DivestOS: long term device support with enhanced privacy and security

433

@wuijbfek
There are no plans for GSI builds of DivestOS.
GSI builds don’t support:

  • any kernel hardening
  • any kernel CVE patching
  • any deblobber changes
  • verified boot
  • bootloader locking

Furthermore many features are often broken/partially working

@hoolamags
I believe the OnePlus 2 and 3?

434

@SkewedZeppelin
Thanks for the details.

435

great job man. Love it

I just have a problem. When downloading the firmware of one device and the sha512 , they dont corresponde with eachother. It has happen with google pixel 2 and fairphone 3+.

436

@PorFin

Please post the specific files and what results you get.

437

Are any camera bugs known for the latest nexus 7 (2013) rom: 18.1-20211106-dos-flox?

If I open the (stock) “open camera” app I can “use”/see the camera (working) but when taking a picture it will not get saved. Looks like the screen/app freezes (but it doesn’t as the clock in the open camera app continues to run on the still picture). It’s the same for the rear and front camera.

Permissions are granted. If clicking on the gallery symbol in the open camera it says “no gallery app available” despite the stock gallery being present.

EDIT: Just checked to record a video and this actually works without any troubles. When the video is saved the gallery link in the camera also works. But taking a picture is still no possible…

:thinking:

438

@NoNameNoFame
I can reproduce.
Seems to just be a SELinux denial, will have a new build up soon.

Edit 1-2-3:
Camera on flox is quirky.

Edit 4:
A new flox build is up with working camera!

2 Likes
439

Thank’s so much Tad! That fix was quicker anyone would expect from any company even with a monthly $10k platin excelsior subscription (if something like that exists) :joy:

Indeed, the new “camera” app now does it’s job. :dancing_women: :camera_flash: :dancing_men:

Sadly the “open camera” will still refuse to take pictures. I also figured out that a well known messenger app (which not should be named :speak_no_evil:) does actually crash the device and enters a boot loop (divetos boot logo for ever) when trying to take a photo.

Any how the camera is now usable sticking to the stock app :muscle:

Thank’s again and keep up the great work!

1 Like
440

@NoNameNoFame

enters a boot loop

Does the device boot normally after rebooting it?

441

Yes, I need to power it off “hard” (keep the power button pressed) and then it will start normally again.

Boot loop wasn’t probably the right term - it just wasn’t booting till the end but just stuck on the boot animation

442

A question: I know the encryption on android changed from a full disk to a file based one.

In the past it was possible to set a different lock screen pin and decryption password for starting the device. This doesn’t work anymore due to the changed encryption - right?

I used to have a long and difficult passphrase for the initial boot decryption and a somewhat short pin code for the lock screen. Used to be a third party app from f-droid (I think their were more than one doing that job) including forcing a restart when ‘x’ wrong lock screen pin attempts were recognized.

443

@NoNameNoFame

and then it will start normally again.

OK, good no data loss.

changed from a full disk to a file based one.

Devices have to opt-in to this.
flox is still block based.
You can easily tell the difference:

  • full/block encryption will show a black background with just a password entry screen
  • file based encryption will show the user set background along with the time and status bar

different passwords

This was always a hack and had many edge cases that could go seriously wrong.
I also don’t think it is trivial to implement on devices with file based encryption.

reboot after wrong

This should probably be added.
There is an app on F-Droid that’ll wipe after X failed attempts, but that isn’t always desirable:

1 Like
444

I used this “feature” (different lock screen pin & decryption password) quite frequent on my devices and the only “problem” I occurred was that often the custom recovery (twrp) wasn’t able to decrypt the device. But I think this was all solved with code changes/updates in twrp.

I think mostly settled with snooper stopper:

or wrong pin shutdown:

if I remember everything right.

What would be such edge cases were things go seriously wrong (guess that means total data loss)?
I will not try this now on my “productive” device but might just try it on a spare one once I have access to one.

I really think such a “setup” (>30 characters decryption password and a short pin code with forced shutdown after couple of tries) makes mobile devices much safer while still perfectly usable for every day life :muscle:

EDIT: Looks like snooper stopper only worked reliable until android nougat (or lower) because things were changed in android afterwards :frowning:

Still work’a’rounds are presented on xda for FDE (looks FBE doesn’t allow separation between decryption password and screen unlock anymore - guess that’s because it really just decrypts the files when unlocking the phone?):

https://forum.xda-developers.com/t/guide-separate-passwords-in-encrypted-lollipop.3048072/page-4

most recent:
http://www.gagliardoni.net/#android_dual_cryptfs_dec_2020

445

Got some news. The camera is sadly still somewhat quirky even with the “new” stock app and can crash the hole os.

I “managed” to get the same behavior I had previously with the messaging app (os crashing and rebooting into a endless boot animation) when taking photos with the new stock camera app and then opening the last picture directly by swiping to the side.

446

Another short update about the nexus 7 (flox build) (this time not camera :camera: related):

I’m having a hard time getting gps to work (at all). I tried all the (usual) bit’s I’m aware of from my custom rom experiences (couple of years).

  • I gave the tablet a good hour on the roof top to get a fix (no luck)
  • I used gpstest to “clear assistant data”, “inject time data” & “inject PSDS data” (this is what typically worked for me in the past years very successful when gps was “quirky” with custom roms)
  • I did not yet do anything special (like getting agps working with unifiednlp)
  • I did not had gps tested before on this particular device because i divestostified it right away :stuck_out_tongue:

PS.: updating to divestos-18.1-flox-2021-11-28 at this very moment :lock:

447

@NoNameNoFame

I just tested my flox indoors and locked onto four satellites.

Perhaps unrelated, but I had to follow the steps in this video to reseat one of the cables to fix the accelerometer last year or so: https://www.youtube.com/watch?v=vGkZiYz-s4Y

1 Like
449

@Ryu945

  1. Technical Details - DivestOS Mobile
  2. I don’t agree with what is done in that video.
  3. On devices that work, they work just fine. Broken - DivestOS Mobile

Also @Ryu945 please stop pinging me on both F-Droid and XDA forums, just pick a place and stick to it. I don’t respond instantly.

To address individual things in that video:

  • DivestOS uses Quad9 for DNS and provides easy selection of other providers via the Private DNS menu
  • DivestOS defaults to the Google captive portal servers, but includes an option on all versions to simply disable captive portal checks. I recommend this over changing the server.
  • DivestOS already comes with a hardened WebView provider called Mulch. Mulch closely tracks upstream Chromium releases for fast patching of security issues.
  • DivestOS does default to Google for SUPL, but disables MSA and doesn’t include your device IMSI in requests. Your SIM card likely overrides this choice anyway.
    • The GPS config he shows editing in that video doesn’t even have any effect as that is the debug config. The real GPS config is compiled into frameworks/base resources.
  • I don’t recommend you keep a rooted device.
  • Completely ignores things like removal of Widevine blobs and similar, something that DivestOS removes.
1 Like
450

In its web page: https://divestos.org/
You can see a summary on the main page.
Then, more details: Technical Details - DivestOS Mobile

I guess there are more, but it’s in WIP.

Good channel, but I suggest you use invidio.us to link to Youtube.

451

Just in case, I’ll explain this for those who don’t know.
This means that you can’t watch protected content on DivestOS from streaming platforms (Netflix, Prime …).

What are the differences between Bromite and Mulch?

452

The patches have reasonably descriptive names:

Bromite is nice as a browser, but as a WebView component I feel doesn’t receive updates fast enough. That is largely due to the sheer amount of patches they maintain and have to update each version.

Bromite has fewer blobs, ad-blocking, fingerprinting resistance, and many other customization options.
Mulch only cares about providing a no-frills WebView, the /chrome component is an afterthought and will degrade if necessary to persist updates of the WebView.

eg. Bromite is currently missing 20 security patches on its 96.0.4664.54, whereas Mulch is at 96.0.4664.92.

454

Mulch the browser can be installed on any device and is on the DivestOS F-Droid repo.
Mulch the WebView can only be installed on DivestOS.