Simply for the reason that GrapheneOS offers further security options in comparison to CalyxOS and has sandboxed play services. An example of a security feature is the firewall that GrapheneOS has (and divestOS has this too!) CalyxOS does have a Firewall but is not build as robust as done in GrapheneOS and DivestOS I have been thought. I also do not believe CalyxOS offers the in the blog listed Additional Hardening (Should You Use GrapheneOS or CalyxOS? - Privacy Guides)
Unless I misunderstand what you’re saying, how could this be true? Android has required verified boot from OEMs since like… Android 8? I think?
Oh verified boot is still there, you can just replace the bootloader entirely.
Most vendors do not implement it correctly at all, but it was actually a deliberate choice for axolotl because they wanted it for Linux phone/postmarketOS-eqsue development.
I guess I don’t understand what the implication of what you’re saying about axolotl actually is.
I’m also trying to figure out what makes this problematic. CalyxOS tells me that because their factory images and OTA updates are signed with their private keys this is a non-issue, because OTA updates are checked against their release key and factory images can’t be installed without unlocking the bootloader again. What is the risk to the end-user? If anything, in theory we should be recommending CalyxOS to Fairphone users because this seems like a potential improvement over their stock ROM.
Honestly it has not really been demonstrated why this is relevant to most people. It’s nice to have, but if CalyxOS isn’t worse than AOSP in general, while providing better privacy protections than AOSP, it’s unclear to me why we wouldn’t want to present it as an option.
Honestly it has not really been demonstrated why this is relevant to most people. It’s nice to have, but if CalyxOS isn’t worse than AOSP in general, while providing better privacy protections than AOSP, it’s unclear to me why we wouldn’t want to present it as an option.
well it really is, MicroG is adding more parties to trust, but not only that also doesn’t offer you the same features as GMS does and is not as stable. It’s just a worse experience I don’t see why we would recommend that especially given the security is lower.
On the test key story:
re: microG
Per my https://divestos.org/misc/mg.txt
- Has unclear potential to leak location to apps without location permission
- “Fused Locations: Does not honor AppOps!”
re: secure boot
secure boot is what underpins verified boot, you can effectively bypass it if you can replace the bootloader
re: test-keys for verified-boot
it may be possible for both a proximate and remote attacker to write valid data and signed metadata even when an alternate key is in use, it is unclear and no one has yet tested/researched it yet
but it is definitely known worse if you’re running the stock OS which is test-key signed.
and yes there is a distinction between signing keys for system/otas and the verified boot metadata
edl access or an exploit would be necessary to gain write access
microG is not mandatory in CalyxOS, is it? My recollection is that it asks during install.
I read that already, it doesn’t answer the question I asked.
microG is not mandatory in CalyxOS, is it? My recollection is that it asks during install.
This just goes full circle then, use GrapheneOS if you have a Pixel or DivestOS if you have a FP2/FP3/FP4.
That only leaves axolotl that they support, which I probably will too eventually.
Mind you SHIFT6mq is a still available for sale 600eur phone with a 5 year old end-of-life SoC. Meanwhile the Pixel 6a is half the price and supported until July 2027 and doesn’t have a broken bootloader.
1 Like
I guess what is still unclear to me is why DivestOS should be listed and CalyxOS should not. My preference would probably be to list Graphene, Divest, and Calyx as they all provide advantages over stock. It’s not a competition.
My qualm here is the numerous issues that they do not document and users end up thinking they have a secure device.
To recap:
- Selling near end of life Pixel 4a 5G without any such note (at an egregious price too)
- Supporting the FP4 as secure despite:
- Supporting axolotl as secure despite already being an end-of-life (2018+3=2021) insecure device and not having Qualcomm secure boot.
- Potential issues with microG leaking location
- Taking up to a week for WebView/browser updates
they can handle this, they can document this, they can do better: they received between $4-6 million dollars last year.
3 Likes
The risk with the SHIFT6mq disabling Qualcomm secure boot seems to be the same risk as Fairphone allowing test keys: Minimal, because as far as I can tell the bootloader still can’t be just completely replaced without unlocking the bootloader first?
because as far as I can tell the bootloader still can’t be just completely replaced without unlocking the bootloader first?
This is wrong.
With secure boot disabled the generic/unsigned Qualcomm firehose files will allow flashing regardless.
EDL access allows flashing and dumping disk+RAM.
They even say so right here: SHIFT6mq - vollständiges Backup über Qualcomm EDL Mode | SHIFTPHONES
SHIFT STAFF
But the 6mq is SB-Off, so a generic Firehose loader can be used.
If you use EDL from bkerler, then it works.
Memory dumps are also possible with it
2 Likes
What’s the actual risk here for CalyxOS users, can the bootloader be replaced with one which doesn’t verify boot while keeping user data intact? I don’t think dumping disk is a concern with encryption.
nickcalyx:
where I come from, if someone makes a claim without evidence, it’s pretty normal and uncontroversial to say oh cool, do you have evidence for that claim ?
I really appreciate you thinking I’m spreading nonsense even when I clearly link sources.
1 Like
If you can change the OS you can also make it upload the data after the user unlocked it. It doesn’t need to happen at the same time.
I’m not debating that, I’m asking whether the “change the OS” part is possible in the first place.
When the bootloader is unlocked anyone with physical access to the device could alter the OS. And without it being unlocked you could still flash updates, if they are signed with the same key it should be accepted and if you use test keys, well anyone can.
The bootloader isn’t unlocked, so that is irrelevant.
Test keys aren’t used for updates, which we just covered here earlier.
In that case I probably do not understand your question.
Test keys aren’t used for updates, which we just covered here earlier.
OTA update signatures or Bootloader lock state isn’t what is being talked about here.
As I mentioned, it is unclear but possible that a remote attacker can gain privs via exploit and then write data and valid signatures to verified boot protected partitions as the bootloader may still accept test-keys on boot even with a user secondary key installed.
And regardless with physical access and EDL access via available signed firehose or unsigned firehose via disabled secure boot any partition can be flashed or RAM dumped while running.
These are three distinct issues.
These issues are not the fault of Calyx, I just want to see them document them.
1 Like