Cassandrich"Age verification" company Yoti caught admitting to blocking GrapheneOS users and "reporting them to authorities".
https://www.reddit.com/r/privacy/comments/1txn8di/did_i_just_got_threatened_by_yoti_age/
Vysogota@dalias the real question is since @GrapheneOS is oh so private, why does it leak what OS their users are on?
You can rely on surveillance capitalism to surveillance capitalist, but graphene is expected to protect a user's privacy and it failed.
Xtreix@petko @dalias @GrapheneOS No, please read : https://grapheneos.org/faq#:~:text=Apps%20can%20detect%20that%20they%27re%20being%20run%20on%20GrapheneOS%20via%20the%20privacy%20and%20security%20features%20placing%20further%20restrictions%20on%20them%20and%20hardening%20them%20against%20further%20exploitation.
Just because a service or app detects that GrapheneOS is being used doesn't mean it's failing; this is normal behavior because that's how it currently works
@Xtreix @dalias so... @GrapheneOS does n fact not protect your privacy. At worst it's performative and at best makes you stick like a sore thumb to adversaries.
They need to do better than an FAQ entry which is 'btw you having no privacy is by design'
@petko @dalias @GrapheneOS GrapheneOS protect privacy, your statements are incorrect.
https://grapheneos.org/features
https://www.ilsoftware.it/focus/grapheneos-come-funziona-android-piu-sicuro/
https://www.sciencedirect.com/science/article/pii/S2666281726000053
https://www.kuketz-blog.de/grapheneos-der-goldstandard-unter-den-android-roms-custom-roms-teil7/
GrapheneOS@petko @Xtreix @dalias GrapheneOS provides massive real world privacy and security benefits.
Apps can detect the operating system in many different ways and that's in no way specific to GrapheneOS. Apps can see many differences between each OEM fork of Android including the differences between their forks across device models and OS versions.
The same thing applies to websites with browsers. A web site can use feature / behavior tests to detect a browser such as if a privacy hole is closed.
@petko @Xtreix @dalias Web sites are far more limited than native apps but they can still do a whole lot to detect the browser variant, the version of the browser and many properties of the OS and hardware without it needing to be directly shared. Web sites can detect which privacy features you have enabled, which content filters you're using, an approximate browser version by detecting which features and bugs are present, etc. How would the OS be hidden from an app with far more capabilities?
@petko @Xtreix @dalias It's feasible to make a Chromium-based browser which looks the same as Chrome with a lot of work to closely mimic everything about it. It would require a large amount of work to closely match everything including their release cycle. It would rule out most privacy and security improvements or anything else. It would be necessary to include all the same Google services and use the Chrome API keys without permission. It's not compatible with making a more private browser.
@petko @Xtreix @dalias At the OS level, it wouldn't be feasible even without hardware attestation.
GrapheneOS is a fork of the Android Open Source Project. It isn't a modification of the stock OS on supported devices. That couldn't be the approach if it had to pretend to be the stock OS. We'd need to instead take the stock OS on each device and modify it at a binary level to have identical code/behavior seen by apps. It would be a rootkit project rather than a privacy and security hardened OS.