this post was submitted on 25 Aug 2025
500 points (97.3% liked)

Android

20113 readers
93 users here now

The new home of /r/Android on Lemmy and the Fediverse!

Android news, reviews, tips, and discussions about rooting, tutorials, and apps.

🔗Universal Link: !android@lemdro.id


💡Content Philosophy:

Content which benefits the community (news, rumours, and discussions) is generally allowed and is valued over content which benefits only the individual (technical questions, help buying/selling, rants, self-promotion, etc.) which will be removed if it's in violation of the rules.


Support, technical, or app related questions belong in: !askandroid@lemdro.id

For fresh communities, lemmy apps, and instance updates: !lemdroid@lemdro.id

💬Matrix Chat

💬Telegram channels / chats

📰Our communities below


Rules

  1. Stay on topic: All posts should be related to the Android OS or ecosystem.

  2. No support questions, recommendation requests, rants, or bug reports: Posts must benefit the community rather than the individual. Please post to !askandroid@lemdro.id.

  3. Describe images/videos, no memes: Please include a text description when sharing images or videos. Post memes to !androidmemes@lemdro.id.

  4. No self-promotion spam: Active community members can post their apps if they answer any questions in the comments. Please do not post links to your own website, YouTube, blog content, or communities.

  5. No reposts or rehosted content: Share only the original source of an article, unless it's not available in English or requires logging in (like Twitter). Avoid reposting the same topic from other sources.

  6. No editorializing titles: You can add the author or website's name if helpful, but keep article titles unchanged.

  7. No piracy or unverified APKs: Do not share links or direct people to pirated content or unverified APKs, which may contain malicious code.

  8. No unauthorized polls, bots, or giveaways: Do not create polls, use bots, or organize giveaways without first contacting mods for approval.

  9. No offensive or low-effort content: Don't post offensive or unhelpful content. Keep it civil and friendly!

  10. No affiliate links: Posting affiliate links is not allowed.

Quick Links

Our Communities

Lemmy App List

Chat and More


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] Turret3857@infosec.pub 14 points 3 days ago (4 children)

If you're on Graphene for security, Linux mobile will be the last thing you want as the security of those devices is akin to carrying around a bootloader unlocked android with no app sandboxing. You'd be better off buying a fair phone and using iodé until they can't develop any further.

[–] Cethin@lemmy.zip 31 points 3 days ago (2 children)

It depends on what your requirements are. Is physical security important, or is preventing data collection more important? Not all security is the same.

[–] Turret3857@infosec.pub 5 points 3 days ago (1 children)

I never implied it was, however if someone is using graphene as a way to achieve mobile security, it can generally be assumed they want said security if they switch to a different OS. Iodé and CalyxOS both support more than just pixels, and don't do data collection, nor do they sacrifice physical security. Mobile Linux on the other hand, has very little physical security, and very poor application sandboxing compared to the aforementioned android forks. It wouldn't make sense from a security perspective to skip over android forks directly to {postmarketos, Ubuntu touch, armbian/mobian, manjaro mobile...} unless your goal is to use a Linux phone without caring about physical security and app sandboxing (which would not make sense if you are using Graphene, and don't want to change your threat model too much while not supporting Google.)

[–] Cethin@lemmy.zip 7 points 3 days ago (1 children)

That's fair. Hopefully in time mobile Linux will be comperable. I'd prefer it over Android if all else were equal. Maybe as Google keeps fucking around with users people will want to get as far away from them as possible and mobile Linux will really get going.

[–] Turret3857@infosec.pub 3 points 3 days ago (1 children)

I agree with you, in fact the only reason I know about the security differences is because I wanted to jump ship when they started down this closing AOSP path. I found that at the current moment the security model won't work for me, and that I'd also have to buy a new phone just to get support. I really want to try out plasma mobile though, it looks nice.

[–] Cethin@lemmy.zip 2 points 3 days ago

Yeah, Plasma mobile looks like where we should be right now, but yeah, sadly too many tradeoffs to actually have users. I'm still hopeful that some day we'll get the Linux mobile we all want. Maybe when some Android devs retire and want a hobby...

[–] ColeSloth@discuss.tchncs.de 3 points 3 days ago (2 children)

I require my banking app to work.

[–] cole@lemdro.id 6 points 3 days ago (1 children)
[–] state_electrician@discuss.tchncs.de 1 points 2 days ago (2 children)

How will that work exactly? Do you carry your TANs or secure token around all the time?

[–] eleitl@lemmy.zip 1 points 1 day ago

I use a hardware TAN generator which I could use with any browser. I use my banking app (which works on LineageOS so will presumably work on GrapheneOS) just to generate TAN for authentication. My banking cards support NFC.

[–] cole@lemdro.id 2 points 2 days ago

no different than your banking app. most websites have a remember me option

[–] lka1988@lemmy.dbzer0.com 2 points 2 days ago* (last edited 2 days ago)

Skill issue?

The day my Pixel 9 Pro XL came to my door, I unlocked the bootloader and rooted it. Yet, somehow, all of my banking apps (Venmo, Fidelity NB, a national bank, and a local CU) still manage to work just fine.

[–] Arcka@midwest.social 2 points 2 days ago (2 children)

That's dangerously close to something Microsoft would say, like

"LiNuX is tHe LaSt ThInG you WaNt FoR sEcUrItY"

But I'll give you the benefit of the doubt and hope you just meant that Linux mobile isn't ready for use as a daily driver yet.

(sent from iodé)

[–] Korhaka@sopuli.xyz 1 points 1 day ago

Just get a flip phone for calls/SMS. Then pinephone for cool stuff.

[–] Turret3857@infosec.pub 3 points 2 days ago

As someone who only uses fedora on all my PCs and iodé on my phone, I'm not sure why you think I'd say this just to stir up drama. I've done the research into what would be available on mobile relative to my current threat model and found its not ready, and will most likely not be ready for a long time unless were somehow blessed with another Steam deck like moment for phones.

Also, can we stop the stupid spongebob chicken mocking text? It makes your response seem a lot more negative than it needed to be.

[–] Limonene@lemmy.world 4 points 3 days ago (1 children)

Not everyone runs dangerous proprietary apps that need sandboxing. Does my offline puzzle game need sandboxing? Firefox has its own sandbox built in.

Some people consider unlocked bootloaders a feature.

[–] Turret3857@infosec.pub 3 points 2 days ago* (last edited 2 days ago) (1 children)

Everyone does run proprietary hardware with its own hardware vulnerabilities that could very easily be exploited and escalated without proper security. Unlocked bootloader leaves you open to very easy physical attacks. Phones batter is low and you need to charge it in a public space? You better hope no one had modified the charger with something like an RPI to silently exploit your phone. Crossing a border into a country and they suspect you're some sort of threat? There goes all your personal information directly to their government. Not running software that updates the hardware's proprietary software drivers? One text message and you've got a rootkit.

You are more than welcome to run less secure and/or insecure software. No one is telling you you can't. If someone is on GrapheneOS however, they're probably not using it to be on a less secure os. Most people don't want a less secure os. I'm glad you currently have the option to do what you want, but this response to someone using a secure OS about how to stay secure didn't really need an "um ackshually" about people who don't want a secure os.

[–] Limonene@lemmy.world 2 points 2 days ago

need to charge it in a public space? You better hope no one had modified the charger with something like an RPI to silently exploit your phone

Any secure Android device should be starting each USB session in device mode, set to charge only. It is usually not possible to change this mode without unlocking the screen. I don't know what this has to do with sandboxing or unlocked bootloaders.

Crossing a border into a country and they suspect you’re some sort of threat?

How does this attack work? Are you saying they'd replace the operating system by using the unlocked bootloader? There are plenty of ways to prevent this with full disk encryption. Of course you need to check for modifications when you get it back, but that's true even if you have a locked bootloader, because of hardware modifications and leaked keys.

Not running software that updates the hardware’s proprietary software drivers? One text message and you’ve got a rootkit.

In any of the open source Android distros, like LineageOS or GrapheneOS, those updates come as part of the operating system. The updater is open source, and doesn't care whether your bootloader is locked. I assume a Linux Mobile system would be closer to Debian's Apt system, which is also an open source updater than can install proprietary drivers, and also doesn't care if your bootloader is locked.

didn’t really need an “um ackshually” about people who don’t want a secure os

This is pointlessly condescending.

[–] 0x0@lemmy.zip 2 points 3 days ago (1 children)

What prevents you from sandboxing in linux? Ever heard of cgroups?

[–] Turret3857@infosec.pub 1 points 3 days ago* (last edited 3 days ago) (1 children)

I can't imagine someone who wants to use their phone wants to spend that time using it setting up sandboxing by hand.

[–] 0x0@lemmy.zip 10 points 3 days ago

There are a few for sure, but the point was the technology is there, it's "just" a matter of implementing it.