A small flaw in Android 16's networking stack let ordinary apps leak data outside the VPN tunnel, exposing real IP addresses
    • gnuplusmatt@reddthat.comEnglish
      14 hours

      Motorola is supposed to be doing Graphene supported phones soon, whether thats from the factory or with an official installer I am not sure

        • dogs0n@sh.itjust.worksEnglish
          3 hours

          From the outside, this doesn’t look one sided to me and Motorola (Lenovo) won’t want GrapheneOS “locked away”.

          Motorola partnered with GrapheneOS explicitly because they want the highest security for their enterprise phones (in my opinion), so Motorola demanding GrapheneOS be less secure would be silly for them anyways since they prioritise enterprise (as far as I know).

          And in any case, if Motorola caused beef with the GrapheneOS team, I believe in GrapheneOS’s morals to ignore stupidity. They probably have a contract anyways that states Motorola have near zero influence over the OS.

          • Holytimes@sh.itjust.worksEnglish
            3 hours

            Lenovo and Dell are some of the only companies that actually care about Linux weirdly enough. That also arnt Linux software developers anyways. If anyone’s goanna do it “right” it’s those two.

        • sanitation@lemmy.radioEnglish
          12 hours

          Yeah but even then - are they targeting hobbyists and privacy crowd? Or more like some special enterprise use case?

      • kiranraine@reddthat.comEnglish
        10 hours

        I want to applaud that but not if its the same as Google android where you’re waiting a year or more for an update. So many features I wanted over the years and was stuck to 11 or 12 at the time(or earlier idk which that thing had but it was a common occurrence since i had the issue with 2 diff phones)

      • A_Random_Idiot@lemmy.worldEnglish
        5 hours

        Really need Theodore Roosevelt to rise from his grave and start taking his big stick to all the big, monopolistic companies again.

  • Reygle@lemmy.worldEnglish
    17 hours

    I went Graphene a while back and can’t be happier with it.

    I’d still love to see a real Linux phone that really works and really has native Signal/etc apps but since buying a pinephone years ago to tinker with it, I’m not holding my breath.

    If anyone here has fears/questions about installing/using it, I can give you basics. NOT an expert, but installation was the easiest thing I could have imagined, took MAYBE 10 minutes literally following their official guide.

    • akwd169@sh.itjust.worksEnglish
      24 minutes

      Does signal not work on grapheneOS?

      Im bound to end up on graphene in the very near future but im trying to prepare myself for the conveniences ill be giving up, I know tap to pay is one, and bank apps proba ly wont work (but online banking in a browser works fine for me)

      Is there anything else like that?

      • MalMen@masto.pt
        21 minutes

        @akwd169 @Reygle signal works on grapheneos… from my experience everything works just fine with the exception of bank apps -_-

    • k0e3@lemmy.caEnglish
      14 hours

      This might be a silly question, but do you think it would be a good idea for me to first set up my old android phone with my bank and authenticator apps before I make the switch in case some of them don’t work?

      • Reygle@lemmy.worldEnglish
        13 hours

        Yep sounds like a good idea to me, I like when people think ahead like that.

        • k0e3@lemmy.caEnglish
          6 hours

          Thanks! I have an old Motorola I can use for banking. I think in just gonna do it tonight!! Wish me luck!

    • Lemmayng@lemmy.worldEnglish
      17 hours

      Agree. On my fifth anniversary with GrapheneOS and it still kicks ass.

      The Pixel phones on the other hand still leave a lot to be desired as reliable hardware. My 8 Pro is the best of the ones I’ve owned, but not by much considering my Pixel 6 Pro had a shitty Tensor modem, and my Pixel 4 XL had a spicy pillow.

      The sooner GrapheneOS moves to Motorola, the better.

      • Holytimes@sh.itjust.worksEnglish
        3 hours

        I went 1 2 4 7 9. The first two where good 4 was shit 7 was even more shit and 9 has been slight better shit.

        But it’s still better then fucking Samsung. Wish there was a good third option on Verizon that didn’t require me to jump through fucking hoops or is just a worse pixel.

      • Reygle@lemmy.worldEnglish
        17 hours

        I don’t have any serious complaints about my 9a REALLY, but I’d prefer something with SD, headphone jack, and I’d REALLY kill for something much smaller. (but no fold, that stuff’s for derpy weirdos)

        • DigDoug@lemmy.worldEnglish
          16 hours

          If Motorola offer one with and SD card and headphone jack, I’m buying it on day one.

          • curbstickle@anarchist.nexusEnglish
            12 hours

            I had looked it up, they are starting with new phones in the same line/family as Motorola Signature, Motorola razr fold and Motorola razr ultra apparently

            • Lemmayng@lemmy.worldEnglish
              10 hours

              So the closest baseline is the Moto Signature, and even then it won’t ever meet their standards. Best to start from the Signature’s specs and hypothesize from there.

    • echo@lemmy.mlEnglish
      16 hours

      The software for linux phones is pretty much there. Gnome and KDE mobile are surprisingly capable. There’s built in apps for every basic thing you’d need on a phone like a dialer, SMS app, camera, etc. plus all the normal apps adapted to work with mobile like the calculator and maps apps.

      The only real limitation is with the hardware. I have no idea why all new linux phones launch with specs from a decade ago. You can get a better experience by flashing ported Postmarket OS to an Android phone like the Nothing phone or a OnePlus 6t.

      It shouldn’t be like that, no idea why it’s impossible to just have a linux phone with decent specs and a good camera on par with modern flagships.

      • utopiah@lemmy.worldEnglish
        5 hours

        Because Linux phones with proper hardware are sold at 1k and hundreds of people want to but that, not thousands or millions and thus they don’t actually get built. Couple of attempts just lasttear didn’t pan out.

      • ozymandias117@lemmy.worldEnglish
        15 hours

        Linux phones try to build from upstream Linux, and the major phone SoC vendors HATE upstreaming their code.

        They believe every character in their source code is absolutely top secret.

        A middle ground I wish was considered more is taking Google’s kernel and the vendors DLKM partition/DTB/DTBO for hardware support, and putting a GNU userspace on top.

        This has had problems in the past, because vendors would modify syscall tables such that they don’t match userspace anymore, but with GKI, I think we’re closer to that being a possibility

        • UnspecificGravity@piefed.socialEnglish
          14 hours

          Thats always the problem with building hardware open source products. You spend millions developing the OS to work with your stuff and you get like six months before someone else is competing with you, except they didn’t have to spend that investment. The only reason we got the steamdeck was because the guys that made it ALSO owned the means of putting games on it, so they didn’t really need to make money on the product itself (kinda like with Google and the play store).

          • ozymandias117@lemmy.worldEnglish
            13 hours

            At least with the vendors I’m referring to (2/3 that make all Android phones), they just took the open source code, hacked it up as quickly as possible to get some basic drivers working, and moved on.

            There wasn’t any “special sauce” in the source, they just didn’t want to spend the effort to upstream it

            Edit: Just because you said “hardware open source” I wasn’t advocating for open hardware, just for hardware vendors to, ya know, support the hardware

      • Lemmayng@lemmy.worldEnglish
        10 hours

        “You can get a better experience by flashing ported Postmarket OS to an Android phone like the Nothing phone or a OnePlus 6t”

        Can you relock the bootloader when flashing Postmarket OS to those phones? The only other OS that allowed for relocking the bootloader after flashing on certain phones was DivestOS, and unfortunately it went the way of the dodo.

      • Squizzy@lemmy.worldEnglish
        16 hours

        100% I got a pixel, secondhand, to allow for gOS.

        All I want is a linux phone that takes good photos that I feel is secure. I need it to launch android apps in sandbox instances too but I understand that is possible.

        Linux phones are always missing modern stuff be it fast charging, nfc, decent compnents, etc.

        Love a tablet too, the pixel tablet with speaker stand is ideal if it wasnt the devils products.

      • Reygle@lemmy.worldEnglish
        15 hours

        Glad to hear it, as years back with the Pinephone, I had a… worse than that experience. It was not good.

        • Reygle@lemmy.worldEnglish
          15 hours

          My 9a running Graphene works with a laptop usb C dock beautifully btw, just had to enable the beta in developer options.

            • foggenbooty@lemmy.worldEnglish
              10 hours

              Sorry, what about it isn’t the same? Is the pixel not using DPAlt mode do handle external montors/docks?

              • muusemuuse@sh.itjust.worksEnglish
                9 hours

                It’s still just android. A Linux phone is like a full Linux PC in your pocket. Android is an abusable compromise.

                Graphene is doing good work and is a great stopgap solution, but it’s not the end goal.

    • eli@lemmy.worldEnglish
      15 hours

      I’m about to make the switch myself. I have a Pixel tablet and a P9 Pro. I swapped my tablet over just so I can test things out. I want to deGoogle completely. No play store.

      So far I’ve had to make a list of all my apps I have on my phone and go one-by-one seeing if there’s an apk for it somewhere outside of play store, and if not, then if there’s an alternative app, and then website or PWA it is.

      I’ve come to realize I have a lot of unnecessary bullshit on my phone to begin with. Think I’ll make the switch this weekend, just need to find a few more alternatives to specific apps.

        • eli@lemmy.worldEnglish
          4 hours

          Thanks! I had no idea about this, wish it was a little more robust but I’ll definitely be sharing this app with others!

      • ItsNotImportant24@lemmy.mlEnglish
        13 hours

        What apps are you looking for alternatives for? I run Graphene and have replaced everything with foss alternatives and couldn’t be happier. Except my banking app and a couple that should absolutely be the official apps, but those are installed on a seperate profile.

        Also, dont use Aurora store for apps once on GOS. Its not recommended. Use Obtainium for apps straight from the source or accrescent along with GOS’ official app store.

        • eli@lemmy.worldEnglish
          11 hours

          Well I found good alternatives(Fossify stuff) or most apps I use already have GitHub releases. I just need to try these apps out and if I dont like them then find other alternatives. Like map apps, calendar, voice recorder, etc. Again I found alts, just not sure how they’ll actually function until using them.

          My biggest one is the Steam app for their authenticator. I read some stuff online that Aegis supposedly can work as a Steam auth, but yeah.

          • ItsNotImportant24@lemmy.mlEnglish
            11 hours

            Well, I use Fossify calendar and have no problems with it. For maps I like and use CoMaps, but the others will work well too. The map apps though use lat and long so they only put you at the block of the address but if you put GMaps WV on your phone you can put the address in it and then click share and copy the lat and long it provides and paste it into comaps and it will route straight to the address, its a couple extra steps but quick and easy. I honestly think youll realize you wish youd have switched sooner. Graphene is just amazing. Plus you can talk to them on their platforms and channels

      • superglue@lemmy.dbzer0.comEnglish
        14 hours

        Check our Aurora store for apps you need from the Play Store. But ya, once you start scrutinizing the apps on your phone you realize 95% of it is just useless junk you dont need.

      • one_old_coder@piefed.socialEnglish
        5 hours

        GrapheneOS is actually the most bland stock ROM you can find, and it’s amazing for that. Android without Google. Some people complain that banking applications may not work, but it’s highly specific to a country and that bank.

        I have no complaint and no problem so far, it’s the best ROM I have ever used.

      • Reygle@lemmy.worldEnglish
        15 hours

        Never used the stock rom on it, purchased it, turned it on, and immediately flashed it. BUT compared to my last “normal” android? (Smasnug- I’ll never NOT call them that thanks to a certain Aussie on YT) No. Nothing. That said I’m middle aged and never even considered using stuff like contactless payments with a phone, etc. Never saw the appeal of increased risk just to look like a douchebag at the checkout aisle or the drive through. Your mileage may vary if you use things like that, I can’t speak to it.

        Only thing I noticed was for my bank’s app, I had to enable “exploit protection compatibility mode” to make it function like it should.

        • _g_be@lemmy.worldEnglish
          11 hours

          I use contactless payments on my pixel, that and banking apps in general keep me from trying it.

          Sounds like it might work fine, that’s encouraging.

          tap to pay isn’t more risky, might be less risky depending on how you use it. My understanding is that it uses a one-time number instead of your card information, not unlike using the chip and pin. I’m no expert tho, don’t quote me on that lol

    • kryptonianCodeMonkey@lemmy.worldEnglish
      15 hours

      I have company managed apps on my device. Teams, Outlook and Authenticator. Any idea if there might be any friction there with Graphene? It’s really the only thing from holding me back and I can’t really justify experimenting if it’s going to break things

      • NinjaTurtle@feddit.onlineEnglish
        13 hours

        Should work, although haven’t tried Teams or Outlook, but I would recommend putting it on a different profile, you can make multiple users, then enable the google play store on there. Leave that as you work profile or google profile. Helps keep things separated.

      • mnemonicmonkeys@sh.itjust.worksEnglish
        15 hours

        I have company managed apps on my device. Teams, Outlook and Authenticator.

        That’s your first problem. If your company want to force you to use specific apps on a phone they should just buy you a phone for that

        • kryptonianCodeMonkey@lemmy.worldEnglish
          15 hours

          Can’t really be helped. I was getting a $50/mth stipend for it for about 3 years but then they turned that off.

          • possumparty@lemmy.blahaj.zoneEnglish
            14 hours

            Oh, they turned that off? Okay, where in the policy does it say that you’re required to use your own device? No stipend no teams. No stipend no outlook. No stipend no authenticator. I’m not giving them a single millimeter.

            • GMac@feddit.orgEnglish
              3 hours

              This, all day long. If you need to access teams on the go (because you choose to) there is a web interface for that. Same for outlook. There are plenty 2FA options so you probably already have something that can provide 2FA without requiring you to install a microslop app to your phone. I will not accept any third party management of my device.

            • PancakesCantKillMe@lemmy.worldEnglish
              13 hours

              Yah, the company I work for has been pushing Bring Your Own Device (BYOD) the last few months. Nope and nope.

              • possumparty@lemmy.blahaj.zoneEnglish
                11 hours

                Oh hell no lmaoooo absolutely tf not. I refuse to outsource the costs of their business to my own wallet.

      • Reygle@lemmy.worldEnglish
        15 hours

        YUCKY! Sorry can’t say. I don’t even allow Microsoft on my network.

  • SwifferWetjet@thelemmy.clubEnglish
    17 hours

    Lol “flaw”

    Guess I’m ditching android fully. Anyone got any reccos for something with a pricetag that won’t make me cry and no Google bullshit?

  • henfredemars@infosec.pubEnglish
    16 hours

    Extremely lame work by Google. Infeasible? Why? This is absolutely a security vulnerability. Any ad SDK on any app on your phone can use it to associate your VPN activity.

  • Rod_Orm@piefed.worldEnglish
    17 hours

    Oh yeah i remember that bug, they still not patch that!? Who knows with their other product like chromium