Our latest release improves our hardware-based USB-C port attack surface reduction. Our previous software-based feature has been extended and merged into it as a 2nd layer of enforcement. We've also extended it to disable pogo pins data at a hardware level on the Pixel Tablet.
Our previous feature is now fully obsolete and has been removed on devices with the newer approach, which is a nice simplification. We've rewritten the documentation here:
https://grapheneos.org/features#usb-c-port-and-pogo-pins-control
Older approach is now only used on the Pixel 5a and earlier end-of-life devices.
Our documentation explains why our approach is much better than the standard Android USB HAL toggle available to device admin apps since Android 12. Standard approach only disables USB connections in the OS. It leaves USB-C and pogo pins enabled at both the OS and hardware level.
The standard approach also can't block new USB connections without ending existing USB connections. It has no distinction between those things. It forces a choice between ending existing USB connections when locking or delaying using it at all until the last USB connection ends.
Several operating systems previously included a port of our legacy software-based approach and mistakenly moved to the less secure approach of disabling USB via the standard USB HAL after the last USB connection ends. It's less secure than simply extending our legacy feature...
#GrapheneOS
final [GrapheneOS] 📱👁️🗨️
npub1c9…7sqfm
2024-06-21 21:03:14
Author Public Key
npub1c9d95evcdeatgy6dacats5j5mfw96jcyu79579kg9qm3jtf42xzs07sqfmPublished at
2024-06-21 21:03:14Event JSON
{
"id": "d00337a98b0f7075fd7398aded58f079cb43c2aee645c0a549ad06a87e1ca6b8",
"pubkey": "c15a5a65986e7ab4134dee3ab85254da5c5d4b04e78b4f16c82837192d355185",
"created_at": 1719003794,
"kind": 1,
"tags": [
[
"t",
"GrapheneOS"
],
[
"t",
"grapheneos"
],
[
"r",
"https://grapheneos.org/features#usb-c-port-and-pogo-pins-control"
]
],
"content": "Our latest release improves our hardware-based USB-C port attack surface reduction. Our previous software-based feature has been extended and merged into it as a 2nd layer of enforcement. We've also extended it to disable pogo pins data at a hardware level on the Pixel Tablet.\n\nOur previous feature is now fully obsolete and has been removed on devices with the newer approach, which is a nice simplification. We've rewritten the documentation here:\n\nhttps://grapheneos.org/features#usb-c-port-and-pogo-pins-control\n\nOlder approach is now only used on the Pixel 5a and earlier end-of-life devices.\n\nOur documentation explains why our approach is much better than the standard Android USB HAL toggle available to device admin apps since Android 12. Standard approach only disables USB connections in the OS. It leaves USB-C and pogo pins enabled at both the OS and hardware level.\n\nThe standard approach also can't block new USB connections without ending existing USB connections. It has no distinction between those things. It forces a choice between ending existing USB connections when locking or delaying using it at all until the last USB connection ends.\n\nSeveral operating systems previously included a port of our legacy software-based approach and mistakenly moved to the less secure approach of disabling USB via the standard USB HAL after the last USB connection ends. It's less secure than simply extending our legacy feature...\n\n#GrapheneOS",
"sig": "279d8bf7525033bb7a4ed371184b2ca2245346c77aa55de17b4901b99ed9eb2a1e48beed9e0d8af1250da4bd2c11be1db2da69de625a2de0a48e516e7dd9e7da"
}