Click to enlarge

For anyone serious about de-Googling their life, you need to know about this. I've seen privacy concerned people overlook a crucial step in the GrapheneOS installation process that creates a direct link to Google.

The Step: On a Google Pixel, before you can unlock the bootloader, you must enable "OEM unlocking" in the Developer Options. The moment you toggle that setting, your phone makes a network request to Google's servers. Google receives that request and can see your IP address.

If you're doing this from your home network, an IP tied to your name, you've just created a digital fingerprint linking you (and your location) to that specific device's serial number before you even wiped it. Google now knows that
1) the person at your IP address is in possession of that specific Pixel phone, and
2) that you intended to modify its software!!!

How to Mitigate:
Use a trustworthy VPN, or preferably, public Wi-Fi (like a café) that is not associated with you.

When Bitcoin undergoes a hard fork, holders suddenly possess coins on two separate blockchains: the original Bitcoin and the new forked coin. While it may seem like free money to sell the new, less valuable forked coins, doing so without proper safeguards can lead to the accidental loss of your original Bitcoin due to a vulnerability known as a replay attack.

What Is a Replay Attack?

A replay attack occurs because, immediately after a fork, both blockchains share the same transaction history and address formats. When you create a transaction to sell your forked coins, you sign it with your private key. The critical issue is that this signed transaction is mathematically valid on both chains if no specific differences exist between them.

If you broadcast a transaction to send your forked coins to a buyer, a malicious actor (or even the buyer themselves) can take that exact same digital signature and "replay" it on the original Bitcoin network. Since the signature is valid and the transaction format is identical, the original network accepts it, transferring your valuable original Bitcoin to the buyer as well. You effectively sell one coin but lose both.

Many users mistakenly believe they can remove the risk by "tainting" their coins with a small transaction or moving funds to a new wallet first. These methods do not work because the protective transaction itself can be replayed, leaving your Bitcoin linked and vulnerable on both chains. The only true defense is replay protection, a technical marker that developers must build into the forked coin's code to make its transactions invalid on the original network.

How to Stay Safe

Since you cannot add this protection yourself, your safety depends entirely on the fork's developers. Before attempting to sell or move any forked coins, you must verify that strong replay protection is active. If the developers have not implemented this feature, the only secure strategy is to do nothing. Holding both coins without transacting eliminates the risk of accidental loss, ensuring your original Bitcoin remains safe.

Technical Details

In progress...