iiinova — where your digital self keeps evolving

Reposted by matchboxbananasynergy

Marco Squarcina @minimalblue.bsky.social · 23/07/2025

Things were a bit different with Android this time, likely due to a functionality vs security trade-off that made it harder to address the issue in AOSP. Going forward, we'll continue reporting to Google but jointly disclose to GrapheneOS for any future Android-related issues.

071

Reposted by matchboxbananasynergy

WIRED @wired.com · 10/07/2025

DHS is urging law enforcement to treat even skateboarding and livestreaming as signs of violent intent during a protest, turning everyday behavior into a pretext for police action. www.wired.com/story/dhs-te...

wired.com

Skateboards and Livestreams: DHS Tells Police That Common Protest Activities Are ‘Violent Tactics’

DHS is urging law enforcement to treat even skateboarding and livestreaming as signs of violent intent during a protest, turning everyday behavior into a pretext for police action.

781211662

matchboxbananasynergy @mbananasynergy.bsky.social · 12/07/2025

Signal. Tor. GrapheneOS. People should be loud and proud about using security and privacy tools that work - that's the best way to counter the narrative that only people with something to hide would. www.androidauthority.com/why-i-use-gr...

androidauthority.com

Cops say criminals use a Google Pixel with GrapheneOS — I say that’s freedom

GrapheneOS offers some of the best privacy and security features of any smartphone operating system, but is it too effective at what it does?

12210

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/07/2025

Android regularly adds and splits permissions for new API levels. Legacy apps are handled by treating them as requesting the permission to provide a toggle for it. For example, Android 13 converted the existing toggle for disabling notifications for an app into a new POST_NOTIFICATIONS permission.

1523

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/07/2025

ICEBlock is incredibly false privacy claims for marketing. They falsely claim it provides complete anonymity when it doesn't. They're ignoring both data kept by Apple and data available to the server but not stored. They're also spreading misinformation about Android: www.iceblock.app/android

7284117

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 02/07/2025

bsky.app/profile/iceb... Apple stores which devices/users install which apps. They have the device IDs. US government could obtain a list of people who installed the app if a court authorized it. Not clear what they mean by having to storing device IDs. Those IDs aren't accessible to Android apps.

830097

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 02/07/2025

European authoritarians and their enablers in the media are misrepresenting GrapheneOS and even Pixel phones as if they're something for criminals. GrapheneOS is opposed to the mass surveillance police state these people want to impose on everyone. www.xatakandroid.com/sociedad/cad...

xatakandroid.com

"Cada vez que vemos un Google Pixel pensamos que puede ser un narcotraficante". Es el móvil perfecto para el crimen por un motivo

Los Google Pixel son los máximos representantes de Android, con permiso de Samsung. Es por ello que convencen a los usuarios entusiastas del sistema...

319648

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 12/06/2025

We're going to be moving forward under the expectation that future Pixel devices may not meet the requirements to run GrapheneOS (grapheneos.org/faq#future-d...) and may not support using another OS. We've been in talks with a couple OEMs about making devices and what it would cost.

818135

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/06/2025

WebRTC is a peer-to-peer communications protocol for web sites and therefore causes numerous privacy issues through making direct connections between participants. By default our Vanadium browser disables the peer-to-peer aspect by only using server-based (proxied) connections.

1439

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 18/04/2025

One of our two senior developers has been forcibly detained and conscripted to participate in a war. When they first went missing, we revoked their repository access as a precaution. We soon learned their disappearance was completely unrelated to GrapheneOS. Our priority has been keeping them safe.

719940

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 10/04/2025

Our 2025040700 release was an early April 2025 security update release based on the Android Security Bulletin backports. April 2025 monthly release of Android 15 QPR2 is in the process of being published today and we'll make a new release after the tags are all pushed to AOSP.

1283

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 01/04/2025

Macarne has provided a sponsored server to replace our current EU update servers so we can handle current traffic and near future growth. Ryzen 9950X, 128GB RAM, 2x 2TB NVMe and most importantly 25Gbps bandwidth. It's greatly appreciated! macarne.com

macarne.com

Macarne | IP Transit & Ethernet Solutions | Global Networking Services and Connectivity Solutions

Experience Macarne's reliable, low-latency IP Transit and Ethernet services, powered by AS64289. Enjoy seamless, scalable global connectivity with high-performance network solutions.

2859

Reposted by matchboxbananasynergy

MetropleX @metroplex.bot · 31/03/2025

For @grapheneos.org users missing Google Pay, it would now appear that Curve are now running Curve Pay in parallel, even in GPay enabled regions where previously unavailable. Tap to Pay is here.

GrapheneOS showing Curve Pay enabled for tap to pay.

1111

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 31/03/2025

For an idea of what we're looking for, see the 10Gbps options at tempest.net/dedicated-se... with 64GB memory. They're also willing to give us a significant discount, which other major providers haven't offered. Tempest is currently IPv4-only though, which isn't ideal for our usage.

tempest.net

Premium Dedicated Server Hosting | Tempest Hosting

Experience fast, reliable, and secure hosting with Tempest. Choose from a range of dedicated servers and game servers such as Rust, CSGO, Gmod, and more! 24/7 support available.

3151

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 31/03/2025

We've made 2 attempts at talking to OVH about offering us something different than their publicly available products which hasn't gone anywhere. We likely need to move this part of our infrastructure to 1 or 2 other providers with unmetered 10Gbps dedicated servers like Tempest.

2212

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 31/03/2025

We currently have 16Gbps total bandwidth for our update servers and that's not nearly enough for major releases anymore. Rather than further scaling up our current 2Gbps unmetered VPS approach, we're currently looking into other options. OVH lacks cost effective 10Gbps servers.

5616

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 30/03/2025

Apps enforcing enforcing a Play Integrity API check have nothing to lose by permitting GrapheneOS too via hardware attestation. You'll get positive reviews from our rapidly growing userbase instead of negative. GrapheneOS is much more secure than anything Play Integrity permits.

0241

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 30/03/2025

See github.com/PrivSec-dev/... for details. They responded on the issue. This is one of several apps which has recently stopped banning GrapheneOS due to the guide we provide on using hardware-based attestation as an alternative or full replacement for the Play Integrity API.

github.com

Yuh - Your App. Your Money. · Issue #509 · PrivSec-dev/banking-apps-compat-report

Is there an existing issue for this? I have searched the existing issues App name Yuh - Your App. Your Money. Link to app https://play.google.com/store/apps/details?id=com.yuh&hl App version 1.30.1...

1231

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 30/03/2025

Yuh app from Swissquote temporarily disabled Play Integrity API enforcement due to complaints from GrapheneOS users and is reimplementing their security checks with support for GrapheneOS based on grapheneos.org/articles/att.... We removed it from the list of apps banning GrapheneOS.

grapheneos.org

GrapheneOS attestation compatibility guide

Guide on using remote attestation in a way that's compatible with GrapheneOS.

3857

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 21/03/2025

Second donation to GrapheneOS by the Proton Foundation: discuss.grapheneos.org/d/21033-seco...

3575

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 19/03/2025

Chromium team developed a new font rendering library (Skrifa) as part of their Fontations library written in Rust. Skrifa now provides memory safe rendering for all web fonts since Chromium 133 for Android, ChromeOS and other Linux distributions: developer.chrome.com/blog/memory-...

developer.chrome.com

Memory safety for web fonts | Blog | Chrome for Developers

Learn how and why the Chrome team has replaced FreeType with Skrifa.

1635

Reposted by matchboxbananasynergy

Osservatorio Nessuno OdV @osservatorionessuno.org · 17/03/2025

We recently analyzed the latest Cellebrite device support matrix published in February 2025. The reality is worrisome. It can be used to unlock most of the mobile devices we use every day. Read our report: (ENG) osservatorionessuno.org/blog/2025/03... (ITA) osservatorionessuno.org/it/blog/2025...

osservatorionessuno.org

A deep dive into Cellebrite: Android support as of February 2025

067

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/03/2025

GrapheneOS network location implementation is now available in the Stable channel after several rounds of fixes and improvements for it. bsky.app/profile/grap... We had to fix an upstream Android system_server crash bug it uncovered along with improving sandboxed Google Play.

1265

Reposted by matchboxbananasynergy

Accrescent @accrescent.app · 21/10/2024

Accrescent 0.25.0 is out with Android 15 app archiving support, Private Space support, and settings UI improvements! We also forgot to announce that since 0.24.0, Accrescent supports in-app predictive back! Check out the release notes below 👇 github.com/accrescent/a...

github.com

Release 0.25.0 · accrescent/accrescent

This release adds initial app archiving support on Android 15, makes Accrescent show up as an installer in Private Space, and improves the settings UI! We also forgot to mention that since 0.24.0, ...

092

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 21/10/2024

GrapheneOS based on Android 15 will reach the Stable channel later today. It's very stable already and we've fixed a bunch of upstream bugs including several impacting the stock Pixel OS. We've made 7 official releases based on 15 already and the 8th is going to reach Stable.

1283

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 25/09/2024

Registering on our forum wasn't working for part of September 24th due to a new anti-spam mechanism going wrong. The issue has been resolved now. discuss.grapheneos.org If you have any issues with this, please report it in our infrastructure room on Matrix/Discord/Telegram.

discuss.grapheneos.org

GrapheneOS Discussion Forum

GrapheneOS discussion forum

052

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 01/09/2024

GrapheneOS version 2024083100 released: grapheneos.org/releases#202... See the linked release notes for a summary of the improvements over the previous release. Forum discussion thread: discuss.grapheneos.org/d/15395-grap... #GrapheneOS #privacy #security

grapheneos.org

GrapheneOS releases

Official releases of GrapheneOS, a security and privacy focused mobile OS with Android app compatibility.

093

Reposted by matchboxbananasynergy

Accrescent @accrescent.app · 25/04/2024

Accrescent 0.20.0 is out with support for respecting other app stores, UI improvements, bug fixes and more! Download Accrescent or view the changelog below for details. github.com/accrescent/a...

github.com

Release 0.20.0 · accrescent/accrescent

A more substantial release this time around! Accrescent now respects other app stores and manual APK installations, no longer attempting to take over updates for apps you installed outside of Accre...

043

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 14/04/2024

he site is hosted via Wix and uses Tucows as the domain registrar. Tucows permits using their services for scamming, impersonation, harassment, etc. until they get a court order to stop doing it (tucows.com/news/why-tuc...) so that's a dead end. Do we know anyone at Wix?

tucows.com

Tucows | Why Tucows Doesn’t Take Down Domains for Website Content Issues

We do not see ourselves, or similar infrastructure companies, as the appropriate arbiters of what content belongs on the Internet. That power belongs to agencies of justice and should continue to be e...

142

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 14/04/2024

There's a site impersonating the GrapheneOS project for scamming people (grapheneos dot fr). GrapheneOS does not currently sell phones or work with any company/individual selling phones. We strongly recommend using the very easy to use web installer: grapheneos.org/install/web.

grapheneos.org

GrapheneOS web installer

Web-based installer for GrapheneOS, a security and privacy focused mobile OS with Android app compatibility.

145

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 07/04/2024

Posting AI generated text in the GrapheneOS community is forbidden with the exception of clearly marked automated translations: discuss.grapheneos.org/d/11951-ai-g... This is becoming a serious problem so we've made a sticky post. It will be covered in a more detailed list of rules too.

discuss.grapheneos.org

AI generated text is forbidden with the exception of automated translation - GrapheneOS Discussion Forum

GrapheneOS discussion forum

062

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 04/04/2024

We posted about discuss.grapheneos.org/d/11860-vuln... on the Digital Forensics Discord (discord.gg/digitalforen...) used by DFIR students, law enforcement, Cellebrite, etc. It's on-topic and they've regularly talked about GrapheneOS but they got upset about it and banned our project account. 🤷‍♂️

162

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

See our thread at bsky.app/profile/grap... for more details. It was added to prevent extracting data via fastboot mode vulnerabilities exploited in the wild. There are now 3 features on our list of hardware requirements where we played a major role in getting them added to Pixels.

131

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

Reset attack mitigation for firmware-based boot modes such as fastboot mode has been added as one of our requirements for GrapheneOS support: grapheneos.org/faq#future-d... It shipped as part of this month's firmware updates for Pixels based on our proposal. Other OEMs should add it.

grapheneos.org

GrapheneOS Frequently Asked Questions

Answers to frequently asked questions about GrapheneOS.

142

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

We encourage users to use "Changing-only when locked" if they don't need USB devices when the device boots or "Charging-only" if they don't use USB beyond charging. There's also an "Off" value disabling charging when OS is booted into the main OS boot mode for high threat models.

241

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

Our USB-C port control is set to "Charging-only when locked, except before first unlock" by default. New USB connections can only be made while unlocked, except BFU. After locking, new connections are blocked immediately and data lines are disabled when existing connections end.

131

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

Due to the importance of auto-reboot, we recently reimplemented it as a low-level timer in the init process. This makes it much harder to prevent the device from rebooting. Previously, crashing system_server would restart the timer. It also allowed us to avoid it chain rebooting.

121

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

All of our defenses against obtaining data from After First Unlock state devices are centered around auto-reboot. Our goal is preventing exploitation long enough for the device to cleanly reboot and get the data back at rest as if it had been obtained while it was powered off.

121

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

Our auto-reboot feature starts a timer after the device is locked which will reboot the device is it isn't unlocked successfully before the timer elapses. This is set to 18 hours by default but can be set between 10 minutes and 72 hours. It won't chain reboot the device anymore.

121

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

Our baseline defenses against attacks aiming to extract data from After First Unlock state devices are our generic exploit protection features: grapheneos.org/features#exp... Wiping freed memory in kernel/userspace helps beyond exploit mitigation by avoiding having data kept around.

grapheneos.org

GrapheneOS features overview

Overview of GrapheneOS features differentiating it from the Android Open Source Project (AOSP).

141

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

In the near future, we'll be shipping a properly secure implementation of a duress PIN/password along with a properly secure panic wipe based on wiping without requiring a reboot. We also plan to make device admin API use our wipe-without-reboot approach until Android ships one.

151

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

Can see the announcement of these being exploited in the wild at source.android.com/docs/securit.... In addition to them working on our proposal to implement wipe-without-reboot, we've spotted work on our other suggestions such as wiping key derivation results from memory after unlocking.

141

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

GrapheneOS has been working on a duress PIN/password feature for a while, and as part of that we already implemented our own wipe-without-reboot system. We care a lot about doing things properly and the way this was done in existing apps and operating systems was highly insecure.

151

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

CVE-2024-29748 refers to a vulnerability providing the ability to interrupt a factory reset triggered by a device admin app. It appears they've implemented a partial solution in firmware. See bsky.app/profile/grap... about ongoing work we spotted on wipe-without-reboot support.

131

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

GrapheneOS already implemented defenses against this attack before we became aware of it. After becoming aware of this attack against Pixels running the stock OS, we improved our existing defenses and added new ones alongside reporting the firmware weaknesses to get those fixed.

141

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

We proposed zeroing memory in firmware when rebooting to fastboot mode to wipe out the whole class of attacks. They implemented this by zeroing memory when booting fastboot mode. USB is only enabled by fastboot mode after zeroing the memory is completed, blocking these attacks.

141

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

CVE-2024-29745 refers to a vulnerability in the fastboot firmware used to support unlocking/flashing/locking. Forensic companies are rebooting devices in After First Unlock state into fastboot mode on Pixels and other devices to exploit vulnerabilities there and then dump memory.

151

Reposted by matchboxbananasynergy

GrapheneOS @grapheneos.org · 03/04/2024

April release of the Pixel boot chain firmware includes fixes for 2 vulnerabilities reported by GrapheneOS which are being actively exploited in the wild by forensic companies: source.android.com/docs/securit... source.android.com/docs/securit... These are assigned CVE-2024-29745 / CVE-2024-29748.

164