Avatar
Final
b98ded4ceaea20790dbcb3c31400692009d34c7f9927c286835a99b7481a5c22
Cypherpunk forensic scientist and security specialist. Associate #GrapheneOS. Matrix: f1nal:grapheneos.org

Documentation about #GrapheneOS removing sensitive data in memory is now available in the features page.

https://grapheneos.org/features#clearing-sensitive-data-from-memory

Christmas has been a big day. Merry Christmas everyone. Wishing good luck over the new year and beyond.

GrapheneOS started in 2014 and was previously called CopperheadOS due to a sponsorship by an abusive, malicious company. GrapheneOS is a continuation from the original team and the product with the older name is now a low-effort proprietary fork. Original CopperheadOS is GrapheneOS.

It was known for a while DivestOS, Mull and others were going to end (at least internally), it's a big job for one person. GrapheneOS has 7 full time developers for comparison.

There are rooms on SimpleX that are not official as there's no ability to bridge SimpleX with all our other platforms and that the nature of SimpleX makes it very difficult to moderate, worse than Matrix in fact and therefore bridging it would be a nightmare.

We had to disable bridging attachments through platforms except Discord due to a lot of gore, CSAM, pornography being sent in raids through Matrix. It would negatively impact all the other users.

A temporary General and Off Topic specific to Telegram has been made and will be unbridged.

I imagine these are pretty easy assumptions for some, but:

- How are OS / App updates managed?

- What is the Prime's battery life?

- What is the security model for apps? (Maybe explain App signing, sandboxing, permission management, available App APIs?)

- How is disk encryption implemented?

- My PC doesn't have Bluetooth, can I still use Prime?

- Can I use Prime airgapped?

- What protections are there against physical attacks?

- I already have a HWW, is Prime still useful?

- How does Stateless Mode work?

- What makes Prime better than a standard U2F Key (i.e. YubiKey)?

- What makes Prime better than a TOTP password manager on your phone?

- What is the feature roadmap for Prime?

A lot of positives from me to note, and I see a ton of the inspiration from the Precursor developer project on here. Hope this authenticator / storage device works well.

Want to get clarification on this before making any comments: are any uses the Bluetooth / QuantumLink mandatory? If there is, what would that be? I see there's no detailed manuals on site right now.

This isn't me making a concern of the device at all since Bluetooth as an attack surface would affect the device connecting to the Prime more than the Prime itself. I'm mainly asking for the users who choose to minimize remote attack surface on their phone by only using Wi-Fi and nothing else.

We're very disappointed Let's Encrypt is ending support for proper revocation checks via OCSP Must-Staple which is the only efficient, private and secure method not depending on a browser-specific service:

https://letsencrypt.org/2024/12/05/ending-ocsp/

No replacement is being offered for the feature.

The built-in nginx support for OCSP stapling doesn't have a way to properly save the last valid result and reuse it but nginx fully supports handling it via an external service. We use https://github.com/tomwassenberg/certbot-ocsp-fetcher for reliable OCSP stapling and it has always worked very well for us.

Short-lived certificates are officially defined as having a 7 day or lower lifetime. It would be a good replacement for OCSP Must-Staple not requiring any client/server support. Let's Encrypt doesn't support short-lived certificates and hasn't announced any plans for adding them.

Let's Encrypt has been very positive about the concept of short-lived certificates and is likely going to implement them which is great. Removing Must-Staple before those are available isn't great. Short-lived certificates aren't even being listed at https://letsencrypt.org/upcoming-features/ yet.

They've heavily implied that they'll try to implement short-lived certificates in 2025, so there will eventually be a replacement for Must-Staple. It will probably come after Must-Staple has been removed for quite a while already. It's not great having things regress before that.

Alpha and beta testing for regressions on the upgrade to Android 15 QPR1 has went well. Hopefully a version of GrapheneOS will reach Stable soon. Thank you!

I wouldn't know about what happened to that repo, sorry. A user on our forum reported it going a few days ago then another said it came back. If it is offline again then I'm not sure what happened as I am not Cake Wallet.

Given there's been no communication about it (that I can see) I'm not assuming it's been ditched.

Happy 100k! 🥳🎉

I will continue spending or swapping with my sats no matter the highs.

It's not a surprise the #security industry is plagued with bad actors, grifters, fraudsters, and even criminals. It's easy to lie to people to follow bullshit because security and privacy are extremely easy concepts people can understand at a basic level, despite being extremely complex and requiring dedication to understand at a higher level. This is exactly the same way physical and mental health is also used to sell pseudoscience.

We're in a space that attracts the fearful and paranoid, and the cold and hard truth is these types of people are easy victims because they always doubt every action they take. Anyone who can't reflect and accept their own approach will make it hard to develop an approach to stay with. It is easy to tell such people that the way they are doing things are wrong and convince them to do something else. You can reference something obscure and that is enough for some people.

Pushing security nihilism that trying doesn't matter isn't helpful either. It's harmful. Giving up means you'll never have an attitude to protect.

Bad actors in the security community market exactly like scammers, with:

- A sense of urgency, by saying they are not safe,

- An appeal to authority, referencing famous people,

- Playing on their emotions, like their fear or paranoia,

- Offering of scarcity or exclusivity, that everyone else is missing out or trashing other projects without valid evidence, and

- Referencing current or past events, often with misinformation.

Why does GrapheneOS or other open source projects go on the offensive then? Because people like these aren't competitors, they're threats. In our case, mobile security is extremely plagued with such people, selling dubious feature phones or repackaged old, insecure devices pretending they are endgame security. Some groups make apps or operating systems that don't add security benefit or reduce security. They're threats because they endanger people into believing that they are safer when they really are not.

It wasn't long ago that the mobile security market had criminals that were selling dubious services bundled onto devices like EncroChat, SkyECC, Phantom Secure and more. They enabled violent criminals and likely also scammed ordinary people in the process with a false sense of security. Hundreds of thousands of people were affected by their takedowns. Companies that used to resell these now try and forget they ever had.

Certain actors in the security industry also don't try and innovate security or privacy for the benefit of the world, but to benefit authoritarian regimes and a powerful, abusive elite class willing to pay them for their skills or the power they could leverage. The security industry is meant to be transparent and collaborative, with an unspoken but understood code of ethics to protect and attack to benefit business clients and users. But, some big organisations don't follow it. Forensic firms like Cellebrite sell exploits to regimes to allow data exfiltration, while mercenaries like NSO selling cyber attacks for customers to commit unlawful espionage against their political opponents and those who dissent.

Oftentimes the people with money in the bank sell security and privacy to try and whitewash their past actions. For example, Unplugged is founded by Erik Prince, a war criminal and illegal arms dealer of Blackwater fame, who also employ NSO employees that sold spyware to target political opponents, journalists and dissidents. This isn't the first ex-Defence industry mobile security LARP product and it won't be the last. It is worse that these companies often steal work from open source developers (like Unplugged stealing from Element and DivestOS' Hypatia) and provide nothing in return.

I will not be complacent in having such people produce their rot in the space we dedicate our daily life to. We'd rather quit than collaborate with opposition and it wouldn't have been the first time GrapheneOS had to do this.