<unnamed>

Public Key

npub1c9d95evcdeatgy6dacats5j5mfw96jcyu79579kg9qm3jtf42xzs07sqfm

Profile Code

nprofile1qqsvzkj6vkvxu745zdx7uw4c2f2d5hzafvzw0z60zmyzsdce9564rpgpz3mhxue69uhhyetvv9ujumn0wd68ytnzvuq32amnwvaz7tmpvanhytnwdaehgu3wd3skueqpzfmhxue69uhhqatjwpkx2urpvuhx2ucpz3mhxue69uhkummnw3ezuvrcw3ezuer9wc8zzjm2

Publishing to

Last Notes

2024-08-26 16:31:50 UTC

Great article from well known cryptographer Matthew D. Green about Telegram per recent events
https://blog.cryptographyengineering.com/2024/08/25/telegram-is-not-really-an-encrypted-messaging-app/

2024-08-25 08:27:04 UTC

Telegram has full access to all of the content of group chats and regular one-to-one chats due to lack of end-to-end encryption. Their opt-in secret chats use homegrown end-to-end encryption with weaknesses. Deleting the content from the app likely won't remove all copies of it.
Telegram has heavily participated in misinformation campaigns targeting actual private messaging apps with always enabled, properly implemented end-to-end encryption such as Signal. Should stop getting any advice from anyone who told you to use Telegram as a private messenger.
Telegram is capable of handing over all messages in every group and regular one-to-one chat to authorities in France or any other country. A real private messaging app like Signal isn't capable of turning over your messages and media. Telegram/Discord aren't private platforms.
A major example of how Telegram's opt-in secret chat encryption has gone seriously wrong before: https://words.filippo.io/dispatches/telegram-ecdh/.
The practical near term threat is for the vast majority of chats without end-to-end encryption: 100% of Telegram group chats and the regular 1-to-1 chats.

2024-08-20 20:01:28 UTC

We've started work on adding support for the Pixel 9, Pixel 9 Pro and Pixel 9 Pro XL. We haven't received our test devices yet but they should arrive within a couple days. Pixel 9 Pro Fold will be supported like the earlier Pixel Fold but it's launching later than the others.
#GrapheneOS on the Pixel 9 Pro Fold will be the first folding phone platform with hardware memory tagging support. The original Pixel Fold is a 7th generation device without these security features. We still need a new Pixel Tablet with ARMv9 CPU cores with MTE, PAC and BTI. They'll hopefully release one in mid-2025 when they release the Pixel 9a.
Pixel 9 Pro Fold is much better than the first generation Pixel Fold. There have been major advances for the folding screen and it has been widely reviewed as being a much better device. It also has a much broader launch. Likewise, it would be great to have a tablet with MTE and 7 years of support from launch instead of 5.

2024-08-16 19:58:34 UTC

This is a fake story: https://x.com/cryps1s/status/1824077327577591827
Turns out that getting security information from the CISO of a mass surveillance company trying to build a dystopian police state providing police with "predictive policing" software largely based on racial stereotypes is a bad move.
Trail of Bits iVerify EDR product runs in the standard app sandbox on iOS and Android. It can hardly do anything beyond static scanning of APKs. It's a crippled antivirus app marketed as detecting sophisticated attackers. It's a scam and Trail of Bits has lost all credibility. Trail of Bits is working closely with Palantir and is focused on getting government contracts. They've created a fake news story to promote their EDR product which has been propagated across mainstream media. Journalists didn't do basic due diligence and spread false marketing.
Verizon has a suite of low-level apps for Android devices to fully use their network. These are included on any Android device with full Verizon support. Pixels disable the packages unless a Verizon SIM is active. This is equivalent to having them installed/uninstalled on demand. One of the apps in this suite is the Showcase retail demo app for Verizon to show off phones in their store. It requires manually up the phone as a retail demo device. Verizon says they don't use it anymore. This demo app is where Trail of Bits / iVerify found an HTTP connection.
In order to exploit Verizon's demo app not verifying a signature for the downloaded config or even fetching it via HTTPS, it would already need to be set up to use retail demo mode. The contractors Verizon paid to implement it did a bad job, but it's not a Pixel security issue. Since it's an obsolete app that Verizon isn't using anymore, the stock Pixel OS already removed it in Android 15 which is visible in the Android 15 Beta. The other Verizon apps needed to fully use their network which get activated with a Verizon SIM are of course still included.
#GrapheneOS has been omitting these carrier apps since around 2015. This meant GrapheneOS users weren't able to use Sprint and can't use certain features on Verizon like Wi-Fi calling. Apple has a special deal with Verizon and implements what the control they want as part of iOS. The restrictions set in Verizon's carrier configuration and the functionality implemented by these apps is a major part of why they prevent installing an alternate OS on any device sold by Verizon. They want to control how people use features like tethering and Wi-Fi calling.
Every month, a bunch of real vulnerabilities are patched for Android on Pixels. A subset of these including all High and Critical severity issues in Android itself get backported to older Android releases for non-Pixels too. iVerify's finding isn't even a Low severity issue. Supposedly reputable news organizations including the Washington Post, New York Times, Wired, etc. are largely acting as press release distribution service for governments and corporations. If it fits a narrative they want to tell, there's no attempt to question or confirm it.
Trail of Bits employees should think over whether they want to be part of building a police state with pervasive surveillance as Palantir partners. You're not even working at a reputable security company anymore. Trail of Bits has become the charlatans they used to criticize.
#security #privacy

2024-08-15 18:21:04 UTC

Wired was manipulated into spreading misinformation to market Palantir and iVerify by misrepresenting a vulnerability in a disabled demo app as being a serious problem which could be exploited in the real world. They should retract the article but won't.
https://www.wired.com/story/google-android-pixel-showcase-vulnerability/
iVerify are scammers and anyone paying them money should rapidly stop doing it and remove their malware from their devices. The real security risk is giving remote code execution on your devices to one of these sketchy EDR companies lying about their capabilities and discoveries.
This is one of multiple carrier apps in the stock Pixel OS which we don't include in #GrapheneOS. We were aware of it already since we had to go through them and figure out why they exist. We could embrace this fearmongering and leverage it for marketing, but we aren't dishonest.
"iVerify vice president of research [...] points out that while Showcase represents a concerning exposure for Pixel devices, it is turned off by default. This means that an attacker would first need to turn the application on in a target's device before being able to exploit it."
"The most straightforward way to do this would involve having physical access to a victim's phone as well as their system password or another exploitable vulnerability that would allow them to make changes to settings. Google's Fernandez emphasized this limiting factor as well."
Wired should retract the article and explain how they're going to do better. They keep publishing this kind of fearmongering misinformation from information security industry charlatans. There are real remote code execution flaws being fixed in Android and iOS but they push this.

2024-08-09 02:46:05 UTC

- reply

Appears not every reply goes through the Mostr bridge but we said there was a WiFi reset option if that could help?

2024-07-31 06:12:49 UTC

arstechnica.com/gadgets/2024/07/loss-of-popular-2fa-tool-puts-security-minded-grapheneos-in-a-paradox/
The article unfortunately leaves out most of the points we made in the thread.
#GrapheneOS supports hardware-based attestation and it's entirely possible for Google to allow it as part of the Play Integrity API. They choose to ban using GrapheneOS.
Play Integrity API has no minimum security patch level and nearly all these apps use weak software-based checks that are easily bypassed by attackers. The hardware-based checks rely on trusting every key distributed to every certified Android device, which are often leaked.
Hardware-based attestation can be used for security purposes such as verifying device integrity with a pinning-based approach without the weakness of being vulnerable to leaked keys from the whole Android ecosystem since specific per-app keys in the secure element can be pinned.
Play Integrity API is claimed to be based on devices complying with the Compatibility Test Suite and Compatibility Definition Document. We have irrefutable proof that the majority of certified Android devices do not comply with the CTS/CDD. Play Integrity API is based on lies.
Essentially every non-Pixel device has important CTS failures not caused by CTS bugs. OEMs are cheating to obtain certification. Google claims GrapheneOS can't be permitted because we don't have a certification where they freely allow cheating and don't ban non-compliant devices.
Since Play Integrity doesn't even have a minimum security patch level, it permits a device with multiple years of missing patches. Hardware attestation was required on all devices launched with Android 8 or later, but they don't enforce it to permit non-compliant devices.
The reality is that the Play Integrity API permits devices from companies partnered with Google with privileged Google Play integration when they're running the stock OS. It's easy to bypass, but they'll make changes to block it being done at scale long term such as if we did it.
It does not matter if these devices have years of missing security patches. It doesn't matter if the companies skipped or improperly implemented mandatory security features despite that being required by CDD compliance. Failing even very important CTS tests doesn't matter either.
Google can either permit GrapheneOS in the Play Integrity API in the near future via the approach documented at https://grapheneos.org/articles/attestation-compatibility-guide or we'll be taking legal action against them and their partners. We've started the process of talking to regulators and they're interested.
We're not going to give Google veto power over what we're allowed to do in GrapheneOS. We comply with CTS and CDD except when it limits our ability to provide our users with privacy and security. Google wants to be in charge of which privacy/security features can be added. Nope.
Google's behavior in the mobile space is highly anti-competitive. Google should be forbidden from including Google Mobile Services with privileged access unavailable to regular apps and services. GrapheneOS sandboxed Google Play proves that hardly anything even needs to change.
Google should also be forbidden from participating in blocking using alternate hardware/firmware/software. They've abused their market position to reinforce their monopolies. They've used security as an excuse despite what they're doing having no relevance to it and REDUCING it.
Google is forbidding people from using a growing number of apps and services on an objectively far more private and secure OS that's holding up much better against multiple commercial exploit developers:
https://grapheneos.social/@GrapheneOS/112826067364945164
They're holding back security, not protecting it.
We've put a lot of effort into collaborating with Google to improve privacy and security for all Android users. Their business team has repeatedly vetoed even considering giving us partner access. They rolled back us being granted security partner access by the security team.
As with how they handle giving out partner access, the Play Integrity API serves the interests of Google's business model. They have no valid excuse for not allowing GrapheneOS to pass device and strong integrity. If app developers want to ban it, they can still do it themselves.
After our security partner access was revoked, we stopped most of our work on improving Android security. We continued reporting vulnerabilities upstream. However, we're going to stop reporting most vulnerabilities until GrapheneOS is no longer blocked by the Play Integrity API.
This year, we reported multiple serious vulnerabilities to Android used by widely used commercial exploit tools:
https://source.android.com/docs/security/overview/acknowledgements
If Google wants more of that in the future, they can use hardware attestation to permit GrapheneOS for their device/strong integrity checks.
Authy's response about their usage of the Play Integrity API shows their service is highly insecure and depends on having client side validation. Play Integrity is thoroughly insecure and easily bypassed, so it's unfortunate that according to Authy their security depends on it.
If Authy insists on using it, they should use the standard Android hardware attestation API to permit using GrapheneOS too. It's easy to do:
https://grapheneos.org/articles/attestation-compatibility-guide
Banning 250k+ people with the most secure smartphones from using your app is anti-security, not pro-security.

2024-07-26 15:16:12 UTC

- reply

Should specify Bitcoin ratio is higher because of the amount donated, not the amount of Donations themselves. Monero users donate more often, but Bitcoin users donate higher amounts.

2024-07-26 10:46:02 UTC

- reply

This time last year, the ratio for BTC:ETH:XMR:ZEC donations via donate page addresses are around 40:20:20:1. We received more donations via Monero than Bitcoin and nearly all of the ETH came from a single, gigantic donation enough to hire a full time developer. Outside of Lightning (not official) then Monero is the only consistent, reliable flow of small crypto donations. ETH gets some as well but not as much.

2024-07-22 09:51:13 UTC

- reply

These tools/procedures are widely used for other reasons including at border crossings. They get training to use it. Law enforcement also often uses them illegally for unjustified search and seizure targeting those who have done nothing beyond crossing a border or journalism. The groups of people using tools from Cellebrite or competitors are often the ones breaking the law or using them for criminal reasons. Many of the people using these tools are criminals breaking the laws of the land.
Even if they say it's only for certain governments and law enforcement clients, it doesn't and won't stop them getting out. There are likely militias, juntas, or criminals in the world with access to these tools as long as they are powerful enough. If Cellebrite isn't available somewhere, something else will take it's place. If we can get documentation, someone far more powerful could get far more.
Defending against tools like these being only valuable to the criminals is a narrative for authoritarianism. Don't let them attack you this way.
#nevent1q…aw2x

2024-07-21 19:26:24 UTC

EXCLUSIVE: Here's the Cellebrite Premium 7.69.5 iOS Support Matrix from July 2024.
404media recently published an article based on the same April 2024 docs we received in April and published in May. Many tech news sites including 9to5Mac made incorrect assumptions treating that as current.
https://image.nostr.build/f042276d5b54561f39a1cf73f9e3dc5c0b8946c4744eb7a20445c859fcbdc7c3.jpg
https://image.nostr.build/df75e212117bed9ec8e1ae80c06ac78ab66dd981931a5f2c796803150856fbf9.jpg
https://image.nostr.build/24e57317d9f77fc17bb26485a319e28d02c0f36df2038681acae9d0ebc1c1bcb.jpg
Here's the Cellebrite Premium 7.69.5 Android Support Matrix from July 2024 for Pixels. They're still unable to exploit locked #GrapheneOS devices unless they're missing patches from 2022. A locked GrapheneOS device also automatically gets back to BFU from AFU after 18h by default.
https://image.nostr.build/6c2c963377aa75af248e5c4ce646df70f50e1d5eedb2184e4b27f63faffd44ee.jpg
https://image.nostr.build/33551de196f545a14b82051aa2a4a826fb84577821c60f4b9841508fb73af375.jpg

2024-07-20 23:44:39 UTC

- reply

The lead dev of Accrescent is a GrapheneOS user and contributor. It'll be a good place to publish apps especially for GrapheneOS users. AppVerifier, BeauTyXT (text editor) and Transcribro (private, on device voice recognition and keyboard) are from the same person who wrote our GrapheneOS Info app. Molly is a security-focused fork of Signal from another GrapheneOS user.

2024-07-20 23:13:58 UTC

- reply

These details should tell you that if you consider these types of groups (sophisticated adversaries with limitless physical access) as a part of your threat model, then you should:
- Use the most recent phone you possibly can
- Upgrade your phone to the newest possible generation as soon as possible after release if you can help it.
- Use the latest version of GrapheneOS ASAP. Do not delay.
- Use a strong, high entropy passphrase to make bruteforcing the device credential impossible if secure element is ever exploited.
- Set GrapheneOS auto reboot time accordingly so encrypted data goes back at rest when the phone reboots, which makes AFU exploitation impossible. The lower the better.
- Enable duress password. Set it to something easy to trigger but not easy to misfire.
- Turn your phone off in a high risk situation, and trigger duress when in a duress situation.
- Disable your radios when not using them (turn off Wi-Fi, use airplane mode, disable NFC, UWB etc.) for attack surface reduction.
- Set an appropriate USB port control or disable the USB port so they aren't able to connect a device to it.
- Use user profiles (application data and user files within profiles are stored encrypted with separate credentials).
- Enable upcoming GrapheneOS security features like second factor authentication unlock when they come out.
- Communicate only over secure messaging. Some apps like Molly (Signal fork) have features to encrypt the app storage with a passphrase, which access to that app's data impossible even when a profile is compromised providing the passphrase is secure enough.
- Become disassociated to data. Learn to only keep files or other data as long as it is necessary. If you have no use for them for a long time, then back it up elsewhere, encrypted. Delete anything you don't have a use for in the present. Your data is not your memories.
- Remember that you are only as secure as the people you trust. If they do not meet your safety or security requirements, don't enable them to do things that could cause trouble.
#nevent1q…af3p

2024-07-20 20:35:37 UTC

- reply

For outside GrapheneOS there's https://accrescent.app

2024-07-20 18:29:30 UTC

- reply

You will need to be on the latest GrapheneOS App Store, it may not have reached everyone yet. If you don't have it then try select Beta and update. You are free to set it back to Stable after updating.

2024-07-20 11:35:56 UTC

- reply

fyi I am aware of other projects using Hardened Malloc as well, for example this hardened Void Linux build has hardened malloc and other hardening:
https://0xacab.org/optout/plagueos
https://0xacab.org/optout/plagueos/-/wikis/Security-Considerations
https://0xacab.org/optout/plagueos/-/wikis/FAQ
It sounds very interesting butI (and I think anyone I know) have never used it though. Can't make a recommendation. Using smaller projects is at your own risk.

2024-07-20 11:28:09 UTC

- reply

The Chromium itself is still patched to disable data collection and opt-in metrics according to the developer and since it uses Vanadium patches I could attest to that. Always better to use the Chromium as a base and build with own patches rather than centipeding someone's fork like ungoogled-chromium. Since if they delay, then you delay.
These forks also aren't security hardened like Vanadium is, forks will just amateurly take out anything that mentions Google which leads to some regressions.
Secureblue is not endorsed but both have a similar user share and the maintainers are frequent GrapheneOS community members. It's listed as an example of other OSes using hardened_malloc on our site.
It's usable, but hardened_malloc will break certain apps the same way they do on GrapheneOS for security. Electron apps are an example. I don't daily-driver secureblue though and the barrier for entry is higher than it is to get started with GrapheneOS.

2024-07-19 22:34:04 UTC

- reply

Brave is a top choice when it comes to content filtering and state partitioning. A big issue with Brave is how much, in my opinion, random nonsense they want you to use with it. Fortunately it never bugs you again once you disable it, but there could be better.
Secureblue (security-hardened Fedora Atomic images) uses a hardened Chromium with Vanadium patches, but it's part of Secureblue for the most part. It also uses our Hardened Malloc.

2024-07-19 15:34:41 UTC

The #Accrescent security and privacy focused Android app store is now available in the #GrapheneOS app store.
Accrescent is a mobile security and privacy project that closely ties to our values. We hope the Accrescent project can benefit from having more users.
Accrescent features:
- App signing key pinning: first-time app installs are verified so you don't have to TOFU.
- Signed repository metadata: repository contents are protected against malicious tampering.
-Automatic, unattended, unprivileged updates (Android 12+): updates are handled seamlessly without relying on privileged OS integration.
- Designed for split APKs: downloaded APKs are optimized for your device to save bandwidth.
- No remote APK signing: developers are in full control of their app signing keys.
- No account required: users don't need an account to install apps, improving privacy.
https://image.nostr.build/0a5a749032e0fb2aecefd1cf258e1bba535b69f66bade881f2202bd3f481b320.jpg

2024-07-19 15:31:02 UTC

- reply

GrapheneOS turns 10 this year, quality work takes time and all of this definitely didn't pop out of nowhere suspiciously. IMO this has been the best past 12 months for GrapheneOS so far. Several vuln disclosures, duress password, Vanadium content filtering and more in a small span of time. We definitely appreciate people coming to support GrapheneOS in droves the past 12 months.
It wouldn't make sense for us to be malicious for many reasons, not every GrapheneOS team member is working in private (e.g. the founder) and we have a Foundation registered in Canada with multiple directors. We participate with the broader cybersecurity community with vulnerability disclosures and such. There's nothing wrong with concealing your identity but in our case, we have reputation and our professional lives on the line not to be evil. How we work is very different and open in comparison to real sting operations ran by governments or scam products owned by criminals.
We dont deny certain people want to break us. We will never say we are impenetrable, but we are aware our work is targeted by threats aligned with governments such as in the leaked Cellebrite documentation where they discuss their failures with GrapheneOS. These people deceit the public with vague and misleading information to discredit us. Our effort the past year is down to fighting back on this attack and our fight is completely in the public eye for people to watch, we already survived a hostile takeover attempt, so we we're very sure we're here to stay.

2024-07-17 16:50:26 UTC

New pictures of upcoming Pixel 9 Pro Fold if anyone is interested: https://www.androidauthority.com/google-pixel-9-pro-fold-ncc-3461263/

2024-07-16 02:35:07 UTC

- reply

For other platforms it was never planned. It was considered for Android OSes as a whole but it's not worth it because non-GrapheneOS users would see major benefits. Vanadium's security advantage depends a lot on the hardware supported and OS security modelling, browser MTE support being the most significant.

2024-07-16 01:00:49 UTC

- reply

Try allow JavaScript JIT permission on site. Vanadium disables by default.

2024-07-10 08:46:41 UTC

#GrapheneOS: About the Positon location service:
https://grapheneos.org/articles/positon-location-service

2024-07-02 18:54:35 UTC

Project Announcement:
Unplugged are a recent entry in the crowded space of selling insecure hardware with significantly worse privacy and security than an iPhone as highly private and secure. Bottom of the barrel MediaTek device with outdated AOSP is worse than status quo. All marketing, no substance.
As part of marketing their products, Unplugged are spreading unsubstantiated spin and misinformation about GrapheneOS and the much more secure hardware we target. We've been aware of it for a while but chose not to respond to it until they began doing it in direct response to us.
#GrapheneOS is a hardened OS built on the latest release of the Android Open Source Project rather than older releases with inferior privacy/security and incomplete privacy/security patches. We substantially improve privacy/security with our changes rather than making it worse.
The work we do in GrapheneOS is highly regarded by privacy and security researchers. We've made major upstream contributions to the Android Open Source Project, Linux kernel and other projects, both through submitting privacy/security improvements and reporting vulnerabilities.
We've also reported numerous vulnerabilities in hardware/firmware along with making multiple suggestions for new features which were implemented for Pixels. They're the only devices meeting our security requirements ( https://grapheneos.org/faq#future-devices ). We target them because of security.
Pixels have first class alternate OS support, which does not come at the expense of security. Support for installing an alternate OS is implemented securely as part of best in class boot chain and secure element security for Android devices. Supporting it has benefited security.
Unplugged has claimed open source and support for alternate operating systems reduces security. Pixel security has benefited from many external security researchers along with contributions from GrapheneOS because of it. They'll benefit more as they publish more firmware sources.
GrapheneOS not only leverages the same hardware-based security features as the OS but implements major hardware-based features unavailable elsewhere.
Hardware memory tagging for production hardening is an exclusive GrapheneOS feature with a best-in-class implementation.
Our USB-C port and pogo pins control feature does hardware-level attack surface reduction with code written for the drivers on each device:
https://grapheneos.org/features#usb-c-port-and-pogo-pins-control
Our Auditor app leverages the pinning-based hardware attestation available on Pixels based on our proposal for it.
Many of our other features are hardware-based, and some of these exist because of features we proposals or helped to secure against weaknesses.
In April, Pixels shipped reset attack protection for firmware based on our proposal, which is not available on other Android devices.
That reset attack protection blocks real world attacks by forensic data extraction companies, which we reported to Android. In April, Pixels also shipped a mitigation against interrupted factory resets used by those companies based on our report, not yet available on non-Pixels.
In June, Android 14 QPR3 was released with a hardware-based OS feature fully blocking interrupting factory resets. This was based on our initial proposal we made as part of our reports of active exploits in January, similar to the reset attack protection shipped in April.
Unplugged uses an older Android release. They do not have this AOSP patch. Their hardware is missing many standard security features including these recent 2 improvements shipped on Pixels. Their hardware doesn't even close to meeting our list of security standards even on paper.
Unplugged has tried to misrepresent these improvements and falsely claimed they're uniquely relevant to Pixels due to alternate OS support. That's not true. Their device is missing these and many other security features, and is not more secure due to lacking alternate OS support.
Unplugged was founded by Erik Prince, the same person who founded Blackwater. Erik Prince, it's founder, and others involved in UP are deeply tied to human rights abuses and surveillance around the world. Best case scenario is they're simply grifting like the Freedom Phone. Worst case is much worse.
Unplugged are also infringing on the open source licensing multiple projects including DivestOS where they ripped off their AV from without attribution. They even still use DivestOS servers without permission. SkewedZeppelin is lead developer of DivestOS.
https://image.nostr.build/5f465e5c3f817dc88ce1c5749aef0515f0ff9d57e49b8a8fb07f1cda43a8ee96.jpg

2024-07-01 04:37:04 UTC

Vanadium version 126.0.6478.122.1 released:
Users will need to enable JavaScript JIT compilation for sites requiring WebAssembly again via the permission menu next to the URL due to us reverting the upstream security regression which resulted in this working by default. Unfortunately, Chromium still doesn't have a WebAssembly interpreter like Edge and got this working by rolling back the security of the API used to disable JIT compilation for their desktop V8 Optimizer toggle.
Support for language-specific content filters was added which is automatically enabled when the language is selected (EasyList Germany has been added to the configuration app for testing the implementation).
https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.122.1
#grapheneos