A very brief intro into Private Android

Communities Science, Engineering, & Security
1

The problem

Stock Android is very bad for privacy. Google Android runs Google play services which collects everything all the time. It also provides APIs that apps use to target users and gather data. What is worse is that almost all of the AOSP apps provided by AOSP have been replaced with proprietary Google ones. Everything from the messaging app to the clock app is collecting data. In Google Android you are expected to use Google apps and I don’t think you can install Play store apps without signing in.

What I use

I use Lineage OS on phone it works for what I need. All of my external apps are from F-droid and I don’t use any proprietary apps what so ever. The stock apps are very good so I don’t need things like a third party Camera app. I have also have done some simple hardening such as setting the private DNS setting which turns on DNS over TLS. I use a bunch of different F-droid apps I use but one of the more important ones I use is Organic maps.

While this setup is mostly solid it does have some serious draw backs. Because I don’t run MicroG or Play services I can’t use any traditional apps. Also Lineage OS does not support boot loader relocking which means I am vulnerable to evil maid attacks.

Other options

When I first started to move to private alternatives I initially used Lineage OS with MicroG. MicroG is a bit like Google play services but it is Foss and designed to be much more private. It spoofs the Google signature and provides many of the APIs found in stock Android. The biggest limitation with MicroG is that it doesn’t fool any Google software. To use anything like Gmail or Gmaps you need to have Google play services.

If I were to do this all again I probably would start with Calyx OS. The Calyx OS team seems to be made up of good people and they ship a Android experience that is privacy friendly. It comes with MicroG installed and setup and the bootloader gets relocked during install. The downside with Calyx is that it has less supported devices. (Although they are trying to add more) It is also farther behind in the update process and the apps are not as polished as in Lineage OS.

One of the things I see frequently is people recommending Graphene OS. I personally do not support Graphene OS and I wouldn’t recommend that you use it. It is better than Stock Android but that is about it. If you want more details let me know but I am trying to keep this short and sweet.

Note on Android security

One of the things I keep hearing Wendel mention is that he wishes Android had sandboxing. I am not quite sure what he is talking about since Android as some of the best sandboxing of any platform. The android security model follows least privilege and each app runs in there own isolated environment. The actual sandboxing is done with SELinux and it very strong. There have been very few exploits over the years and there is only one piece of malware that I know of that managed to persist across a factory reset.

The real weakness in Android is the proprietary kernel baggage. The Android device kernels are based on specific Linux kernel versions and you can’t easily mainline a device. Almost all of the hardware is dependent on proprietary blobs that can not be replaced. If there is a publicly disclosed vulnerability you better hope that Qualcomm is feeling nice as if they don’t patch it you are out of luck.

Update:

Why I don’t like Graphene OS: A very brief intro into Private Android - #13 by Darin755

1 Like
2

I’m curious about Graphine OS not being recommended. I know Edward snowden has previously recommended it, as well as many of the larger privacy focused channels out there and if I recall correctly I think Michael Bazzell also recomended it.

1 Like
3

Been using Lineage since it was called CyanogenMod. Its always been lighter and snappier than OEM bloatware and google’s garbage.

Planned obsolescence and monopoly.

Many older devices are perfectly usable when refreshed with LineageOS.

Removing Google MobileMalware Services is a huge win for battery life.

What is wrong with Graphene?

2 Likes
4

GrapheneOS is easily the most secure version of android out there and the only one I am willing to use anymore, to be honest. Lineage is great if you want to get more use from an old, out of support device but otherwise there is nothing about it that makes it any more secure than stock AOSP. That said it is still probably the best option if you do not have a pixel device, which is the only device supported by graphene at the moment, and will probably remain so until they start making their own devices (if they ever do).

Why do I think GrapheneOS is the most secure android os? I can only invite you to read the features page on their website. It is a loooong read, as it’s pretty exhaustive, and damn impressive.

The focus on the pixel devices is another reason why it’s so good. Google has been very good about keeping the firmware on their devices up to date along with the software, which is not something you can say about many other manufacturers. Also when you turn things off, they will turn off on the hardware level on a pixel, which is not always the case on other devices.
I would not switch to another device anymore, unless google discontinued their phone manufacturing.
And no, the Pixel isn’t “ancient” as Wendell called it, he was confusing it with the Nexus. :stuck_out_tongue:

As to why Wendell doesn’t like android security, I think it’s because he wants all the apps to run in their own virtual machine, as apple does it (afaik, could be wrong about that as I have never used an apple device). I’m not sure he has ever really looked into the sandboxing on android, it is actually really good, and even way, way better on GrapheneOS, as they have made numerous improvements to it.
Of course this only applies on a device without google apps or services, as they are always privileged and can escape the sandbox.

1 Like
5

Obligatory Android comparison resource:

6

There are certainly several choices when it comes to using less google. I think the spectrum runs from stock android, to LineageOS, to Calyx, to Graphene. They each have their pros and cons in terms of security and usability, and I don’t think there is a one size fits all solution. It really depends on how secure/private you want/need to be and what you are willing to change or give up to get that security/privacy. I will say that it’s not always a 1-to-1 give and take for features vs security.

Personally, I build my own version of Graphene. As a matter of fact, I am currently building vanadium right now and then I’ll throw that into a January build of Graphene. I know it seems odd to buy a google phone to get away from google, but they do offer timely firmware updates and security patches.

In the past, I have used stock AOSP and cyanogen/lineage, with various amounts of microG at different times, and a few cherry-picks from Calyx.

7

I would love to use LineageOS or GrapheneOS but I use so old and cheap phones that there usually aren’t any supported and maintained versions available. I also don’t like to spend money on devices I’m trusting so little. I think they are all just inherently insecure and possibly backdoored spying devices. Well, I don’t know if PCs are any better.

Like, lets take Pixel+GrapheneOS which is recommened as de facto standard but it’s limited to just single device. Sure, we can come up with reasonings that sound compeling why this is but it could also mean that there’s NSA hardware backdoor that they want everyone to use.

NSA has previously intercepted iPhone packages and installed malware to these phones. They have attacked almost any other internet device there is or ever has been. They have previously worked with Google and was allowed to monitor unencrypted traffic in their LAN. There are laws that could be used to force Google to cooperate.

I want that phone with fully open hardware or I can’t trust it.

The NSA Actually Intercepted Packages to Put Backdoors in Electronics

According to Snowden documents, TAO has a catalog of all the commercial equipment that carries NSA backdoors. And it’s a who’s who of a list. Storage products from Western Digital, Seagate, Maxtor and Samsung have backdoors in their firmware, firewalls from Juniper Networks have been compromised, plus networking equipment from Cisco and Huawei, and even unspecified products from Dell. TAO actually intercepts online orders of these and other electronics to bug them.
The NSA Actually Intercepted Packages to Put Backdoors in Electronics

Glenn Greenwald: how the NSA tampers with US-made internet routers

Revealed: The NSA’s Secret Campaign to Crack, Undermine Internet Security

Beginning in 2000, as encryption tools were gradually blanketing the Web, the N.S.A. invested billions of dollars in a clandestine campaign to preserve its ability to eavesdrop. Having lost a public battle in the 1990s to insert its own “back door” in all encryption, it set out to accomplish the same goal by stealth.
Revealed: The NSA's Secret Campaign to Crack, Undermine Internet Security — ProPublica

8

i remember Rossmann made a video about why he doesn’t use grapheneOS anymore.

it could point to some reasons why OP is against it?

1 Like
11

GrapheneOS recently recommended on David Bombal’s channel.

12

5. Don’t expect much privacy on a smart phones

As we’ve covered before, most “smart” devices are data collection tools for various entities.

Smart phones are especially vulnerable to browser fingerprinting. A team of researchers at Cambridge published a paper highlighting how smartphones can be fingerprinted using internal sensors – and there’s nothing the user can do about it.

The paper delves into the technical details, but here’s a brief overview of their findings:

  • The attack can be launched by any website you visit or any app you use on a vulnerable device without requiring any explicit confirmation or consent from you.
  • The attack takes less than one second to generate a fingerprint.
  • The attack can generate a globally unique fingerprint for iOS devices.
  • The calibration fingerprint never changes, even after a factory reset.
  • The attack provides an effective means to track you as you browse across the web and move between apps on your phone.

Aside from the sensor issue, there are many other reasons for avoiding smart phones if you expect privacy. See our article on controlling communication channels for more info on this topic.
— Browser Fingerprinting Protection: How to Stay Private

SENSOR ID: Sensor Calibration Fingerprinting for Smartphones

13

The TL;DR is that the developers behind Graphene OS are jerks. The think they know everything and harass other people in the community. Not only that but they help spread misinformation about alternatives. It is also important to note that Graphene OS could be ported to significantly more devices but the devs choose not to. I would understand if they simply admitted to not having enough man hours but instead they like to blame everything but themselves. The arrogance of the Graphene OS team also shows in there forums and matrix channel. If you express any negatively about Graphene OS or mention anything not condoned by the Graphene OS team you are immediately banned or harassed. They have harassed well known people from all over the community including the devs of MicroG and the Calyx OS team. They want Graphene OS to be front and center even if there might be other options. I find this bad for privacy and security since it is almost like security via obscurity. I don’t trust a single source to verify something is secure. Good security requires freedom of expression which is not what the Graphene OS team does.

Even if we look past the people issues I don’t really see much point in Graphene OS at a technical level. Much of the featureset is either possible with AOSP based systems or totally unnecessary. The security features were seeming designed without a threat model. Graphene OS users tend to like to brag about how insecure everything else is even though the attacks may be totally theoretical. I also don’t like how they are doing Google services. While it might be good for security to run the Google proprietary services in a sandbox it is unlikely to help with privacy all that much. A lot of those services send data to Google and others when you use them. You can’t really patch something that is fundamentally not private. The other issue with the Google services is that they are fundamentally proprietary. Many of us in the community want to minimize how much proprietary we use even if it costs a bit of usability and security. Trying to explain that to the Graphene community is hard and many will take it as a personal attack. I get that Google services are optional in Graphene OS but that doesn’t change the fact that they are heavily promoted.

With all of that being said, this is not intended as an attack on Graphene OS. If you like it and want to use it go ahead but I personally will stay away from it. The privacy tooling included with Graphene OS is either in newer stock AOSP or is possible with standard Android APIs. For instance there are a few apps on F-droid that can limit internet access. (One of them is preinstalled on Calyx OS) In newer Android versions file permissions have been tightened down and apps need to get permission to specific folders instead of the entire user filesystem.

1 Like
14

This is more of sensational headline than anything else. You can use a hardened browser which will help significantly. The biggest risk is the GPU and screen but those can be mitigated.

1 Like
15

I personally would not recommend Graphene OS. (See my other comment)

1 Like
16

It doesn’t make any sense for the NSA to try to backdoor hardware. The vast majority of people are using stock Google or Apple devices. These devices collect a significant amount of data about you and are not private in the least.

I do think there is a high likelyhood that modern phone hardware has serious security vulnerabilities. This not because of the NSA but instead budget constrains and the rush to get something to the market as fast as possible. When you have a bunch of proprietary binaries for a proprietary non standard piece of hardware you are going to find holes. The reality is that this is a problem for every single device on the market since they are all made by just a handful of companies who want to guard there trade secrets. If there was ever some modern open wireless hardware I would be the first to adopt it but for now everything is proprietary.

17

If you put those all souces together and look at the history, there’s been systematic effort to put backdoors and vulnerabilities to almost everything connected to internet. So, to say that hardware backdoors doesn’t make sense, doesn’t really make sense. That’s something they have previously done. I really don’t like when people just try to brush this off like it doesn’t even matter.

Sure, you can (and should) harden your browser but if you allow Javascript there’s always lots of attack surface and people are searching new datapoints for fingerprinting all the time but this is just one single little thing.

Phones can be tracked just in so many ways that it’s hard to call them private. Your cell towers track your location all the time for example. Phones are the most obvious targets and they also have been targeted time and time again.

Just couple of days ago, one GrapheneOS guy was talking highly about his phone and its security, so I challenged him to try two fingerprinting sites. Both of those were able to reliably fingerprint his phone browser.

These were the sites. First one just gives you your fingerprint hash and second one is closer to real service.
https://www.thumbmarkjs.com/

Improving your privacy is still a good thing and there’s never going to be a perfect phone, so I’m not trying to be too strongly against anything either. I just don’t think that phones are secure or private in any way and I don’t want to invest lots of money to device like that. I still want that phone with open hardware.

2 Likes
18

also, a naughty list for devices / manufacturers that prevent the user from unlocking bootloader and installing OS of choice.

1 Like
19

That’s a wild claim, given that GrapheneOS is the most hardened Android version there is. It locks the bootloader and goes way out of its way to set all the SELinux contexts. LineageOS disables SELinux, idk about CalyxOS to comment on its SELinux stance (I think they’re disabling it as well).

Graphene also has an improved sandbox compared to stock android (so better than google’s and lineage’s). If you disable permissions for programs, they won’t run on a googled or degoogled device. If you don’t give permissions to programs, graphene will feed in false information, making the programs think they got the permissions (network, sensors, storage, heck even wifi).

Some people reported that they convinced their freaking bank that graphene is not a rooted phone (because it isn’t) and they got their banking program (ugh, cringe) unlocked for grapheneos. Even google services (which you can install on a per-profile basis) in graphene are sandboxed to the same insane degree.

Wendell said he wants a virtualization-level sandboxing, i.e. to run the apps in small virtual machines, probably something like qubes for normies.

Yeah, if only people porting lineage wouldn’t outright disable it for most devices.

Same.

It’s more private than google android, but in many phones, it’s arguably less secure (because selinux gets disabled or put in permissive mode).

That’s a whole different story. On its technical merits, grapheneos is superior. I respect your choice for not wanting to associate yourself and even boycotting the project because of perceived toxicity.

Because other devices don’t have the same hardware security features like pixel devices. For the same reason they aren’t backporting the latest versions of graphene on older pixels (the ones in legacy support or deprecated), because being older devices they lacked the new hardware security enclaves that newer pixels have.

But nobody bothered to do it, so gos is the only option in that regard. Heck, the work’s already done, why still isn’t anyone porting the security features to other AOSP, like lineage?

I can agree to that. One man’s security features is another man’s bloat. I don’t consider it bloat, you may and that is fine.

The sandbox literally restrict’s the play services from accessing any other part of the OS, like contacts or storage. And because of how gos does sandboxing, the play services are receiving false information about the system, including false geolocation data if you don’t give it permissions for that.

True, but then the software you’re using probably isn’t that private either if they require play services. Which is where separate users in gos come in, separating the whole system. It’s recommended that one doesn’t install play services on the main profile and one doesn’t mix all their (play services) software together in a single profile, but install games in a games profile, web in a web profile, banking in a separate profile etc.

The instances of play services from different profiles shouldn’t receive the same information and I believe the separate instances will think they’re running different devices (correct me if I’m wrong). And just because gos lets people install play services that doesn’t mean it can’t run without them and just run f-droid software alone.

The user profiles where play services run can be stopped (logged out of), so no programs will be running in those separate profiles, including the play services. Additionally, I think gos is the only AOSP that allows notifications from different user profiles to reach the owner user notification bar (particularly because user profiles are used in such a way on gos, when on other AOSP it’s usually assumed they’re used by different people - yet the play services on stock android run in a privileged mode and have access to all the profiles on the system, collecting all the data from them, unlike on gos).

AFAIK programs can still be made to not work if they don’t receive full access to the storage. In stock android if a program sees that, it’ll just refuse to work. On gos it’ll think it has access to everything, when in fact it has no access, just a layer in its own sandbox. That makes gos more private even with proprietary junk.

Of course ideally users should stay away from these if they can no matter their OS. And the problem with gos users is that they think they’re more secure than they are and they risk installing crap when they shouldn’t, because they think they’re protected (yes, I know some gos users IRL). If you use a hardened OS that doesn’t mean your responsibility goes out the window.

I don’t have a gos device and don’t plan on buying one (I use a stock android phone with mostly f-droid software). I’m probably going to buy a PinePhone Pro and install lineage on my current device (check out my rant on my rants page).

Backdoors and vulnerabilities are 1 thing and hardware backdoors are another. IntelME and AMD’s PSP can be considered hardware backdoors. And I think there was some news that Cisco was allowing bioluminescent boys to get into some company’s networks, but idk if that’s necessarily a hardware backdoor, but more of an intentional vulnerability in the absolutely proprietary software stack.

Backdoors at the hardware level don’t really make sense financially (the glow-boys don’t want to bankrupt the companies that cooperate with them and help them plant the backdoors and vulnerabilities to begin with, but they themselves also don’t have the funds to subsidize hardware backdooring of every device on the planet). I’m sure they plant hardware backdoors on certain devices for targeted attacks, but as far as general surveillance goes, I don’t think they do, because most people will just be running insecure, outdated and deprecated software anyway.

20

also, thread for this:

https://forum.level1techs.com/t/what-is-going-on-with-grapheneos

I don’t care if a couple people in the community are jerks. I choose the OS based on technical merit.

Even if you don’t like graphene, bug fixes are upsteamed and android as a whole benefits from graphene’s existence.

2 Likes
21

Actually, grapheneOS users are probably a very unique fingerprint since the community is so small. This coupled with the refusal to take the MicroG approach makes a grapheneOS user very identifiable without proper network security measures (especially with google sandbox on)

This is also why I think the hatred on root permissions needs to be re-thought. A device that allows the owner to lock it down further beyond the intended userspace permissions is always more secure and private than a non-root permission set that is stuck sending data to its preconfigured sources. Instead of locking out root we should sandbox it. There are really good ways already developed but they’re not compatible with grapheneOS’s model. It’s like comparing Apple’s desktop OS to Linux. The former is “secure” but certainly not private and good luck locking it down because even if you manually get root working by rebooting, it’s still a stripped down root user with no feature set like the first versions of android that came out. The latter; if you do the research and know what you’re doing you can lock it down to infinity (finding new methods everyday)

1 Like
22

This is so sad tbh