Hacker News Reader

Comment by bsimpson | Hacker News Reader

Has anyone here looked at the security of Lineage? I know it's a rebrand/fork of Cyanogen, but I don't actually know much about it as a project.

It seems to be the only image that works with Waydroid (the Android environment for Linux tablets), but I am not super comfortable entering my passwords into a project I don't know much about.

View on HN

Lineage is more about convenience and longevity rather than security and privacy. As another commenter said, Graphene is most suitable for this task if it's a major concern.

Take a random device like Google Pixel [1] it runs on a 4.4 kernel, long outdated and no longer maintained by Google. You can explore the code [2] however you are not going to be getting critical security updates (such as those issued by Qualcommm or any closed source blobs/firmware etc, and those released as per the pixel/android security bulletins).

Lineage is more about 'hacking' a kernel and making it work with the latest AOSP when the official software support ends. It's more vulnerable to exploits than a continuously supported device (although even devices that are 'in support' by the OEMs can often be depressingly behind things like patches etc).

Google is trying to fix this within the ecosystem (GKI, Apex etc) but at least as far as custom ROMs go...yeah, don't store state secrets on such a device ;)

[1]: https://wiki.lineageos.org/devices/sailfish/

[2]: https://github.com/LineageOS/android_kernel_google_marlin

> Lineage is more about convenience and longevity rather than security and privacy. As another commenter said, Graphene is most suitable for this task if it's a major concern.

Are there devices which graphene supports which aren't fully patched on lineage? AFAIK graphene is just outright not supporting devices without current kernel updates, while lineage does best effort on the long tail, meaning that on the same device they'll have the same kernel.

If you are concerned with security, you might be interested in GrapheneOS. It has some nice added security features, but only works with Pixel phones.

This article has some good info about the security of LineageOS, although the biggest complaint comes from the physical security implications of unlocking the bootloader.

https://madaidans-insecurities.github.io/android.html

Thanks!

Since it's running in an emulator, I'm less concerned about bootloader and adb. More concerned about keyloggers, malware, etc.

I think you'll be fine for that purpose, it's a large reputable open source project. It's not impossible that someone has sneaked in a bug or exploit, but I don't think any overt attempts would make it in. Similar to Linux or other large open source projects.

LineageOS prioritizes device compatibility and maintainability over security. I do not think this is a good tradeoff to make as normal people don't care about such security until it is too late.

I think it's wild how universal the idea that a phone is a place for secrets had become.

A device you are most likely to lose, break or get stolen by virtue of being outside of your home for much of the day.

... and where users are going to use it to do EVERYTHING in their daily digital lives, from doing financial transactions and accessing work email, to playing data-exfiltrating "free" games and surfing porn. And where the only actually viable location for backing up the data stored on it is some Big Tech conglomerate's cloud.

I agree it's pretty crazy.

Surely having some vulnerabilities patched is better than having none patched. I don't think the crowd running Lineage is doing so in lieu of the latest iPhone.

Reply on news.ycombinator.com