Add Google Pixel section "Security/Privacy"
This commit is contained in:
parent
981e1d536f
commit
89e0ba937f
SSH Key Fingerprint:
SHA256:FtEVfx1CmTKMy40VwZvF4k+3TC+QhCWy+EmPRg50Nnc
210
about.html
210
about.html
@ -1,7 +1,7 @@
|
||||
<!DOCTYPE html>
|
||||
|
||||
<!-- Inferencium - Website - About -->
|
||||
<!-- Version: 6.3.0-alpha.8 -->
|
||||
<!-- Version: 6.3.0-alpha.9 -->
|
||||
|
||||
<!-- Copyright 2022 Jake Winters -->
|
||||
<!-- SPDX-License-Identifier: BSD-3-Clause -->
|
||||
@ -242,97 +242,123 @@
|
||||
Google Pixel
|
||||
</td>
|
||||
<td class="desc">
|
||||
<p>Google Pixel devices are
|
||||
the best Android devices
|
||||
available on the market
|
||||
for
|
||||
<a href="https://security.googleblog.com/2021/10/pixel-6-setting-new-standard-for-mobile.html">security and privacy</a>.</p>
|
||||
<p>They allow locking the
|
||||
bootloader with a
|
||||
<a href="https://android.googlesource.com/platform/external/avb/+/master/README.md#pixel-2-and-later">custom Android Verified Boot (AVB) key</a>
|
||||
in order to preserve security
|
||||
and privacy features when
|
||||
installing a custom operating
|
||||
system, such as
|
||||
<a href="https://source.android.com/docs/security/features/verifiedboot/">verified boot</a>
|
||||
which verifies that the OS has
|
||||
not been corrupted or tampered
|
||||
with, and
|
||||
<a href="https://source.android.com/docs/security/features/verifiedboot/verified-boot#rollback-protection">rollback protection</a>
|
||||
which prevents an adversary from
|
||||
rolling back the OS or firmware
|
||||
version to a previous version
|
||||
with known security vulnerabilities.</p>
|
||||
<p>They also include a
|
||||
<a href="https://developer.android.com/training/articles/keystore#HardwareSecurityModule">hardware security module</a>
|
||||
(Titan M2, improving on the
|
||||
previous generation
|
||||
<a href="https://security.googleblog.com/2018/10/building-titan-better-security-through.html">Titan M</a>)
|
||||
which is extremely resistant to
|
||||
both remote and physical attacks
|
||||
due to being completely isolated
|
||||
from the rest of the system,
|
||||
including the operating system.
|
||||
Titan M2 ensures that the device
|
||||
cannot be remotely compromised
|
||||
by requiring the side buttons of
|
||||
the device to be physically
|
||||
pressed for some sensitive
|
||||
operations. Titan M2 also takes
|
||||
the role of
|
||||
<a href="https://source.android.com/docs/security/best-practices/hardware#strongbox-keymaster">Android StrongBox Keymaster</a>,
|
||||
a
|
||||
<a href="https://source.android.com/docs/security/features/keystore">hardware-backed Keystore</a>
|
||||
containing sensitive user keys
|
||||
which are unavailable to the OS
|
||||
or apps running on it without
|
||||
authorisation from Titan M2 itself.
|
||||
<a href="https://android-developers.googleblog.com/2018/05/insider-attack-resistance.html">Insider attack resistance</a>
|
||||
ensures that Titan M2 firmware
|
||||
can be flashed only if the user
|
||||
PIN/password is already known,
|
||||
making it impossible to backdoor
|
||||
the device without already
|
||||
knowing these secrets.</p>
|
||||
<p>Google Pixel device kernels
|
||||
are compiled with
|
||||
<a href="https://android-developers.googleblog.com/2018/10/control-flow-integrity-in-android-kernel.html">forward-edge control-flow integrity</a>
|
||||
and
|
||||
<a href="https://security.googleblog.com/2019/10/protecting-against-code-reuse-in-linux_30.html">backward-edge control-flow integrity</a>
|
||||
to prevent code reuse attacks
|
||||
against the kernel. MAC address
|
||||
randomisation is
|
||||
<a href="https://android-developers.googleblog.com/2017/04/changes-to-device-identifiers-in.html">implemented well, along with minimal probe requests and randomised initial sequence numbers</a>.</p>
|
||||
<p>Google releases
|
||||
<a href="https://source.android.com/docs/security/bulletin/pixel/">guaranteed monthly security updates</a>,
|
||||
ensuring Google Pixel devices
|
||||
are up-to-date and quickly
|
||||
protected against security
|
||||
vulnerabilities.</p>
|
||||
<p>Pixel 6-series and 7-series
|
||||
devices are a large improvement
|
||||
over the already very secure and
|
||||
private previous generation
|
||||
Pixel devices. They replace
|
||||
ARM-based Titan M with
|
||||
RISC-V-based Titan M2, reducing
|
||||
trust by removing ARM from the
|
||||
equation. Titan M2 is more
|
||||
resiliant to attacks than Titan
|
||||
M, and is
|
||||
<a href="https://www.tuv-nederland.nl/assets/files/cerfiticaten/2022/09/nscib-cc-22-0228971-cert-final.pdf">AVA_VAN.5 certified</a>,
|
||||
the highest level of
|
||||
vulnerability assessment.
|
||||
Google's in-house Tensor
|
||||
System-on-Chip includes Tensor
|
||||
Security Core, further improving
|
||||
device security.<br>
|
||||
Pixel 8-series includes Armv9's
|
||||
<a href="https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/enhanced-security-through-mte">Memory Tagging Extension</a>,
|
||||
which dramatically increases
|
||||
device security by eliminating
|
||||
up to 95% of all security issues
|
||||
caused by memory-unsafety.</p>
|
||||
<h5>Security/Privacy</h5>
|
||||
<p>Google Pixel devices
|
||||
are the best Android
|
||||
devices available on the
|
||||
market for
|
||||
<a href="https://security.googleblog.com/2021/10/pixel-6-setting-new-standard-for-mobile.html">security and privacy</a>.</p>
|
||||
<p>They allow locking
|
||||
the bootloader with a
|
||||
<a href="https://android.googlesource.com/platform/external/avb/+/master/README.md#pixel-2-and-later">custom Android Verified Boot (AVB) key</a>
|
||||
in order to preserve
|
||||
security and privacy
|
||||
features when installing
|
||||
a custom operating
|
||||
system, such as
|
||||
<a href="https://source.android.com/docs/security/features/verifiedboot/">verified boot</a>
|
||||
which verifies that the
|
||||
OS has not been
|
||||
corrupted or tampered
|
||||
with, and
|
||||
<a href="https://source.android.com/docs/security/features/verifiedboot/verified-boot#rollback-protection">rollback protection</a>
|
||||
which prevents an
|
||||
adversary from rolling
|
||||
back the OS or firmware
|
||||
version to a previous
|
||||
version with known
|
||||
security vulnerabilities.</p>
|
||||
<p>They also include a
|
||||
<a href="https://developer.android.com/training/articles/keystore#HardwareSecurityModule">hardware security module</a>
|
||||
(Titan M2, improving on
|
||||
the previous generation
|
||||
<a href="https://security.googleblog.com/2018/10/building-titan-better-security-through.html">Titan M</a>)
|
||||
which is extremely
|
||||
resistant to both remote
|
||||
and physical attacks due
|
||||
to being completely
|
||||
isolated from the rest
|
||||
of the system, including
|
||||
the operating system.
|
||||
Titan M2 ensures that
|
||||
the device cannot be
|
||||
remotely compromised by
|
||||
requiring the side
|
||||
buttons of the device to
|
||||
be physically pressed
|
||||
for some sensitive
|
||||
operations. Titan M2
|
||||
also takes the role of
|
||||
<a href="https://source.android.com/docs/security/best-practices/hardware#strongbox-keymaster">Android StrongBox Keymaster</a>,
|
||||
a
|
||||
<a href="https://source.android.com/docs/security/features/keystore">hardware-backed Keystore</a>
|
||||
containing sensitive
|
||||
user keys which are
|
||||
unavailable to the OS or
|
||||
apps running on it
|
||||
without authorisation
|
||||
from Titan M2 itself.
|
||||
<a href="https://android-developers.googleblog.com/2018/05/insider-attack-resistance.html">Insider attack resistance</a>
|
||||
ensures that Titan M2
|
||||
firmware can be flashed
|
||||
only if the user
|
||||
PIN/password is already
|
||||
known, making it
|
||||
impossible to backdoor
|
||||
the device without
|
||||
already knowing these
|
||||
secrets.</p>
|
||||
<p>Google Pixel device
|
||||
kernels are compiled
|
||||
with
|
||||
<a href="https://android-developers.googleblog.com/2018/10/control-flow-integrity-in-android-kernel.html">forward-edge control-flow integrity</a>
|
||||
and
|
||||
<a href="https://security.googleblog.com/2019/10/protecting-against-code-reuse-in-linux_30.html">backward-edge control-flow integrity</a>
|
||||
to prevent code reuse
|
||||
attacks against the
|
||||
kernel. MAC address
|
||||
randomisation is
|
||||
<a href="https://android-developers.googleblog.com/2017/04/changes-to-device-identifiers-in.html">implemented well, along with minimal probe requests and randomised initial sequence numbers</a>.</p>
|
||||
<p>Google releases
|
||||
<a href="https://source.android.com/docs/security/bulletin/pixel/">guaranteed monthly security updates</a>,
|
||||
ensuring Google Pixel
|
||||
devices are up-to-date
|
||||
and quickly protected
|
||||
against security
|
||||
vulnerabilities.</p>
|
||||
<p>Pixel 6-series and
|
||||
7-series devices are a
|
||||
large improvement over
|
||||
the already very secure
|
||||
and private previous
|
||||
generation Pixel
|
||||
devices. They replace
|
||||
ARM-based Titan M with
|
||||
RISC-V-based Titan M2,
|
||||
reducing trust by
|
||||
removing ARM from the
|
||||
equation. Titan M2 is
|
||||
more resiliant to
|
||||
attacks than Titan M,
|
||||
and is
|
||||
<a href="https://www.tuv-nederland.nl/assets/files/cerfiticaten/2022/09/nscib-cc-22-0228971-cert-final.pdf">AVA_VAN.5 certified</a>,
|
||||
the highest level of
|
||||
vulnerability
|
||||
assessment. Google's
|
||||
in-house Tensor
|
||||
System-on-Chip includes
|
||||
Tensor Security Core,
|
||||
further improving device
|
||||
security.</p>
|
||||
<p>Pixel 8-series
|
||||
includes Armv9's
|
||||
<a href="https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/enhanced-security-through-mte">Memory Tagging Extension</a>,
|
||||
which dramatically
|
||||
increases device
|
||||
security by eliminating
|
||||
up to 95% of all
|
||||
security issues caused
|
||||
by memory-unsafety.</p>
|
||||
<h5>Support</h5>
|
||||
<p>Pixel 4a (5G), Pixel
|
||||
5, and Pixel 5a, are
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user