GrapheneOS, a privacy and security-focused mobile operating system, has released an experimental build for the Pixel 9a (codename "bluejay"). This release marks initial support for the device, but is considered experimental and may have some instability. Users are cautioned that this build is not yet suitable for daily use due to the potential for bugs and incomplete features. While core functionality like calls, messaging, and camera access should work, further testing and development are ongoing before it reaches a stable, recommended state. The announcement encourages users to report any issues they encounter to help improve the build.
The post "Everyone knows all the apps on your phone" argues that the extensive data collection practices of mobile advertising networks effectively reveal which apps individuals use, even without explicit permission. Through deterministic and probabilistic methods linking device IDs, IP addresses, and other signals, these networks can create detailed profiles of app usage across devices. This information is then packaged and sold to advertisers, data brokers, and even governments, allowing them to infer sensitive information about users, from their political affiliations and health concerns to their financial status and personal relationships. The post emphasizes the illusion of privacy in the mobile ecosystem, suggesting that the current opt-out model is inadequate and calls for a more robust approach to data protection.
Hacker News users discussed the privacy implications of app usage data being readily available to mobile carriers and how this data can be used for targeted advertising and even more nefarious purposes. Some commenters highlighted the ease with which this data can be accessed, not just by corporations but also by individuals with basic technical skills. The discussion also touched upon the ineffectiveness of current privacy regulations and the lack of real control users have over their data. A few users pointed out the potential for this data to reveal sensitive information like health conditions or financial status based on app usage patterns. Several commenters expressed a sense of resignation and apathy, suggesting the fight for data privacy is already lost, while others advocated for stronger regulations and user control over data sharing.
Verichains' analysis reveals that several Vietnamese banking apps improperly use private iOS APIs, potentially jeopardizing user security and app stability. These apps employ undocumented functions to gather device information, bypass sandbox restrictions, and manipulate UI elements, likely in pursuit of enhanced functionality or anti-fraud measures. However, reliance on these private APIs violates Apple's developer guidelines and creates risks, as these APIs can change without notice, leading to app crashes or malfunctions. Furthermore, this practice exposes users to potential security vulnerabilities that malicious actors could exploit. The report details specific examples of private API usage within these banking apps and emphasizes the need for developers to adhere to official guidelines for a safer and more reliable user experience.
Several Hacker News commenters discuss the implications of the Verichains blog post, focusing on the potential security risks of using private APIs. Some express surprise at the prevalence of this practice, while others point out that using private APIs is a common, though risky, way to achieve certain functionalities not readily available through public APIs. The discussion touches on the difficulty of Apple enforcing its private API rules, particularly in regions like Vietnam where regulatory oversight might be less stringent. Commenters also debate the ethics and pragmatism of this practice, acknowledging the pressure developers face to deliver features quickly while also highlighting the potential for instability and security vulnerabilities. The thread includes speculation about whether the use of private APIs is intentional or due to a lack of awareness among developers.
Mobile Verification Toolkit (MVT) helps investigators analyze mobile devices (Android and iOS) for evidence of compromise. It examines device backups, file system images, and targeted collections, looking for artifacts related to malware, spyware, and unauthorized access. MVT checks for indicators like jailbreaking/rooting, suspicious installed apps, configuration profiles, unusual network activity, and signs of known exploits. The toolkit provides detailed reports highlighting potential issues and aids forensic examiners in identifying and understanding security breaches on mobile platforms.
HN users discuss the practicality and legality of MVT (Mobile Verification Toolkit), a tool for forensic analysis of mobile devices. Some express concerns about the complexity of interpreting the results and the potential for false positives, emphasizing the need for expertise. Others debate the legality of using such tools, especially in employment contexts, with some suggesting potential violations of privacy laws depending on the jurisdiction and the nature of the data collected. A few commenters point out that the tools are valuable but must be used responsibly and ethically, recommending comparing results against a known good baseline and considering user privacy implications. The utility for average users is questioned, with the consensus being that it's more suited for professionals in law enforcement or corporate security. Finally, alternative tools and resources are mentioned, including existing forensic suites and open-source projects.
This guide emphasizes minimizing digital traces for protesters through practical smartphone security advice. It recommends using a secondary, "burner" phone dedicated to protests, ideally a basic model without internet connectivity. If using a primary smartphone, strong passcodes/biometrics, full-disk encryption, and up-to-date software are crucial. Minimizing data collection involves disabling location services, microphone access for unnecessary apps, and using privacy-respecting alternatives to default apps like Signal for messaging and a privacy-focused browser. During protests, enabling airplane mode or using Faraday bags is advised. The guide also covers digital threat models, stressing the importance of awareness and preparedness for potential surveillance and data breaches.
Hacker News users discussed the practicality and necessity of the guide's recommendations for protesters. Some questioned the threat model, arguing that most protesters wouldn't be targeted by sophisticated adversaries. Others pointed out that basic digital hygiene practices are beneficial for everyone, regardless of protest involvement. Several commenters offered additional tips, like using a burner phone or focusing on physical security. The effectiveness of GrapheneOS was debated, with some praising its security while others questioned its usability for average users. A few comments highlighted the importance of compartmentalization and using separate devices for different activities.
iOS 18 introduces homomorphic encryption for some Siri features, allowing on-device processing of encrypted audio requests without decrypting them first. This enhances privacy by preventing Apple from accessing the raw audio data. Specifically, it uses a fully homomorphic encryption scheme to transform audio into a numerical representation amenable to encrypted computations. These computations generate an encrypted Siri response, which is then sent to Apple servers for decryption and delivery back to the user. While promising improved privacy, the post raises concerns about potential performance impacts and the specific details of the implementation, which Apple hasn't fully disclosed.
Hacker News users discussed the practical implications and limitations of homomorphic encryption in iOS 18. Several commenters expressed skepticism about Apple's actual implementation and its effectiveness, questioning whether it's fully homomorphic encryption or a more limited form. Performance overhead and restricted use cases were also highlighted as potential drawbacks. Some pointed out that the touted benefits, like encrypted search and image classification, might be achievable with existing techniques, raising doubts about the necessity of homomorphic encryption for these tasks. A few users noted the potential security benefits, particularly regarding protecting user data from cloud providers, but the overall sentiment leaned towards cautious optimism pending further details and independent analysis. Some commenters linked to additional resources explaining the complexities and current state of homomorphic encryption research.
Summary of Comments ( 166 )
https://news.ycombinator.com/item?id=43669185
Hacker News users discussed the experimental Pixel 9a GrapheneOS release, expressing excitement but also caution. Several praised GrapheneOS's security focus and the expansion of supported devices. Some questioned the practicality of using a less mainstream OS and potential compatibility issues with apps. The discussion also touched on the challenges of maintaining a hardened OS and the trade-offs between security and convenience. A few users shared their positive experiences with GrapheneOS on other Pixel devices, while others raised concerns about the "experimental" tag and potential bugs. Overall, the sentiment was positive but tempered with pragmatic considerations.
The Hacker News post titled "Experimental release of GrapheneOS for Pixel 9a" has generated a moderate number of comments, mostly focusing on the practical implications of using GrapheneOS on the Pixel 9a and comparisons to other privacy-focused operating systems like CalyxOS.
Several commenters discuss the trade-offs between security and usability. One commenter notes the inconvenience of needing a secondary device for initial setup and questions the necessity of this requirement. This sparks a small thread discussing the rationale behind it, with others explaining that it's a security measure to prevent compromised host devices from interfering with the installation process.
Another significant thread revolves around the comparison between GrapheneOS and CalyxOS. Commenters delve into the nuances of their differing approaches to security and privacy. One commenter argues that CalyxOS offers a more user-friendly experience while still providing robust security, while another counters that GrapheneOS prioritizes hardening at a lower level, making it a more secure, albeit less convenient, option. The discussion touches on specific features like microG and the availability of banking apps, highlighting the practical considerations for users choosing between the two.
A few comments also mention the Pixel 9a's hardware limitations, particularly regarding its modem, and how these might impact the overall performance and security of GrapheneOS on the device.
Some users express interest in the experimental release and inquire about specific aspects like camera performance and battery life. However, as the release is experimental, concrete answers are limited.
While there isn't an overwhelming number of comments, the existing discussion provides valuable insights into the perceived advantages and disadvantages of GrapheneOS on the Pixel 9a, focusing particularly on the balance between security, usability, and the practicalities of daily usage compared to alternatives like CalyxOS. The thread also highlights some of the technical limitations imposed by the Pixel 9a's hardware.