"Your device does not support hardware aes, so it is easier to track you at the network level."

[BlueMax]

Hallo,
this message comes up every now and then and is kinda annoying. How can i disable that?
Your device does not support hardware aes, so it is easier to track you at the network level.

v119.0.6045.160
arm-v7

[uazo]

that's weird. what's your device?

[BlueMax]

Samsung S4-LTE (GT-9506)
LOS 18.1 (Android 11)

[uazo]

that patch verifies the presence of hardware encryption support in the cpu (Qualcomm MSM8974 Snapdragon 800) and it appears that yours does not support it. according to wikipedia it appears to be supported with the qualcomm 805.
my advice is to change the device, there is nothing on the software side that can fix it, and there are very few devices like yours
more info https://bugs.chromium.org/p/boringssl/issues/detail?id=579

How can i disable that?

you can remove the message with chrome://flags#no-hw-aes-warning

[BlueMax]

Great. Thanks!

[SkewedZeppelin]

@uazo
that is quite interesting!

but indeed as you mention can't do much about it
I recommend a Google Pixel 6a/7a/8a to those who need a new phone as they have long support and they have many ROMs available for them for choice

edit: test results

• does has aes instruction:
  • Tensor G1 / GS101 / 2021
  • Snapdragon 835 / MSM8998 / 2017
  • Snapdragon 820 / MSM8996 / 2015+2016
  • Snapdragon 808 / MSM8992 / 2014
• does not have aes instruction:
  • Snapdragon 800 / MSM8974 / 2013+2014
  • Snapdragon 617 / MSM8952 / 2015
  • Snapdragon S4 Pro / APQ8064 / 2012
  • TI OMAP4460 / 2011

[kilou]

the flag is under chrome://flags/cromite but I do not recommend using that device.

cc @SkewedZeppelin

Thanks, I could indeed find it under flags/cromite. I understand you don't recommend using that device but is it for privacy and/or security reasons? I'm mostly concerned about security and less about privacy. The reason I'm running DivestOS is that it's the only custom ROM that still provides security patches for my device. Is the lack of hardware AES support a security problem (phishing, malware etc) or is it only a potential privacy issue? By the way, what is the purpose of hardware AES support? I can find tons of articles about android encryption but that does not seem to be related (by the way, my phone is encrypted...). Could you provide an example of how the lack of AES hardware support could be problematic? thanks!

EDIT: by the way, would any vulnerability linked to a lack of hardware AES be alleviated by using a VPN?

[SkewedZeppelin]

This isn't a security issue.

Basically when you want to establish an TLS connection to an HTTPS website the server and client each say what the support.
Software AES is advertised differently between them than hardware AES.
So the server could use that as a metric, combined with other metrics, in order to better track your person/device.

Hardware AES is better than software AES because all/most implementations guarantee constant time which is important.

[uazo]

yes, that is how SkewedZeppelin writes, it is not a security bug but a privacy issue.

BoringSSL, the library used in Chromium for SSL connections, changes the order of the encryption protocols if it does not detect any hw capable of handling them, due to performance issues.
Since the ordered list is presented at the connection endpoint, it can be detected simply by making you different from other cromite.

be alleviated by using a VPN

No.
EDIT: Maybe a proxy

[kilou]

Thanks to both of you @SkewedZeppelin and @uazo for your explanations! As this is not a security issue, then I'm mostly fine with it (I guess). I'll probably move at some point to e.g. a Pixel 8a but then I'd use GrapheneOS instead of DivestOS. I'm currently having a pleasant experience with DivestOS (and Cromite) on my old Galaxy S5 so I'm kind a relunctant to get a new smartphone :) Thanks for your help on this issue and all the great work with your respective projects!