Develop Bugs

[Q] can someone explain how a root works?

to start yes i used the search bar, for a while. and quite frankly it didn't help one bit
im just curious as to how it works so i could try to figure it out on my own evo as im very impatient to find a way to root my 2.2 phone.

I don't know what makes you think you'll find one before the experts but a root is an exploit in the software that allows flashing custom recovery, SU and the engineering HBOOT

063_XOBX said:
I don't know what makes you think you'll find one before the experts but a root is an exploit in the software that allows flashing custom recovery, SU and the engineering HBOOT
Click to expand...
Click to collapse
just because someones an expert doesnt make them perfect...
but i work in the satellite industry and commonly do things similar to rooting a phone and am willing to try my hand at doing it on my phone

063_XOBX said:
I don't know what makes you think you'll find one before the experts but a root is an exploit in the software that allows flashing custom recovery, SU and the engineering HBOOT
Click to expand...
Click to collapse
Actually your wrong. We use magical beans to empower the very essence of one self, thus making root possible. Ok back to reality its not something you can learn over night trust me. I have been working on some solutions got real close just to get thrown further back. Patience is key to anything in life.

Basically, root is like being the "master administrator" of the file system on your phone. Without root, the phone just recognizes you as an ordinary user and will only give you the ability to read and write to certain parts of the system. Once you find a way for the system to recognize you as "root", you then have access to everything. You can read and write and do almost whatever you want. This could be pretty dangerous if you don't know what you're doing, but that's why we have the SU app to control what is getting full access and what isn't. If you haven't already had experience with a Linux OS to know this, your chances of finding an exploit to root 2.2 are pretty much .00485% .

Root is akin to the networking term "full administrator access". The Android filing system is setup with permission requirements for accessing certain areas. Root means you have been granted read/write access instead of just read-only.
I believe root is also a Linux term denoting the lowest directory on any particular storage device. By rooting, you gain read/write access to this area of your phone's sdcard and the internal storage.
Sent from my PC36100 using XDA App

Roots are constantly growing and digging into the soil for more nutrients and water to feed on. Roots use time and pressure to find water. The penetration may start as an almost microscopic root end, but over time the root grows thicker and pushes its way in deeper, growing more tendrils along the way.​

garyfunk said:
Roots are constantly growing and digging into the soil for more nutrients and water to feed on. Roots use time and pressure to find water. The penetration may start as an almost microscopic root end, but over time the root grows thicker and pushes its way in deeper, growing more tendrils along the way.​
Click to expand...
Click to collapse
---Like---

I've seen some replies as to what what is, but not how you get there. To answer the OP, to get to root, you have to be able to find an exploit in the software that allows you to flash recovery. Once you're able to flash recovery, that can be used to flash su permissions bootloaders, roms, etc. The last exploit was found in how the phone uses flash, and some root methods had you actually opening the browser and going to any site that was running something in flash - this would open the loophole and allow access to things that are normally blocked.
This loophole/exploit has been plugged with 2.2, so now a whole new rood method has to be discovered.

thank you pikkon and fachadick you two have been the most helpful in this.
but also so what your saying is theres no ##xxxxxx# code i could put in to find the administration change menu or anything like that?

If you really want to learn, get some books on Linux and read everything about root access and how to hack the root user.
Sent from my PC36100 using XDA App

envoykrawkwarrior7 said:
thank you pikkon and fachadick you two have been the most helpful in this.
but also so what your saying is theres no ##xxxxxx# code i could put in to find the administration change menu or anything like that?
Click to expand...
Click to collapse
Supposedly there is some sort of code to get access, but its supposed to be impossible to crack. Wiser men than I have discussed the possibility of using brute force attacks to crack the code, but those ideas were discounted when the numbers were crunched and it was determined that it would take a ridiculously long time, using state of the art equipment. As I understand it, the only way to get a crack at the code is if the key is leaked, and it was agreed that the odds of that happening are pretty much nil.
Your best bet if you're serious, is probably to pick up some books on the subject, like the other post mentioned. Try and see if anything in your day-to-day can be transferred over to solving the problem. The way I see it, the more people working on it, the better.
Sent from my blah blah blah blah

I can see 100,000 Iphones Evos working together to crack the SU password. SETI @ Evo team maybe?

fachadick said:
Supposedly there is some sort of code to get access, but its supposed to be impossible to crack.
Click to expand...
Click to collapse
It is the root password. Find out the password and you are in.

weidnerj said:
I can see 100,000 Iphones Evos working together to crack the SU password. SETI @ Evo team maybe?
Click to expand...
Click to collapse
LOVE IT! +1!
Sent from my blah blah blah blah

No offense... but if you don't even know what "root" is, and aren't familiar with the Unix-based software platform, and think you can just fiddle with something in a hidden menu on your phone, you have absolutely no chance at discovering a root method. Zero. It'd be nice if it could work that way though...
Obtaining root is essentially hacking into your own phone. In order to do that, you have to know what potential vulnerabilities there are in the software running on the phone, and how to exploit them to give you precisely what you want. It's a lot of trial and error, reverse engineering, and sometimes, just plain educated guessing backed by experience.
Also, this comment baffles me:
but i work in the satellite industry and commonly do things similar to rooting a phone and am willing to try my hand at doing it on my phone
Click to expand...
Click to collapse
You claim you do things similiar to rooting a phone because you work in the satellite industry, but you don't even know what rooting involoves?? I admire your confidence, but I wish it was more well-placed...

sohr said:
You claim you do things similiar to rooting a phone because you work in the satellite industry, but you don't even know what rooting involoves?? I admire your confidence, but I wish it was more well-placed...
Click to expand...
Click to collapse
well the difference im working on already administrator devices running through a root menu commonly, and to me, technology is technology, no matter how different the usage or device its still just a chip computing algorithms the way it was set up by someone else, which means that anyone else can change what someone else did.

[Q] Any cons to encryption?

I am running XPosed framework and the only module I am running is XPrivacy. I don't like anyone having too much information about my porn habits, and / or text messages to my many girlfriends (Wife won't understand), so I am thinking about encrypting my phone.
Are there any cons to this? Will any apps not work with phone encrypted? AT&T variant, if that matters.

Cons: If you forget the password/strings you entered, you're pretty much screwed.
Having locked down your device will draw more suspicion from the wife.
Irony: Using an open source device with open source software to hide and not be "open" about these things yourself.
Will it interfere with any apps, not that I have experienced before. Though I don't encrypt anymore and haven't used that many apps even when it was so...

lostangelintx said:
I am running XPosed framework and the only module I am running is XPrivacy. I don't like anyone having too much information about my porn habits, and / or text messages to my many girlfriends (Wife won't understand), so I am thinking about encrypting my phone.
Are there any cons to this? Will any apps not work with phone encrypted? AT&T variant, if that matters.
Click to expand...
Click to collapse
BerndM14 said:
Cons: If you forget the password/strings you entered, you're pretty much screwed.
Having locked down your device will draw more suspicion from the wife.
Irony: Using an open source device with open source software to hide and not be "open" about these things yourself.
Will it interfere with any apps, not that I have experienced before. Though I don't encrypt anymore and haven't used that many apps even when it was so...
Click to expand...
Click to collapse
LOL come on man, I was just being facetious about all that. I just don't like the fact that apps that have no need to know my location have access to that information by default. I don't want the NSA to be able to use anything against me.
I don't have any girlfriends, and I don't surf porn on my 5 inch screen.

lostangelintx said:
LOL come on man, I was just being facetious about all that. I just don't like the fact that apps that have no need to know my location have access to that information by default. I don't want the NSA to be able to use anything against me.
I don't have any girlfriends, and I don't surf porn on my 5 inch screen.
Click to expand...
Click to collapse
:good: Even if you were it's not my problem, I was kidding around
The apps though, I don't think will cause any problems if you encrypt the device. Usually you can encrypt specific files or folders, though even if it's the entire disk in the device it shouldn't cause a problem. The M8 also has its own encryption tool on the phone already.
NSA...Well if they really want to look at your porn they probably could, it's perhaps not impossible to have encryption tools with backdoors already in it. Trust the NSA to spy, you can't really trust those who say they'll encrypt your data in order to prevent them from spying though, how do we know?

has there ever been a security breech on a custom Rom?

So yes basically I know things on xda are supposedly safe in terms of security and roms. But have there ever been a case of a Rom having something like a keystroke logger or any type of hack to gather information or gain access to your personal stuff? And if it had never happened on xda maybe from one of the other sites?
I suppose I'm just trying to address how safe custom roms are I have been using various ones recently so I do trust them some what of course and I assume if a roms been on xda for months and has many posts it's been checked but I still wonder if someone was clever they could wait for the right moment to strike if you know what I mean. Thanks.

Yea, in a way, you are trusting that the devs have no added anything sinister to their custom ROMs. But in the time I've been here (a long time!) I haven't seen anything like this added to any ROMs. You could always do a full scan of the ROM before flashing it to be sure.

the_scotsman said:
Yea, in a way, you are trusting that the devs have no added anything sinister to their custom ROMs. But in the time I've been here (a long time!) I haven't seen anything like this added to any ROMs. You could always do a full scan of the ROM before flashing it to be sure.
Click to expand...
Click to collapse
What would you scan it with though? Pc viruses and malware different to mobile no? And anyway surely a clever hacker would make there own hack etc. And maybe they just add it to the update add well . Anyway good to hear no ones reported one yet!

Well I will try a pc scanner...phone scanners seem to just check.apk's so that's useless...done some full scans all the same just for the hell off it. Guess I don't have any money anyway so I'm safe . But like I say if they are clever they will write their own code so the scanners won't find it .

Still no one reported ok that's given me more confidence...a bit :s ...

Only thing I new of was start of the year I had a xperia z ultra and the mostly only way to gain root at the time was to use kingo root. It wasn't a XDA developed root tool is was from a Chinese website and it was suspect as it took your phone details like imei number. Not sure what happened in the end. But if you get a phone and you trust the recognised devs you should be OK.

Golly, I sho hope not!
:good::good::good:

How about as of late and the security involved when you have a rooted phone? I have not been able to locate any substantial info concerning the legitimacy of or about the claim. Do I need to UN root my phone after the new flash or no? Or, am I way of base here and obviously don't fully understand the weekness of having a rooted phone? In other words, a rooted phone is just as safe as a non rooted phone?
Thanks in advance

Edit

Randy L said:
How about as of late and the security involved when you have a rooted phone? I have not been able to locate any substantial info concerning the legitimacy of or about the claim. Do I need to UN root my phone after the new flash or no? Or, am I way of base here and obviously don't fully understand the weekness of having a rooted phone? In other words, a rooted phone is just as safe as a non rooted phone?
Thanks in advance
Click to expand...
Click to collapse
No, a rooted phone is not as secure as an unrooted phone. You've opened up access to the system when you rooted, and therefore made it vulnerable.
Not that an unrooted phone is completely secure either, but with root access, a malicious app could do much damage.

What would you suggest since I plan to flash a newer, stable ROM with a newer radio binary? I need to ensure my phone is locked up right as possibly allowable without over taxing the system.
Thanks again

Randy L said:
What would you suggest since I plan to flash a newer, stable ROM with a newer radio binary? I need to ensure my phone is locked up right as possibly allowable without over taxing the system.
Thanks again
Click to expand...
Click to collapse
It's all a trust and common sense game. If you flash a rom you are putting the trust in others hands. No way around that. As for keeping it locked down. Your best bet would be to stay on stock. Root is a security hole and that's why Google is starting to allow apps to check for root and if found disable the app or features of the app.

Luckily most of our ROMS don't come from people stand to gain anything from that info and are probably like-minded when it comes to how we want our phones to work.

To answer some of these questions, it might help to fully understand what we're talking about.
What kind of security issues face an Android phone?
Well, for one, there are network-level attacks. This are fake cell towers (sometimes called Stingrays) that can collect the sort of data a cell tower might be able to collect, your location, your messages, and your data.
A third-party ROM or a rooted phone is not intrinsically more vulnerable to this. In fact, there are some apps that help detect this kind of attack, and those apps will generally require root access. This kind of attack is less likely to be a random skiddie, and more likely to be the police or a government.
Another kind of attack is a malicious app. Think of it like a trojan horse, something you willingly let into your phone, and it has a secret malicious payload. Maybe it's a browser that actually skims all your activity to sell to marketers. Maybe it's a widget that shows a neat clock on your lock screen, but it actually collects all of your contacts so they can be spammed later.
Since this would be an app that you've willingly downloaded, a third-party ROM doesn't make you much more susceptible, but granting this app Root could make it much more damaging, since it could hide itself from uninstallation or even modify other apps to do bad things.
Note, though, that certain third-party ROMs and apps that require root can help protect against this. If you download an app, and it says it needs permissions that don't make sense (why does a clock app need access to my camera, or my contact list?), that should be a red flag to not install it. But some ROMs actually let you revoke/block individual permissions., so if a baddie app was trying to access stuff it shouldn't, you can stop that from happening.
But there's a slightly more insidious kind of malicious app. Imagine third-party app that accesses Twitter, or Snapchat, or Instagram. Now this app actually saves all of the things you're doing elsewhere before it punts them off to the service you're trying to access. This app could be appearing to function completely honestly, hoarding your Snaps and your snapchat password, until one day they decide to leak all your snaps, or upload all the images you sent to your private Instagram to a public site.
You're not intrinsically more vulnerable to this kind of attack with a third-party ROM or a rooted phone. These apps will likely be come from a non-Play store source, which can happen even stock/unrooted. An app like this with root access can do more bad stuff, but their wheelhouse is in doing bad things with the data you've already willingly given them, so it's moot.
Then there's the issue you seem to be most worried about, which is malware baked into a ROM. This is by far the biggest danger in terms of risk, because it could be doing all sorts of nasty stuff relatively invisibly. What prevents someone from doing this, though? Well, for one, with an open source project, everyone can see the code. If there is something flagrantly wrong, it could be spotted by other people. It's possible to try to hide it, though, and some smaller ROMs don't attract a ton of eyeballs, so not that many people might be looking.
Then again, plenty of major ROMs could have the same thing going on, just in very clever or subtle ways. Look at how pervasive the Heartbleed issue was, and that was in code that tons of very smart people had the chance to look over.
Third-party ROMs do present more danger in this regard. What do we consider third-party, though? Major carriers lay tons of extra code on top of vanilla Android. And plenty of them may be doing unseemly things with your data, either for marketing reasons or at the behest of someone like the NSA. In that case, you're best but would be to stick strictly to AOSP ROMs, but even then, it's not a sure thing.
Truth be told, the best thing you can do for security is just pay attention to what you're letting onto your phone, and what you're letting those apps do. Your choice of ROM and root status is a part of it, but being generally aware is by far the most important thing.

First time root help for z1 compact d5503, 5.1.1, 14.6.A.0.368

Have been advised that this is the best place to get the info I need :good:
Essentially I am thinking of purchasing the above phone purely to use as a music device. I already have the phone I want/am happy with (no msd slot). Hence looking at the above.
Now, being a UK model it will be subject to volume capping so I wanted to root the device, remove any bloatware, and install viper for Android.
Looking around this looks like a viable option, really after the simplest/easiest option to make this happen
The device is already out of warranty - so not worried about that, would also consider removing any other function than music replay, browser and Bluetooth (even phone, contacts, weather etc etc).
This would be a first time root, but I'm relatively tech savvy and have flashed other (ios devices) with jailbreak, rockbox etc so not completely alien to me
Any suggestions, pointers, or end users who have done the same would be great
Thanks

dimmockg said:
Have been advised that this is the best place to get the info I need :good:
Essentially I am thinking of purchasing the above phone purely to use as a music device. I already have the phone I want/am happy with (no msd slot). Hence looking at the above.
Now, being a UK model it will be subject to volume capping so I wanted to root the device, remove any bloatware, and install viper for Android.
Looking around this looks like a viable option, really after the simplest/easiest option to make this happen
The device is already out of warranty - so not worried about that, would also consider removing any other function than music replay, browser and Bluetooth (even phone, contacts, weather etc etc).
This would be a first time root, but I'm relatively tech savvy and have flashed other (ios devices) with jailbreak, rockbox etc so not completely alien to me
Any suggestions, pointers, or end users who have done the same would be great
Thanks
Click to expand...
Click to collapse
Post #2 here will root you - http://forum.xda-developers.com/son...eneral/simple-reversable-root-method-t3302157 The rest of the thread will fill you in on the Kingroot controversy.
Besides Kingroot, you can either unlock BL, and flash su/kernel/recovery, or use downgrade method.
Or prf method - http://forum.xda-developers.com/son...ck-step-step-to-rooted-lollipop-14-6-t3213465

Thanks for that, kingroot certainly seems the easiest option
As I wouldn't have any contacts on the device, no banking or other related apps and nothing in the way of PayPal etc used on its browser (if used at all) I guess there would be minimal risk - If in fact the conspiracy theories were correct of course? Used as a pure music playback device and nothing else I see no risk at all

You can still use your phone for stuff like banking after you are rooted. Just be careful with what you install and what permissions you are giving to your apps. Avoid downloading shady apps from other places like play store and browse safely and there is no security issue for your phone.

KingRoot, may I add.

Question Rooting has become a pain

I have never had so many issues with updating a phone with Magisk before. Today is the 2nd time I lost all my data trying to update. I feel like Magisk isn't worth the hassle anymore. It is frustrating how anti-root google is becoming.
Anyone else share the same opinion?

mkhcb said:
I have never had so many issues with updating a phone with Magisk before. Today is the 2nd time I lost all my data trying to update. I feel like Magisk isn't worth the hassle anymore. It is frustrating how anti-root google is becoming.
Anyone else share the same opinion?
Click to expand...
Click to collapse
Were you running a custom kernel and you tried to update to March? Did you get the phone is corrupt and it wouldn't boot screen? If that ever happens again, you don't have to wipe, Just go on the Android flashing tool uncheck everything flash and you'll be good to go again. At least it's worked for me every time so far.

mac796 said:
Were you running a custom kernel and you tried to update to March? Did you get the phone is corrupt and it wouldn't boot screen? If that ever happens again, you don't have to wipe, Just go on the Android flashing tool uncheck everything flash and you'll be good to go again. At least it's worked for me every time so far.
Click to expand...
Click to collapse
No custom Kernel, it came to a point where the only screen I was given was Android Recovery screen.

mkhcb said:
No custom Kernel, it came to a point where the only screen I was given was Android Recovery screen.
Click to expand...
Click to collapse
I ended up going to stable magisk

mkhcb said:
I have never had so many issues with updating a phone with Magisk before. Today is the 2nd time I lost all my data trying to update. I feel like Magisk isn't worth the hassle anymore. It is frustrating how anti-root google is becoming.
Anyone else share the same opinion?
Click to expand...
Click to collapse
I disagree with you...
Coming from the OnePlus 6T, and previous phones you can't really beat just pulling the boot.img from the factory image, patching it with magisk, then fastboot boot that img then install directly in the magisk app. It's actually that simple. Really is that black and white to be up front about it.
That's how I have been doing it for a while now...and...no problems for me! But this IS JUST ME.

mkhcb said:
I have never had so many issues with updating a phone with Magisk before. Today is the 2nd time I lost all my data trying to update. I feel like Magisk isn't worth the hassle anymore. It is frustrating how anti-root google is becoming.
Anyone else share the same opinion?
Click to expand...
Click to collapse
No. It really comes down to reading instructions and knowing what you're supposed to do when it comes to rooting. I can't tell you how many times I read folks spewing instructions that are out of date or they're patching the wrong files for their device that inevitably cause a problem.
I have not had any issues with root since the P6 came out. I have followed directions exactly as they've been written and I've been fine.

mkhcb said:
I have never had so many issues with updating a phone with Magisk before. Today is the 2nd time I lost all my data trying to update. I feel like Magisk isn't worth the hassle anymore. It is frustrating how anti-root google is becoming.
Anyone else share the same opinion?
Click to expand...
Click to collapse
Did you update magisk and then faced a bootloop?
That was a bug/is a bug introduced with the latest magisk update (monday), Magisk kind of "lost" the ability to handle a certain amount of modules/certain modules. We are all waiting for a fix. The temporary solution was/is to press down Lower Volume rocker when the Google logo appeared when booting, that way you activate safe mode and all Magisk modules get deactivated. Discord says 4 modules are max right now, some say it's "just" certain audio modules that are incompatible.

I wouldn't say it's become a pain but you really need to "do your homework" and make sure to read before attempting stuff. Same old, same old I'd say.
If you're unsure, just ask. There's plenty of people here who are willing to help out.

I was on regular A12 and tried to update from the app. The device rebooted and didn't appear to be rooted (I know that ryhmed) tried to direct install but got an error, can not remember the error.
Then I decided to update to the A13 DP2 beta and used canary magisk , updating via flashtool and fastboot flashing the patched image and voila! Couldn't be happier.

Seems like people have had some issues lately

I don't know about harder, but maybe more haphazard. February update I did the uninstall magisk method and it worked as described. Did it again for March and this time it took me three tries to get the phone to boot and at that point I lost root. Had to download the image from Google, extract boot, patch it and flash it. Not the end of the world but still no idea what happened.

There was some glitchyness at the beginning with the vbmeta nonsense, but that's all sorted out now. The tools available are so simple to use now that its hard to imagine that anyone could have any trouble with it.
FWIW: for privacy/security reasons, I run GrapheneOS. It would normally do its own update procedures, but when you need root (I need for conducting proper backups since the built-in misses a lot), it freaks out with the unmatched boot.img. The update solution then is to download the full "factory" update package, extract the boot.img, patch it with magisk, edit the "flash-all.sh" script to remove the "-w", run the flash-all.sh, then finally fastboot flash the magisk-patched boot.img.

Ghisy said:
I wouldn't say it's become a pain but you really need to "do your homework" and make sure to read before attempting stuff. Same old, same old I'd say.
If you're unsure, just ask. There's plenty of people here who are willing to help out.
Click to expand...
Click to collapse
^^^This 100%
mkhcb said:
I have never had so many issues with updating a phone with Magisk before. Today is the 2nd time I lost all my data trying to update. I feel like Magisk isn't worth the hassle anymore. It is frustrating how anti-root google is becoming.
Anyone else share the same opinion?
Click to expand...
Click to collapse
While there are many ways to skin this cat, I follow the step by step instructions in my sig every update, and haven't had an issue yet.
I will admit that rooting is loosing it's allure for me as it seems cust Rom development on the phones I prefer is waning (remember the day when every device had a dozen cust Roms to choose from). That coupled with I'm no longer the guy who tries to squeeze an extra 30 min of battery life, who over/underclocked cpu's and gpu's to get a 100 pt higher benchmark score.
Root is something I still do because I like having the OPTION of customizing beyond a cust kernel and some "root required" apps, and jumping through a few hoops to make magisk work is worth it IMHO.

Az Biker said:
Root is something I still do because I like having the OPTION of customizing beyond a cust kernel and some "root required" apps, and jumping through a few hoops to make magisk work is worth it IMHO.
Click to expand...
Click to collapse
This 100% as well!!
The stock Google ROM is perfectly fine with some tweaks!

96carboard said:
There was some glitchyness at the beginning with the vbmeta nonsense, but that's all sorted out now. The tools available are so simple to use now that its hard to imagine that anyone could have any trouble with it.
FWIW: for privacy/security reasons, I run GrapheneOS. It would normally do its own update procedures, but when you need root (I need for conducting proper backups since the built-in misses a lot), it freaks out with the unmatched boot.img. The update solution then is to download the full "factory" update package, extract the boot.img, patch it with magisk, edit the "flash-all.sh" script to remove the "-w", run the flash-all.sh, then finally fastboot flash the magisk-patched boot.img.
Click to expand...
Click to collapse
Root renders half of the purpose of grapheneos moot though... It's "security hardened". Hand a rooted "security hardened" android phone to anyone who can watch a YouTube video and has a computer that has a USB port or wifi and they could be dumping your system files in in a matter of minutes.
What sort of privacy do you imagine you gain? Are you under the assumption that Googleplayservices is the only method by which your traffic can be singled out of the background internet swarms? Hopefully you're not replying on it to not be physically tracked. Or worse, trust it to go dark and do dirt with.
I'm asking because because I generally don't understand the motivations of users such as yourself. Using a flagship device, attempting to de-google/brand it, and then openly say it's for X privacy or X security usecase. It's simply not true. To me it's like someone buying a Porsche, throwing Ford stickers on it's and saying it's because they get better traction.

erktheerk said:
Root renders half of the purpose of grapheneos moot though... It's "security hardened". Hand a rooted "security hardened" android phone to anyone who can watch a YouTube video and has a computer that has a USB port or wifi and they could be dumping your system files in in a matter of minutes.
Click to expand...
Click to collapse
Maybe in the hands of an incompetent, but no, you can't just "walk in". Said compromising individual would have to somehow unlock the device in order to authorize the USB debugging session or whatever type of compromise they're attempting.
erktheerk said:
What sort of privacy do you imagine you gain? Are you under the assumption that Googleplayservices is the only method by which your traffic can be singled out of the background internet swarms? Hopefully you're not replying on it to not be physically tracked. Or worse, trust it to go dark and do dirt with.
Click to expand...
Click to collapse
You are mistaking absolute security for mitigating known and easy to close holes. Bad mistake, which will always make you look like a fool.
erktheerk said:
I'm asking because because I generally don't understand the motivations of users such as yourself. Using a flagship device, attempting to de-google/brand it, and then openly say it's for X privacy or X security usecase. It's simply not true. To me it's like someone buying a Porsche, throwing Ford stickers on it's and saying it's because they get better traction.
Click to expand...
Click to collapse
While root control of a device can provide a high degree of access to a system, it only does so in the hands of an incompetent. Every single server running connected with the public internet has a root account. If it was so terrifyingly and absolutely dangerous, it would be pretty obvious. But the reality is that those systems are administered, in large part, by competent system administrators, who know how to safely make use of the increased access without guaranteeing that some hostile entity will walk in and take control.
Conversely, consumer electronics are assumed to be placed in the hands of nitwits who will install applications that promise to deliver jiggling lady parts that are published in hostile countries, and even worse, will hit the "ok" button when a root authorization prompt pops up. Yes, consumers, by and large, are a security DISASTER waiting to happen.
So don't you dare make the claim that root access is a violation of sane security measures. There is nothing wrong with root, as long as it is used responsibly by someone competent to make use of it.

No, you misunderstand me. I've been rooting android since day one. Literally. Rooted by Dream/G1 running Cupcake with telnet on release day in 2008. I have 3 Pixel in front of me right now. One with CalyxOS, and one with Graphene. Those are for a paying customer who values their privacy, and not walking around with a crippled 'hardened device". So no root. The other is by test device I really want to Kali running on at some point.
I'll just let the lead dev/owner of GrapheneOS say the rest, I'm not debating what you want/like, I only elaborated on you want it sounds like to others.

96carboard said:
Maybe in the hands of an incompetent, but no, you can't just "walk in". Said compromising individual would have to somehow unlock the device in order to authorize the USB debugging session or whatever type of compromise they're attempting.
You are mistaking absolute security for mitigating known and easy to close holes. Bad mistake, which will always make you look like a fool.
While root control of a device can provide a high degree of access to a system, it only does so in the hands of an incompetent. Every single server running connected with the public internet has a root account. If it was so terrifyingly and absolutely dangerous, it would be pretty obvious. But the reality is that those systems are administered, in large part, by competent system administrators, who know how to safely make use of the increased access without guaranteeing that some hostile entity will walk in and take control.
Conversely, consumer electronics are assumed to be placed in the hands of nitwits who will install applications that promise to deliver jiggling lady parts that are published in hostile countries, and even worse, will hit the "ok" button when a root authorization prompt pops up. Yes, consumers, by and large, are a security DISASTER waiting to happen.
So don't you dare make the claim that root access is a violation of sane security measures. There is nothing wrong with root, as long as it is used responsibly by someone competent to make use of it.
Click to expand...
Click to collapse
No, you misunderstand me. I've been rooting android since day one. Literally. Rooted by Dream/G1 running Cupcake with telnet on release day in 2008. I have 3 Pixel in front of me right now. One with CalyxOS, and one with Graphene. Those are for a paying customer who values their privacy, and not walking around with a crippled 'hardened device". So no root. The other is by test device I really want to Kali running on at some point.
I'll just let the lead dev/owner of GrapheneOS say the rest, I'm not debating what you want/like, I only elaborated on you want it sounds like to others.

erktheerk said:
No, you misunderstand me. I've been rooting android since day one. Literally. Rooted by Dream/G1 running Cupcake with telnet on release day in 2008. I have 3 Pixel in front of me right now. One with CalyxOS, and one with Graphene. Those are for a paying customer who values their privacy, and not walking around with a crippled 'hardened device". So no root. The other is by test device I really want to Kali running on at some point.
I'll just let the lead dev/owner of GrapheneOS say the rest, I'm not debating what you want/like, I only elaborated on you want it sounds like to others.
Click to expand...
Click to collapse
There's nothing "crippled" about it. Its just AOSP with some hardening.
Yeah briefly looking at that link, their explanations are irrelevant. The bottom line is that they don't want morons who don't know what they're doing modifying the crap out of it, and either (a) having to be supported, or failing that (b) making the project look bad.
Nothing about it makes it "less customizable" than any other AOSP. Magisk/root or anything else installs on it and works just like it does on any other AOSP distribution. It just doesn't have all the broken junk thrown in willy nilly without taking a careful look at the implementation first, i.e., is it actually a *useful* feature, and can it be implemented in a secure manner? As a clear example, take a look at the call recording feature request; https://github.com/GrapheneOS/os-issue-tracker/issues/868 -- clearly a useful feature. The "lineageos" implementation has been brought forward, not as something to pull straight in, but as a point of study and/or somewhere to start building a good implementation -- their implementation is unsatisfactory in terms of security and maintainability.

Rooting this device is so easy compared to attempting to root a z fold 3 or any other recent Samsung flagship