Rasing the bar for Android Recommendations

[TommyTran732]

Related: https://github.com/privacyguides/privacyguides.org/discussions/58

Modern android systems only encrypts the user data - the operating system is not encrypted whatsoever. To prevent tampering, Android uses Android Verified Boot to verify the integrity of the OS.

Without verified boot, anyone with physical access to an Android can quickly flash any malware they want. Again, the system isn't encrypted, so an adversary can literally just put whatever backdoor in as they please, and there is nothing to detect it. In fact, this ruins so much of Android security that I don't think anyone should be using an Android derivative without verified boot at all.

LineageOS makes no attempt to support verified boot - not even on devices that support it. On a Pixel, there is no reason for a user to use Lineage - Graphene and Calyx are far superior choices. On older hardware, there is already a soft fork signed with a custom AVB key and support for verified boot (if the hardware supports it) - DivestOS.

For this reason, I propose that we raise the bar for Android recommendation and not recommending any OS that does not support verified boot at all. This means that we should replace Lineage with DivestOS and add some info about the importance of verified boot on Android.

[dngray]

I'm inclined to approve this, as LineageOS was never really a privacy-centric ROM.

The reason it was listed is because they have a charter that assumes some quality control for officially listed ROMs and goes through their build service, which does make those ROMs a little less risky than random unofficial ROMs uploaded to xda-developers. A lot of the time people were trying to clear away the rubbish bundled with their OEM ROM.

If we look at the industry in general, verified boot systems are becoming more popular, especially if we look at Windows 11 and their TPM requirement or other platforms.

Should the LineageOS charter change to require verified boot, we might re-add it. That's probably unlikely though. We've always in our social media (matrix, reddit etc) advised that its best to buy hardware that is supported, rather than look for software to support the hardware you've chosen.

[TommyTran732]

Before we get too lost in the weeds, perhaps we should step back?

@ignoramous main point is that the lack of GrapheneOS features as negatives to Calyx is not neutral. I agree. Perhaps they should instead be listed as positives of GrapheneOS.

The intend here is to make it absolutely clear to the user which Android derivative is the best choice for their device. GrapheneOS gives the utmost security. The user could alternatively considers CalyxOS, its not a bad option that it will ruin their privacy and security. However, they should be aware that it is less secure than GrapheneOS. I never said CalyxOS isn't secure (like LineageOS or Ubuntu Touch), it's just less secure than GrapheneOS and the user should be aware of that.

I don't want to just include their list of features and let the users guess which one is better.

[ignoramous]

At this point, It does look like you are concern trolling and is engaging in this discussion in bad faith.

You need to engage in discussions in good faith. So far, you've nothing but been disrespectful.

I will not be replying to this thread anymore except for a few very, very stupid ideas that you have just posted:

I consistently pointed out neutrality is the key sticking point, while you went off on some tangent about GrapheneOS' superiority. This isn't me flame-baiting you, this is you flame-baiting yourself and getting tied up in a knot, imo. Avoidable.

Does the reasoning matter if your end result is less secure?

Yes. It does: Great! Let's link to those refs. If you'd notice, the only linkbacks are to Graphene's documentation to justify "a lot less secure" CalyxOS, and nothing pointing to CalyxOS' forums / position / reasoning.

---

Thanks for engaging in this discussion. If nothing, I learned a bunch from the links you shared. Appreciate it.

[dngray]

I consistently pointed out neutrality is the key sticking point, while you went off on some tangent about GrapheneOS' superiority.

Android page is complete, in a lot of cases we use Wikipedia links to describe terminology, as a lot of what GrapheneOS does as it improves upon classical comp sci issues.

If you'd notice, the only linkbacks are to Graphene's documentation to justify "a lot less secure" CalyxOS, and nothing pointing to CalyxOS' forums / position / reasoning.

They don't have documentation explaining their deficiencies no.

[Goldmaster]

I hope lineage is still listed as I haven't heard of divestos, plus, divest does not run on every phone that lineageos supports.

Who knows, would be nice to see if lineage os adds verified boot and can be relisted.

[SkewedZeppelin]

lineage os adds verified boot and can be relisted.

Would break compatibility with Magisk and Google apps, something most users seem to really want.

[PhysicsIsAwesome]

It is not just about physical access, there is way more to it: https://madaidans-insecurities.github.io/android.html

I mean you can use LineageOS way more privately then third party vendor's Android (Samsung etc) or stock OS (Google pixel), but to the extend of way worse security. Aside from breaking the Android security model, LineageOS also, depending on the phone model, gets security updates delayed, nobody knows if the maintainers can be trusted (especially for the many unofficialy maintained smartphones) and some of their supported phones are dated and don't even get security updates anymore.

If people understand all the risks in using it and are on a very low budget, then it is their decision to make. Tbh, I don't know if I would risk it, if I could only afford to buy a phone for 50$.

But for everyone who can afford a Google Pixel the recommendation should be very clear towards a custom OS that keeps the Android security model, like GrapheneOS.

If people don't want to deal with a custom OS, iPhones are still their best bet.

[TommyTran732]

It is not just about physical access, there is way more to it: https://madaidans-insecurities.github.io/android.html

I mean you can use LineageOS way more privately then third party vendor's Android (Samsung etc) or stock OS (Google pixel), but to the extend of way worse security. Aside from breaking the Android security model, LineageOS also, depending on the phone model, gets security updates delayed, nobody knows if the maintainers can be trusted (especially for the many unofficialy maintained smartphones) and some of their supported phones are dated and don't even get security updates anymore.

If people understand all the risks in using it and are on a very low budget, then it is their decision to make. Tbh, I don't know if I would risk it, if I could only afford to buy a phone for 50$.

But for everyone who can afford a Google Pixel the recommendation should be very clear towards a custom OS that keeps the Android security model, like GrapheneOS.

If people don't want to deal with a custom OS, iPhones are still their best bet.

Yes, I wouldn't risk it myself either. The point I was trying to make is, if they have an existing device and do wanna risk it, then they should be using DivestOS instead of LineageOS.

I guess the question really is how high should the bar be. But regardless, removing/replacing Lineage will put us at a better place than we are right now anyways

[SkewedZeppelin]

Aside from breaking the Android security model

I've patched/restored nearly everything that Lineage has broken/disabled.

security updates delayed

I've published the November ASB for all devices supported as of yesterday.
https://divestos.org/index.php?page=news#2021-11.2
Many of these older devices don't have any other ROMs available for them in over a year.
And although CVE patching is dumb, my automated kernel CVE patcher provides a level of security to these older kernels that no other project has come anywhere close to doing so.

don't even get security updates anymore.

I note these details in full here:
https://divestos.org/index.php?page=patch_levels

are on a very low budget

Many, many people cannot afford to buy a new phone for themself or their family members every two years.
GrapheneOS already dropped support for the Pixel 3.

iPhones are still their best bet.

A proprietary walled garden? Requiring a credit card to install "FREE" apps? Great idea.

[SkewedZeppelin]

Furthermore I'd like to note evidently that CalyxOS is largely LineageOS based, not AOSP or GrapheneOS based.
Not at all as a negative to Calyx, but as to prove that Lineage can be made more than "breaking the Android security model".

[PhysicsIsAwesome]

Aside from breaking the Android security model

I've patched/restored nearly everything that Lineage has broken/disabled.

security updates delayed

I've published the November ASB for all devices supported as of yesterday. https://divestos.org/index.php?page=news#2021-11.2 Many of these older devices don't have any other ROMs available for them in over a year. And although CVE patching is dumb, my automated kernel CVE patcher provides a level of security to these older kernels that no other project has come anywhere close to doing so.

don't even get security updates anymore.

I note these details in full here: https://divestos.org/index.php?page=patch_levels

are on a very low budget

I was talking about LineageOS, not DivestOS.

Many, many people cannot afford to buy a new phone for themself or their family members every two years. GrapheneOS already dropped support for the Pixel 3.

I understand that a lot of people cannot afford a recent Pixel. Different projects have different goals. GrapheneOS wants to increase the security of the already very good security of Google Pixels stock OS while also improving privacy. Considering this, anything else than dropping support after Google's EOL would be implausible.

iPhones are still their best bet.

A proprietary walled garden? Requiring a credit card to install "FREE" apps? Great idea.

Yes. There is imo no better solution for people who want a secure phone, but don't want to use a custom OS. Do you have a better solution?