Oh you're using a prepaid SIM?

In reality almost all of the Graphene OS features are either built into AOSP or are easy to implement via an app from F-droid

Straight up misinformation

If you're only sending text messages (no voice memos, stickers, photos or videos), you're data plan should never be an issue when using Signal.

rcs only works on unrooted stock google-certified android with a locked bootloader

Uh no? It literally works on GrapheneOS. https://grapheneos.org/usage#rcs

I think you're confusing this with Google Pay, which only works on Google-certified systems.

Ungoogled Chromium works fine too

No, you need a browser that supports WebUSB

give the sandboxed website access to one specific USB device

That is exactly how it works. You get a prompt like this you have to chose a device, and only then does a website get access to it via WebUSB.

,

(From the documentation: https://developer.chrome.com/docs/capabilities/usb)

You can also disable WebUSB permission requests globally in Chromium:

Would use it for piracy, not if you need good privacy. It's good enough to avoid a complaint letter from your ISP when torrenting, but can you be sure that they don't sell your data to advertisers? I don't know. Will they respond to a law enforcement subpoena? Probably.

Outlook.

Thankfully Thunderbird, although most folks here just use the Roundcube web client.

With a giant signature that includes an embedded image.

They are auto-generated and enabled for everyone. Typical corporate bullshit I guess.

Also the image is a 2400px image that has been resized using width and height attributes.

It's a portrait (that thankfully has been downsized and compressed so much, that it's barely recognizable (thank goodness, because it's a horrific photo)), as well as a photo of my physical signature. Oh god do I hate emails and email signatures. And fuck my company for wanting emails to look "authentic" and including this stupid ass signature.

This is beautiful. I'ma send this to my coworkers.

That rate limiting can easily be bypassed by an attacker. In order to be effective, the rate limit needs to be enforced by tamper-resistant hardware, i.e. a secure element. Here are some of the requirements for a secure element: https://developer.android.com/privacy-and-security/keystore#StrongBoxKeyMint

An implementation of StrongBox KeyMint must contain the following:

Its own CPU
Secure storage
A true random-number generator
Additional mechanisms to resist package tampering and unauthorized sideloading of apps
A secure timer
A reboot notification pin (or equivalent), like general-purpose input/output (GPIO)

For details, I recommend reading:

• https://grapheneos.org/faq#encryption
• https://blog.quarkslab.com/android-data-encryption-in-depth.html

Only devices with a proper implementation of a secure element (Titan M2, i.e. Pixel 6 or later, or the Apple SEP, i.e. iPhone 12 or later) are actually resistant to brute-force attacks by forensic data extraction tools, such as Cellebrite or GrayKey. GrapheneOS has obtained some internal documents from multiple forensics companies. They published the Cellebrite docs at https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation

Specifically, I recommend looking at this chart:

It clearly shows that data cannot be extracted from iPhones with the SEP, unless the device is in the AFU state, meaning that the encryption keys are kept in memory.

Those are the charts for Pixels:

Certainly not