Google's new phone is alleged to be "insecure", but there may be hidden difficulties behind it.

If you attach great importance to device security and personal privacy protection, you have most likely heard of the reputation of "GrapheneOS".

So how secure is GrapheneOS? To put it simply, it allows users to independently control the permissions of every App on their phone, and turn on or off every sensor on the phone separately. Most importantly, thanks to its unique mechanism design, GrapheneOS can render some of the most notorious spyware (NSO Pegasus, Predator) almost impossible to function.

That's why when the GrapheneOS team announced that they would not provide adaptation support for Google's newly released Pixel 11 series devices, it was essentially a public accusation that these models are "insecure".

Are the new Pixel 11 series devices insecure? The answer is yes

Why did GrapheneOS refuse to adapt the new Pixel 11 series? The reason is that Google removed a hardware security mechanism called MTE from the Tensor G6 processor used in the Pixel 11 series, and MTE happens to be the core functional selling point of GrapheneOS. Without it, the biggest advantage of this system no longer exists.

So what is MTE? Its full name is "Memory Tagging Extension", a hardware security mechanism introduced by ARM starting from the ARM V8.5-A instruction set.

To put it simply, the reason why some spyware can silently obtain the target phone's permissions is that they can induce the CPU to access wrong memory addresses, thus triggering specific program bugs.

MTE will add a "Tag" to all memory addresses, and every time the CPU finishes executing an instruction and is about to write to the memory, it will check whether the tag of the memory address to be written is correct. If a mismatch is detected, it will forcibly terminate the current instruction. Obviously, it can effectively strengthen the memory security of the device and prevent some malicious software from succeeding.

Ironically, Google was actually the first manufacturer to promote MTE in the Android ecosystem. Back in the Pixel 8 era, they had already introduced the MTE mechanism in their self-developed Tensor G3 processor, and the subsequent Tensor G4 and G5 also included this design.

Exposed internal documents show that MTE was originally supposed to be a high-priority feature of the Tensor G6

Even some recently exposed materials show that the Tensor G6 processor of the Pixel 11 series did list MTE as a high-priority feature in the design stage, but the feature was later removed. This led to the current situation where GrapheneOS publicly criticized these devices as "not secure enough".

Why did Google remove MTE? It not only cuts costs but also improves performance

Then why did Google remove the MTE security feature that it had adhered to for several generations from the Tensor G6?

A research paper involving Google internal staff states that after MTE is enabled, every 16 bytes of memory requires an additional 4 bits (that is, 0.5 bytes) of space to store the memory address tag information required by MTE.

MTE will slightly increase memory consumption, but the proportion is very low

In other words, after enabling this feature, users will lose about 3.25% of available memory space. Since this proportion is extremely small, relevant research believes that it is very unlikely that Google deliberately removed the MTE feature in chip design just to save memory.

The more likely reasons lie in two aspects. First, removing MTE can effectively simplify the chip design itself, because MTE requires special memory controller wiring and a separate high-reliability hardware random number generator in the chip. Removing these designs can reduce chip manufacturing costs to a certain extent while hardly affecting other functions.

Enabling MTE on Tensor G3 will cause serious performance impact

More importantly, some test results show that on certain CPUs, enabling MTE will bring a severe performance penalty. This is because MTE requires the CPU to complete security checks before every memory write, which may lead to significant latency. In some specific tests, enabling MTE even caused a performance loss of more than 80%.

Apple has also added a security mechanism similar to MTE in the A19 series and M5 series processors

But please note that we have emphasized "certain CPUs". Because Google is not the only player in the industry that has insisted on using MTE in the past, ARM server chip manufacturer Ampere, as well as the well-known Apple, have also included dedicated MTE circuits in their recent generations of chips. Tests on these chips show that after enabling MTE, the performance loss is less than 5% in most cases.

It can be seen that although Google removed MTE probably to make its own processor faster, this may instead indicate its insufficient capability in chip design.

You might think this is the end? There may be hidden reasons behind it

Although it must be admitted that Google's removal of the MTE feature in the Tensor G6 does make the Pixel 11 series devices less secure than their predecessors. Moreover, when competitors can integrate MTE into their chips with little impact on performance, Google's development team being unable to do so may indicate that their capability is "not good enough".

However, Google's choice to abandon the MTE feature may not be entirely because they are chasing that tiny cost saving and performance improvement, but may be related to the deep-seated controversy caused by this security protection feature.

Although MTE can indeed make devices more secure and prevent specific memory vulnerabilities from being exploited, please note that it cannot defend against most viruses, nor can it prevent all malicious software from prying into users' privacy.

This is because most mobile viruses and malicious software are not that "advanced", and most of them need to trick users into performing specific operations (such as manually granting high-risk permissions, or clicking on an option that should not be clicked) to exert their destructive power.

The MTE technology is actually targeted at weapon-grade surveillance and theft tools (the picture shows the well-known spyware company NSO)

What MTE can really block are those more hidden and more advanced spy and surveillance programs. These programs have no icons and do not rely on user misoperation to function. They can completely silently monitor users and steal their personal privacy, so they are more destructive than conventional viruses and malicious software.

Most importantly, these "advanced spy programs" are extremely expensive, most hackers cannot afford them at all, and such programs are basically impossible to be used against ordinary users. In some cases, such spy programs are used by law enforcement agencies to track the most heinous criminals as an auxiliary means of secretly collecting evidence.

If you have read some related news before, you may still remember such a rumor. Border inspection personnel in some places will "pay extra attention" to people using devices from the Pixel 8 to Pixel 10 series, because they assume that these phones are flashed with GrapheneOS, the purpose of which is to get rid of this kind of hidden surveillance.

moto has announced its cooperation with GrapheneOS

Since such things have already happened, you can imagine whether Google, as a device manufacturer, has received other "pressures". While some may say that Google's technology is still not good enough, or at least not as tough as Apple (all new models are built with MTE-like technology) and moto (they are about to launch devices equipped with GrapheneOS), no one except Google itself knows what kind of game is playing out behind the scenes.

This article is from the WeChat Official Account "SanYi Life" (ID: IT-3eLife), written by SanYiJun, and published by 36Kr with authorization.