Hacker News Reader

Comment by warrantisall | Hacker News Reader

[flagged]

I don't have anything to do with GrapheneOS (only using it on a phone), but the security of Fairphone is not great, like many other Android phones it does not have a separate secure enclave to store secrets, but instead relies on a TrustZone-based TEE, which is often vulnerable to side-channel attacks (e.g. see the recent attack where a lot of MediaTek phones could be decrypted in seconds, even in BFU). Note: iPhone has had a secure enclave since iPhone 5s (2013), Pixel since 3 (Titan M, 2018), and Samsung flagships since S21 (I think? Knox Vault, 2021).

They also do firmware updates very irregularly even though Qualcomm does monthly bulletins and Fairphone's firmware is known to be full of CVEs. They also have a bad history of updating Linux kernels, e.g. Fairphone 4 is on an ancient Linux kernel. Fairphones also miss modern security mitigation techniques like MTE.

To be fair, this applies to many Android phones outside Google Pixel and Samsung flagships.

Aside from that, repairability is nice, but the most common early failures on the Fairphone 6 seem to be broken volume buttons, for which Fairphone does not offer a replacement and an issue where the logic board dies during charging, which is also not user-replaceable.

---

Ps. perhaps you could use substantive arguments the next time? E.g. which points of the GrapheneOS lists of requirements do you think are irrelevant and why are they irrelevant?

They're also pretty behind on major OS updates and even bug fixes last I've checked. The software story was very disappointing when I wanted to get one.

Yep. I was interested in more sovereignty and degoogling to some extend. So I got a Fairphone 6 with /e/OS. It was only until I dug a bit deeper into the OS image and the microG source code that I found worrying things:

- Old kernel versions with many known CVEs (applies to both stock an /e/OS).

- Old firmware bundles with many known CVEs (applies to both stock an /e/OS).

- Old major Android version, so missing fixes for vulnerabilities not marked high/critical (applies to both stock an /e/OS).

- Chinese firmware blobs, TCL image processing firmware (applies to both stock an /e/OS).

- When using the App Lounge, F-Droid installs go through a proxy (CleanAPK), that Murena does not want to reveal the purpose or owner of. Given Android's trust on first use policy, this could be used to intercept installs and install malicious packages. (/e/OS)

- Runs microG privileged. When an app does Google Play Integrity checks, Google's obfuscated DroidGuard blobs run privileged (/e/OS).

- Runs many Google apps (e.g. Google Maps) with higher privileges (/e/OS).

How do they intend to comply with the European CRA act then?

That is a question I cannot answer - and CRA is pretty new, so we'll see if anything changes.

Different priorities. GrapheneOS prioritizes very strong security (inside a very specific model that includes treating the user as an attack vector to be protected against). Fairphone prioritizes repairable hardware (and actually makes their own hardware). On a finite budget (of both money and time and people), prioritizing either one of these will undermine the other.

No, GrapheneOS is a privacy project. Privacy depends on security which is the only reason we work on security too. /e/ and Fairphone both have much worse privacy than the standard Android Open Source Project on decent hardware. They go in the opposite direction from AOSP which GrapheneOS does for privacy.

Privacy depends on fixing widely abused privacy weaknesses by patching privacy vulnerabilities and shipping major privacy improvements. /e/ is missing many standard Android privacy patches and protections. Privacy also depends on security to avoid it being bypassed. It's also missing many of the standard Android security patches and protections. GrapheneOS preserves the baseline and makes major privacy and security improvements along with being far better at patching vulnerabilities rather than far worse.

/e/ and Fairphone don't do the bare minimum to protect user privacy and security by keeping up with updates. Both are missing crucial standard patches and protections needed against many real world adversaries including widespread privacy abuse by apps.

and actually makes their own hardware

Fairphone hardware and software is developed/maintained by a Chinese ODM (T2Mobile).

Reply on news.ycombinator.com