GrapheneOS: the private and secure mobile OS
grapheneos.org
GrapheneOS is a security and privacy focused mobile OS with Android app compatibility.

After using LineageOS for long time, I have finally moved to GrapheneOS. I use a lot of banking and financial apps which I never felt comfortable using on LineageOS due to lack of proper sandboxing, unlocked bootloader etc.

GrapheneOS works flawlessly just like Android. You don’t even notice there’s hardening underneath. Also it protects from Google’s evil location tracking using WiFi/Bluetooth or even when the Location is turned off. I don’t understand how people in general are comfortable with Google tracking all the time. You can use Google Play and Play Services in a sandbox that works just like regular installation, but without deep tracking.

If you haven’t tried GrapheneOS, try it. You won’t go back to regular Android.

    • exploder@sopuli.xyz
      2·
      6 months ago

      Yeah, it’s kind of wild and ironic that one of the most private OSes requires a Google phone.

      • curry@programming.dev
        1·
        6 months ago

        My country’s second hand market sucks donkey balls. Import fees are crazy if you even dare to use Amazon instead of cheap Chinese shop. I just wanna scream.

      • Einar@lemm.ee
        1·
        6 months ago

        Doesn’t change that this only runs on Pixel devices. I simply don’t want a Pixel device for various reasons. Used or not, Graphene won’t run officially on a Sony, a Fairphone, etc.

        • Imprint9816@lemmy.dbzer0.comEnglish
          11·
          6 months ago

          If the security benefits of a pixel is less important then the fact Google made it then GOS is simply not meant for you.

          Its silly people complain about it being only compatible for pixels but never seem to blame other android brands for making significantly less secure phones. The responsibility should be put on phone makers to create secure phones that meet GOS requirements, not to expect GOS to make a less secure OS.

          The whole AOSP environment is very Google centric so its pretty weird to think because your not buying a pixel that you are somehow avoiding Google.

          • Einar@lemm.ee
            0·
            6 months ago

            I have more considerations than security, like a headphone jack and other details. But you have my upvote anyways, because you make a lot of sense. I agree with you. 🏅

            • Imprint9816@lemmy.dbzer0.comEnglish
              01·
              6 months ago

              That’s fair, and the reasons why someone buys a phone is a personal choice.

              I would suggest with things like a headphone jack that, while its annoying to buy an adapter (usb-c to headphone) it may be worth the cost vs sacrificing something like hardware security.

              Sadly a lot of the time consumers are forced to choose between security and privacy or convenience.

  • cmhe@lemmy.world
    1·
    6 months ago

    I would like to switch, but there are a couple of points that are still holding me back right now:

    • Charge limits, on LOS I can root the phone, install ACC and still use the OTA updates, if I apply the patch afterwards. (Will be resolved in A15)

    • Option for sandboxed MicroG, IMO privacy is also very important for security, and people should be able to decide if they like more privacy or more security.

    • Option for rooting sandboxed apps from outside. IMO I, and a person, like to have full control over my phone. Trust often comes with control. If I choose to trust one app to have root access to another app in order to inspect it, then this should be possible. Sandboxing could allow one app to have root access to individually chosen other apps, thus limiting the impact compared to system-wide root access. Maybe offer rooting gated behind a separate hardware token authentication. (sudo like) A lot there can be improved IMO, while still providing it and making it more secure in general.

    I know that my understanding of security and privacy might be different from what GrapheneOS understands, but as a long time Linux Admin, I don’t like black boxes, I like to peek into them, modify or patch them, when they do something I don’t want them to do, etc. So that when I enter personal information into them, I am still in control what happens to them, at least that is my desire.

    Taking control away from the user in order to “improve security” might be a valid approach to some, but it is not something I have much trust in.

      • cmhe@lemmy.world
        1·
        6 months ago

        I am currently using a rooted LOS with MicroG. It certainly is not as secure as GrapheneOS in terms of app sandboxing, encryption, regular security updates, etc., but I have control of the system, in case I need it, for instance ACC, F-droid privilege extension (F-Droid auto updates), ReVanced Manager (not using it currently) etc.

        I trust GrapheneOS much more than Apple, but both go into a similar direction with their understanding of security. IMO taking control away from the user might be a good option, if you are dealing with just regular consumers, but I don’t really like the “one-size-fits-all” approach of it. And it is my device, I should be allowed to decide what I want to do with it.

        BTW, this is just a personal annoyance of mine. The GrapheneOS devs do a very good job.

        • thayer@lemmy.caEnglish
          01·
          6 months ago

          You can root GOS like any other Android-based OS. It’s just highly discouraged, completely unsupported and, in the opinion of the GOS devs, you will no longer be considered to be running GOS since you are compromising the core OS by doing so.

          • cmhe@lemmy.world
            0·
            6 months ago

            Exactly right. However all the downsides you have when doing that sort of defeats the purpose. So a GrapheneOS native way to control your device would be nice.

  • atro_city@fedia.io
    0·
    6 months ago

    I just looked it up and GrapheneOS only works on google hardware? So you had to give google some money first or did you get it to work on something else?

    • DavidGarcia@feddit.nl
      1·
      6 months ago

      Yeah the fact that Pixel Phones are the defacto standard for privacy phones is absurd. It’s guaranteed chock full of hardware surveillance tools you can’t remove with custom roms or kernels.

      Outside of the Pixel lineup, custom rom support is almost non-existant in 2024. it’s wild, you can get the same or better hardware for half the price.

    • pHr34kY@lemmy.world
      1·
      6 months ago

      My bank apps all work fine. Just keep your physical bank cards on you because Google Wallet won’t work with credit cards, NFC or transport passes. Your gig tickets and membership cards will load fine though.

      You probably don’t want Google rummaging through your purchase history anyway. I certainly don’t miss it.

  • rikonium@discuss.tchncs.deEnglish
    0·
    6 months ago

    Does RCS work reliably on Graphene? I thought Google was fucking with RCS quietly for those on custom ROMs or other things.