←back to thread

Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

(arstechnica.com)
446 points akyuu | 10 comments | 30 Oct 25 23:12 UTC | HN request time: 0s | source | bottom
Show context
derbOac ◴[30 Oct 25 23:39 UTC] No.45766747[source]▶
They couldn't answer the question most on my mind: "We’ve reached out to Google to inquire about why a custom ROM created by volunteers is more resistant to industrial phone hacking than the official Pixel OS. We’ll update this article if Google has anything to say."
replies(10): >>45766778 #>>45777056 #>>45778032 #>>45778056 #>>45779079 #>>45779102 #>>45779404 #>>45780503 #>>45781099 #>>45783125 #
LoganDark ◴[31 Oct 25 23:59 UTC] No.45778032[source]▶
GrapheneOS makes security trade-off that are inconvenient to the user. This results in a far more secure device, but nonetheless a device that the general public would find far more annoying. Google would lose a proportion of its user base by implementing the same protections.

Example: https://old.reddit.com/r/GooglePixel/comments/ytk1ng/graphen...

Also Google Pay is missing.

replies(4): >>45778078 #>>45779111 #>>45779935 #>>45780063 #
tranq_cassowary ◴[01 Nov 25 03:48 UTC] No.45779111{3}[source]▶
Google Wallet works but tap-to-pay NFC payments don't because Google enforces strong Play Integrity for that portion. They only allow Google certified OSes to use it. It's a sad choice on their part, not GrapheneOS' fault or choice.
replies(1): >>45779164 #
1. LoganDark ◴[01 Nov 25 04:03 UTC] No.45779164{4}[source]▶
Without Google Pay, Google Wallet is practically a glorified card number vault. Which can still be useful, just not at card terminals.
replies(2): >>45779312 #>>45781781 #
2. tranq_cassowary ◴[01 Nov 25 04:43 UTC] No.45779312[source]▶
True. This is an issue in America specifically. Where there is a Google Apple duopoly on tap-to-pay tech. Can be worked around though with smart watches like Garmin watch with Garmin Pay. In many other regions there are alternatives like Curve Pay or tap-to-pay functionalities in banking apps
replies(1): >>45779633 #
3. dns_snek ◴[01 Nov 25 06:26 UTC] No.45779633[source]▶
Google Pay also works with a Pixel watch connected to a GrapheneOS phone, FWIW.
replies(1): >>45780173 #
4. LilBytes ◴[01 Nov 25 08:47 UTC] No.45780173{3}[source]▶
Oh is that right? That's cool. That might be enough to give Graphene another go, especially since Android Car is supported now. Thank you.
replies(2): >>45780614 #>>45781788 #
5. dns_snek ◴[01 Nov 25 10:31 UTC] No.45780614{4}[source]▶
Yeah, technically your phone isn't even involved. The watch manages all the cryptographic keys independently and you can add cards through the Google Wallet app or website.
6. subscribed ◴[01 Nov 25 14:12 UTC] No.45781781[source]▶
Close.

To me it's a biggest missing feature to date (and the team brought that up with European Commission already, as there are no technical or security reasons for that). Worth noting it will work on the old, unpatched, rooted, wildly unsafe phones with the right magisk configuration. But not on the safest os.

Anyway, it keeps the passes okay for me, and for the payments I use Garmin Pay.

7. subscribed ◴[01 Nov 25 14:13 UTC] No.45781788{4}[source]▶
Also Garmin watches if you'd prefer wearing something with battery lasting weeks, not hours ;)
replies(2): >>45783878 #>>45784836 #
8. alex-korr ◴[01 Nov 25 18:10 UTC] No.45783878{5}[source]▶
That's what I use. The Garmin O/S UX is a bit ass, but usable and I never need to carry money if I am going on a run.
replies(1): >>45784367 #
9. subscribed ◴[01 Nov 25 19:04 UTC] No.45784367{6}[source]▶
"a bit ass" is a charitable way to put it, but same here, it's dependable, dead stable, good enough as a backup map.
10. dns_snek ◴[01 Nov 25 20:00 UTC] No.45784836{5}[source]▶
It's not that bad, my battery lasts around 36 hours. I take it off when I go to shower and by the time I remember to put it back on (~30min) it's usually back to 90%+.