Play services compatibility layer in active development and an early prototype has the basics working.

It will allow users to install Play services as a regular app in specific profiles without granting it any special privileges. Most functionality can work with this approach.
Play services won't be bundled with the OS. It will be up to users to choose to install Play services in a profile.

It won't be part of the upcoming July security update release but there will likely be an initial experimental implementation ready for testing by the end of July.
This approach will be drastically more maintainable than attempting to reimplement the APIs. It will be much easier to port to new major OS versions and will provide much more of the functionality. It will also have all the usual security checks and component/server key pinning.
We plan on doing other things in this area but this is what we decided to fund in the short term.

We'll continue providing the necessary funding/resources to keep it properly maintained including porting to Android 12 and future releases.

Ideally, others will be interested too.
Apps not explicitly using Play services won't use it even if it's in the same profile since we won't set it as a provider for OS APIs.

Many apps like Signal use it when available but work fine without it via their own push, etc. so dedicated profile(s) for Play are a good idea.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with GrapheneOS

GrapheneOS Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @GrapheneOS

20 Jun
Next release of GrapheneOS will finally have a fix for IPv6 privacy addresses to prevent them being used to track users not only across connections to the same network but across networks.

Future devices won't have this particular kind of issue anymore due to upstream fixes.
All of the blatant issues with Wi-Fi anonymity should be resolved now. Hardware/firmware on the supported devices has done things properly for a while but there were higher-level anonymity issues. Of course, it would be a good idea to go over everything from the bottom up again.
It won't be possible to provide the same kind of Wi-Fi anonymity on other hardware unless it goes out of the way to minimize leaked information and randomize sequence numbers, etc. in the same way.

Should be possible to properly do this on most modern Snapdragon devices though.
Read 4 tweets
29 May
Someone has been impersonating Bromite's (bromite.org) developer on Telegram. They convinced a bunch of room admins and a lot of people in the rooms. Once they had a couple trusted people convinced, they chained from them to everyone else. The web of trust at work...
This is a serious issue. They had the unofficial Bromite room and a bunch of other people convinced.

They were using the stolen identity to spread misinformation including attacking GrapheneOS in coordination with others. We intervened and then their false identity fell apart.
The username they were using was TheAntimatter. They appear to have started doing it right after csagan5 (Bromite's developer) left the platform.

They pretended they switched to a pseudonym to avoid harassment. Please be more skeptical. This unraveled fast from our intervention.
Read 6 tweets
29 May
GrapheneOS makes a lot of privacy improvements, not just security improvements.

A recent focus has been fixing difficult issues to prevent users being tracked via Wi-Fi. Android and other Linux-based OSes along with iOS, etc. have flaws preventing MAC randomization from working.
See grapheneos.org/features#graph… for an overview of the features added by GrapheneOS. This is a list of what we improve upon over Android 11.

It doesn't take credit for what Android provides, as is common elsewhere. That's even the case for features we participated in getting landed.
On Android and iOS you can be tracked across Wi-Fi networks, apps can use sensors to record coarse movement, location and audio information without a way to fully revoke it and the attempts at preventing cross-app tracking are very incomplete even across profiles. Lots more too.
Read 8 tweets
27 May
@ihackbanme @spoofyroot If the device is deeply compromised, how is this going to help you? Why would the attacker allow you to use an OS mechanism to analyze it?

Verified boot, attestation (via our Auditor app and attestation.app) and a sideloaded update are the only things countering them.
@ihackbanme @spoofyroot If you don't have meaningful verified boot, then they don't even need to exploit the OS every boot to maintain their deep level of persistent access.

If you have a way to grant persistent root access, you don't have meaningful verified boot for the OS accomplishing anything.
@ihackbanme @spoofyroot In the verified boot security model, persistent state is not trusted. If there's a way to grant root access to an application persistently or even to make it available to the user in the OS persistently then that compromise is permanent root access without exploitation each boot.
Read 5 tweets
26 May
Freenode admins hijacked the #grapheneos and #grapheneos-offtopic channels due to us migrating to Matrix rooms:

gist.github.com/thestinger/eb9…

They removed our channel moderation privileges, changed the topic and set the channel to invite-only preventing users from joining/rejoining. Screenshot of Weechat (IRC ...
It justifies our urgent migration away from freenode.

Be careful what you say in private messages on freenode because the new admins can easily read them and may retaliate if you speak badly about them.

See arstechnica.com/gadgets/2021/0… and vice.com/en/article/m7e… for more details.
Please join #grapheneos:grapheneos.org and #grapheneos-offtopic:https://t.co/f02rVtJa8a via Matrix. Links to join via the Element web client:

app.element.io/#/room/#graphe…
app.element.io/#/room/#graphe…

Element (web, desktop or mobile) with matrix.org is one option.
Read 5 tweets
4 Feb
If you're installing GrapheneOS or making a guide on it, please use either the official web installer (grapheneos.org/install/web) or CLI install guide (grapheneos.org/install/cli).

There are many out-of-date and/or inaccurate third party install guides. Many have dangerous advice.
If you do publish an unofficial guide, please address inaccuracies that are reported and keep it up to date. If you lack the time, please take it down and ask people to use either our web installer or official CLI guide instead.

Many people are being harmed by inaccurate guides.
Every day, multiple users come to our chat needing help after following one of the problematic unofficial guides.

They often have a soft bricked device and a mess on their computer to clean up. Some of these users end up hard bricking their devices.

It's totally unnecessary...
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

:(