lobsters score: 1 · tags: android
The problem with all these approaches is it’s too easy for a website to detect you’re blocking their ads and then harass or block you. A browser extension like uBlock Origin has extra code trying to defeat the anti-blocker blockers that works a lot better.
It is ridiculous that my computer is a battleground for companies trying to trick me into buying goods and services.
score 1 · canonical
Yes, it’s totally unacceptable. Mobile devices are definitely an area where open computing is being lost. It’s even worse in iOS, where running arbitrary code within the device you’ve bought requires a $100/y payment or running an insecure version of the operating system and a jailbreak.
GrapheneOS seems to be the only workable, half-decent solution. But there is a lot of tradeoffs that are neede.
score 1 · canonical
In terms of user-control, I don’t think GrapheneOS is the best solution in the Android ecosystem. It may well be the best in terms of security, but that’s a different question.
Just like Google’s Android, GrapheneOS does not allow the user arbitrary filesystem access under any circumstances. This means a few things:
-
You cannot take full backups of your phone or otherwise take out all your data. All you can do is ask each app kindly via a backup API for the things it’s willing to give you.
-
If you ever want to replace GrapheneOS, maybe because you’ve found something better or because the project stops supporting your device, you need to re-unlock the bootloader, wiping all your data.
In essence, this means that replacing Google’s Android with GrapheneOS swaps out one gatekeeper for another. Your data is still not yours. The same is true for e.g. CalyxOS, which also insists on locking the bootloader (with a non-user-controlled key) and providing no arbitrary filesystem access.
This is a definite degradation compared to the previous generation of Android distros such as Lineage OS, where users kept full control of their device and their data. Is it worth giving that up in exchange for stronger security? Maybe, maybe not. All I’m saying is that GrapheneOS does not represent the optimum in terms of user control.
score 1 · canonical
LineageOS does not support arbitrary filesystem access for the user. This requires rooting, which they don’t support and don’t recommend. The LineageOS.org web site won’t tell you how to root your phone. https://wiki.lineageos.org/faq#can-you-help-me-root-my-device But you can do this with Magisk.
Likewise for GrapheneOS. Here’s a way to run GrapheneOS on a rooted phone with Magisk: <github.com/schnatterer/rooted-graphene>.
The choice of whether to run your phone with the bootloader unlocked is likewise a choice that the user makes, independent of the OS. To run GrapheneOS with the bootloader unlocked, skip the “relock bootloader” step when you follow the official GrapheneOS installation instructions.
score 1 · canonical
Huh, that’s interesting. I’ll admit I haven’t used it in years, but back then it was always
userdebugbuilds, which enabledadb rootand thus full backups. They also used to recommend TWRP, which gives another method of proper backups. It seems like they’ve regressed in this domain, again in the interest of security, but still kind of regrettable. Is there no longer an Android distro focused on user control?
score 1 · canonical
I suspect the problem is the existence of Android apps that will refuse to run if they detect that the phone has been rooted. (Mostly banking apps? IDK.) Perhaps Lineage decided that it was more important for apps to work, and maybe they didn’t want the tech support hit from people complaining that their apps don’t work.
The distro you want isn’t a popular distro, because it will be focussed on the needs of hard core tech types who want ultimate control at the expense of app compatibility, and therefore at the expense of user friendliness.
score 1 · canonical
Interesting! I hadn’t considered that perspective. I think this is because of attempts to sandbox applications between one another right, and avoiding a single application getting all data within the device. It’s interesting for me because I am having discussions in https://lobste.rs/s/9ipypq/updates_full_disk_access_macos where people lament the lack of isolation between apps in desktop operating systems such as MacOS.
score 1 · canonical
But it’s not just apps. ADB also does not get full access. Neither does the recovery (we used to be able to do full backups via TWRP, does anybody remember that?). The only party who could get full access to your data is whoever holds the signing keys - so either Google or GrapheneOS. This may be a fine tradeoff for many people but I’m not happy about it. This is not how I run my desktop Linux and I don’t think I want to run my Android like this either.
score 1 · canonical
If you find a solution that works and is open I’d be interested to hear it! I’ve been thinking in this area, albeit not with a lot of effort hehe. I’d prefer not to have a phone at all, though these days there are so many apps that require a phone, like banking and so on.
score 1 · canonical
There are basically 2 types of solutions:
-
Run Android with local root and/or unlocked bootloader, like Lineage OS. You lose some security such as defense against evil maid attacks but it’s very convenient and you’re fully in control
-
Run something like GrapheneOS, including the locked bootloader, but build and sign it yourself with your own key. If done correctly this would let you have your cake and eat it too, but it’s a bit of a hassle to set up. I think a project with proper support for this would be great.
score 1 · canonical
My problem is I don’t really believe it is possible to use Android in a way that lets you be independent of Google. I feel the same way with Google Chrome. It’s like, sure, technically it’s open source but in practice most forks cannot sustain updates against such a large codebase, and Google is fundamentally hostile. I think the people behind Graphene have done a good enough job of this, working very hard to make an OS that, for example, can be used without Play Store.
Mobile devices are such a pain! I wish they hadn’t become a necessity of life and one could have a reasonably practical solution to this.
score 1 · canonical
-
-
Drives me nuts that it requires root access to add to the hosts. Is it a conspiracy that Google wants you to see ads so you can’t modify the hosts? I have both ad-blocking & non-ad-blocking reasons to do so, but now with a rooted device everyone acts like my device is insecure—when I would argue I’m now more secure with ad/adware/spyware/malware all blocked via hosts. But it was never about my privacy/security to take this away from me on Android.
score 1 · canonical
Yeah, I’m also really pissed that a “rooted” device is frowned upon as “insecure”, and some enterprisey / financial / govt apps refuse to work “for my own safety”, unless I manage to hide the rooting fact from them somehow. I’m so tired of it so I’m ready to give up, and the next Android phone I’ll have is probably not gonna be rooted. I guess I lost in this cat-and-mouse game against the corporations.
score 1 · canonical
For a brief moment I could use things in the Sailfish OS sandboxed Android space, but recently that started being detected too & is just as difficult to patch. I might need to carry a separate stock Android phone of burner quality just for this nonsense, but I report everything to these corpos & tell them they should just have a PWA as this should be a 2-way street: you don’t trust my device, but I don’t trust your application not doing nasty things (with Exodus showing how many questionable permissions + trackers are in your app I don’t want to install).
score 1 · canonical
I might need to carry a separate stock Android phone of burner quality just for this nonsense
I call this “the compliance device”. I increasingly believe that we should just bite the bullet and get a vanilla as-standard-as-possible device for things that require it, and then perform the rest of our computing in the least-encumbered device we can find. And I’m increasingly thinking this device should not be mobile, it should have a decently sized screen, and a full-size keyboard.
The “traditional programmable” computer seems to be on its way out, and we should hold out to them as much as possible. IMHO, phones are a bit of a red herring and… always-on Internet on our pockets is not healthy.
score 1 · canonical
Oh, & I just found out you ne to have a SIM in the device & it needs to match the same on os your passport—so I can’t just use a airplane-mode-on, Wi-Fi-off aux phone. The cherry on top today was find out today that “internet banking” will be sunset at the end of the year. This was my last way to access my balanace (without calling (no misutes) or visiting).
score 1 · canonical
Mind you, I can do a lot with cash in this cash-forward country (to the chagrin of the gov’t & bank corpos). However… any sort of online payment requires OTP, & the OTP is now tied to the app only. I have emailed & bitched about them getting off SMS 2FA & to support WebAuthn/FIDO2 for ages. There are new laws in place to prevent a local lack of tech literacy getting all sorts of folks duped/scammed. These laws are not that bad on the surface since they mostly talk about banks getting their shit together on security (tho I really hate tying 1 device + 1 SIM + 1 human only)—but the downstream is that rather than complying by setting up WebAuthn for the web apps, almost all banks have decided to just close down their internet banking rather than code up the measures for compliance (where many have sites that are more or less abandoned where Bualuang here actually has Netscape Navigator 4 detection in their source). Accessibility is massively hurt since it’s now funneling everyone into a) having a smart phone & b) making that smart phone be U.S. megacorpo only in Google’s Android or Apple’s iOS (some also do Huawei’s Harmony OS, but that’s just Chinese megocorpo). We know these companies track users & in many cases, users will be required to fork data over to these companies—not to mention all of the apps have Facebook & others’ tracking utils in them. Somehow the banks are allowed to force their concept of security on me but it’s not a 2-way street where I can to enforce my security/privacy back at them—which I could do from the comfort of my laptop, browser sandbox, DNS blackholing, & uBlock Origin.
At least the EU is finally starting to wake up about trusting & getting locked into all of the U.S. big tech, but we’ve just started the nonsense here. …Do I need to start my own bank? Too bad you must keep a nontrivial amount of money in their banking system to keep your visas.
score 1 · canonical
Thanks for the link.
I don’t know. I’ve thought forever that computers are dying and after reading The Eternal Mainframe it became even more clear to me; personal computers were an “accident” that IMHO brought the people many great things, but huh, I don’t know how it will play out. Phones being proprietary dongles that you can only use for certain stuff is… something.
(Actually, on some aspects it could be good to be able to do critical stuff such as banking on a massively locked down device. And if people kept these locked down devices as “the bank, gov’t stuff dongle” and stopped using them for being Internet-connected 24x7… maybe I’d be happy with that. However, that last part seems quite unlikely to me.)
score 1 · canonical