What's the phone OS landscape now? What can someone who values their agency and wants FOSS choose?
* iOS - walled garden, so no
* Android:
* * with a Google account and Play Services - a bit less of a walled garden, but still no
* * Android without Google:
* * * GrapheneOS - root or adb not supported, so no
* * * LineageOS - (edit: root or adb not supported, so no - just learned) seems like a viable option although it seems like it depends on Google's development of Android and keeping it FOSS. How's the situation with security updates? Which phones would you recommend? I don't count Samsung or whatever crap as they're generally quite user-hostile.
* Linux - IIRC only PMOS supported FDE. Is that still the case? Are there are good Linux phones? I tried PinePhone a few years ago, but it was crappy. The OS also lacked basic features like new windows showing up inside the screen.
Like the other poster said, you can get root on GOS. However it's highly ill advised and severely breaks the security model of devices. 99% of the time nobody, especially the average person, needs root on their phone (imo). Allowing that easily just opens up the average person to getting duped into getting their phone rocked with exploits and possibly persistent malware.
There is no reason that a lack of root access should be viewed as a negative within the context of GrapheneOS. In that case why even mention or choose GOS? Just choose an Android fork with poor security or a Linux phone with zero security instead.
> 99% of the time nobody [...] needs root on their phone
Do you also not have root on your laptops or desktops? I don't get why it's so different. I don't just want to open TikTok and Instagram, I want to use my phone computer as a computer. I assumed HN folks would get it.
I would choose something as locked down as GrapheneOS for its security if I was going to use it to install random apps left and right and give them root or run JavaScript from random sites on a browser I gave root to.
Anyway, not having root seems like a very weird way to harden security. What about compartmentalization?
And what's wrong with my my terminal app having root sometimes? How is shadycryptonews.xyz/exploit.js going to leverage it? How would even the Official Authoritarian Police State app leverage it?
I probably don't get it, but it's like people see 2 extremes - run nothing ever in root or run everything in root all the time.
I want to run like 5-6 apps I trust.
Maybe if I wanted to secure a billion dollars worth of Bitcoin, I would be OK with a separate phone without root, but then again I would likely use a hardware wallet. What's the threat model for someone who doesn't blindly give apps root or do anything stupid, really?
> Do you also not have root on your laptops or desktops? I don't get why it's so different. I don't just want to open TikTok and Instagram, I want to use my phone computer as a computer. I assumed HN folks would get it.
The security models of desktop operating systems are far, far behind those of mobile operating systems (Android/iOS). ChromeOS, followed by macOS are the closest to mobile security but are still severely lacking. Windows is farther behind and desktop Linux might as well be minimum security. It’s not even an equivalent comparison as you’re comparing mobile OSes to ones on a platform with a fundamentally worse security architecture.
I mean, even to an extent some of the Linux distributions understand the security problems with the traditional model. Look at what Universal Blue is doing with their images and leaning more into Flatpaks and containers for any developer like etc tooling while actively discouraging installing things via rpm-ostree.
> I would choose something as locked down as GrapheneOS for its security if I was going to use it to install random apps left and right and give them root or run JavaScript from random sites on a browser I gave root to. Anyway, not having root seems like a very weird way to harden security. What about compartmentalization?
The first sentence is inherently incompatible with the security structure of GrapheneOS (for example). The point is to not give applications root, giving them root circumvents basically all of the protections GrapheneOS and Android give the user. Yes, mobile operating systems were designed sandbox first to treat all applications as untrusted. However it doesn’t matter if you’re only giving “trusted” apps root, all it takes is one supply chain exploit, one malicious developer, one anything to make that app with root do something its not supposed to do.
Not having root is the best way to harden security. Mobile OSes are designed to be heavily compartmentalized, each application runs in its own sandbox. Giving an application root circumvents the entire thing, allowing that application in theory to see into other sandboxed apps etc. If you want a real world example look at all the malware exploits that come into iOS via iMessage, one of the only apps on iOS that’s not fully sandboxed like normal apps.
> And what's wrong with my my terminal app having root sometimes? How is shadycryptonews.xyz/exploit.js going to leverage it? How would even the Official Authoritarian Police State app leverage it?
The problem is that we don’t know how they could leverage it, so the solution is to eliminate that pathway entirely.
This is also my issue with the push for Linux phones onto the average person (instead of the community coming together and forking AOSP if they want to escape Google). The platform has zero real sandboxing, and the average person still wants to use Meta apps as shit as they are. These big tech companies’ and governments’ apps would go absolutely crazy on Linux phones.
> What's the threat model for someone who doesn't blindly give apps root or do anything stupid, really?
To not get unknowingly pwned. Realistically even if you have a trusted app, you or the community can only verify that it’s trusted at a specific point in time. Realistically a community cannot verify that an app or package etc is consistently not malicious and will more often than not lag behind in the implementation of the exploit vs its discovery, it doesn’t matter if its closed or open source.
To be clear though my view is that we shouldn’t be pushing root-capable mobile operating systems onto the average person and that no root is infinitely more secure than having it. Maybe companies could provide alternatives, i.e. offering devices with rooted versions available but offering no customer support if something goes wrong with the software. But it certainly shouldn’t be a default available feature for the majority of the population.
—
An edit: Also preventing root allows devices to pass attestation checks. I know it has a dirty connotation in light of how companies are behaving recently, but it really is a security benefit for a device to be able to prove that it’s base operating system is unmodified (i.e. no persistent malware is present).
Edit: I looked at your other comments to see if you had discussed Linux or Android security before (and to avoid repetitive threads). I'll reply to this post of yours here as you'll likely not see that I've replied there:
> Also linux only really has block level encryption, not file based encryption like iOS/Android. It would be trivial for LEO to access your device unless it was totally powered off and then the only protection is LUKS. Or really even if you lose your phone and someone was so inclined to they could just extract all the data if it was powered on but on the “lock screen,” as most if not all desktop (and I’d imagine linux phone) environments do not actually do any encryption or anything when the system is locked, it’s just a cosmetic lock for all intents and purposes.
With LUKS or plain dm-crypt unencrypted data never touches the storage. Small parts of the storage are decrypted in RAM, but what gets written is encrypted. FDE at the block level gives less info to the adversary than file based encryption. With detached /boot (and maybesome other stuff) (like on a USB stick), and plain dm-crypt, you can even have plausible deniability that the storage medium was just overwritten with random data. LEO can't do anything for LUKS or dm-crypt if they can't bypass the lock screen, short of a cold boot attack. That's true for file-based encryption, too. The lock screen (on Linux, at least) isn't related to disk encryption and doesn't have to be.
I don't agree with you, but I appreciate the time you took to reply. Apologies if I may appear terse.
> The security models of desktop operating systems are far, far behind those of mobile operating systems
What about Qubes? That's my standard. Everything else has worse security almost by definition (since you can virtualize it and increase its security that way).
> The first sentence is inherently incompatible with the security structure of GrapheneOS (for example).
My mistake - sorry. I wanted to say something like:
> I would choose something as locked down as GrapheneOS (no root) for its security if I were to use it to install random apps or to run JS from random sites - examples of exposing myself to unnecessary danger like someone who doesn't know what he's doing. I would choose something with root but wouldn't run random apps with root permissions or JS on a browser started with root permissions.
I somehow mixed both sentences when editing.
> it doesn’t matter if you’re only giving “trusted” apps root, all it takes is one supply chain exploit, one malicious developer, one anything to make that app with root do something its not supposed to do.
That's where we differ on our views of security, agency and responsibility. I own the computer so I should be able to give root to whatever I trust. I already trust the the hardware, the myriad of developers writing the OS, the libraries they've used and so on. Yes, trusting less things is better, but there's a tradeoff and we can easier restrict the OS further and further until we're left with nothing. The OS shouldn't restrict what I can trust and what I can't trust. Why is the OS trying to force me to not trust any app but only the millions on lines of code of the OS itself and the hardware?
> The point is to not give applications root, giving them root circumvents basically all of the protections GrapheneOS and Android give the user.
Giving all applications root might circumvent all protections in GrapheneOS and Android. How does giving 1 application I trust circumvent all protections? Let's say I wrote the app (and I trust myself) and then formally verified it - just for the sake of argument. Although I'd give root to apps I didn't write or verify because I am an adult who can choose what code to trust. We already have important information and already give important permissions to apps that, if compromised, can ruin our lives easily (browsers, communication apps and so on).
> The problem is that we don’t know how they could leverage it, so the solution is to eliminate that pathway entirely.
So apps are both sandboxed and there are robust permissions which make Android much more secure than most desktop OSes, but we can't even give an app root because it might somehow wreck the whole system? I don't get this. By that logic we don't know if any app could compromise any of the system processes that have root (or functionally equivalent access). The solution would be to not run untrusted apps in the same OS at all, to have different computers or some hardened virtualization like Qubes? I get that it's not black and white, but my hypothetical terminal app with root permissions won't be the only process with root permissions running on the OS, so why is it THAT bad to give it root? Especially when I'd run it with root only for certain tasks, just like I don't "sudo ls ~" but just "ls ~".
> This is also my issue with the push for Linux phones onto the average person (instead of the community coming together and forking AOSP if they want to escape Google). The platform has zero real sandboxing, and the average person still wants to use Meta apps as shit as they are. These big tech companies’ and governments’ apps would go absolutely crazy on Linux phones.
Why not try to use existing security mechanisms in various Linux distros (or Qubes) to prevent Meta's apps from going crazy? Additionally, why can I load facebook.com in Firefox on Linux and be relatively certain I won't get pwnd by Facebook even though I have root on Linux? That would mean we trust browser sandboxing more than Android sandboxing. Yet we have root on Linux and can do anything with the browser. What I mean is, you state that Android is so secure, yet we trust it less than untrusted JS on a browser on desktop. If we don't, should we disallow people to run JS (or even CSS, as there have been attacks via CSS) at all?
> my view is that we shouldn’t be pushing root-capable mobile operating systems onto the average person
My view is that we should default on root-capable devices for anyone. If a user doesn't feel sure in their abilities, they may select "I am not sure of my abilities to operate a computer, lock it down for me permanently" option. Otherwise it's on them. We shouldn't be nannies for people. People will eventually learn when enough people get burned. We should be nannies for obvious cases of mental retardation where the person requires round the clock care, but not for everybody. We're not sheep and shouldn't all be treated as sheep even if a lot of us are.
> Also preventing root allows devices to pass attestation checks. I know it has a dirty connotation in light of how companies are behaving recently, but it really is a security benefit for a device to be able to prove that it’s base operating system is unmodified (i.e. no persistent malware is present).
I might see a benefit for workers in a company for work-provided computers because they're company owned, but any attestation for user-owned computers that is imposed on a user will almost inevitably lead to a dystopian future where computers get more and more controlled, locked down and even backdoored without a way to even see if they are. For example, in many jurisdictions you're required to have phone, to use Android or iOS, to have an account with Google or Apple, to not have root and to not run a custom ROM in order to use basic public services or banking (even if my bank account has like 5 bucks in it and I wouldn't care less if it got hacked). That is absolutely wrong and if we don't do something it's going to get much worse in the future. We should fight these restrictions whenever we encounter them. We the people own our lives - we should own our computers and we should own (as in responsibility) our choices.
You need root to get around all the stuff that Google won't let you do. There's tons of examples I've encountered over the last 20 years, but the one I encountered most recently is that without root, when I plug in an external display to my phone, I can't actually make the phone display go off. So it sits there powering the external display and its own display (that I'm not using) because of permissions.
GrapheneOS - does allow you to root/ADB. It's just not official, just like LineageOS. You can even sign your own images and relock the bootloader and have root i f you put in the effort.
So I misunderstood about LineageOS - I haven't read anything about it for a while. Everyone on GrapheneOS's forum is really anti-root, they even mention it's not GrapheneOS anymore. From what I saw you can't get any support whatsoever if you have an issue with root or adb, which seems like a core component to any OS to me. Would've been nice if there was a community that gave each other support for rooted LOS or GOS. There could be one, though - I haven't researched it.
I had the first two iPhone models, but then moved to Android. So I've been an Android user for ~15 years. This will probably be the drop that makes me go back and try an iPhone again. If all phone OSes are going to be walled gardens, might as well go for the best one.
Android has always been lagging on usability/performance/polish, but I stuck with it for the openness and because it generally was first to tryi new things. I remember how people at work laughed at me when I got a Samsung Galaxy Note ("It's so big it looks like you have an iPad in your pocket"), yet a few years later every phone was that size. And now Android is leading with foldables. I love my OnePlus Open, but OnePlus seems to be pulling out from the Western market so further support is looking "iffy", so might as well get an iPhone.
It was a long time ago, so I don't remember. Phosh or Plasma. I tried to like Sxmo, but it was really unintuitive, unlike tiling WMs on Linux.
Fairphones seems OK, although for €549 I'll probably stick to a dumb phone and invest in a better laptop for now. I'm not saying it's too expensive for what it is, though - it's still a tiny computer with all kinds of periphery.
I just wish there was a version with a shitty camera for €50 less or with no Bluetooth for €10 less - you get the idea.
I think a problem is that phones, as a concept, are communication first, rather than general computing first.
If you want to partake in social networks, messaging, work communication, banking, etc you're at the mercy of the service's owner and their moat. You can't access Instagram in any other way than their app, and at that point an open OS doesn't help a lot.
I'm sure FOSS can make a feature equivalent Instagram (or Whatsapp, or whatever) but the people aren't in there.
> I think a problem is that phones, as a concept, are communication first, rather than general computing first.
I use all kinds of computers for communication. I'm communicating with you on my desktop. I had a call earlier on my laptop. And a phone IS a computer, so why pretend it's not?
> If you want to partake in social networks, messaging, work communication, banking, etc you're at the mercy of the service's owner and their moat. You can't access Instagram in any other way than their app, and at that point an open OS doesn't help a lot.
I wouldn't use proprietary work tools on a personal device. It's not good hygiene.
I don't care if Instagram requires an app on a non-rooted phone with verified Google attestations because I don't use it and it's not essential.
Banking apps ARE a problem because a lot of banks don't let you use their site without their app at all. That should be solved with regulations - give people a FOSS banking app or, better yet, an API, so they can bank however they want to. Let us create FOSS interfaces for the different banks. Right now we need to revert the regulations who more or less force us to rely on Google or Apple's attestation. Internet banking is important both because there's a trend, even in countries where cash is still widely used, to have places that don't take cash, and because it's a highly regulated system paid for my taxes - I should be able to participate in a modern way with bullshit restrictions allegedly made to prevent someone's grandpa from getting hacked or phished.
But if I can't access my bank online, I'm not going to bow my head and buy a bank-approved phone with a bank-approved OS and a bank-approved $tech_company account. Who banks that often that they really need to do that, outside of places like Sweden where cash is almost dead?
> Who banks that often that they really need to do that, outside of places like Sweden where cash is almost dead?
I often pay cash in physical stores, but when buying things online I (and every other Dutch person) use Ideal (Wero). That means authorising each payment via my bank, and that means either using my smartphone (GrapheneOS) with the bank's app, or using the bank provided OTP device with my debit card inserted.
Using my smartphone is, unfortunately, the easiest way. I hate both options for the fact that I need to fetch either my smartphone or my debit card though.
Banks want their stupid app because it is the easiest way to keep some client-side secret secure in a nearly fool-proof manner. I can do everything I want in any browser, but authorisation and authentication happens by means of that app, so even just logging in means scanning a QR code with the app, and then continuing in the browser of any device I want.
I think most people use bank several times a week at the very least. Some do it constantly and put debit cards on their smartphones and concentrate everything financial on that single device, but even folk who keep ready amounts of cash on hand and don't buy things online too often bank several times a month, even if just to pay taxes and keep an eye on their finances.
>I use all kinds of computers for communication. I'm communicating with you on my desktop.
Sure, now get a date, connect with old friends, get invited to a party or join your children's school parent groups exclusively on free software.
>And a phone IS a computer, so why pretend it's not?
I agree we shouldn't, I'm just saying that it's unlikely for that need to meet a large enough demand.
You might consider Instagram, whatsapp or similar apps personally not essential, but for many (I would say most) people they are - if not truly essential for living, at least essential in the sense that they don't have much use for their phone outside of those apps.
Which was my point, as long as the main use of a phone requires passing through meta's (or whoever else's) hoops, it's going to be a hard battle.
The only minimally mainstream uses of a phone that currently lie outside the walled garden are piracy and emulators, and that's already a stretch.
> Sure, now get a date, connect with old friends, get invited to a party or join your children's school parent groups exclusively on free software.
It's tough, but that's a normal part of trying to change the status quo and fight for something you believe in. The people who I truly care for (and who care for me) have actually installed secure FOSS apps to connect with me and invite me to parties. They were reluctant and in some cases it took months of prodding, but it happened. And slowly there's a network effect - friend X and friend Y both have app Z. They might continue to use Meta to communicate between each other, but if and when they realize they want to move away from Meta, they can use Z.
I haven't had to deal with school parent groups in particular, but I have, in just a few cases over the years, managed to convert small groups from proprietary to FOSS solutions. It's hard, it's not the usual outcome (often they stay in their walled garden and I don't join them), but sometimes, just sometimes it works. That means there is actually hope and we can keep fighting the good fight. If we win, everyone wins.
I also understand if someone agrees with me, but reluctantly uses a closed proprietary solution to connect to the school parent group if it's important to them to be in that community. But losing a battle doesn't mean we have to forfeit the whole fight.
> If you choose to root, then I believe its not considered to be "GrapheneOS" any longer and assistance will not be provided for issues you face
Getting no support would suck. Obviously it's a FOSS OS, so it would be community support for the most part, but it's still invaluable when you run into issues.
Ah yes, getting access to your own data would be a massive problem, can you imagine such a world?! /s
Such data should be put in (or encrypted by) the hardware-backed keystore. You get to have full access to what the OS does, including seeing what data gets passed into this secure element for encryption or signing (you retain visibility and control), and yet secrets can't be leaked to you or an attacker who tries to extract those secrets
See e.g. your bank card: it's yours, you can choose where to stick it and what transactions it authorizes, but you can't get at the token that serves as proof of possession nor reset the PIN attempts counter. Your phone('s banking app) could work in the same way and has the hardware on board that makes this possible. So you see, it's a choice that you don't get to see what apps are doing and people are scared into believing that access to their own phone is bad. It's a matter of conflicting incentives on the vendor side, not technical risk
There is an API for backing up all app data that requires authorization. This is different from giving the user root, so any malicious can back up all app data at any time.
Oh, that useless thing. I was very confused about something which can "app data that requires authorization" (thought maybe it's some Google service that extracts your secrets for device migrations) but you just mean the old adb backup that the security industry (that I'm part of, and fighting from within :p) destroyed in the name of people's own good
Like, yes this exists, but it doesn't back up half the things you need :(
Because my new phone would be my new phone. And a phone is a computer. That should be enough of a reason.
I'm quite surprised people who post here don't get that. I've been lurking for years even though my account is new and even though general hackerishness here has gotten a bit reduced over the years, but it's still HackerNews, not ConsumerNews. No offense implied - I just hoped I'd see more people willing to claim their right to own and modify their OS like a true hacker.
I do (re-)root my phone (after each update I have to flash the Magisk-modified boot.img again), but FWIW almost nothing needs root on Android, it lets you do way more by default than iOS. I think some people equate jailbreaking and rooting when there's not really a jail to begin with. You can install a custom ROM without having root and I think that's what most people really want to do. Cleaner base system, maybe some new features. I run LineageOS without gapps and it's great. I can use `sudo` inside termux since I have root. I don't really use it for anything except to verify that Magisk reinstalled okay (I do `sudo ls /` as a quick check). Installing F-Droid doesn't need root. You can even do it on locked down TVs and Amazon tablets usually. adb works as well, not sure why someone was saying it doesn't. Hell, adb should work even without either root or a custom ROM. I use it to reboot my phone into fastboot without the button combo and then flash Magisk right after.
I agree you might not need it, but the issue is one of principle. I want it because I might need it. I don't want to find another OS that supports root if I realize I need it.
Just how I may be OK with staying at home for months with deliveries and internet access and everything else provided for me, but I want the freedom to go outside. There is rarely anything I need that's outside, to be honest. And outside is more dangerous. But I want to be able to sudo outside whenever I want for whatever reason I want.
Well, as far as I know, none of the popular Android custom ROMs prevent root, though what you found about them not wanting to support you when you run into issues is probably somewhat true everywhere. I think the idea is that if something you're doing to get root or after getting root is causing problems, it would be outside the scope of the ROM itself and not their problem. I do still get help in the #LineageOS IRC channel and mention issues in there despite being rooted. I don't mention it unless it seems relevant, but I've seen bug report forms where they specifically ask. Ultimately it's gonna come down to whether they can reproduce it, consider it an issue, and if it's a problem with the ROM or something else. I don't think they intend to be malicious. I used to work in tech support for some enterprise backup software, and if there were signs that the customer's issue was because of their OS or network or someone else's software, that wasn't our problem to fix, and as soon as we could prove that, we could usually close the case. We were only there as support for a specific piece of software, it was their problem, or at least someone else's to keep the general servers and network working. I imagine the volunteer maintainers of LineageOS don't want to help you with things unrelated to what they do either. Have not used GrapheneOS as I've never owned a Pixel, but I imagine it's a similar situation.
I think you are answering not quite what's being asked.
I think it's completely reasonable to want to be able to get root on your device. For the exact reasons you mentioned. GrapheneOS allows that.
To actually do so, it's reasonable to have a reason. Otherwise what you're doing is basically running commands with sudo "because you can", which will bite you.
To have a rooted phone just for the sake of the trophy of having a rooted phone is something generally considered worse. Better to have a rootable phone, which you root if or when you have need of it.
>To have a rooted phone just for the sake of the trophy of having a rooted phone is something generally considered worse. Better to have a rootable phone, which you root if or when you have need of it.
This is indeed pretty reasonable. Very easy to root at any time after flashing LineageOS, for example.
If I could point out, the vast majority of people you see writing things as stupid as that are either have a huge stake in the company/industry or the government.
Thanks for all of your other comments in this thread I read them all and it is such useful advice for everyone, even seasoned security people.
* iOS - walled garden, so no
* Android:
* * with a Google account and Play Services - a bit less of a walled garden, but still no
* * Android without Google:
* * * GrapheneOS - root or adb not supported, so no
* * * LineageOS - (edit: root or adb not supported, so no - just learned) seems like a viable option although it seems like it depends on Google's development of Android and keeping it FOSS. How's the situation with security updates? Which phones would you recommend? I don't count Samsung or whatever crap as they're generally quite user-hostile.
* Linux - IIRC only PMOS supported FDE. Is that still the case? Are there are good Linux phones? I tried PinePhone a few years ago, but it was crappy. The OS also lacked basic features like new windows showing up inside the screen.
* anything else?