I used Rethink DNS for this a while ago to track apps and where they were talking to. In my experience, socials and browsers were the worst offenders. Browsers just being open, connect to all kinds of domains.

If that key is gone, the encrypted data is as good as random garbage data.

I suppose if you had a copy of the encrypted data and a decryptor, you could try to brute force it.

No such thing as side loading - it is just installing

Which devices though? All Pixel devices? Just a specific subset? Which specific modems have this vulnerability? No specificity at all, just Pixel devices, and also this is happening while they are slow rolling their updates being accessible to GrapheneOS and co.

Hmmm. Install the update that will enforce the sideloading restrictions, or risk pwning... 🤔

There's no encrypted copy, just a manifest showing the encrypted copy is on Google's servers, but the device that has the hash to decrypt it was flashed...I'm tantalizingly close

Hmm. If you don't have a local copy, and the encrypted copy is corrupt, you might be SOL. I doubt Google is going to provide any support.

I didn’t miss it, I was trying to use it as a rhetorical tool to help the commenter recognize that material conditions keep the things they seem to think are how it ought to be from happening.

“You think it’s one way but it’s the other.” To steal a phrase from a show. I wanted to use that as a hook to keep the readers interest through what is a pretty dry topic.

E: grammar

Thanks. I wanted to focus on the part you missed for some reason.

It's PCPDroid. Basically wireshark for android.

Tracker control can a different although similar thing, and then block the calls.

Unfortunately I only get the encrypted txt manifest not the data itself from takeout - the phone was flashed trying to fix a problem with the file picker and that's what started this problem, I can't export the data using takeout and the phone image doesn't match the cryptographic hash - I just need to log into maps using a phone that is recognized as the originator of the data at the time the new encryption method rolled out. I have the phone but it was flashed so it's not recognized as the device that has permission to decrypt my location history. Very frustrating.

Right!?

They probably are. But everyone can talk to the modem via the cellular network or the internet.

Does the S23 have a full copy of the data? If it does, you can probably do an export on the device https://dawarich.app/docs/getting-started/import-existing-data/

If it doesn't, it might be that the server-side backup is corrupt. Or maybe just the backup/restore process is broken; I've had that happen and I just had to try again a few weeks later.

So...it's not working then?

My one gripe with Android Auto currently is that you can't use a separate Bluetooth headset/mic with Google assistant. It makes the assistant useless for motorcycles unless the AA unit supports connecting a Cardo/Sena directly to it.

It is possible for open source hardware to be securable hardware. Of course, someone has to design it, manufacture it and distribute it and eventually it will be unsecurable because new vulnerabilities and capabilities are developed every day, so that someone will have to design, manufacture and distribute a successor and the old hardware will have to be deprecated.

All that costs money and the people who care about security are a super small group so graphene chooses hardware that is “accidentally” securable. The reference implementation pixel phones are a great example. Google doesn’t care about security or graphene. But they built a phone intended to do the hard work of putting all the possible parts together so that other manufacturers could look and see how they could do an Android phone with some feature (or even some better feature) without having to spend a bunch of cash doing it from scratch. It just so happens that Google included relockable (this is different and more important for security than unlockable) bootloaders, a processor with memory tagging support and a big pile of documentation in case you want to use those features.

Then Google indicated that it was gonna stop doing everyone else’s work for them. There are a bunch of reasons for this and I’m not gonna go into them but I will summarize some analysis: you should make it a priority to move away from Android devices eventually depending on your citizenship and stop relying on the securability of a computer system of any type. Doing everyone’s work for them was why the pixel phones were such a good target for graphene, they had the features and the documentation. Now that Google isn’t making reference implementations anymore, they don’t intend to have every feature (notably security features) or give out docs.

So the graphene people switched to Motorola. The new Motorola phone that’s expected to run graphene wasn’t designed for it, it just so happens to have the features and the company agreed to give them the documentation required. It’s “accidentally” securable.

That’s how graphene works. There isn’t an alternative for them. They don’t have the money, capital or expertise to design and release a phone specifically for security and there isn’t a market for that product they could endeavor to sell to and get a loan against the promise of.

I want to make sure we’re on the same page: graphene is open source. There are open source projects that prioritize security. Security and privacy are different things.

It was fun! I'd never done any kind of sideloading or customization of a phone prior. I learned a lot from the experience. Similar getting the Jellyfin app to run on a Samsung TV. I'd like to eventually convert my old laptop into an automotive diagnostic reader, with the ability to add/delete keys via the OBDII port. That's a big project tho, lots of moving parts

Thanks for the write-up on your post, very informative 😁♥️

tries to boot android, fails and goes to recovery

Tbh I care more about qi2 for the magnets and standardised accessories. Also just disappointing that we still have new phones using the old qi charging

you mean it

• tries to boot android, fails and goes to recovery?
• or it doesn't even show the boot animation and just hangs on fastboot? or reboots immediately?

i'll need details to help..

It still won't start

Submit a bug report with details about both your phone and head unit. Make sure to record logs and include those.

https://github.com/Benjamin-Wiegand/Flywheel/wiki/Troubleshooting#recording-logs

Confirmed it works on my head unit from 2015, but no audio at all

Can OSH be secured hardware? Is there a fundamental contradiction there?

I suppose if schematics for chips are available to the public, then it would be easy enough for a trained bad actor to follow those schematics and identify hardware vulnerabilities that they could attack.

Does this mean that the product GOS Foundation provides necessarily has to be closed source? Open source and privacy can never coexist?