before the real PIN is guessed.
Also, in case you want to look at the diagrams in the post more since they don’t really explain all the acronyms, here’s a key:
You might be referring to Catalonia, Spain?
In their case, it was more about Pixel phones in general being used by criminals, and GrapheneOS being their OS of choice which made cracking them harder, rather than GrapheneOS itself being considered criminal or suspicious, but I get where you’re coming from.
You could also be referring to the UK, but that was regarding a journalist with GrapheneOS, but the charge was refusing to unlock his phones. And yes, I said phones, because he was also carrying an iPhone, and they wanted that password too. So in this case the charge wasn’t GrapheneOS-specific.
There’s also France, who was going after GrapheneOS because they wanted an encryption backdoor, but GrapheneOS just said no, so they told police to consider any Pixel with GrapheneOS “suspicious”, but not to consider it a crime in itself. (nor did they have the legal authority to do so) GrapheneOS actually migrated all their server infrastructure out of France as a result of this.
Generally speaking, even in those areas, this (fortunately) just isn’t true. You are more likely to be considered suspicious in Catalonia if you have… a Pixel, GrapheneOS or not. You’re likely to be criminally charged in the UK… if you don’t give up your password, GrapheneOS or not. And you’re likely to be considered “suspicious” in France… but can’t be charged with anything for it, and the only way they’ll know if you have GrapheneOS installed is if you were already arrested for something else and had your phone seized.
Practically speaking, it’s better to support an OS that protects your data, but could increase the risk of you getting in trouble for protecting your data, than an OS that doesn’t protect your data, and gives it all to the authorities, making whether or not you’re considered criminal pointless. After all, you could voluntarily unlock your GrapheneOS phone in any of these jurisdictions and stop facing any of these possible consequences, and it would carry the same implication as a non-GrapheneOS phone that does it whether you provide your PIN/password or not.
So this:
Just isn’t (at least currently) the case, since no regions currently doing anything against GrapheneOS have made the act of having GrapheneOS installed in itself a crime.
Not to say this couldn’t change, and you’re totally valid in assuming that governments will try to push this, but at least currently, using GrapheneOS will not in itself increase the chance of you going to a black site.
deleted by creator
Big enough for a headline, not big enough to make a difference.
I would go so far as to say they are only big enough to make an updoot-bait headline at that.