Final

https://discuss.grapheneos.org/u/final

Still fighting. Technology writer, security researcher and engineer, contributor #GrapheneOS. Npub used for post comments and support.

Different key? Burned my last npub. See first note for verification.

Public Key

npub1hxx76n82ags8jrduk0p3gqrfyqyaxnrlnynu9p5rt2vmwjq6ts3q4sg75y

NIP-05 Address

final@stacker.news

Profile Code

nprofile1qqstnr0dfn4w5grepk7t8sc5qp5jqzwnf3lejf7zs6p44xdhfqd9cgspz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qzrmhwden5te0dehhxarj9ekk7mghqnqdu

Publishing to

relay.mostr.pub

nostr.mom

nos.lol

Author Public Key

npub1hxx76n82ags8jrduk0p3gqrfyqyaxnrlnynu9p5rt2vmwjq6ts3q4sg75y

Show more details

Last Notes

2025-04-01 20:16:04

Macarne (https://macarne.com/) has provided a sponsored server to replace our current EU update servers so we can handle current traffic and near future growth. Ryzen 9950X, 128GB RAM, 2x 2TB NVMe and most importantly 25Gbps bandwidth. It's greatly appreciated!
We use GeoDNS and round-robin DNS to distribute load across our servers with automatic failover. Ideally, we can find a good 2nd provider willing to provide sponsored/discounted 2x 10Gbps servers to cover each coast of North America. 2x 25Gbps would be great but not needed yet.
Our existing setup was 8x 2Gbps OVH VPS instances with 4 in Quebec, 2 in France and 2 in Germany. This was getting increasingly overloaded for the 4 major releases per year, and the largest one (Android 16) is coming up soon. European bandwidth usage is also around 50-60% higher.
#GrapheneOS

2025-03-15 22:29:45

Next release of #GrapheneOS will enable the new Desktop Mode on all devices rather than just the Pixel Tablet.

2025-03-15 15:04:09

LibreOffice Calc in #GrapheneOS Debian VM running on an external display in the launcher with 'freeform windows in external display' switched on:
https://image.nostr.build/a6cb2fb03a7f584188f2530d0b8e2f1112a6c93a2cf9b20e16a1d3aa9d8ace86.jpg

2025-03-13 14:58:38

- reply

This is a GrapheneOS feature by default, 18 hours but configurable to 30 minutes of inactivity. iOS implemented it too but it's done in 3 days of no unlock. The Shortcuts app could be useful for this as you can assign device restarts to a trigger. A more primitive shortcut could be to assign a reboot when the clock hits a certain hour such as when you're asleep.
Stronger USB port security features would help, I don't see why Apple couldn't copy what GrapheneOS does with disabling Pixels' USB-C port at a hardware level when they create both the phone and OS.

2025-03-13 14:45:02

- reply

Yes. If the device is unlocked successfully via brute force then it's considered an unlocked device extraction. Cellebrite call hot phones that are locked 'AFU' and hot phones that are unlocked / brute forced successfully as 'Unlocked'. Older Cellebrite docs we published used to call their AFU iOS capabilities Instant Password Retrieval (IPR) but they stopped doing that for some reason.
AFU exploits are to access and extract data without unlocking the device or to bypass the unlock mechanism entirely. Since data isnt encrypted/at rest when AFU they can obtain almost all of the data (except conditional circumstances like data of other Android user profiles or the Mail inbox on iOS) if an exploit is available.
"BFU Yes" in their docs means accessing data encrypted by the device rather than user credentials in a BFU state. For Android it's some OS configuration and APKs of installed apps. iOS provides far more information.

2025-03-12 21:48:43

- reply

Are you using a different keyboard app? If so, which?

2025-03-12 06:26:20

- reply

As a preview of what's going to be possible in the upcoming release of #GrapheneOS, here's a screenshot from a Pixel Tablet running desktop Chrome in a virtual machine with basic GPU acceleration via ANGLE on the host. The infrastructure is a lot more robust than the Terminal app:
https://image.nostr.build/cb6acb3ddd99be420bb87947a7d5c55dae3d064cded174e555235fffebfe9584.jpg
Our next release also enables running the Terminal app in secondary users. There's still the temporary limitation of only being able to use a single VM on the device at a time because the dedicated internal network interface it uses for the Terminal app isn't split up at all yet.
GUI VM support will have 2 main use cases:
1) Running a specific app or an entire profile via GrapheneOS virtual machines seamlessly integrated into the OS.
2) Running Windows or desktop Linux applications with desktop mode + USB-C DisplayPort alt mode on the Pixel 8 and later.
This virtual machine management app (Terminal) will be handling the 2nd case. It's essentially already available in a very primitive way. We expect this to become much more usable and robust entirely from the upstream Android work on the virtual machine and desktop mode features.

2025-03-11 10:57:16

- reply

Android's own Terminal app, not a third party app. Termux doesn't do virtual machines.

2025-03-10 18:42:54

Our 2025030900 release currently in the Beta channel is the first one with support for managing hardware-based virtual machines via the Terminal app in Android 15 QPR2. Since then, we've backported massive improvements to the feature for an upcoming new release, maybe even today.
Backports include terminal tabs, GUI support with opt-in GPU hardware acceleration (ANGLE-based VirGL until GPU virtualization support is available), speaker/microphone support and fixes for a bunch of bugs including overly aggressive timeouts. We're working on VPN compatibility.
At the moment, the Terminal app isn't compatible with having a VPN in the Owner user. It only works if VPN lockdown (leak blocking) is disabled and the VPN allows local traffic to pass through. It's also not clear how it SHOULD interact with a VPN since VPNs are profile-specific. #GrapheneOS

2025-01-25 16:29:30

Revolut insecurely checks the ro.boot.verifiedbootstate property and forbids it being yellow, which means a locked device with an aftermarket OS that's being cryptographically verified by the firmware. They permit it being orange, which means an unlocked device with any OS.
They're specifically banning having a device that's locked with an aftermarket OS rather than banning having an unlocked device or an aftermarket OS in general. Similarly, they're specifically banning the value `grapheneos` for ro.build.user/ro.build.host.
Having the verified boot state at orange is unsafe, it means verified boot is disabled. There is no verification of OS integrity after each boot and update. There is no protection against exploit persistence nor a threat choosing to push a malicious update that is not signed with the same key as the originally installed operating system.
Both of these things and other similar insecure, useless checks are being done by several different SDKs. Revolut's app is full of sketchy, insecure third party libraries. They certainly don't take security seriously as they claim in their message about banning GrapheneOS.
We've fixed both of the ways they're banning GrapheneOS for our next release. Since third party SDKs are what's being used to do it, our hope is that this fixes a few other poorly written banking/financial apps doing similar stuff to ban aftermarket operating systems.
These are the full set of changes fixing Revolut's ban on GrapheneOS:
https://github.com/GrapheneOS/platform_build/commit/bcd027b1273db32d6361092c635bf52a5d08c0e7
https://github.com/GrapheneOS/platform_build_soong/pull/24/commits/cc62edd5c3af000a6089fe2cceef10b9458f8aae
https://github.com/GrapheneOS/platform_system_core/commit/971110e37d73b5acb6e806b62146dcdcb29277b2
https://github.com/GrapheneOS/platform_frameworks_base/commit/5c85337ba0c4f5e40811a5a753754f7ccc2bc72f
https://github.com/GrapheneOS/platform_frameworks_base/commit/29c31dcdb5f826f1032a1a4da4dc584dbee8f01d
Other banking apps banning #GrapheneOS will need to be retested after the next release.
#nevent1q…e8pl

2025-01-22 02:32:22

- reply

I don't have the signal app and I find the Pixel 9 lasting days, and I use the battery limit feature.

2025-01-22 00:42:56

Quoting this for other #GrapheneOS users, if you have battery drain then it's probably because you have Signal.
https://github.com/signalapp/Signal-Android/issues/13704
The hardened signal fork Molly is far more optimized and doesn't have this issue. A pull request was made to Signal to fix but they never merged it. Been ignored.
#nevent1q…cdpz

2025-01-22 00:31:49

Revolut is specifically banning #GrapheneOS by checking for the build machine hostname and username being set to 'grapheneos'. We've changed these to build-host and build-user. Combined with another change, this allow our users to log in to it again until they roll out Play Integrity API enforcement.
There's no legitimate excuse for banning using a much more private and secure operating system while permitting devices with no security patches for a decade. Meanwhile, Revolut's shoddily made app tells users they're banning GrapheneOS because they're "serious about keeping your data secure".
Revolut's app will stop working against once they start enforcing having a Play Integrity API result showing it's a Google certified device. This is not a security feature but rather anti-competitive behavior from Google deployed by apps like Revolut wanting to pretend they care about security.
Revolut uses a bunch of shady closed source third party libraries in their app and it's one of these libraries banning GrapheneOS. These libraries are a major security risk and put user data at risk of being compromised. Revolut is not taking user security seriously at all and is cutting corners.

2025-01-15 14:01:53

- reply

You can build emulator images via the build tutorial page. We don't provide any images to download though. Not all features would be fully available with it

2025-01-09 16:11:51

- reply

Most of these features are to do with privileged features in Google Play Store (Play Protect) and not Android itself. Means nothing to GrapheneOS:
https://security.googleblog.com/2024/05/io-2024-whats-new-in-android-security.html?m=1
The "live threat detection" is just trivial antimalware scanning based on heuristics for known malicious behaviours of installed apps, such as asking for accessibility services or device admins and other unnecessary permissions. Google calling it "AI powered" is it at best disingenuous. People falling into scares for it would also be the same people falling for such corporatespeak.
The "unsafe connection detection" appears to be about the feature of detecting fake cellular base stations or when their cellular network connection is unencrypted. This is a good feature, but ideally you wouldn't want to be using the cell network at all.
The "side loading restrictions" are already a thing since Android 13. What this means is apps installed in certain ways (like directly from an APK) are considered unsafe installs and are automatically blocked from accessing certain dangerous permissions. Currently apps through modern app stores don't have this and if you downloaded it anyway you have to go through a semi-hidden dialog to activate their access.
A future Android update is adding enhancements the feature to provide a whitelist of sources where only apps from said sources can have such permissions without the ability to allow any from outside. This is enforced by an XML file in the system partition and so GrapheneOS would just change or not use it.
App devs should never use such permissions unless they are absolutely necessary if they care about user freedom because they are an attack surface risk and can be very dangerous. Accessibility services allow an app to make inputs on your behalf. This is also why Auditor detects when there is one in use and you can see in audit results.

2024-12-31 15:08:30

- reply

SMS wouldn't provide this access at all. It's likely a VPN issue, I had the project account reply to you about more info as well. It's through Mastodon so it may not show everything correctly, a project-wide Nostr account is being considered though.

2024-12-31 02:21:02

#GrapheneOS version 2024123000 released. Introducing two-factor fingerprint and PIN authentication, 80% battery charge limit, and more.
• add support for adding a PIN as a 2nd factor to fingerprint unlock to enable our new recommended high threat model configuration of a random diceware passphrase as the primary unlock method and fingerprint+PIN with a random 4-6 digit PIN as the regularly used secondary unlock method (the usual limitations of secondary unlock only being usable for 48 hours after successful primary unlock and our limit of 5 total secondary unlock attempts apply as usual)
• add support for limiting charging the battery to 80% with support for bypass charging similar to the new Android 15 QPR1 stock Pixel OS feature, although unlike the stock Pixel OS our implementation still works while using a secondary user (the limit is currently hard-wired to 80% due to that being what's properly supported throughout the OS, but we can eventually make it configurable)
• add support for disabling dynamic code loading via storage for user installed by default as we already do for the dynamic code loading via memory setting
• allow dynamic code loading from storage by default for apps depending on Play services due to the legacy dynamite module implementation not yet being fully replaced by split APKs to avoid users encountering a huge number of issues if they disable it by default for user installed apps (users can still disable it for these apps manually and we won't need to keep this exception forever since Google is moving to split APKs for dynamite modules)
• add support for partially recompiling apps (speed-profile) in the Finalizing step of OS updates to skip partially recompiling them during boot, but while still doing most of the work after boot in the background (speed) to avoid slowing down OS update installation too much
• remove adding back boot-time display of app compilation progress now that it's no longer heavily used
• use 2 threads instead of 1 for background compilation of apps
• switch to the new upstream default of 4 threads for compiling apps during boot instead of our previous 2 threads which we set to replace the previous upstream default of a single thread
• Settings: add back battery optimization settings link to Battery screen which was removed by Android a long time ago
• Settings: don't disable App info > Battery usage item while its summary is loading
• Settings: temporarily stop showing battery usage info in App info item summary due to an upstream regression causing it to take more than 5 seconds to load in many cases
• add back our fix for an upstream Android bug causing null pointer exception system_server crash in InputMethodManagerService triggered when ending user sessions because it turns out to still be required after Android 15 QPR1
• fix upstream Android bug causing null pointer exception system_server crash in NotificationManagerService
• Contacts: improve dark theme color contrast
• kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.232
• kernel (5.15): update to latest GKI LTS branch revision including update to 5.15.173
• kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.119
• kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.61
• kernel (Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold): fix very minor Android 15 QPR1 regression causing the kernel commit hash to the omitted from the kernel version string and the Unix epoch being used as the build time instead of the kernel commit timestamp
• Camera: update to version 75
• Vanadium: update to version 131.0.6778.200.0
• add developer option to log binder transactions
• fix ignoring harmless fingerprint-service.goodix crash for our system service crash reporting
https://grapheneos.org/releases#2024123000

2024-12-30 23:23:46

- reply

just so you know I also made a Google account just for this, and I've not been able to reproduce it. I have all the privacy settings in the Google account maxed out. on other platforms it just tells me the device used to sign in and nothing else.

2024-12-30 22:36:45

- reply

No one else has reported this and every other query I looked in our forums and chats shows theirs as expected. I can't consider it a bug without it being reproduced. Please check your profile's settings and apps.
I would evaluate what apps you are using that has location permissions. You may have provided a location access even if you think you may have not or you haven't realised.
Apps can embed Google services into their own apps and integrate Play accounts for IAPs, etc.
Enabling location accuracy also gives Google location in exchange for more accurate locations optionally. Some had enabled this before.
I've only seen users report when relating to:
https://github.com/GrapheneOS/os-issue-tracker/issues/502 which has been known for years (it's in our FAQ) but this is only registered country code of the SIM and nothing further than that. I've also heard this isn't even used for what you're talking about either.
The session data may also be historical (did you initially set up or install without the VPN?) and I would see what happens if you remove that session and sign in again. Google also attempts to infer location based on location specific Google searches on the accounts.

2024-12-26 13:33:08

Documentation about #GrapheneOS removing sensitive data in memory is now available in the features page.
https://grapheneos.org/features#clearing-sensitive-data-from-memory

2024-12-24 18:39:07

- reply

It was known for a while DivestOS, Mull and others were going to end (at least internally), it's a big job for one person. GrapheneOS has 7 full time developers for comparison.

2024-12-23 20:57:46

#DivestOS development has ended
https://divestos.org/pages/news#end

2024-12-23 13:52:51

- reply

There are rooms on SimpleX that are not official as there's no ability to bridge SimpleX with all our other platforms and that the nature of SimpleX makes it very difficult to moderate, worse than Matrix in fact and therefore bridging it would be a nightmare.
We had to disable bridging attachments through platforms except Discord due to a lot of gore, CSAM, pornography being sent in raids through Matrix. It would negatively impact all the other users.

2024-12-19 00:23:32

- reply

I imagine these are pretty easy assumptions for some, but:
- How are OS / App updates managed?
- What is the Prime's battery life?
- What is the security model for apps? (Maybe explain App signing, sandboxing, permission management, available App APIs?)
- How is disk encryption implemented?
- My PC doesn't have Bluetooth, can I still use Prime?
- Can I use Prime airgapped?
- What protections are there against physical attacks?
- I already have a HWW, is Prime still useful?
- How does Stateless Mode work?
- What makes Prime better than a standard U2F Key (i.e. YubiKey)?
- What makes Prime better than a TOTP password manager on your phone?
- What is the feature roadmap for Prime?

2024-12-17 02:26:42

- reply

A lot of positives from me to note, and I see a ton of the inspiration from the Precursor developer project on here. Hope this authenticator / storage device works well.
Want to get clarification on this before making any comments: are any uses the Bluetooth / QuantumLink mandatory? If there is, what would that be? I see there's no detailed manuals on site right now.
This isn't me making a concern of the device at all since Bluetooth as an attack surface would affect the device connecting to the Prime more than the Prime itself. I'm mainly asking for the users who choose to minimize remote attack surface on their phone by only using Wi-Fi and nothing else.

2024-11-22 22:38:09

- reply

This was changed upstream 2 major version revisions ago I believe. We haven't really touched these small changes as we're worried the ability to port and maintain them the more some part of the OS is updated upstream can be a problem.

2024-11-17 21:17:14

- reply

One of our contributors developed a Typst-compatible text editor designed for GrapheneOS users.

2024-11-05 08:49:44

- reply

They need to meet the security requirements on here:
https://grapheneos.org/faq#future-devices
If they don't then we aren't interested in supporting it. Users will just paint flaws caused by less secure devices to be a GrapheneOS problem.
Some are just totally incompetent, for example, Fairphone 4 set ther verified boot keys as publicly available test keys, meaning anyone can just sign an update with those same keys. Samsung kills certain device features via an eFuse when the non-stock OS is installed.

2024-10-30 18:01:25

- reply

I've not had this issue. I'd try restart device, and if not, try a mobile network reset: settings -> system -> reset
Is there an alert of an error / crash log?

2024-10-29 16:30:16

#GrapheneOS device deployment and management was mentioned in the requirements for a director-level job vacancy in a large (multi-million) NGO about wildlife and environment preservation. Their overall security commitments outside of their mobile security demands is also very impressive.
https://image.nostr.build/1f5a43c393de180f0d007718fb81b9fb1327cc6ab93cc4cc669c33fdc6f98da0.jpg
It is great to see big organisations with big requirements choose GrapheneOS because they know we provide security and privacy other platforms do not have. For too long users with tougher security requirements were left in the dark because every commercial OEM is often thinking about seamlessness or user experience. Users should have the choice to go above.
Let it be a message to every exploit broker and mercenary who tries to use our name / the platforms we support for marketing an urgency to attack our work: You cannot claim your actions to be for the greater good. You want to target a project that protects people in organisations campaigning for a cause far more important than yours. GrapheneOS works for good while you arm oppressors who work agsinst causes like the ones above.
The security community's greatest principle is transparency and you can't claim yourself to be trailblazers when you keep research a secret and we will continue our work in spite.

2024-10-25 19:16:37

- reply

When we had previous reports for this it was usually because their phone had automatically rebooted from our auto reboot feature (it may unlock slower for first unlocks), or if they are switching between profiles and there may also be a slowness as the profile is starting up.
I can't really say I experienced this myself although I use the latest device which will be faster. My 6th generation Pixel didn't have any noticeable differences.

2024-10-25 10:16:42

#GrapheneOS version 2024102400 is out. It brings back the a stricter DNS leak block that was previously reverted due to it breaking a lot of popular VPN apps (notably Proton VPN). An additional fix was made for the VPN DNS routing to prevent the compatibility issues from before. The ancient Android bug to do with widgets in secondary users disappearing have also been fixed by us.
IMPORTANT NOTICE that only affects a small amount of users: Apps which were only installed in secondary users but not Owner before updating to Android 15 and which were then installed in Owner after updating to Android 15 will have a one-time revocation of their Network/Sensors permissions after updating to this release as a minor consequence of migrating them from Android 14 again. If you installed an app, check those permissions!
Changes since the 2024102100 release:
- switch back our original stricter approach to DNS leak blocking from our [2024050900](https://grapheneos.org/releases#2024050900) release with an additional fix for an Android DNS routing bug causing requests to the VPN DNS servers to be routed incorrectly, which should avoid the compatibility issues experienced with certain VPN apps when we tried to ship it before
- avoid resetting Network or Sensors back to the global default after app updates in a specific case when migrating the state from Android 14 or earlier
- add an extra one-time migration of Network and Sensors being disabled in Android 14 to Android 15 to work around an issue with the previous migration of the permission state which occurred for some users with some of their apps
- fix ancient Android bug causing widgets to disappear from the user's home screen when the user stops, which was a major usability issue for secondary users
- Keyboard: extend fix for upstream layout bug in landscape mode to fully fix it for 3-button navigation in addition to the default gesture navigation
- Gallery: fix upstream cropping activity bug when both the input and output URI is the same to fix setting profile pictures for user profiles
- raise backup service transport (Seedvault) timeout from 10 minutes / 5 minutes to 60 minutes / 30 minutes to handle very large backups, particularly for the device-to-device mode which includes nearly all app data
- temporarily revert enforcing minimum 64kiB stack guard size for arm64 since Facebook recently included a buggy stack overflow check for the React Native Hermes runtime that's incompatible with larger gap sizes and beginning to be shipped by apps (revert was not applied for Android 15 port)
- Sandboxed Google Play compatibility layer: add stubs for update_engine wrapper API to avoid potential Play services crashes if the existing approaches to disable the update service fail
- Pixel 8, Pixel 8 Pro, Pixel 8a: disable Wi-Fi HAL debug logging to avoid memory corruption caught by hardware memory tagging on GrapheneOS
- kernel (6.1): update to latest GKI LTS branch revision
- use hardened GrapheneOS 6.6 LTS kernel for microdroid virtual machines for both arm64 and x86_64
- Vanadium: update to version 130.0.6723.73.0
- GmsCompatConfig: update to version 145
https://grapheneoss.org/releases#2024102400

2024-10-22 20:38:02

#GrapheneOS fully supports the Private Space feature in Android 15, which is essentially a separate user nested inside of the Owner user.
We strongly recommend it as a replacement for a work profile managed by a local profile admin app. It has better OS integration and isolation.
Private Space is an isolated workspace (profile) for apps and data similar to both user profiles and work profiles. All 3 forms of profiles also have entirely separate VPN configuration which is very useful even if you connected to the same VPN, since exit IPs can be separate.
All forms of profiles have separate encryption keys. You can keep a Private Space at rest while the Owner user is logged in just as you can with a secondary user.
Private Space makes it easier to share data than users. The clipboard is shared, but we could add a setting for it.
GrapheneOS users choose to use the OS in different ways. A lot of people largely use open source apps and not sandboxed Google Play. Others use sandboxed Google Play in their main profile. Many use sandboxed Google Play in a dedicated profile to choose which apps use it.
Regardless of how people choose to use sandboxed Google Play, they're regular sandboxed apps without special access. Private Space makes it easier to use a dedicated profile for sandboxed Google Play though.
It's also worth noting you can still use a work profile alongside it.
All of our features including Contact Scopes, Storage Scopes and sandboxed Google Play have full support for Private Space. We added support for it significantly before the release of Android 15, even before the initial early release of the source code was published in September.

2024-10-22 20:33:13

#GrapheneOS: We've finally fixed the ancient Android bug causing widgets/shortcuts to disappear in secondary users when switching away from them. It will be included in our next release. This issue impacts every Android-based OS with secondary user support and was a major usability issue.
We've also fixed 2 more Android 15 regressions in AOSP. AOSP Gallery had a long time bug in the cropping activity which started breaking setting profile pictures for users in Android 15. We also extended our AOSP keyboard landscape layout fix for the legacy 3 button navigation.

2024-10-16 08:40:56

#GrapheneOS version 2024101600 released:
This is the initial release of GrapheneOS based on Android 15 based on the October 15th stable release of Android 15. We had previously ported all of our features to Android 15 based on the Beta releases and have been finishing it up based on the early September release of the source code for Android 15.
The most notworthy addition to GrapheneOS from Android 15 is Private Space, where users can create an isolated, sandboxed environment on their device to separate apps. Apps in the private space show up separately to other apps and are hidden from the recents view, notifications, settings, and from other apps when the private space is locked.
The sandboxed space works like a profile where the end user adds or installs an app inside private space and the app is installed in a new Android profile. The system treats this as a fresh app install, and no app data is copied over to the private space. When the space is locked, the private profile user is stopped, and when the space is unlocked, the user is started.
Apps in the private space are installed as separate copies of the apps in the main space. User content (user-generated or downloaded) and user accounts are separated between the private space and the main space. You can use the system Sharesheet and the Photo Picker to give apps access to content across spaces only when the private space is unlocked.
A private space does not replace user profiles, although it may be better for some users depending on what they use user profiles for. Currently, private spaces are only able to be ran on the Owner profile. We hope to add improvements and enhancements to this feature, in theory there could be support for multiple Private Spaces at once but memory usage is a concern and this needs to be considered first.
Changes since previous version:
- full 2024-10-05 security patch level since the Pixel patches were disclosed in the Pixel Update Bulletin today rebased onto AP3A.241005.015 Android Open Source Project release (Android 15)
- full port of GrapheneOS features to Android 15 including integration of our features with the new Android 15 features including Private Space
- Sandboxed Google Play compatibility layer: add stubs to fully remove the need for the Google Services Frameworks app, which has been removed as a dependency in our app repository for Android 15+ and you can remove it for an existing install of sandboxed Google Play after each Google Play services installation runs at least once on Android 15 which migrates the GSF databases to itself (stock OS still requires this despite nearly fully obsoleting it for Android 15)
- Pixel 9 Pro Fold: add assorted device-specific Settings and SystemUI changes to better match the stock OS
- kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.56
- Vanadium: update to version 130.0.6723.58.0
- GmsCompatConfig: update to version 141
This update is currently limited to a sideload-only release but if there are no regressions it will be pushed into the over-air updates. For users on Stable, expect Android 15 releases to come to your device in the coming days.
https://grapheneos.org/releases#2024101600
#nevent1q…vauy

2024-10-16 07:27:48

Our initial #GrapheneOS release based on Android 15 is now available for early testing for technical users willing to sideload the release to their device. It's a regular production release and this can be done on a locked device with USB debugging disabled, but it's not heavily tested yet.
If you're interested in helping with either the early testing via sideloading or regular public testing via our Alpha and Beta channels, join our public testing chat:
https://grapheneos.org/contact#community-chat
You can choose between Matrix, Discord, IRC or Telegram. Most people use Matrix or Discord.

2024-10-14 09:45:23

- reply

CashApp isn't available in my country. I'd suggest their web app or using the sandboxed Play Services, or registering an account on another device and logging in on here.
If it doesn't work, it's blocking OSes that are not Google certified

2024-10-14 08:55:48

- reply

I'm still around! 👋 I burned the last key due to some important changes and I'm on more secure devices. I am letting the official project account Mastodon bridge do the responses where possible. The whole team uses that and they can be around when I'm busy.

2024-10-12 14:03:55

New change to #GrapheneOS website.
You can now see which device has which releases in Alpha, Beta, and Stable channels. This let's you know what release you'll be on depending on the channel you used.
https://grapheneos.org/releases

2024-10-12 12:25:37

Android Auto with GrapheneOS on OSMand maps
#nevent1q…myu9

2024-10-11 14:12:45

GrapheneOS statement regarding a highly misleading and inaccurate article from Cybernews about the Pixel 9 'phoning home'
https://discuss.grapheneos.org/d/16338-highly-misleading-and-inaccurate-article-from-cybernews-about-the-pixel-9

2024-10-09 06:27:55

- reply

We're the ones who published these documents on the GrapheneOS social media account.

2024-10-08 21:05:08

New GrapheneOS update out now folks. Contains this month's security patch level and some fixes with memory tagging by patching some Android memory bugs.
#nevent1q…7e5q

2024-10-01 08:08:12

- reply

That npub was burned, I don't use that one anymore.
(Check GrapheneOS forum profile for npub so you don't click a sketchy from me.)
It's not something we come across, but we are aware Orbot has some problems, that's why a Tor VPN app is being redone (not by us) in the future.
We are aware of leaks caused by some VPN apps and we keep making patches to fix it but they end up breaking said apps and force us to revert. It's predominantly an app issue, look at the posts on my old npub about Mullvad to get what I mean here.
Latest build added a second-generation leak prevention mechanism but for it's for multicast leaks: https://grapheneos.org/releases#2024092900
I'd contain Tor usage in its own profile so I don't see this happen. I guess if it happens right when Orbot is connecting, give it a few seconds after connecting before doing something?

2024-09-30 06:19:26

Top of Stacker News, thank you so much.

2024-09-29 21:05:13

#GrapheneOS: The Purpose, The Strategy, and The Why [Article]
This post explains a bit about the development approach, reasoning and strategy behind GrapheneOS security innovation and how power users protect themselves.
On SN: https://stacker.news/items/705242

2024-09-27 17:35:40

Using an app that locks with the OS credential like Phoenix Wallet in GrapheneOS allows you to trigger the device duress password when starting the app because the duress feature also extends to any OS credential input. This doesn't extend to apps exclusively doing their own implementation of a PIN though.

2024-09-27 07:32:11

- reply

The older generation face scanning hardware was far more robust and secure and the current face unlock options are far less.

2024-09-27 06:44:30

- reply

Didn't have the zap address back, only the NIP-05 (which is the same as the zap address)

2024-09-26 19:14:46

- reply

RE: Chainalysis
Companies targeting users of cryptocurrencies like Blockchain analysis firms being a fan of the tech would be expected. I would expect they use it on a daily basis and would know more about it than the typical maxi would. In conferences i've met FBI digital forensics lab staff who hold Bitcoin because of learning more about it during seizures.
We have a similar two-faced relationship with forensic companies who try and target GrapheneOS and the Pixel platform. Hate that we do whatever we can to break their capabilities but some definitely use GrapheneOS because they are impressed by the security offerings. I also find some of their tools interesting. Chainalysis is a very well made application.

2024-09-26 18:20:41

What would you want to see in a post about #GrapheneOS? Preferably something you've not seen in posts before. I want to be unique here. Is there a feature you want to understand the technical details about? Maybe a justification on X? Would be inrerested to know.
#nevent1q…u8hv

2024-09-26 11:12:32

- reply

Believing they are using the literal definitions to base their statement here... For data to be uncensorable it needs to be known and distributed to everyone. Online privacy is about reducing, hiding, or anonymizing data so it's not known. Some privacy techniques involve self-censorship.
You can use censorship resistant platforms with privacy technologies like onion routing to make the connection between your identity and the platform private, but what you create on the platform is never private.

2024-09-26 11:00:35

- reply

If a nation state had been in my old phone I'd almost consider it a compliment because I am fucking boring 🫡

2024-09-26 08:02:33

Every time a GrapheneOS post trends on SN I feel like delaying my big post I promised a year ago because I don't want to oversaturate the trending with the project. Suffering from success...

2024-09-26 07:43:15

- reply

Wasn't really something I looked into since it was extremely unexpected. Also up to believe official GrapheneOS platforms would suffice in announcing my key change. I dont want to spread fear by people misunderstanding a personal and isolated incident as a GrapheneOS one.

2024-09-26 07:29:56

- reply

All the text the LLM produced are just explaining the default features of Android (secure boot, disk encryption, data collection etc). Doesn't go into the features of any of them. Also some features like "secure boot" (likely means Verified Boot) depends on device support. Replicant definitely doesn't have that.
Id look at: https://eylenburg.github.io/android_comparison.htm

2024-09-26 02:43:49

- reply

That would be the standard procedure, but circumstances about the event meant I couldn't. Users should announce change of keys if able to.

2024-09-25 22:50:46

- reply

I didn't put the links as some people may have thought links may be phishing (IF YOU DO, GO FIND MY PAGES ON A SEARCH ENGINE INSTEAD! DONT TRUST ME!)
BUT, if you kinda trust me:
Official GrapheneOS forum page: https://discuss.grapheneos.org/u/final
My stacker.news page:
https://stacker.news/final
All zaps are going to the original address the old npub has as you can see on my profile so I earn nothing doing this if I was a real faker anyway.

2024-09-25 22:48:13

- reply

how im looking today
https://image.nostr.build/e32bccf36796b26d7877f8bccdee568d20406e2018f1c136c27e39f3ee5e38f4.jpg

2024-09-25 22:46:00

- reply

I understand. I imagine I have really annoyed a ton of people but oh well.
Key pairs for Nostr are great for verification but are a disadvantage towards certain security measures. Nsec is only as secure as the app that generated it and is only as secure as the least secure platform you stored/used it on. Takes a lot of responsibility, which I'm fine with, but most people aren't.
If you want to change security requirements (like me) you likely need to burn your key... I guess it's no different to PGP keys that expire on a set time but I'd really be waiting for a dedicated secure hardware signer before I ever share my Nostr nsec keys on any other app or device... and id probably also rotate my keys again if a device existed.

2024-09-25 22:33:32

- reply

He has bursts of being quite busy.

2024-09-25 22:27:21

- reply

Metroplex: @nprofile…jrax
He was in Nostr before I was.

2024-09-25 22:26:42

- reply

1. npub is burned, can't post what I don't have the keys for.
2. Official GrapheneOS forum page: https://discuss.grapheneos.org/u/final
3. https://stacker.news/final
Trust me or not, it's up to you. All zaps are going to the original address the old npub has as you can see on my profile so I earn nothing doing this.
You're free to contact another GrapheneOS team member.

2024-09-25 22:15:46

#plebstr #nostr #newstr (winks)
#nevent1q…0sq8

2024-09-25 22:00:06

Hi all, Final from #GrapheneOS again.
Due to an extraordinary event (not a breach!) and a change causing me to up my security requirements, I have burned the previous npub I used. This is my new npub. My security requirements are above people's conveniences, I apologise for these inconvenience but I don't regret necessary actions either.
- I will use this npub for post comments and support.
- I will refrain from constant GrapheneOS reposts as Mastodon bridges fulfill that space. Rest of the team can also USUALLY see posts there. I believe I should be more diverse in my content here.
- In short, less GrapheneOS, and more Final.
I can be verified using the original Stacker News account (final) NIP-05, Bio and LN address.
I can be verified via the GrapheneOS discussion forum user page (final). You may also verify me in any official GrapheneOS platform you wish.
Thank you for the support.
-- final