Kuketz IT-Security Blog

> open-source means auditable privacy

This is what that auditing actually reveals:

* /e/OS sends user speech data to OpenAI without consent [1], and thought this was ok until they got caught [2].

* /e/OS massively delays security patches, and calls this a "standard industry practice" [3]. Meanwhile, GrapheneOS' opt-in security preview releases provide early access to security updates prior to official disclosure [4]. Also see [0] (Security update speed) and [7] (WebView being 40 security updates behind).

* microG downloads and executes proprietary Google binaries in a privileged environment [5] [6]. You can obviously not audit these, nor should this count as "degoogled".

* microG still phones home to Google by default (android.clients.google.com for device registration check-in, mtalk.google.com for FCM push, firebaseinstallations.googleapis.com for SIM activations) [7].

[0] has a comparison of popular privacy and security-focused Android-based OS, which paints the whole picture. Privacy-friendly does not necessarily mean secure, but in this case "privacy-friendly" is quite a stretch already.

[0] https://eylenburg.github.io/android_comparison.htm

[1] https://grapheneos.social/@GrapheneOS/114880528716479708

[2] https://community.e.foundation/t/clarification-about-voice-to-text-stt-in-e-os-and-whats-next/75121

[3] https://community.e.foundation/t/e-os-and-security-updates/72384

[4] https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases

[5]…

GrapheneOS provides much better privacy, stability and app compatibility than /e/ rather than only security. GrapheneOS entirely exists as a privacy project and focuses on security too in order to protect privacy. GrapheneOS is a privacy project aimed at being highly usability. There's a good third party comparison between them here:

https://eylenburg.github.io/android_comparison.htm

/e/ regularly lags many weeks and months behind on essentially privacy and security patches for Android, the browser engine used by many apps, the Linux kernel, drivers and firmware. It doesn't preserve the standard Android privacy and security model either. It isn't safe from a privacy or security perspective for those reasons. It doesn't take a nation state attacker to exploit not having patches for many known browser/OS privacy and security vulnerabilities.

Despite the misleading marketing, /e/ always uses multiple Google services and integrates them into the OS with privileged access unavailable to other services. They automatically download and run Google code with privileged access along with giving privileged access to certain Google apps when they're installed including Android Auto.

Article from Mike Kuketz about /e/ including covering user tracking in their update client, still using Google services with privileged integration into the OS and major delays for important privacy/security…

It's not, it starts sending all kinds of information to Google from the very first time you unlock the phone: https://www.kuketz-blog.de/e-datenschutzfreundlich-bedeutet-nicht-zwangslaeufig-sicher-custom-roms-teil6/

They also run proprietary Google blobs in a privileged process to pass basic Play Integrity and give certain Google apps higher privileges than the normal Android sandbox.

Aside from Google, Fairphone 6 (both the stock OS and /e/OS) ship with proprietary, Chinese TCL blobs for image processing (most likely also privileged).

Besides that, /e/OS often uses way outdated Linux kernel versions and firmware bundles with many known CVEs and old major Android versions, having many unfixed vulnerabilities that are not marked high/critical (ASBs only give you high/critical fixes).

Fairphone does not have a secure enclave, only TrustZone. So, secrets can be extracted using frequently-found side-channel accounts. The lack of a secure enclave + the many available CVEs, it will probably fail within seconds when using data extraction tools like Cellebrite, even when the phone is locked. So better not bring your phone to demonstrations or border crossings.

But hey, it doesn't matter, because Murena's CEO says security hardening is only for spies and pedophiles.

(Friends don't recommend friends Fairphone or /e/OS.)

Edge shares literally every single website you visit with Microsoft, even in InPrivate (= Incognito) mode. [1] The worst part is that you have to disable a genuine security feature (i.e., SmartScreen) to prevent this. No other browser makes you choose between security and privacy in this manner. Even Chrome attempts to protect your privacy by doing hash prefix computations for their Safe Browsing feature.

Also, at least Chrome lets you set a custom encryption passphrase. Microsoft managed to import every other feature from Chrome, except this one, apparently.

Microsoft has somehow done the impossible and beat Google in its own game. Edge is a complete privacy nightmare, only rivaled by the likes of Opera and Yandex browsers. If Chrome is the fire, Edge is a nuclear reactor in meltdown.

[1]: https://www.kuketz-blog.de/microsoft-edge-datensendeverhalten-desktop-version-browser-check-teil4/ (English version: https://www-kuketz--blog-de.translate.goog/microsoft-edge-datensendeverhalten-desktop-version-browser-check-teil4/?_x_tr_sl=de&_x_tr_tl=en)

GrapheneOS leaks less data to Google by default and otherwise than /e/OS and is also a privacy-focused project. I believe places like https://www.kuketz-blog.de/ and https://eylenburg.github.io/android_comparison.htm will attest to that.

App compatibility should also be better with sanboxed-play-services compared to microG since almost all apps/features that don't require meeting certification requirements (e.g. Google Pay and certain banking apps) or privileged integration (Android Auto) should work just like on another Android family OS. Something you might run into is the hardened memory allocator exposing memory corruption issues in apps whereyou might not see the same crashing elsewhere.

/e/OS falls significantly behind the other alternative Android systems with regards to privacy and security.

Please see this independent comparison table: https://eylenburg.github.io/android_comparison.htm

And additionally the reviews by Kuketz: https://www.kuketz-blog.de/android-grapheneos-calyxos-und-co-unter-der-lupe-custom-roms-teil1/

See also my table that shows historical release dates for monthly Android Security Bulletins: https://divestos.org/misc/a-dates.txt

and the Chromium (WebView): https://divestos.org/misc/ch-dates.txt