The need for cyber security existed entirely out of a need to prevent people being a victim of cyber crime.

People being tech-literate and using the best technologies available to them is standard to a connected society. This can't be prevented and no developer ever deserves to be blamed for what is outside of their own control.

Cyber security is non-negotiable and making compromises enables criminals more than anything else because criminals prey on the weak, the vulnerable, the easy targets. Making a spin on tools that empower the vulnerable as tools to enable criminals is nothing short of slanderous to the projects and the good people protected by these works.

Solidarity

nostr:nevent1qqsqkjhn4mw5gfej40mhypwnwgepmdysazgm6jzamyw55apk3avy6hgppemhxue69uhkummn9ekx7mp0qgsvnx99ww0sfall7gpv2jtz4ftc9v6wevgdd7g4hh7awkpfvwlezugrqsqqqqqpmwuzwd


Build will only be for Alpha.

nostr:nevent1qqstgx6upj8zqjqum8lv9ultahzwee3eygnc8uhd70aerjs78gatc8spzamhxue69uhhyetvv9ujumn0wd68ytnzv9hxgtczyp2x308wkaxwxh95zu7uext5hhdvn6y55a9l84z0nj5tw42xqhy76qcyqqqqqqg2lap8y


I've not posted changelogs for today's update as there will be more updates for Android 15 fixes as they come including another update today/tomorrow. Would spam the feed.

Most users will not get the Android 15 updates yet as it is exclusive to Alpha release channel so testers can provide feedback on fixes with AOSP bugs.

Some improvements also need to be made to Private Space. It needs to be worked on further to be more useable to GrapheneOS users, like an install available apps feature similar to user profiles. Private Space was only designed for installing apps from the OS source so it ends up opening the GrapheneOS App Store or Play Store for now, would need to get APKs manually, may be a problem to some.

Private Space also can't transfer files from Owner to Private Space (other way around is fine) which is a regression. Additional work needs to be done.

Here is how the Private Space feature looks so far. This footage belongs to tuxsudo, a Cake Wallet contributor.
 https://image.nostr.build/3940b2b6978e5629db0e29f36c23e4e0ef17e21c93ca1a3d84b343964a3bed91.jpg

Check out his thread for more, note this is footage from a sideload-only pre-Alpha build of GrapheneOS and regressions in this thread have or are currently being addressed in following updates. If you are a normal user then you do not have this feature yet.
 https://xcancel.com/tuxpizza/status/1846494168496959667#m


Can see more about it here: https://stacker.news/items/722833


Final

Still fighting. Security researcher and engineer, contributor #GrapheneOS. Npub used for post comments and support.

Different key? Burned my last npub. See first note for verification.


Stacker News is going noncustodial!

- Zaps to me aren't affected, transactions to final@stacker.news always attached to my own external wallet. Sending to there sends to final@minibits.cash.

- regardless, I have replaced the zap address on my Nostr page.

- Yes, I accept ecash now. #Nuts!


Not usually something I like to post about, but I was waiting for a Material 3 UI Notes App for a long time.

Then I found this app: https://image.nostr.build/ed3abbd7ae3e6381ebf516776ba26b83f692045f0451671af7adb489c751d3f6.jpg

Text formatting, exports to Markdown and JSON, media support, and encrypted backups. I've personally wanted an app like this for a long time. Other apps are either text editors or are very dated.

Apps like these fit extremely well into #GrapheneOS and I have a soft spot for them. I hope the developer continues working on it.

Check it out: https://github.com/maelchiotti/LocalMaterialNotes


6 Pro was the first phone to get the 120hz display. But the 8a is the first A-series to get 120hz. The 6 Pro is cheaper, but the 8a is better value with an extremely long update span and the best security features.


New key for nostr:nprofile1qqstnr0dfn4w5grepk7t8sc5qp5jqzwnf3lejf7zs6p44xdhfqd9cgspzpmhxue69uhkummnw3ezumt0d5hszrnhwden5te0dehhxtnvdakz7qgawaehxw309ahx7um5wghxy6t5vdhkjmn9wgh8xmmrd9skctcnv0md0, give him a follow if you want updates on GrapheneOS.

nostr:nevent1qqs99ufgxxxd33ennrmlwjqjjpd7zrtszftdnmsn8yzu6a3aehhgtccpzdmhxue69uhhwmm59e6hg7r09ehkuef0qgstnr0dfn4w5grepk7t8sc5qp5jqzwnf3lejf7zs6p44xdhfqd9cgsrqsqqqqqp9dea0e


There isn't a formal vetting process as we rarely make app recommendations. Accrescent is maintained by a long-term community member and we have been indirectly watching progress over it since the project started since we needed something like it. If we had the resources we'd be funding it ourselves.


#GrapheneOS version 2024101600 released:

This is the initial release of GrapheneOS based on Android 15 based on the October 15th stable release of Android 15. We had previously ported all of our features to Android 15 based on the Beta releases and have been finishing it up based on the early September release of the source code for Android 15.

The most notworthy addition to GrapheneOS from Android 15 is Private Space, where users can create an isolated, sandboxed environment on their device to separate apps. Apps in the private space show up separately to other apps and are hidden from the recents view, notifications, settings, and from other apps when the private space is locked.

The sandboxed space works like a profile where the end user adds or installs an app inside private space and the app is installed in a new Android profile. The system treats this as a fresh app install, and no app data is copied over to the private space. When the space is locked, the private profile user is stopped, and when the space is unlocked, the user is started.

Apps in the private space are installed as separate copies of the apps in the main space. User content (user-generated or downloaded) and user accounts are separated between the private space and the main space. You can use the system Sharesheet and the Photo Picker to give apps access to content across spaces only when the private space is unlocked.

A private space does not replace user profiles, although it may be better for some users depending on what they use user profiles for. Currently, private spaces are only able to be ran on the Owner profile. We hope to add improvements and enhancements to this feature, in theory there could be support for multiple Private Spaces at once but memory usage is a concern and this needs to be considered first.

Changes since previous version:

- full 2024-10-05 security patch level since the Pixel patches were disclosed in the Pixel Update Bulletin today rebased onto AP3A.241005.015 Android Open Source Project release (Android 15)

- full port of GrapheneOS features to Android 15 including integration of our features with the new Android 15 features including Private Space

- Sandboxed Google Play compatibility layer: add stubs to fully remove the need for the Google Services Frameworks app, which has been removed as a dependency in our app repository for Android 15+ and you can remove it for an existing install of sandboxed Google Play after each Google Play services installation runs at least once on Android 15 which migrates the GSF databases to itself (stock OS still requires this despite nearly fully obsoleting it for Android 15)

- Pixel 9 Pro Fold: add assorted device-specific Settings and SystemUI changes to better match the stock OS

- kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.56

- Vanadium: update to version 130.0.6723.58.0

- GmsCompatConfig: update to version 141

This update is currently limited to a sideload-only release but if there are no regressions it will be pushed into the over-air updates. For users on Stable, expect Android 15 releases to come to your device in the coming days.

https://grapheneos.org/releases#2024101600

nostr:nevent1qqsrnzvv65prgn5mt56kq0vnjme4jj48j9jy0khc6t99vfwc9552y3spzpmhxue69uhkummnw3ezumt0d5hsyg9e3hk5e6h2ypusm09ncv2qq6fqp8f5clueylpgdq66nxm5sxjuygpsgqqqqqqssavauy


Our initial #GrapheneOS release based on Android 15 is now available for early testing for technical users willing to sideload the release to their device. It's a regular production release and this can be done on a locked device with USB debugging disabled, but it's not heavily tested yet.

If you're interested in helping with either the early testing via sideloading or regular public testing via our Alpha and Beta channels, join our public testing chat:

https://grapheneos.org/contact#community-chat

You can choose between Matrix, Discord, IRC or Telegram. Most people use Matrix or Discord.


Initial Android 15 release for GrapheneOS looking good so far. OS builds are built for 6/15 devices and counting. Hope to have a release out soon.


Big day for GrapheneOS coming.


Cellebrite recently had a job application for an Android security researcher with experience in MTE and PAC (ARMv9 security features) as a desirable bonus.

Can you guess the only mobile OS with the best/only production MTE implementation and PAC in userspace and not just kernel?

🫣🤔


If you mean state-level threats, it's not likely they'd want to target the secure element unless there's a requirement to prove they aren't tampering with data in the operation. This capability is most useful for attacks with physical access. Cellebrite wants this because their tools are used with seized phones for customers to extract a forensic copy of it's data.

It is almost certain groups are researching this capability. We recommend users to use a high entropy passphrase that can't be brute forced if they believe that it could happen and if it will be used against them. Brute force also doesn't always mean secure element is exploited, MSAB's now burned stock Pixel brute force capability used a memory dump instead of secure element.

Remote exploitation may be better for intelligence agencies. GrapheneOS defence strategy puts remote exploitation as the most dangerous threat we want to protect against. Users with that risk should do due diligence on who and what apps they communicate with.


CashApp isn't available in my country. I'd suggest their web app or using the sandboxed Play Services, or registering an account on another device and logging in on here.

If it doesn't work, it's blocking OSes that are not Google certified


Worth noting it's same with the team. Some have technical knowledge but some don't use them because they have different backgrounds. Some full-time devs are paid with BTC and Monero but not all.


We don't plan to bundle apps at this time, we keep a blank slate to reduce trusted parties on install. We recommend users to get an app store of their choice by themselves. The Play Store and Accrescent are in our app store app because we vet these apps.


Most users don't use any cryptocurrency, they're just ordinary individuals most of the time. We have quite a broad range. Outside of BTC or XMR the most significant after those two is probably ETH, Vitalik Buterin himself uses GrapheneOS. To my knowledge he's one of our largest donors too but not entirely sure on the numbers?


I'm still around! 👋 I burned the last key due to some important changes and I'm on more secure devices. I am letting the official project account Mastodon bridge do the responses where possible. The whole team uses that and they can be around when I'm busy.


This update is now in Stable.

https://grapheneos.org/releases#2024101200

nostr:nevent1qqsr7f0gp36wrhnyultrpkjv2n7h4v42zr43955qddlmk4gtk28fq8cppemhxue69uhkummn9ekx7mp0qgstnr0dfn4w5grepk7t8sc5qp5jqzwnf3lejf7zs6p44xdhfqd9cgsrqsqqqqqpgfcsfa


New change to #GrapheneOS website.

You can now see which device has which releases in Alpha, Beta, and Stable channels. This let's you know what release you'll be on depending on the channel you used.

https://grapheneos.org/releases


Facebook shipped buggy stack overflow detection in the Hermes JavaScript engine used by React Native:

https://github.com/facebook/hermes/issues/1535

It breaks when the default stack guard is 64k instead of 4k. The standard 64-bit ARM Linux ABI requires 64k. So far only 1 person noticed a broken app.

We're going to be temporarily reverting a change in today's release of #GrapheneOS before Facebook's broken code reaches more apps. We tried lying to apps about the stack layout to hide this change but that breaks compatibility much more. We'll have to detect the Facebook library instead.

Not particularly important since we weren't planning on switching to standard 64k stack probes instead of 4k stack probes to avoid risk. However, it's nicer if it's larger to cover 3rd party code without stack probes. Very minor compared to other things blocked by app compat.

The main feature that's blocked due to third party app bugs is enabling hardware memory tagging by default for all user installed apps. That works fine but catches many memory corruption bugs. We might put the toggle into the setup wizard so that most users end up enabling it.

We want to disable the 32-bit ARM system call ABI in the kernel config on devices without 32-bit app support. Certain widespread anti-tampering frameworks use it even on devices like the Pixel 8 without CPU level support for 32-bit. We'll have to extend the seccomp filters.

We want to disable the 32-bit ARM system call ABI in the kernel config on devices without 32-bit app support. Certain widespread anti-tampering frameworks use it even on devices like the Pixel 8 without CPU level support for 32-bit. We'll have to extend the seccomp filters.

Enabling ShadowCallStack for Vanadium worked well but caused issues with WebView-based apps, likely due to anti-tampering code. This would be nice even on the recent devices with PAC and MTE until we have stack allocation MTE enabled... which is blocked due to app bugs for now.


Android Auto with GrapheneOS on OSMand maps

nostr:nevent1qqs8vg9fym7gv3jwhy30edmvejzque7uw8ky05vc3wyql4y0rn8fklspzamhxue69uhhyetvv9ujumn0wd68ytnzv9hxgtczyq89gkx4qje3xanx0fc36krcl29es7zpjmn6fsr2ms9dfmvu9pf5sqcyqqqqqqghxmyu9


TLDR: Tech 'journalism' sensationalizing something that happens on every other Android device to be a Pixel 9 issue to scare people away from Pixels into less secure platforms.


GrapheneOS statement regarding a highly misleading and inaccurate article from Cybernews about the Pixel 9 'phoning home'

https://discuss.grapheneos.org/d/16338-highly-misleading-and-inaccurate-article-from-cybernews-about-the-pixel-9


Tor Browser users, please update your browser.

https://blog.torproject.org/new-release-tor-browser-1357/

Latest update patches a remote code execution vulnerability confirmed to be exploited in the wild.


Also, this is outdated and we published the July version as well. These docs don't reflect newer iOS versions or iPhone 16


We're the ones who published these documents on the GrapheneOS social media account.


New GrapheneOS update out now folks. Contains this month's security patch level and some fixes with memory tagging by patching some Android memory bugs.

nostr:nevent1qqsvvwunwpzx4492p3j3vx0t5vw78mk943f7nsz9awh3pd4pfngtg8gpzamhxue69uhhyetvv9ujumn0wd68ytnzv9hxgtczyp2x308wkaxwxh95zu7uext5hhdvn6y55a9l84z0nj5tw42xqhy76qcyqqqqqqg9x7e5q


GrapheneOS features don't just stop exploitation of vulnerabilities, but uncovers potential vulnerabilities in apps.

nostr:nevent1qqsdhlnf5ezmjkdvc08gdmljex320jh5etyyxxcdlfazgmx8ppsmjaspzamhxue69uhhyetvv9ujumn0wd68ytnzv9hxgtczyp2x308wkaxwxh95zu7uext5hhdvn6y55a9l84z0nj5tw42xqhy76qcyqqqqqqgtw6and


That npub was burned, I don't use that one anymore.

(Check GrapheneOS forum profile for npub so you don't click a sketchy from me.)

It's not something we come across, but we are aware Orbot has some problems, that's why a Tor VPN app is being redone (not by us) in the future.

We are aware of leaks caused by some VPN apps and we keep making patches to fix it but they end up breaking said apps and force us to revert. It's predominantly an app issue, look at the posts on my old npub about Mullvad to get what I mean here.

Latest build added a second-generation leak prevention mechanism but for it's for multicast leaks: https://grapheneos.org/releases#2024092900

I'd contain Tor usage in its own profile so I don't see this happen. I guess if it happens right when Orbot is connecting, give it a few seconds after connecting before doing something?


Top of Stacker News, thank you so much.


#GrapheneOS: The Purpose, The Strategy, and The Why [Article]

This post explains a bit about the development approach, reasoning and strategy behind GrapheneOS security innovation and how power users protect themselves.

On SN: https://stacker.news/items/705242


cc: nostr:nprofile1qqsyawyrzrttfmv4cmtx5w2m85702kdct7hv3amfrkhagpdf9cz46mgprpmhxue69uhkv6tvw3jhytnwdaehgu3wwa5kuef0qyghwumn8ghj7mn0wd68ytnhd9hx2tcpydmhxue69uhkv6tvw3jhytnwdaehgu3wwa5kuef08ankcmmzv9kr6ctvds20l3q3 believe I mentioned making a post like this to you before, here it is.


Using an app that locks with the OS credential  like Phoenix Wallet in GrapheneOS allows you to trigger the device duress password when starting the app because the duress feature also extends to any OS credential input. This doesn't extend to apps exclusively doing their own implementation of a PIN though.


The older generation face scanning hardware was far more robust and secure and the current face unlock options are far less.


RE: Chainalysis

Companies targeting users of cryptocurrencies like Blockchain analysis firms being a fan of the tech would be expected. I would expect they use it on a daily basis and would know more about it than the typical maxi would. In conferences i've met FBI digital forensics lab staff who hold Bitcoin because of learning more about it during seizures.

We have a similar two-faced relationship with forensic companies who try and target GrapheneOS and the Pixel platform.  Hate that we do whatever we can to break their capabilities but some definitely use GrapheneOS because they are impressed by the security offerings. I also find some of their tools interesting. Chainalysis is a very well made application.


Didn't have the zap address back, only the NIP-05 (which is the same as the zap address)


What would you want to see in a post about #GrapheneOS? Preferably something you've not seen in posts before. I want to be unique here. Is there a feature you want to understand the technical details about? Maybe a justification on X? Would be inrerested to know.

nostr:nevent1qqsrk40h6yrmwsm7lmgjylpulecz3khpy8yncp8havkkulglvcql9rspzpmhxue69uhkummnw3ezumt0d5hsyg9e3hk5e6h2ypusm09ncv2qq6fqp8f5clueylpgdq66nxm5sxjuygpsgqqqqqqstru8hv


Believing they are using the literal definitions to base their statement here... For data to be uncensorable it needs to be known and distributed to everyone. Online privacy is about reducing, hiding, or anonymizing data so it's not known. Some privacy techniques involve self-censorship.

You can use censorship resistant platforms with privacy technologies like onion routing to make the connection between your identity and the platform private, but what you create on the platform is never private.


If a nation state had been in my old phone I'd almost consider it a compliment because I am fucking boring 🫡


Every time a GrapheneOS post trends on SN I feel like delaying my big post I promised a year ago because I don't want to oversaturate the trending with the project. Suffering from success...


Wasn't really something I looked into since it was extremely unexpected. Also up to believe official GrapheneOS platforms would suffice in announcing my key change. I dont want to spread fear by people misunderstanding a personal and isolated incident as a GrapheneOS one.


All the text the LLM produced are just explaining the default features of Android (secure boot, disk encryption, data collection etc). Doesn't go into the features of any of them. Also some features like "secure boot" (likely means Verified Boot) depends on device support. Replicant definitely doesn't have that.

Id look at: https://eylenburg.github.io/android_comparison.htm


That would be the standard procedure, but circumstances about the event meant I couldn't. Users should announce change of keys if able to.


I didn't put the links as some people may have thought links may be phishing (IF YOU DO, GO FIND MY PAGES ON A SEARCH ENGINE INSTEAD! DONT TRUST ME!)

BUT, if you kinda trust me:

Official GrapheneOS forum page: https://discuss.grapheneos.org/u/final

My stacker.news page:
https://stacker.news/final

All zaps are going to the original address the old npub has as you can see on my profile so I earn nothing doing this if I was a real faker anyway.


how im looking today
 https://image.nostr.build/e32bccf36796b26d7877f8bccdee568d20406e2018f1c136c27e39f3ee5e38f4.jpg


I understand. I imagine I have really annoyed a ton of people but oh well.

Key pairs for Nostr are great for verification but are a disadvantage towards certain security measures. Nsec is only as secure as the app that generated it and is only as secure as the least secure platform you stored/used it on. Takes a lot of responsibility, which I'm fine with, but most people aren't.

If you want to change security requirements (like me) you likely need to burn your key... I guess it's no different to PGP keys that expire on a set time but I'd really be waiting for a dedicated secure hardware signer before I ever share my Nostr nsec keys on any other app or device... and id probably also rotate my keys again if a device existed.


He has bursts of being quite busy.


1. npub is burned, can't post what I don't have the keys for.

2. Official GrapheneOS forum page: https://discuss.grapheneos.org/u/final

3. https://stacker.news/final

Trust me or not, it's up to you. All zaps are going to the original address the old npub has as you can see on my profile so I earn nothing doing this if I wasn't who I'm claiming to be.

You're free to contact another GrapheneOS team member.


Metroplex: nostr:nprofile1qqsyxcm6xydptuwz2w6avpmc4d65ftrrnwywz688yf9fqr22gy5rrqcpzamhxue69uhhyetvv9ujumn0wd68ytnzv9hxgtc9zjrax

He was in Nostr before I was.


1. npub is burned, can't post what I don't have the keys for.

2. Official GrapheneOS forum page: https://discuss.grapheneos.org/u/final

3. https://stacker.news/final

Trust me or not, it's up to you. All zaps are going to the original address the old npub has as you can see on my profile so I earn nothing doing this.

You're free to contact another GrapheneOS team member.


#plebstr #nostr #newstr (winks)

nostr:nevent1qqs8d4xg7f0fyfl29wjfxyest6fshsy7x2te298cfs2xj7sema4zh7cpz4mhxue69uhkummnw3ezummcw3ezuer9wchsyg9e3hk5e6h2ypusm09ncv2qq6fqp8f5clueylpgdq66nxm5sxjuygpsgqqqqqqspt0sq8


Hi all, Final from #GrapheneOS again.

Due to an extraordinary event (not a breach!) and a change causing me to up my security requirements, I have burned the previous npub I used. This is my new npub. My security requirements are above people's conveniences, I apologise for these inconvenience but I don't regret necessary actions either.

- I will use this npub for post comments and support.
- I will refrain from constant GrapheneOS reposts as Mastodon bridges fulfill that space. Rest of the team can also USUALLY see posts there. I believe I should be more diverse in my content here.
- In short, less GrapheneOS, and more Final.

I can be verified using the original Stacker News account (final) NIP-05, Bio and LN address.

I can be verified via the GrapheneOS discussion forum user page (final). You may also verify me in any official GrapheneOS platform you wish.

Thank you for the support.

-- final


Relay list to discover the user's content