Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"In its latest release, GrapheneOS says it has "disable[d] registerQuicConnectionClosePayload optimization to fix VPN leak," effectively neutralizing the attack vector on supported Pixel devices."

"GrapheneOS responded by disabling the underlying optimization entirely in release 2026050400."

GrapheneOS "fixed" the leak by disabling the optimisation

Some HN commenters in the past have praised QUIC and downvoted comments that questioned who QUIC stands to benefit the most

Using QUIC may serve the interests of others but for me the tradeoffs are not worth it; I block QUIC traffic

QUIC is sometimes on by default in software distributed by Google, like Android, and in some cases there is no option to disable it



QUIC still works fine on GrapheneOS. GrapheneOS only removed a way to ask the OS to close a QUIC connection automatically in case the app dies, etc. It's an optimization from a server perspective since it avoids the server thinking the connections are still open and keeping resources assigned to them until the idle timeout it has configured followed by having to go through a connection shutdown process. It's not an optimization from a client perspective.

GrapheneOS also has fixes for around 5 other VPN leaks and more fixes on the way. Android currently implements VPNs in a way that's prone to leaks due to VPNs being per-profile but profiles not using their own network namespaces yet and also depending on central services for the DNS resolver and various other things which have to properly handle VPN support. We have plans to improve the VPN architecture in the future to make it very resistant to leaks. There will also be support for running apps or groups of apps in VMs which can have even stronger protection against it.


This is the path for the graceful closing on the QUIC connection via (IMO) illegitimate/exploitative call, GOS is not disabling QUIC as a whole.

QUIC as it is is brilliant, and this is not a feature of the protocol, it's a feature of the surveillance OS (Google's Android).

Other than that I checked on the OS before the latest release, and it didn't work anyway.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: