gilfredstuart

[SecureDrop @SecureDrop]

"It could be as significant an upgrade as HTTPS."

A nice explainer of WEBCAT, our project to make JavaScript tamper-proof and the web a safer place for everyone:

https://t.co/YYysp8E35J

[gilfredstuart @gilfredstuart]

@ShimazuSystems Just mute and block untill you build a decent feed

[Ben Visness @its_bvisness]

Now that TypeScript is written in Go, you can just put this in your go.mod, then run `go tool tsgo`, and run TypeScript without ever installing npm.

[Qubes OS @QubesOS]

XSAs released on 2026-07-28

https://t.co/vvnNxzNOpE

[GrapheneOS @GrapheneOS]

https://t.co/fSCUYxV9OB

This proposal wouldn't hide that a wipe occurred and would help adversaries exploit and recover data from the device. It isn't a new idea and people have proposed variations of this hundreds of time for years. These proposals wouldn't hold up against widely available forensic software. Giving an attacker access to a decoy profile would make it far easier for them to exploit the device. Without a shut down or reboot, a device was previously in After First Unlock state would be very vulnerable to having data extracted.

GrapheneOS has strong protection against data extraction without depending on a duress PIN/password. The default enabled protections combined with a strong passphrase and 2nd factor fingerprint PIN would have provided fantastic protection for the data on the device. Reducing the device auto-reboot timer would be even better. The secure element would have protected the data with only a random 6 digit PIN instead of a passphrase in practice too.

All of our features are designed to work against adversaries aware of GrapheneOS. Our duress PIN/password is no different. Adversaries aware of GrapheneOS face a dilemma about whether a PIN/password provided by the user is going to unlock the device or wipe it. It wasn't designed around being a secret resulting in an unpleasant surprise for an adversary. We also plan to provide it as part of secure element rate limiting on future devices built to run GrapheneOS to prevent bypassing it with an OS exploit.

Triggering our duress PIN/password feature wipes both hardware keystores, the secure element as a whole and disk encryption metadata. Each of these 3 steps is enough on their own to reliably wipe material needed to obtain the key encryption keys for disk encryption. It happens nearly instantly and it wouldn't be secure if it took a bunch of time or depended on actually erasing any of the encrypted data. Shutting down the device triggers clearing sensitive data from RAM and registers to complete the process. It's necessary to clear a lot of sensitive data from memory and registers including decrypted encryption keys in TEE memory.

Giving an adversary access to a profile on the device instead of shutting down or rebooting would be very problematic. It would give them an immense amount of attack surface for exploiting the device to recover sensitive user data. If the Owner user is in After First Unlock state, the adversary has given massive attack surface for exploiting the device to obtain all of the data from the main user. It would be the extreme opposite of the attack surface reduction and exploit protections provided by GrapheneOS.

GrapheneOS and apps running on it could continue to function indefinitely after the key derivation material is wiped. It already has disk encryption keys loaded into Trusted Execution Environment memory and is using those for inline disk encryption via wrapped keys. Only functionality depending on hardware keys would be broken. If there were profiles in After First Unlock state those would still be available. An attacker exploiting the device would recover the same data as before wiping the key encryption keys.

Forensic data extraction companies have access to GrapheneOS and we don't have access to their software. We cannot rely on security through obscurity or knowing how their software works including which vulnerabilities they exploit. Fooling widely available forensic software into believing a decoy profile is the Owner user isn't feasible. It would need to provide a fully functional Android Debug Bridge (ADB) environment which is completely impractical.

People should consider the fact that they likely haven't thought about this nearly as much as us. There are good reasons for why we designed this feature the way we did and it's working as intended in the real world. The feature becoming widely known about is a requirement for it to work as intended by creating a dilemma for adversaries. The main thing we need now is secure element support for it which we can get implemented for future devices as part of our Motorola Mobility partnership and future OEM partnerships.

[gilfredstuart @gilfredstuart]

Bought a ChatGPT Pro 20x subscription because I'm a good little wagie (it will be compensated). I hope this proprietary shit will be noticeably better than GLM, otherwise I will be pretty disappointed.

[gilfredstuart @gilfredstuart]

@UsugeNoDansei @SleepingFumo @bee_fumo It's a meaningless distinction, if I understand correctly. Android OS is called a ROM the same way a Linux OS is called a distro

https://t.co/JNwgUozHL4

[gilfredstuart @gilfredstuart]

@SleepingFumo @bee_fumo It's a proper ROM with locked bootloader, I have no issues using it as a primary device. Sanboxed Google Play works fine as well.

[Khuanxy @khuanxy]

Sinnits Journey to Semetica

[Ṛtasmara\𑀋𑀢𑀲𑁆𑀫𑀭 @mythomatician]

“Who will be a victim of my malice?”

“…”

“Who will bear witness to my indifference?”

“…”

[gilfredstuart @gilfredstuart]

@isjuustadream Too much anthropomorphism. You are as much of a thought as a crack on a rock is a thought of the rock - it's not a thought, it just is.

[gilfredstuart @gilfredstuart]

Decided to give up and just use an image from the marketplace, I'll set up Packer another day, maybe

[gilfredstuart @gilfredstuart]

Man, this worthless cloud does not allow me to attach extra disks using terraform (what?), and it seems like I have to bust out Packer because it does not parse my cloud-init properly for some reason. I wish I could use a proper cloud instead of dealing with this nonsense.

[gilfredstuart @gilfredstuart]

@spergchud @GrapheneOS @TheOutlanderArt @interesting_aIl You forgot the gigachad image. Me, spies, and terrorists should have access to secure and private computing because there is no such a thing as a "backdoor for the good guys".

[Misu @yngmisu]

i have tremendous amounts computer aura, most computer aura out of anyone
when robots take over they're gonna hook me up to a machine to harvest my computer aura because it is so strong it can heal both software and hardware

[gilfredstuart @gilfredstuart]

@spergchud @GrapheneOS @TheOutlanderArt @interesting_aIl Backdoring encryption is famously a great idea and works wonders

[gilfredstuart @gilfredstuart]

@elder_plinius They bought the books and as such they are free to do whatever they want to them. If those books were that valuable, then their previous owners should not have sold them.