iodé 🇬🇧Nov 28
The next time someone says "Privacy doesn't matter to me, I've got nothing to hide", show them this video.
Show threadPlumeros ☮️Nov 28

@iode

GrapheneOS decided to leave France because they would have to implement a backdoor for French authorities.
What about backdoors in #IodeOS as Iodé is a French company?
https://goingdark.social/@watchfulcitizen/115605398411708768

Watchful Citizen (@[email protected])

@[email protected] is being threatened by French authorities for refusing to add backdoors and they're dealing with coordinated attacks in French media right now. They're pulling out of France entirely, moving all their servers, and fighting off a wave of bullshit one-sided reporting that makes them look like they're helping criminals. They need us to fight back. Support them however you can, whether that's a dollar, sharing their story, pushing back on the garbage news coverage when you see it, or just telling someone you know about what's happening. All of it matters because they're drowning in attacks from governments and media and bad actors who want them gone. This is the only Android OS that actually makes me feel like privacy isn't just marketing. They fight for us now they need us to fight for them. The EU is pushing Chat Control and creating an environment where governments feel empowered to threaten developers into compliance, and if we stay quiet we're letting it happen. Show up for them in whatever way you're able to. #grapheneos #Privacy #NoBackdoors #encryption #security #chatControl

GoingDark
Show threadUddelhexeNov 29

@plumeros @iode

I am interested in that issue too.
I'm planing to get an IodeOS phone and i highly oppose the idea of "scan-on-device" / cliwnt scanning backdoors in Software.

Not only having a single App with such a backdoor in, but the base OS having one, is even worse...i didn't know this was law in france already.

Even if i am not in danger to be targeted in an legal investigation, does such a backdoor not pose a great risk to be hacked by criminals via that way too?

Show threadGrapheneOSNov 29
@Uddelhexe @plumeros You should readhttps://discuss.grapheneos.org/d/24134-devices-lacking-standard-privacysecurity-patches-and-protections-arent-private which also applies to iodéOS. There's linked content from Divested Computing, Mike Kuketz and Eylenburg there too which each directly cover iodéOS. /e/ and iodéOS both have extraordinarily poor privacy and security. They make it much easier for states to get into devices remotely or extract data with physical access compared to iPhones.
Show threadCoralie RenéeDec 2

@GrapheneOS @Uddelhexe @plumeros

Are iphones secure in that sense?

I didn't think they were...

Show threadGrapheneOSDec 2
@globcoco @Uddelhexe @plumeros iPhones are far more secure than anything running LineageOS, iodéOS or /e/. An iPhone 17 provides much stronger protections than past generations due to hardware memory tagging which was only previously deployed in production for a lot of code by GrapheneOS (more than iOS). iPhones can be configured to have a higher level of security than they do by default via lockdown mode and other features. End result is definitely far better than any non-GrapheneOS option.
Show threadGrapheneOSDec 2
@globcoco @Uddelhexe @plumeros Pixels and iPhones are the only devices with high quality secure elements providing working disk encryption with a random 6 digit PIN or other typical lock method rather than 6 -8 random diceware words. This matters a lot to many people even if they don't realize it. Other Android devices either omit a secure element providing this or have a much lower quality implementation which gets bypassed by commercial exploit tools in practice. That's just one example.
Show threadPlumeros ☮️Dec 2

@GrapheneOS @globcoco @Uddelhexe

iOS is closed source, so nobody will ever find any backdoors in the software, even if the hardware offers to implement a high level of security. Do I miss anything?

Show threadCoralie RenéeDec 2

@plumeros @GrapheneOS @Uddelhexe

Nope.

Now, closed source is also problematic as well if decisions were made at the top...

Show threadGrapheneOSDec 2

@globcoco @plumeros @Uddelhexe No, it's very inaccurate and is a common misconception among people who aren't developers or security researchers about open source. It does not provide anything close to what you believe it does. You still highly trust the developers of software released as open source and even rare cases of extensive external review do not find all or most vulnerabilities in practice. Finding subtly hidden vulnerabilities would be even more difficult.

https://grapheneos.social/@GrapheneOS/115651550181157144

GrapheneOS (@[email protected])

@[email protected] @[email protected] @[email protected] No, that's not how closed source and open source work at all. Closed source software is not a black box. Open source absolutely doesn't mean that all or most vulnerabilities get discovered. Linux kernel has many severe vulnerabilities being found on a regular basis which have existed for years and even decades. Most projects are not getting anything close to that much review. It certainly doesn't mean that an intentionally hidden subtle vulnerability will be found.

GrapheneOS Mastodon
Show threadPinpinDec 2
@GrapheneOS @globcoco @plumeros @Uddelhexe

Yep, choosing a smartphone is really hard.

I have a iPhone 13 Pro (bought used) right now, and whenener I think about its replacement in the years to come, I remain undecided, stuck between those 3 options:

iPhone : secure, not owned by the biggest advertising compagny on the planet, but it's not easily self-repairable and gives zero control software side.

Fairphone : easily self-repairable but not secure enough and needs a custom ROM (to retain a little bit of privacy) which brings less stability and may require more maintenance.

Pixel with GrapheneOS : secure, but not easily self-repairable and needs to use a custom ROM which brings less stability and may require more maintenance.
Show threadGrapheneOSDec 2
@pinpin @globcoco @Uddelhexe @plumeros Fairphones have atrocious privacy and security regardless of OS choice. See https://discuss.grapheneos.org/d/24134-devices-lacking-standard-privacysecurity-patches-and-protections-arent-private. Fairphone 4 has an end-of-life 4.19 kernel and the Fairphone 5 kernel is end-of-life this month. They do not provide the long term support they claim in their marketing. They lag far behind on OS updates, do not properly update the kernel/drivers/firmware and lag behind on bare minimum AOSP security backports to older releases too.
Devices lacking standard privacy/security patches and protections aren't private - GrapheneOS Discussion Forum

GrapheneOS discussion forum

GrapheneOS Discussion Forum
Show threadGrapheneOS

@pinpin @globcoco @Uddelhexe @plumeros GrapheneOS is a production quality OS. GrapheneOS does not have issues with stability and does not require more maintenance. It doesn't sound like you've used it.

GrapheneOS is not a "custom ROM" and that isn't accurate terminology. It's not terminology we've ever used and we correct it when people incorrectly refer to it that way.

There are official parts and repair kits available for the devices we support for quite a long time.

Dec 2 at 9:11pmWeb
Show threadPinpinDec 3
@GrapheneOS Sorry, I wasn't aware of the negative connotation behind custom ROM. I meant it as "modified AOSP version".

And you're right, I haven't used GrapheneOS. My preconceptions are based on me tinkering with CyanogenMod and such 10 years ago.

@globcoco @Uddelhexe @plumeros