7 ms·
They're both security, just security "against" different things. Graphene frequently fails to clearly describe the threat model when calling something "more sec
by Borealid 16d ago
They're both security, just security "against" different things. Graphene frequently fails to clearly describe the threat model when calling something "more secure".
For example, let's say hypothetically I want to be secure against the threat of Google pushing a targeted update to my phone that runs malicious code. Turning on automatic software updates from Google would make me vulnerable to that threat. Using MicroG instead of Google Play Services would make me less vulnerable to that threat. But Graphene devs say things like "MicroG is less secure than Google Play Services".
Similarly, if you want privacy you might secure your device by locking the bootloader with your own keys - not a third-party vendor's keys. Saying that's "insecure" is extremely misleading: it just puts you in charge of security, instead of abdicating to someone else.
I wish there were something like GrapheneOS that let you choose, yourself, who to trust instead of requiring you trust an OS vendor implicitly.
- microtonal 15d agoBut Graphene devs say things like "MicroG is less secure than Google Play Services". It is. microG runs Google DroidGuard blobs in a privileged process (to pass Play Integrity Basic). Reminder for those who forgot about DroidGuard: it's an obfuscated binary blob delivered to you by Google on each request that uses a special VM with constantly changing registers, etc. to avoid analysis. On GrapheneOS that crap runs in a sandbox.
- Borealid 15d ago[flagged]
- exceptione 16d ago> Turning on automatic software updates from Google would make me vulnerable to that threat. Using MicroG instead of Google Play Services would make me less vulnerable to that threat I would say that any auto-update mechanism is a threat, so in both cases you would disable auto-updates.
- lucb1e 16d agoThe point is that you might know the people behind microG or trust them for any other reason, but not the people at Google
- exceptione 16d agoFair point.