There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

@Nr97JcmjjiXZud@infosec.pub avatar

Nr97JcmjjiXZud

@[email protected]

This profile is from a federated server and may be incomplete. Browse more on the original instance.

Nr97JcmjjiXZud , to technology in Tor’s shadowy reputation will only end if we all use it | Engadget
@Nr97JcmjjiXZud@infosec.pub avatar

You can, but you really shouldn’t.

Nr97JcmjjiXZud , to android in Privacy with Google's Gboard
@Nr97JcmjjiXZud@infosec.pub avatar

“I quoted that because it’s part of the borderline misinformation. Security is security. Malware is malware. Android isn’t magical and neither is desktop Linux. They absolutely can be meaningfully compared.”

That’s why the author said it’s tempting. You cannot compare desktop Linux to Android. Android is light-years ahead in terms of security than desktop Linux will ever be.

If you install Debian on your machine then that means you trust the Debian developers. If you trust the Debian developers then that means that you trust their repositories. The same cannot be said about Android. If you, for example, install GrapheneOS you’re trusting the graphene developers for the OS and the individual developers for their individual apps you install on your phone.

On Android a compromised user doesn’t have root, on ordinary Linux desktops, a compromised non-root user with access to sudo is equal to a full root compromise. On a Linux desktop with Xorg you can easily keylog everything with one malicious app(that app automatically gets these permissions without prompting you), with modern Android that’s not even an option(you’d need to accept all of these invasive permissions yourself, unless the app has a zero day that can bypass permissions).

The list goes on and on and on. You can read more here

“Ah, you’re right. I misread that part, sorry.”

No biggie :D

“By the way, I’m not sure I understand how Neo Store is supposed to be more secure, as it’s supposedly just an alternative UI for F-Droid.”

Neo store has the highest target SDK currently so it can use security and privacy APIs that Android provides with each new version. That alone is one of the biggest reasons to use neo store over native F-Droid. It shows you the target SDK, permissions (Way more understandable than whatever F-Droid does) & trackers for the apps you want to install. So you can make a more informed decision if you want that app installed.

“As for Obtainium, it’ll protect you from malfeasance or compromise on the part of the F-Droid repository, but it won’t protect you from malicious app developers, and unless I’m mistaken, the latter is a much more common threat.”

You are adding more attack surface when using F-Droid, but when using Obtainium, you have one less attack surface. Instead of worrying about malicious F-Droid developers and malicious app developers, you only worry about the latter. Malicious app developers can still publish to F-Droid without F-Droid getting compromised.

Nr97JcmjjiXZud , to android in Google Pixel Tablet gets support for LineageOS
@Nr97JcmjjiXZud@infosec.pub avatar

grapheneos.org/faq#default-connections

On self-hosting: You’d have to modify the source code and then build the OS yourself(which a lot of people do).

grapheneos.org/articles/grapheneos-servers

Nr97JcmjjiXZud , to android in Google Pixel Tablet gets support for LineageOS
@Nr97JcmjjiXZud@infosec.pub avatar

grapheneos.org/faq

“By default, GrapheneOS only makes remote connections to GrapheneOS services and the network provided DNS resolvers”

Nr97JcmjjiXZud , to android in Privacy with Google's Gboard
@Nr97JcmjjiXZud@infosec.pub avatar

What exactly are you trying to point out ?

From your quote: “It really shouldn’t be compared to the Android platform in any way.”

And where exactly does it downplay reproducible builds ? “reproducible builds are not as common as we would have wanted.”

“I’m going to go ahead and continue using F-Droid, thanks.” Good friend, do whatever it is you want to do.

I’m just trying to spread security awareness.

EDIT: “Saying Play Store is filled with malicious apps is beyond the point: the false sense of security is a real issue. Users should not think of the F-Droid main repository as free of malicious apps, yet unfortunately many are inclined to believe this.”

Nr97JcmjjiXZud , to android in Privacy with Google's Gboard
@Nr97JcmjjiXZud@infosec.pub avatar

Here are a couple of videos that try to explain it a little easier.

Video 1

Video 2

Nr97JcmjjiXZud , to selfhosted in Built a Small Offsite backup machine! What to run on it?
@Nr97JcmjjiXZud@infosec.pub avatar

Would rsync corrupt the backup if the main file gets corrupted (seeing as this would be a change) ?

Nr97JcmjjiXZud , to android in Privacy with Google's Gboard
@Nr97JcmjjiXZud@infosec.pub avatar

Give DivestOS a look, it tries to make LineageOS a more secure OS.

LineageOS

doesn’t

have

good

security.

EDIT: Better formatting

Nr97JcmjjiXZud , to android in Privacy with Google's Gboard
@Nr97JcmjjiXZud@infosec.pub avatar

F-Droid has a lot of security issues(if you care about security), use Neo Store if you want access to F-Droid apps with a more secure app.

EDIT: Even better to use Obtainium and add the links of the APP’s own Github/GitLab repo to it.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • lifeLocal
  • goranko
  • All magazines
    •