🔥 Hello again, new #GrapheneOS Update 2024022600. This time we have a new security feature that's been worked on for a while: USB-C Port Security. This is a significant security enhancement.

This feature allows users of Tensor Pixels (6 and later) to have fine grained controls on USB controller functionality including totally disabling data lines or the port when the OS is in use.

There are 5 modes:

- On (current)

- Charging-only when locked except in BFU (before first-unlock)

- Charging-only when locked

- Charging-only

- Off (which even disables charging while booted into the normal OS mode).

This is different from the previous existing USB control features including the Android 12 USB HAL toggle which only disable high-level kernel functionality which still left all the low-level kernel driver, USB protocol and USB controller attack surface enabled.

Other changelogs:

- kernel (5.10, 5.15): add support for ignoring USB alt modes

- kernel (Tensor Pixels): extend max77759 USB-C controller driver used by Tensor Pixels with support for a sysfs node providing fine-grained control over the USB-C data path at the USB controller level

- Setup Wizard: fix crash for SIM locales not recognized by com.android.internal.app.LocalePicker

https://grapheneos.org/releases#2024022600

#GrapheneOS #Privacy #Security

Reply to this note

Please Login to reply.

Discussion

It is likely that the charging only except in BFU mode will be the default in the distant future. Other, stricter modes will be useful for people who have threat models that consider a threat having proximity to an AFU device a high risk.

#GrapheneOS will continue to develop systematic security enhancements.

Why would you want data enabled before first start?

I was about to ask the same, I assume it's for recovery in case you mess up the OS, without data accces before first unlock, you are stuck with a brick unless you can boot and unlock it.

Bur I'm not sure I got it right.

My question would be more, what is the rest to select charge only when locked? Is there a risk that the device cannot be recovered? Or is there always a possibilty to reinstall from scratch in case of serious issues that prevent booting?

The USB port configuration is when the phone is in the OS mode. The phone will charge when powered off and recovery still works via fastboot. My other reply to Max just now explains the usecase for accessories on BFU.

This would benefit a user who uses a dock on startup, or has an extremely long passphrase for the owner profile that cannot be brute forced. If they have a keyboard or another device responsible for typing the key, they can use that instead.

Some USB keys may have features to store a password in them and type them when used in a certain way. Since the phone only would accept the accessory in a BFU state there is not much added risk.

Interesting, thanks.

I'd guess that this is a small part of the user base, so a more secure default might be fine.

This is still being looked on as it's a new feature and overall feedback is required, we don't want to have added confusion by people wondering why their accessories wont work at all. Users sadly still mix this up even with the older accessories toggle we have. Currently it's set to On but either Charging-only when locked or Charging-only except BFU would be a default in the future.

Charging-only with BFU exception and Charging-only have almost the same benefit since the BFU device is still entirely encrypted. Although, charging-only would definitely be the way for someone who doesn't use any accessories at all. Stricter modes like Off are for people who consider any situations with access to the phone's USB port when powered (like a seizure risk) as an unacceptable threat.

Charging only when locked with BFU exception and charging-only when locked*

What a tongue twist.

#GrapheneOS releases significant new security enhancement, USB-C Port Security

#cybersecgirl #privacy #security

nostr:nevent1qqsr2m8v4zk36wnwn4rh5kfse77mnqrcy79k3gpp7wkw8pf5sff3jfqpp4mhxue69uhkummn9ekx7mqzyrq45kn9nph84dqnfhhr4wzj2nd9ch2tqnncknckeq5rwxfdx4gc2qcyqqqqqqgvuvrvw

When's the super duper vanadium edition coming out? I wanna ditch the other browsers and go native already but dem ads they drive me mad.

Adblocking is available now in Vanadium for a while. Check your Apps app for Vanadium updates or make sure your updates aren't disabled. Currently Vanadium uses only EasyList as an initial implementation so there could be more.

When are you going to build your own hardware? I wont want to give google money

I wanted to know too

We have had a few OEMs who have wanted to work with us but so far none has been able nor willing to follow through on what we want with security requirements. We aren't going to support a device that is less secure than what we support already and if something were to go wrong on that device we will get the blame for their incompetence or lack of ability to provide such security that we were able to use elsewhere.

https://grapheneos.org/faq#future-devices

Other sane OEMs do anticonsumer practices, like Samsung with having an eFuse that breaks security features (and the camera in some models) when you want to use another OS. This shouldn't be a thing, but sadly it is.

We still want more devices and are still looking for OEMs. Buying a device secondhand will stop you giving money to Google as another means. DivestOS is an option for non-Pixel devices who use a small amount but not all of our enhancements, but it's mainly used for harm-reduction for insecure end of life devices.

What phone is currently ideal for GrapheneOS?

Pixel 8 and later due to the support of hardware memory tagging. This is a humongous security benefit the other phones do not have. We use MTE throughout the OS and the Vanadium web browser.

GrapheneOS 🔥

nostr:note1x4kwe29dr5axa8280fvnpnaahxq8sfutdzszruavuwznfqjnryjq26l6em