@dushman @safiuddinkhan@fosstodon.org @iska@mstdn.starnix.network @cyberspook I use something called Fennec which is basically Firefox Mobile with telemetry removed I think. And it is just fine for browsing Twitter. Via Nitter 😂
It might have inferior performance, but phones are so powerful nowadays that the difference is barely noticeable.

@m0xee
"Fennec" is Mozilla's codename for Firefox on mobile.
@dushman @safiuddinkhan @iska

@m0xee
Also, it's not just about removing telemetry because Firefox's image assets are themselves proprietary.
@dushman @iska @safiuddinkhan

@cyberspook @safiuddinkhan@fosstodon.org @dushman @iska@mstdn.starnix.network It was. Then they've renamed it to Firefox Mobile and this Fennec we have now is a fork: https://f-droid.org/en/packages/org.mozilla.fennec_fdroid/

@inference @safiuddinkhan@fosstodon.org @cyberspook @iska@mstdn.starnix.network @dushman But Graphene only supports Google phones, does it not?
Trusting Google with hardware and not trusting with software is a little weird 🤷

@m0xee @safiuddinkhan @cyberspook @iska @dushman Not exactly. Don't be part of the FOSS cult and you'll be just fine. The reason GrapheneOS only supports Pixels is because they are extremely sane with security and allow you to even sign your own OS with your own key which at that point even Google can't get it, because it's yours, just like a PGP key.

Not a single other phone allows you to do that. GOS knows their shit, and it's the reason I only use Pixels. I want real security and privacy, not fairy tales. Fairphone even signs their OS with Google's publicly available test key... as their private signing key.

@inference @safiuddinkhan@fosstodon.org @cyberspook @iska@mstdn.starnix.network @dushman Insightful! At least now I know what this is about.
Still, I prefer to stay away from anything by Google. Not because I'm some FOSS-zealot, I just don't like them and don't trust them. I can't even take things that are not obviously evil like WebPee and VP9, sorry.
Still, thanks for the info, that was interesting.

@m0xee @safiuddinkhan @cyberspook @iska @dushman Well, it's fine as long as you understand it's emotional opinion/preference and you're not just saying it's factually bad because it's by Google. I respect your own beliefs and opinions, I just won't tolerate people spreading misinfo because of opinions.

At least you did it the right way.

@inference @safiuddinkhan @iska @dushman @cyberspook @m0xee

actually I believe OnePlus also allows custom signing keys (however not all models have an unlockable bootloader)

@roboneko @safiuddinkhan @iska @dushman @cyberspook @m0xee They do, but their implementation is very bad. Their recovery has SELinux set to permissive, making it useless, and it also fails to wipe the memory on reboot. It also has no HSM unlike Pixels, so you're relying on weaker TEE.

@inference
The magic is, the phone is secure… until you root it.
"Well, don't root!"
Not an option.
@safiuddinkhan @iska @dushman @m0xee

@cyberspook @safiuddinkhan @iska @dushman @m0xee I'm focused on security, so of course I'm anti-rooting.

If you're not focused on security and want more freedom, sure, root it.

@inference
That's the flaw of Android itself, making root so insecure. It's the design issue. One would think getting root is a core functonality of an OS. Not on Android.
@safiuddinkhan @iska @dushman @m0xee

@cyberspook @safiuddinkhan @iska @dushman @m0xee Linux hardening always includes restricting root access, regardless of Linux proper or Android.

root is, by design, the worst security flaw of Linux.

@inference
Root is flawed if there's no proper permission control system in place like sudo or whatever. Nobody suggests this.
@safiuddinkhan @iska @dushman @m0xee

@cyberspook @safiuddinkhan @iska @dushman @m0xee Even sudo and doas are flawed.

I can give you a simple code block which can save your root password and feed it back:
https://madaidans-insecurities.github.io/linux.html#root

@cyberspook @dushman @iska @m0xee @safiuddinkhan root access via any means, on any Linux system, regardless of OS, is fatal. Game over. The end.

@inference
Might as well not use the Internet then.
@safiuddinkhan @iska @dushman @m0xee

@cyberspook @safiuddinkhan@fosstodon.org @dushman @inference @iska@mstdn.starnix.network You can always resort to hardware firewall in case of emergency!

@inference
Why would you run some random code from the Internet on a GNU/Linux machine to begin with?
@safiuddinkhan @iska @dushman @m0xee

@cyberspook @safiuddinkhan @iska @dushman @m0xee You don't have to, your attacker will do it for you.

I suggest you read this, because I'm not repeating what Madaidan of Whonix has already written:
https://madaidans-insecurities.github.io/linux.html

@inference
That implies that the attacker has an access to my computer somehow.
@safiuddinkhan @iska @dushman @m0xee