GrapheneOS Users Flagged and Reported by Yoti Age Verification

Yoti Reports GrapheneOS Usage to Authorities

Age verification service Yoti has reportedly implemented a system that automatically flags devices running GrapheneOS and reports these instances to both its internal security team and law enforcement authorities. This revelation surfaced via a user support experience shared on Reddit and the GrapheneOS discussion forums, where a user attempting to verify their identity was informed that their device was flagged due to the operating system in use.

According to the reported communication from Yoti:

"Yoti automatically flags [...] any devices running GrapheneOS. These instances are automatically reported both to the authorities and our security team."

This practice suggests that the use of a privacy-hardened operating system is being treated as a signal of suspicious activity by identity verification providers, potentially creating a "heatscore" for users who prioritize digital privacy.

How GrapheneOS is Detected

Apps can identify that they are running on GrapheneOS through several technical mechanisms, despite the OS's focus on privacy. Because GrapheneOS implements extensive exploit mitigations and hardening features not found in stock Android, these unique characteristics can be used as side channels for fingerprinting.

Specifically, detection occurs through:

• Hardware Attestation API: Apps can request a hardware attestation and match the verifiedBootKey against known GrapheneOS boot keys.
• Security Feature Fingerprinting: The presence of specific hardening features, such as secure exec spawning, allows apps to differentiate GrapheneOS from other Android distributions.

Privacy Implications and User Risks

The reporting of GrapheneOS usage to authorities raises significant concerns regarding the intersection of privacy tools and legal scrutiny. A critical point of failure highlighted by community members is the risk of "de-anonymization." If a user provides sensitive identity documents (such as a passport or ID) to a service that simultaneously flags their OS as suspicious, the service effectively links the user's real-world identity to their use of privacy-preserving software.

Furthermore, Yoti's history with data protection has been noted by critics. The company was recently fined €950,000 by the Spanish privacy regulator (AEPD) for unlawful processing of biometric personal data, obtaining invalid consent, and exceeding data retention periods in violation of the GDPR.

Community Recommendations for Identity Verification

In response to these flagging practices, privacy advocates and GrapheneOS users suggest a "segmented device strategy" to avoid linking private identities with privacy-hardened hardware:

• Dedicated Verification Device: Use a separate, inexpensive device running stock Android for government apps, age verification, and other mandatory identity checks.
• Data Isolation: Ensure the verification device contains no personal contacts, private emails, or messaging apps.
• Avoid High-Risk Links: Avoid using a GrapheneOS device to "legitimate" oneself to services that may employ hostile fingerprinting techniques.

Counterpoints and Skepticism

Some observers have expressed skepticism regarding the authenticity of the report or the severity of the threat:

• Boilerplate Language: Some argue that the "reported to authorities" claim may be standard boilerplate text used to deter users rather than a reflection of actual law enforcement reporting.
• Context of Use: Analysis of the original Reddit thread suggests the user may have made multiple failed verification attempts, which may have triggered the flag rather than the mere presence of GrapheneOS alone.
• Verification of Claims: Critics note that the source is based on screenshots of text from a Reddit post rather than a verified journalistic report, leaving room for the possibility of edited images or misinterpreted support communications.