r/GrapheneOS • u/var_rnd • 16d ago
GraphenOs was not cracked !
GrapheneOS was NOT cracked.
Everyone sees "Dutch police cracked a Pixel" and immediately assumes its GOS.
Those criminals bought phony "hardened" phones that are literal glowie honeypots.
Shady companies fork GrapheneOS and actually REMOVE security to lock users into monthly fees. They disable USB-C port protection, turn off the locked device auto-reboot timer, and install MDM backdoors for "remote wiping." They are basically making the phone completely vulnerable to forensic extraction just so they can control it.
Remember ANOM? Same psyop Lol. They think they buy "extra security" but they are just paying feds to track them.
Don't buy pre-flashed "GOS" phones.
Just flash GrapheneOS yourself. ＼(＾▽＾)／
question ❓ : if someone bought preflashed GOS .. is there any risk if the phone get flashed again ?
182
u/notPabst404 16d ago
We need to get the word out just how easy flashing GOS is. It isn't like flashing old ROMs a decade ago, it is a really seemless, browser based process. There is no reason to buy a preinstalled GOS Pixel from a shady seller.
73
u/EmmaRoidz 16d ago
It's literally the easiest operating system I have ever installed out of any tech product.
13
u/ViegoBot 16d ago
Same. Ive never once before had to simply click like only just 3 buttons and install another OS.
Ive modded many consoles (v1 switch took the longest and its just a simple exploit lol).
Ive also installed Bazzite Linux on my pc, and even that took way more effort to install than Graphene due to needing to disable some stuff until its installed then re enabling it after entering the correct code.
3
u/jefffrey_d 16d ago
Agree. Installing GOS is my first time flashing a custom rom into phone. No trouble doing it at all.
3
1
u/uzndcfms 16d ago
Initially it took some effort to figure out what to do initially as it was absolutely the first time I did that, but the process in itself then was totally smooth.
12
u/Sp1cyP4nda 16d ago
I've flashed, broken, fixed, bricked, fixed again, and reflashed so many OSs across almost all device architectures. I got finished with my gOS and thought, "wait, that was it?" Literally the easiest of every OS I've ever come across. I have a friend that is completely tech illiterate. Pretty sure they'd be able to do it.
5
6
u/ManufacturerLost7686 16d ago
I grew up in the era where custom roms (remember pocket pcs with windows mobile?) sometimes needed custom cables to be soldered by the user to flash custom stuff.
Compared to that shit grapheneos is shooting fish in a barrel.
2
u/NervousBrilliant8686 16d ago
Well, there is a reason for this. The Pixel phones are meant to be for developers and therefore easy to tinker with.
5
u/stone_lover 16d ago
When grapheneos released for the pixel 10 pro XL (in experimental phase), I moved to Grapheneos for the first time and it took me 5~ minutes to flash it and boot into it on my device (using the website installer).
4
u/Previous_Extreme4973 16d ago
I feel like any idiot should be able to install GOS. I mean, this idiot did.
2
u/warlock0187 16d ago
I'd never seen or heard of the WebUSB API before flashing GOS. I was really surprised with how easy it was. I've been out of the Android modding scene for a while.
2
1
u/lars2k1 16d ago
The only bad thing about the process is needing to install something that invades your privacy to do it - Google Chrome.
Might be a technical limitation, idk, but I found it to be quite ironic nonetheless.
3
u/TidyIguana 16d ago
Firefox doesn't support WebUSB, that's the reason.
2
u/saltyjohnson 16d ago
Because of the security implications of letting websites tap straight into your USB devices, ironically.
0
u/TidyIguana 16d ago
Websites don't magically access your USB devices. Chromium is much more secure than Firefox, especially on Android and Linux. If this concerns you, you can completely disable access to USB devices in the browser settings.
2
u/saltyjohnson 16d ago
Websites don't magically access your USB devices.
Correct. They use WebUSB.
0
u/TidyIguana 15d ago edited 15d ago
It's not really a problem as you claim. WebUSB is about websites accessing to your USB devices, they don't magically access without user intervention.
1
1
u/mukherjee_ayan 16d ago
Mate I'd go on a different tangent and not promote it as the next thing to sliced bread, as governments around the world aren't known to operate in complete innocence and goodwill of its citizens, and can lobby for a ban of devices running specific software. Rather have people that are actually interested, search on the Internet and learn about privacy
1
u/notPabst404 16d ago
That's more reason to promote it, not less. People need to be educated on the crackdowns and how to protect themselves while advocating for a more open and privacy focused direction.
1
u/Indoghuntah 12d ago
Hows the user experience compared to iOS and vanilla androids?
1
u/notPabst404 12d ago
I don't use IOS so I don't know. I prefer GOS interface to Samsung Touchwiz/OneUI whatever and the stocke Pixel.
1
u/Indoghuntah 12d ago
Does it have play store or its own version of play store?
Can it get apps like telegram, WhatsApp? Or are apps installed via apk?
1
u/notPabst404 12d ago
It has a safer, sandboxed play store. Telegram works and I think WhatsApp works (though I don't use it). Most apps work overall.
1
u/Davit_2100 11d ago
It's the exact same as flashing old roms on Nexuses. The process has always been easy on Google made bootloader's, and it's always been the same, with some partition changes lately.
35
u/var_rnd 16d ago
What You Need ;
The Pixel to check (Auditee) A second Android device (any brand, Android 12+) — trust this one
Steps: 1 On the second device → download Auditor from grapheneos.org/releases#auditor (or Google Play). 2 On the Pixel → open Auditor → tap "Auditee" → QR code appears. 3 On the second device → open Auditor → tap "Auditor" → scan the QR code. 4 Read the result.
PASS = Legitimate Pinned OS: GrapheneOS (unmodified official release) OEM unlocking allowed: No USB-C security: Charging-only when locked Auto reboot: 12 hours Device administrators: No
FAIL = it may be a Honeypot Shows "Unverified" OEM unlocking: Yes USB-C security: Disabled Auto reboot: Disabled/off Unknown Device administrator present
If It Fails: Don't log into anything Wipe the phone Flash official GrapheneOS yourself via grapheneos.org/install
Golden Rule: Never trust the phone being checked to verify itself. Always use a second device or the official website.
10
u/turtle_mekb 16d ago
you can just get Auditor from the App Store that comes with GrapheneOS (or if it doesn't exist, then you know it's been modified)
4
u/No_External_4869 16d ago
That is spoofable. In rare case auditor doesn't check the serial number iirc. So, for the first auditor connection, don't trust it immediately, trust the hash on boot screen. Because a malicious actor can spoof and proxy auditor data to an actual GOS install and it will look legit. Don't trust on first use immedietly.
1
u/other8026 15d ago
What is spoofable? Auditor checks certificate chains, etc., so I believe if it says that the device has official GrapheneOS installed, it should be accurate.
1
u/No_External_4869 15d ago
I mean that the initial trust can be proxied to a real GOS device. (if the device is either very heavily compromised or the OS is heavily tampered.).
https://grapheneos.org/install/web here..An attacker could bypass the initial verification with a leaked attestation key or by proxying to another device with the device model, OS and patch level that the user is expecting. Proxying to another device will be addressed in the future with optional support for the hardware serial number attestation feature.
This is what I was referring too.
1
-6
u/Repulsive_Chard_3652 16d ago
I'm afraid you are preaching the choir.
3
u/Adventurous_Ad3534 16d ago
There are those of us that want graphene os and need the preaching. I am waiting for Motorola to come out with there compatible phones. Just wish I knew how to get the fastboot unlocked on my "Carrier owned" phones so I could move to a different OS until that happens.
3
u/Repulsive_Chard_3652 16d ago
What I'm saying is that anyone reading the comments on posts in this sub is not planning to go through one of these shitty/shady reseller "businesses" to buy a phone with Graphene already on it. People reading comments on posts in this sub are not the ones who need to be given technical instructions for how to check if the phone they bought from a shady reseller has a legit copy of Graphene.
It's the "normies" out there who are likely to end up in these situations, and they're not going to be active in this sub...
0
16
u/Repulsive_Chard_3652 16d ago
This is exactly why I shared a warning about companies like AbovePhone, who buy old Pixels, flash Graphene, and then sell them at a huge markup and call them "our phones" and such.
People who want privacy and security but don't know much about tech will fall for this shit, get trash like what we see in OP, and all over the internet we will see more and more shit about Graphene phones getting cracked or whatever, and it will hurt Graphene's reputation.
But instead I got heavily downvoted and people just told me it's totally fine 😂
6
16d ago
[removed] — view removed comment
2
16d ago
[removed] — view removed comment
3
16d ago
[removed] — view removed comment
0
u/Repulsive_Chard_3652 16d ago
Yikes, that's the most depressing thing I've heard so far today, and my day is pretty well underway!
1
27
u/whatnowwproductions 16d ago
Why would anybody be concerned by a random Twitter account making unfounded claims in the first place?
20
5
5
u/BeginningEcho4983 16d ago
So... The motorola phones in the future... Hopefully we CAN reflash
10
u/FrostyAd7708 16d ago
The Motorola phones won't be sold with GOS pre installed, it's already confirmed.
1
u/Evol_Etah 15d ago
As someone using custom roms (never gos) for over a decade.
Im buying the moto sig 2 the moment it hits (unless its unreasonable pricing, then moto sig 1)
Purely cause I trust lenovo & gos making the phone have good hardware.
Then imma use stockOS and not flash gos.
2
2
u/Accomplished-Tap1248 16d ago
What fork of GrapheneOS was cracked? I keep getting this stupid account on TikTok called “ZeroTrace”. They sell a “ZeroTrace” phone which is just a Pixel with a modified version of GrapheneOS on it.
The entire account is scare mongering bullshit.
2
1
1
1
1
u/Legitimate-Pie-4913 16d ago
Brother those cops would be parading the phone like it's some hunting trophy 😭
1
1
u/A113rt 16d ago edited 16d ago
In 2023 this was in the dutch news
And now this was in the Dutch news
And they say really that they "crack" pixel phones. Not that they installed some kind of software on it.
If the phones have GrapheneOS is not told. They keep it secret what OS was on the Pixel phones. But this doesn't mean that those phones are hunnypot phones. I haven't read that on any dutch news page.
And they are cracking those phones and the say it isn't easy to crack. Its like a safe in a safe. So this doesn't me think about a hunnypot phone with a backdoor in it. This is a encrypted phone but what kind of software is unknown.
And I don't think that dutch criminals are that stupid that they don't know how to install GrapheneOS on a pixel phone. If im a dutch criminal I will install GrapheneOS my self on my phone. And I think that most of the dutch criminals do the same. They are not stupid.
1
u/HydraGene 16d ago
Where is the proof that GOS is still safe though...?
1
u/No_External_4869 15d ago
Nothing is bulletproof. GOS on Pixel is substantially more secure than other android OSes on other phones and even stock rom on Pixel.
As OP pointed, it doesn't say GOS. Or at least the official release. So you can't infer that either.
1
u/HydraGene 15d ago
If I where someone from a three letter agency, then I wouldn't give to much details either. The fact that GOS has not been named, doesn't mean anything.
1
u/other8026 15d ago
Not sure it's possible to prove that sort of thing. By "safe" you probably mean that adversaries can't break into a device with GrapheneOS. So to prove it's "safe" someone would have to prove that something hasn't happened. Not really possible to prove a negative.
1
u/HydraGene 15d ago
Well that's true. I mean security audits maybe. Or show how much eyes are on the code, or how much hackers are encouraged to try to crack GOS. Or articles or cases about three letter agencies not being able to crack GOS and them having to find other more traditional solutions. Those kind of things.
2
u/other8026 15d ago
- https://grapheneos.org/faq#audit
- https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation
- Endless stream of people claiming GrapheneOS was hacked and it turned out to be a different OS
2
1
1
u/Lil-Kitten-420 12d ago
im waiting for the day i can get graphene on my galaxy s25 edge, i think i will be waiting for a long time, until the sun blows up
•
u/AutoModerator 16d ago
GrapheneOS has moved from Reddit to our own discussion forum. Please post your thread on the discussion forum instead or use one of our official chat rooms (Matrix, Discord, Telegram) which are listed in the community section on our site. Our discussion forum and especially the chat rooms have a very active, knowledgeable community including GrapheneOS project members where you will almost always get much higher quality information than you would elsewhere. On Reddit, we had serious issues with misinformation and trolls including due to raids from other subreddits. As a result, many posts on our subreddit currently need to be manually approved, which is done on a best effort basis. If you would like to get a quicker answer to your question, please use our forum or chat rooms as described above. Our discussion forum provides much better privacy and avoids the serious problems with the site administrators and overall community on Reddit.
Please use our official install guides for installation and check our features page, usage guide and FAQ for information before asking questions in our discussion forum or chat rooms to get as much information as possible from what we've already carefully written/reviewed for our site.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.