So Pixel 6 and 7 hardware is more secure than the newest iPhone hardware?
(Pixel 8 hardware is obviously more secure because of MTE.)
1 Like
No, that’s incorrect… If you actually look into it (and I encourage others to independently do so), here’s exactly what happened:
Forensics companies like MSAB etc. are trying to prop themselves up by boasting that they have “GrapheneOS support”. They are intentionally vague about what that means. It’s only when you actually get a hold of a table with their actual capabilities that what they actually mean is that they can do an extraction of an unlocked GrapheneOS device. These forensics companies are singling GrapheneOS out and talking about it in particular (no other AOSP-based OS that I am aware of gets singled out this way) exactly because it is understood that GrapheneOS makes an actual difference in security that changes their capabilities compared to other AOSP OSes where the capabilities for the same device are more or less the same.
GrapheneOS has been used as marketing for these companies before GrapheneOS decided to focus more on physical attack vectors, as the priority in the past has been bolstering defenses against remote exploitation.
MSAB (a forensics company) released a video as part of their “MSAB Monday” video series that showed them exploiting a Stock OS Pixel by doing a RAM dump (something that they shouldn’t be able to do on a locked device) as well as preventing a factory reset that was triggered by the “Wasted” app. They quickly realized that they divulged too much information and removed the video from their socials.
That video was enough evidence to get Google to act on both of those things, which it did based on GrapheneOS’ reports.
New Zero-Day Attacks Target Google Pixel Phones | PCMag for more information on this, the video from MSAB that made Google care about it, and how it was fixed.
GrapheneOS isn’t “trying to market itself” in this way, forensics companies started using GrapheneOS’ name to do that; get it right.
Coming back to the Digital Forensics discord: do you know who’s present in that Discord other than law enforcement asking for help doing extractions? Basically every forensics company and exploit vendor imaginable. If you actually go to the Discord, you’ll see that GrapheneOS and the project’s features were discussed in the past, with someone even going as far as to say “it’s best not to discuss GrapheneOS publicly”, fearing that talking more about it would likely get us to cancel any of their capabilities. It’s funny to think that what did them in was one of the companies’ marketing material. Regardless, GrapheneOS was mentioned there long before we ever joined it, and just like people had in the past, we informed people of our new defenses and the reports that patched the holes they were using for stock OS, we corrected some misconceptions, and answered some questions. The response was for GrapheneOS to be banned. 
They have continued keeping up with GrapheneOS, just like they did in the past, such as recently warning each other about new developments like the new max length for passwords and the duress feature.
To claim that GrapheneOS is being “risky” by tackling these things head on is just silly. These groups were well aware of GrapheneOS way before, and will be aware of all updates way into the future.
Divulging info leaked to GrapheneOS to the public (Celllebrite’s capabilities) from an industry whose entire goal is to try and keep as much as possible hidden is the right thing to do. People knowing how they can protect themselves is the right thing to do. Insinuating that Cellebrite and all of these other tools are only used by law enforcement, and are only used on criminals is a wild take that I didn’t expect to see on this forum.
11 Likes
Can we just agree that everyone is being silly and spilling too much ink over something that literally doesn’t matter? Like who cares about marketing holy shit lol
False and inaccurate marketing in the privacy and security space is a gigantic problem and is exactly how people end up making decisions that can hurt them in the future. In many cases, false marketing is exactly what this site is meant to be fighting against.
Forensics companies doing misleading marketing to prop themselves up has real consequences when people see that and misunderstand what it means, especially when scammers in the space try to use it to get people to use something significantly worse instead.
If Lastpass or NordVPN were being marketed as doing things they can’t actually do, or were trying to spread misinformation about Bitwarden or Mullvad in based on intentionally misinterpreting something, wouldn’t you take issue with that?
I don’t expect anything better from forensics company and people working in an industry that basically relies on secrets and gatekeeping to fucntion. I don’t expect anything better from scams peddling something blatantly insecure trying to use that marketing material to push people away from something that works.
I do expect people here to think about this matter a bit more critically and realize that the take in this thread sucks. No two ways about it.
11 Likes
It does matter, because trolls go around and start screaming that GrapheneOS is compromised, even though that isn’t true.
2 Likes
I’m a massive cynic and really don’t think that it matters – people listen to whoever says the nicest lies, not the most accurate truths. Trolls don’t need Cellebrite’s marketing to dunk on GOS, they would do it anyway and shill their own Product™️
They already are marketed on effectively lies, and yeah it sucks but ultimately it doesn’t matter because barely anyone is going to “see the light” if you shout the truth into the void because the lies are marketed better, hence, arguing about this is silly 
1 Like
If you truly think that lies and false marketing always prevails, is the mission of Privacy Guides doomed from the get-go? We can tell the current team to pack it up, then, I suppose.
3 Likes
Sure yeah, it’s pretty doomed. I still like having a curated list of resources and a discussion forum though, that stuff is sometimes useful
1 Like
Privacy is dead!
Signed,
A Privacy Guides forum member
If you truly don’t think misleading and inaccurate marketing and misinformation is worth addressing, then I can see how you wouldn’t see the value in this conversation. I reserve the right to still consider it important though, if that’s okay.
3 Likes
I said precisely what I said, not that privacy is dead. I would prefer that my words not be twisted, thank you very much.
Signed,
Some person who does not appreciate people deliberately misrepresenting them
P.S. I think just making useful tools and writing up accurate information is far more valuable than repeatedly going “nuh uh” about marketing spin or arguing with people online, and yes I recognise I’m doing that right now but shh I’m bored, I have clocked out of work for today 
3 Likes
That’s the sentiment that I got from what you said. I didn’t add any quotes to what I said, people can also read up, I’m quite clearly not trying to misinterpret you; just some lighthearted fun.
I’m sorry to hear that you think we’re arguing. My issue here is with other weird claims being made, not anything you said, though I did still think it made sense to address it and explain why I felt it was important to explain.
As for your other statement, I believe that while it is unfortunate to have to spend time debunking misinformation and inaccurate marketing claims is time consuming and not enjoyable for anybody to do, it’s necessary to minimize people being duped by it. Of course, writing accurate information and developing useful tools and features are both things that GrapheneOS does alongside that.
1 Like
Maybe you stop 1 person being duped by it, but then there’s the 1000 other people who never see your post or video or comment debunking it. This is from experience – it’s far more fulfilling and useful to just not bother directly debunking every single false or misleading claim, because people will come up with 1001 false claims for every 1000 you debunk with Facts and Logic™️Like, critical thinking and media literacy are long dead.
1 Like
It actually hurts more than you think. This is the reason why project projects like Tornado cash and Samourai Wallet devs got arrested for doing open source projects that was misued by criminals.
Same is currently happening with Monero, fluffy pony got arrested and then got released later on but resigned from Monero Project. Chainalaysis companies and literally FEDs are trying to discredit Monero by accusing it for funding CSAM and terror attacks.
1 Like
I don’t see how that’s related to marketing
There’s speculation that there are NSA agitators trying to shift discourse online, that’s far more relevant than thinkpieces or marketing from different publications – heck, I myself got called an NSA plant for advocating for proper threat modelling and risk analysis over in the PG matrix rooms 
1 Like
I think that this is defeatism.
1 Like
5 Likes
You have learned the wrong lesson.
3 Likes
so is it analog computing time?
The lesson is: use GrapheneOS, and if you ever do marketing, don’t do it like Cellebrite.
3 Likes