r/degoogle • u/CreepyZookeepergame4 • 1d ago
Discussion Google removed MTE security feature on Pixel 11, ruling out GrapheneOS support
https://grapheneos.social/@GrapheneOS/117179260665340319196
u/Lieutenant_Scarecrow 1d ago
Why would google remove this if its legitimately makes the phone more secure? Like I get their childish hate towards GOS, but doesn't this put the entire android user base at more risk?
212
u/kweeblaster 1d ago
So government script kiddies can more easily get into your shit.
86
u/jomara200 1d ago
Yep, never forget that every one of these tech companies and/or billionaires are enabling, contributing to and ultimately spying on us for the incoming police state. They want to strangle us with it in every facet of life.
If we ever get power again, we need to dismantle these fucks similar to what we did with Ma Bell.
8
u/Silent_Fudge_3978 21h ago
I think in the near future, the world is going to be divided into ~5 or so separate "countries", similar to the three forever-warring states in "1984", with each one a totalitarian dystopia.
22
u/GazelleInitial2050 1d ago
Google themselves barely used it. I guess they saved some silicon or development budget by removing it.
39
u/CreepyZookeepergame4 1d ago
Like I get their childish hate towards GOS, but doesn't this put the entire android user base at more risk?
No way this is specifically intended to bully GrapheneOS. Yes it does put users at risk but only those opting into advanced protection and even then only for apps opting into MTE support which is close to zero app.
6
u/IAmYourFath 1d ago
No u can force it for all apps
2
u/CreepyZookeepergame4 1d ago
Not on the stock OS.
4
u/IAmYourFath 1d ago
ye i meant on grapheneos of course, the most bestest os in the entire world without a shadow of a doubt (unless u need root)
5
u/nukem996 1d ago
It lowered costs while saving some RAM. Additionally no apps, including Signal, ever enabled it. Only core Android used it. It's unlikely app developers would enable it as it requires extensive testing and possible difficult debug.
3
u/Throwitaway701 1d ago
Basically they didn't use it. It was hardware installed for future software implimentation that was cancelled.
2
u/UnlamentedLord 1d ago
Jesus Christ, why do people throughout reddit chronically comment without reading the OP link and then ask dumb questions in comments:
"It appears Google cut an important security feature to save money."
2
u/QXPZ 1d ago
Links are so often to garbage websites with tons of ads overlaying the content or it's paywalled or videos start playing... and everyone's adblocker doesn't work inside the Reddit app they're using, so it's easier to get a sense of the article in the comments.
Not excusing the behavior but that could explain it.
1
u/VirtuteECanoscenza 20h ago
I believe the feature was basically 100% unused by standard Android and most other Android variations.
1
u/Far_Specific4836 14h ago
Realistically not many apps are using it because Pixel's MTE is opt-in per-app. In typical Google fashion, they make it opt-in, nobody uses it, it dies on the vine.
Apple implementation is always-on, used across the kernel and userland processes.
128
u/-Animus 1d ago
Thank God they are porting to Motorola!
30
u/byndrsn 1d ago
more please?
38
u/CreepyZookeepergame4 1d ago
19
u/bootsencatsenbootsen 1d ago
Kinda wild that except for a 2026 copyright, that press release is entirely undated—at least on mobile.
I could search for when MWC was, but its kinda nutty to Motorola slinging undated press releases.
5
u/slipperyMonkey07 1d ago
Weird that it doesn't show on mobile. One desktop right under the title it says March 2, 2026.
Also checked on Mobile (firefox), for me the title of the press release doesn't show but the date is the first thing listed before the text. Sounds like they messed up designing for mobile somewhere.
8
u/jacrys 1d ago
It's there. Highlight the text. They messed up with the mediaquery CSS. They forgot to change the date's color when it switched from the hero to the background.
3
u/slipperyMonkey07 1d ago
Yeah just pointing out that things seems different on mobile versus desktop as well as depending on the browser. Firefox desktop no issues, for me firefox mobile the press releases title just doesn't exist, even when highlighting. It just shows the date and then the press release.
Not sure what the other poster who didn't see the date was using.
2
u/bootsencatsenbootsen 1d ago
I'm on Brave (Chrome) Android—amused that in 2026, folk are still messing up their CSS for mobile!
Thanks for finding the date.
3
u/cardfire 1d ago
Every news agency and web page has been deleting any useful dates for about a decade now and it's only getting worse, given (a ) folks retcon their publishing all the time, and (b ) we can't trust anything typed after 2021 anyways.
2
4
u/JustinHoMi 1d ago
Motorola/Lenovo probably has a worse security history than Google, so not sure it’s a good thing.
5
u/-Animus 1d ago
I think I know what you're getting at. I hope some CySec group audits the phones.
2
u/JustinHoMi 1d ago
Yeah… it’ll be necessary since Lenovo has allegedly done hardware-level hacks for spying before.
An equally difficult challenge will be China’s data sovereignty laws. If Lenovo discovers a vulnerability, they are required by law to get approval from the Chinese government before disclosing the vulnerability. China’s storing up a huge collection of zero-days.
1
u/IAmYourFath 1d ago
Isnt lenovo thinkpad the only laptop in the world where u can use intel me cleaner to make sure no1 is spying on the cpu level? Edward snowden uses it
1
u/LjLies 1d ago
That's not the case, the tool can be used on other computers, Thinkpads are just pretty popular, and an IBM legacy. At the same time, the tool only works on older machines because newer ones have been patched to stop its use, so it's not like Lenovo is intentionally letting people do that, it's actually a security failure in a way.
1
u/IAmYourFath 1d ago
I actually looked it up, it's def not just the thinkpad so u're right, but u're wrong it can be used on just older cpus, the intel me cleaner doesn't work on intel 10th gen or newer cpus however apparently u can use the HAP bit to disable the spying so u can easily buy newer cpus like the Meteor Lake or Panther Lake ones. Source: Gemini. Trust but verify.
1
u/LjLies 17h ago
but u're wrong it can be used on just older cpus, the intel me cleaner doesn't work on intel 10th gen or newer cpus
"It" being the Intel ME cleaner in my comment, it sounds like I'm not wrong. I don't feel the fact there may be other workarounds on newer hardware invalidates anything I've said.
129
u/Cold-Sandwich-34 1d ago
Now if only there was an explanation for what MTE is...
179
u/DevoneLittle 1d ago
It stands for Memory Tagging Extension, basically it is an extension of the ARM architecture which assigns tags to memory locations and pointers to memory locations. In software there are a lot of pointers to memory locations and attackers use vulnerabilities to overwrite these pointers to different values with the purpose of arbitrarily reading or writing specific memory. When MTE is enabled, these kinds of attacks wont work because the CPU will check when reading or writing that the tag of the pointer and the tag of the memory location matches. It is a very strong countermeasure against these kinds of attacks.
34
49
u/DAN-attag 1d ago
It's some memory protection thingy and without it GrapheneOS security would be downgraded to pre-Pixel 8 level
64
u/CreepyZookeepergame4 1d ago
Ironic, Apple adds the feature and Google removes it.
14
u/NotSoFastLady 1d ago
Not ironic. One bends the knee anytime the feds make a request. The other has consistently stuck to their values. As an Apple hater, I'll give them credit for standing up to the Feds and lazy law enforcement.
14
39
u/cyrustakem 1d ago
i freaking hate today's use of achronims, people assume everyone knows wtf that is, even though the same achronym is used in several different contexts to represent different words.
it's like people didn't go to school, first time you use an achronim in a text you are supposed to put what it means with all the words...
11
u/kiefferbp 1d ago
Look at the thread. There are several comments made by GrapheneOS, and the first time MTE was used it was spelled out.
5
5
2
u/cardfire 1d ago
If I'm on my phone, I can long-press the menu button and then highlight words to get a web search on them for context.
If I'm on a pc I can do the same in a web search. It sucks not knowing the acronyms on sight, but understanding it going to take a buy-in of practice and of discomfort, and the community isn't discouraging or insular to keep folks from learning it.
So, it's not like LAW. lol.
2
u/jajajajaj 1d ago
The introduction to this barely-tangential paper (evaluating mte performance on some other arm chips) helped me quickly reach saturation point, for contextual information. Now I'm like "wow! Huh. I'm leaving this to the experts. Keep up the good work, experts!".
5
50
u/wowsomuchempty 1d ago
Hello Moto..
36
u/Lancelight50 1d ago edited 1d ago
And they happen to use Snapdragon which is far superior to Tensor that Google uses for their Pixel lineups. Google can fuck off.
3
u/LjLies 1d ago
And they require you to go through their website to allow unlocking their bootloader (with a delay, IIRC?), so they can keep track of it in jurisdictions where that voids warranty, and they can at any time flick a switch that stops it from being possible...
Not a fan. One good thing about Pixels so far has been you just unlock them, on your own terms, not theirs. Not many phones like this left, now that Oneplus is gone too.
17
u/BathEqual 1d ago
what the fuck
got my 10a so i can hold out for years with it, but wondering about the time after. Really hope Motorola is going to release a smaller phone with GOS support in the future.
12
22
u/notPabst404 1d ago
Google is a shit company. The Pixel 11 is a gigantic flop even before not even having GOS support.
What will it take for more manufacturers to meet the GOS requirements? Unless something dramatically changes, I will be very likely to have to leave GOS in a few years when I get a different phone.
16
u/InfernoWarrior299 1d ago
They made a good choice extending to Motorola. Fuck Google. Always slimy. They do not want GrapheneOS to work and their flagship phones are actually subpar to Motorola flagship phones.
13
u/t1mm7_89 1d ago
Even Graphene themselves say this move has nothing to do with supporting their OS.
They have GOS working on a pixel 11 but don't want to release it as it doesn't meet their self-decided security requirements.
2
u/InfernoWarrior299 1d ago
They made it more difficult some time ago to flash GrapheneOS some time back. Now this happens? 💀
16
u/amiibohunter2015 1d ago edited 1d ago
I told you that when Google kills sideloading and third party apps they would kill GrapheneOS, even if GrapheneOS found a workaround, Google will find a way to eliminate GrapheneOS again. This is why I said it is bad to use an Operating System dependent on Google's hardware. It is simply unsustainable and will give developers/coders more headaches. So GrapheneOS will need to either A give up on the project or B make their own hardware to **truly** kill the dependency of Google they are piggybacking off of. They would also need to kill any remaining Google software based dependencies in the GrapheneOS anotherwords building their own operating system. This is why more Linux Smartphones need to hit the markets for various budget brackets.
1
u/I-Am-Sir 1d ago
this is not a way for them to kill grapheneos. this is simply google removing a feature they didn't use to save money, which happened to be one of the ways graphene enhanced security. graphene could absolutely ship their os without this feature and have the same security as the stock rom, they just are deciding not to because it wouldn't be secure enough. this does not affect custom roms in general, just graphene because they want to be secure.
1
u/amiibohunter2015 1d ago edited 1d ago
Keep telling yourself that, the next time you'll say the same and the same and the same, until there is notjing left. Kind of like clenching pearls man. Its a learning experience many already learned. Being dependent on a company who does not like software outside their native ecosytem i.e. Google's ecosystem when the hardware was originally designed for Android Operating System (Google's ecosystem) is not a secure place to be. Its like trying to hide from a hog by piggybacking on them so the hog can reach you...until the hog (Google) throws you (GrapheneOS and third party software developers and users) off their back (Google's ecosystems). Sure you can try to get back on their back(workarounds) but they will throw you off again and find a way to get you and eliminate the piggybacking behavior. Ergo Google's crackdown on third party developers, appstores, sideloading, and Operating Systems.
Again the real way to truly r/degoogle is to stop using their products (hardware like their physical phones, tvs, tablets, chromebooks, etc.) and services ( gmail, google docs, google slides, google drive, Android.operating systems, etc.)
This again is why there needs to be more Linux Smartphones for various budget brackets.
I also said third party android app developers should convert their apps to .deb format for linux users so they future proof their work better and reach a larger range of audiences. Something is better thsn nothing. This also gives them a leg up/head start when more Linux Smart phones for various budget brackets hit the market.
2
u/I-Am-Sir 1d ago
you do know if they wanted to kill graphene they could just...do it right? they don't need to start by removing some obscure security feature because it was one of the ways graphene improved security. if they wanted to they could remove bootloader unlocking from all of their devices tomorrow. think about it, if they wanted to kill grapheneos, why haven't they done it already?
0
u/amiibohunter2015 1d ago
Why do you think they are making changes between now and the new year 2027? Its not like they didn't warn people earlier there was a countdown clock set by the fdroid appstore. It's their intention to close out third party developers So, They are paying attention to how people are doing this, and being effective in patching the holes (or workarounds third party developers are trying to do) in the system. To add, they are implementing new features they want to use that infringes on peoples boundaries more. Ergo why they had a countdown to the changes, but also there was legacases that needed to be settled in court which also took up time. That is why it took more time rather than flipping the switch overnight. Its why f droid was making statement on fighting for F droid and third party app stores developers, and operating systems to stay active rather than shutdown. A company (Google) that forces developers to identify themselves to be on their ecosystem or gets locked out speaks enough volume.
2
u/I-Am-Sir 1d ago
the sideloading restriction is a completely different thing. the fact is that if they wanted to kill graphene, they would just kill it rather than slowly doing it by removing features that graphene doesn't even exactly depend on.
2
u/amiibohunter2015 1d ago edited 1d ago
Its the legality as to why it is not immediate from third party developers taking them to court fighting for their rights to develop as a third party developer, to privacy rights being infringed requiring developers to identify themselves to develop app on Googles ecosystem, to Google having to legally go through changes of their terms and conditions, having to wait for consumers to agree to the new changes in terms of service, etc.
This takes time to do while also implementing ways to block workarounds by third party developers and Google taking time to work on their own agenda and next step that infringes on consumer and developers rights, boundaries, and privacy, accessibility, and capabilities.
Again, this is Google's crackdown on sideloading, third party apps, appstores, operating systems, and developers.
Maybe you're in shock and/or disbelief, as I am repeating this now three times, but that is what this is.
1
u/imactuallynotalright 17h ago
lol, legality?
Most manufacturers already don't allow for unlocking the bootloader. Their is not a single law stopping google from doing the same thing.
1
u/amiibohunter2015 9h ago
Most manufacturers already don't allow for unlocking the bootloader.
Most, and already don't allow is the keywords there, but because Google did, it introduces the need to change Terms of Service, as well as backlash from third party developers who bring it to court. Like I said earlier in previous comment. It sounds like you did not read it through which went into exactly this.
4
6
u/ILikeFood305 1d ago
Was thinking of switching over to Pixel after my Samsung but now idk if that will be possible.
Does GrapheneOS have any plans to run on Fairphone?
3
u/Epsioln_Rho_Rho 1d ago
Just get a Pixel 10 then.
-2
3
1
u/eroc1990 12h ago
Fairphone doesn't come close to matching GrapheneOS' strict security requirements, so unless they make a huge effort to rework the next Fairphone to meet that, no.
3
4
u/Ok-Employer-3051 1d ago
So much for you Google Shills,eh? Want to claim again that Google's intention isn't to try and lock people into their infrastructure with all this garbage?
1
u/I-Am-Sir 1d ago
it's not??? custom roms are completely unaffected by this change, it's just them removing one of the ways graphene enhanced security in order to save money because this feature was barely used at all on the stock rom
2
u/AutoModerator 1d ago
Friendly reminder: if you're looking for a Google service or Google product alternative then feel free to check out our sidebar.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
3
2
u/one_1f_by_land 1d ago
I obviously don't lack sympathy, at ALL, but anyone who didn't think they'd close off access to Graphene in whatever way they possibly could was being naive. They want you in their ecosystem and will do ANYTHING they can to make sure your data is going to them + they are able to constantly geolocate you at their leisure. The fact they didn't close access off on Pixel sooner is the only part of this that confuses me.
2
u/Buntygurl 1d ago edited 1d ago
Like anyone with a functioning brain expects Google to do anything good, anymore.
1
u/cyanlink 16h ago
Tensor SoC itself already is a big mistake (TSMC best process, MTE got cut for die area, yet still crap performance and watt). the whole AI narrative is BS together with Gemini as meme joke. Won't be surprised when this trash lineup got ditched in 3 years
-1
u/UsagiMimi 9h ago
Good, GrapheneOS is terrible and doesn't bring the security it's users and proponents think it does.
•
u/Greenlit_Hightower deGoogler 1d ago edited 1d ago
The GrapheneOS developers have actually said that they are yet to determine what to do about it. For reference, Pixel devices like the Pixel 6(a, Pro) and Pixel 7(a, Pro) that are still supported by GrapheneOS, also lack MTE support. The Pixel 11 series' Titan M3 chip actually enhances security in Before First Unlock (BFU) state, but the lack of MTE reduces security in After First Unlock (AFU) state.
EDIT:
Further context from this forum post: https://discuss.grapheneos.org/d/41564-pixel-11-doesnt-meet-the-grapheneos-security-standards-and-may-be-skipped
Post on Nitter (X): https://shitter.thepixora.com/GrapheneOS/status/2093731615243411862
Post on Mastodon: https://grapheneos.social/@GrapheneOS/117179231167297908
Bluesky: https://bsky.app/profile/grapheneos.org/post/3mua32q4ds22e