Hacker News new | past | comments | ask | show | jobs | submit
microtonal | on: GrapheneOS protections against data extraction from locked devices
This is why it is important to continue iterating everywhere that device security is important for everyone. iPhone has nearly the same level of protection and we also do not see it as 'criminal by default'.

Secondly, it is important to get as many people to use GrapheneOS as possible, including non-tech people. The more widespread it becomes, the harder it will become to paint this picture.

loading story #49062827
chasil | parent | next
I'm not sure that I agree that iOS devices have equal protection.

The recent Darksword exploit should give everyone pause in asserting that iOS is secure:

https://www.malwarebytes.com/blog/mobile/2026/03/a-darksword...

I trust iOS with my banking and financial apps in a way that I would never trust Google, but I am under no illusion that any architecture can be completely secure.

On the Linux side, I have found SELinux maddening at times in forcing me to the syslog to enable and permit what I need the machine to do.

I have never seen anything this obstreperous in a BSD, but perhaps I have not looked with sufficient depth.

In any case, the Trust / SELinux / Enforcing status is a sizable advantage against iOS.

kungito | parent | next
sounds to me like iphone isnt actually that safe otherwise it wouldnt make sense. maybe we are missing some critical information
Cider9986 | root | parent
GrapheneOS seems to be consistently the hardest to exploit AFU based on various Cellubrite leaks. iPhones have better protection than all other Androids except Pixels.
microtonal | root | parent | next
I might be wrong, but I get the impression that the GrapheneOS folks generally recommend GrapheneOS > iOS > Pixel >> everything else.

It might have to do with e.g. Apple having rolled out MIE at a broader scale than Google rolling out MTE on PixelOS, where AFAIK it is still largely opt-in (not 100% sure, I always wipe a Pixel immediately).

loading story #49057923
loading story #49057969
inigyou | root | parent | next
IIRC it was the only one that Cellebrite couldn't break, but this was based on quite old news.
loading story #49060884
K3V1N_FLYNN | root | parent
[flagged]
loading story #49058207
loading story #49059513
loading story #49059634
loading story #49058123
mycall | parent
Perhaps GrapheneOS should just be an ASOP release with implicit security features that makes it hard to notice it is anything different. If people think it is a vanilla Android install, it would give them no reason to imply criminal activity.
chasil | root | parent | next
Google is never going to put their administrative access in a restricted sandbox.

That is diametrically opposed to their interests in data collection.

Cider9986 | root | parent
Not worthwhile or feasible. The OS is not designed to hide its identity.