Thought on Graphene?
Hello, making this post to get some honest, and technical opinions about GrapheneOS. Please do not be bother by this question. No drama here pls 🙏. I've heard that there is some of the google code into the "sandbox" feature. Say your opinion below! 👇👇
I have been using GrapheneOS on a Pixel 7 Pro for 3 months now. I am BLOWN AWAY at how good it is. I have 3 user profiles. Main profile has no google services at all, and 95% of my apps are running there. Then I have a second user I can switch to that has sandboxed google services and my banking apps on it. I then have a third user that also has sandboxed google services running where I can install any random app that demands google services. (I have only 1 app on that user) . So 99.9% of the time my phone is running with no google services at all. (Side note: without even the sandboxed google services installed, apps need to be left open in the app switcher in order to receive notifications. If you swipe all your apps away, then you won't receive notifications. This is not a problem for me, as I just keep my messaging apps open in the app switcher. But if it is a problem for you, you would need to run the sandboxed google services).
I see GrapheneOS as a way of removing 99% of all the tracking, spyware and things that I dont like, while still having the convenience of having all the apps and features that are available on a regular smartphone.
There is a learning curve, and many settings to learn and customize. But definitely worth it.
To get a Pixel, instead of paying £900 for a new pixel 8 pro, I paid £300 for a second hand Pixel 7 Pro on eBay that was in perfect condition. So for £300 I now have a privacy phone and an AMAZING camera, which was very important for me the camera.
if you have a pixel theres absolutely no reason why you shouldnt use it.
Plenty reasons to not use it on a pixel...I had horrible compatibility with all sorts of banking apps, government 2FA and traffic warning systems, to the point where they just couldn't work at all. Their sandboxed play services breaks a shitload of day to day convenience and even necessities to increase privacy.
GrapheneOS has something in store for everyone. The fully de-googled setup by the common definition a lot of people strive for is a fully supported configuration, it comes that way out of the box in fact, making zero connections to Google - unlike many other operating systems. But you can also transform it into a more "regular" phone by installing Google Play and all the bells and whistles and enjoy the benefits while still feeling save, thanks to the app sandbox applying to it. So you can take away its permissions and feel rest assured it can't snoop on you even if it wanted to. Or you take a middleground somewhere inbetween if that's your cup of tea; functionality is an important factor for many, and there's little you need to sacrifice.
Thats good to know. Thanks for sharing
Did you try reading through the FAQ?
No and now I've answers to a lot of my questions
Its always better to try and get firsthand knowledge through the FAQ then rely on, possibly inaccurate, Lemmy users. I would also seek answers on their official forum over Lemmy as well.
It's a middleground between a regular stock spyware ROM and a degoogled one with pretty good security thanks to lockable bootloader.
P. S. I can hear the drama coming unfortunately. This ROM's devs have haters.
I've seen that you basically have two choice (more but not very relevant) GrapheneOS for security and /e/OS for privacy. Thoughts on it?
DivestOS is the most thoroughly degoogled of the android ROMs (it removes the most proprietary binary blobs). DivestOS is also decently security hardened, better security hardening than any other Android ROM other than GrapheneOS. But since it removes more of these proprietary blobs, it further reduces the attack surface of the ROM. Both GOS and DivestOS are good options. As commented by another user, /e/OS falls behind on security updates often, which is quite bad for a security or privacy focused OS.
/e/OS is not for privacy but more for anonymization. It has a built in VPN and a ton of spoofing stuff afaik. It's closer to Qubes if you ask me. And I heard it had proprietary software so ehh it's made to make you look like the most average internet user so you can search anonymously. I don't have enough information about this ROM but I wouldn't use it on my main device.
E often falls behind on patch levels, see the page here https://divestos.org/pages/patch_history
There's a lot of false information in your statements, GrapheneOS is not spyware, and it does a better job at degoogling than any other ROM mentioned in this thread, the only one that comes close is DivestOS, and no eOS is NOT like Qubes...
GOS wanted to reduce the attack surface as much as possible so they removed all the unecessary Bloat, it doesn't even ship with wallpapers !!
This list is not exhaustive and covers a tiny bit of the differences between these custom ROMs but it's a good place to start
I've been using GrapheneOS for over a year. I cannot complain about it, it works as advertised and it does it the best way possible. However, here's the list of things I find annoying/missing. Keep in mind, this is a subjective list.
Not much to comment on the technical side, but quite a bit of things get upstreamed or reported from GrapheneOS. I believe they really know what they're doing. You can ignore the rest if you don't care for the general opinion.
Yes, there's probably Google code in the sandbox feature, it's basically the stock Android userland app sandbox. The magic is the compatibility layer that allows Google apps to run as regular userland apps.
Louis Rossman got threatened by the GrapheneOS dev
And is GrapheneOS Dev threatened by Louis Rossman?
No the dev is very sensitive to criticism https://www.youtube.com/watch?v=4To-F6W1NT0
I used it for quite a while, but with most of the Google apps. One morning RCS chat stopped working and would not reconnect, since I use RCS for texting most people I'm back on stock for now. I know it's not graphenes fault, but I didn't want to have to keep dealing with Google randomly disabling stuff. Up until then, everything worked as it was described
FYI, there's a workaround for RCS in the graphene forums. Graphene changed some defaults to block IMEI reading (a hidden permission), which RCS needs in order to activate...
https://discuss.grapheneos.org/d/1353-using-rcs-with-google-messages-on-grapheneos/308
That should take you to the post that worked for me.
Will look into it, thank you!
There's also CalyxOS, low drama and very reliable. Https://www.calyxos.org
Can it run problem bank apps? I need a bank auth app for work as the bank stopped fobs and it just would not run on LineageOS. It refused to run because "the phone is insecure". I tried Magisk hiding stuff and MicroG, and a number of way of tricking methods. That's why I ended up on GrapheneOS, as a compromise without feeling too compromised. Everything seams to think it's on a normal Android phone, but I've sandboxed the Google tentacles. But it would be better if mandating OS wasn't allowed. If I want to run a "insecure" phone, that's my "problem".
Agreed, it shouldn't be their problem. But, I am using applications just fine that are sensitive to root, even device attestation, but I don't recommend attestation just out of principle.
Even pokemon go seem to run ok with just micro g and aurora.
Calyx is unfortunately pretty slow to release security patches, uses privileged apps with root access like microG and the F-Droid privileged extension by default and doesn't really provide any unique features. All of the privacy features of Calyx are either already present or can be easily replicated in a better form on GrapheneOS. Take Datura Firewall, it's yet another privileged app with root access which adds unnecessary attack surface, and is less secure than the Graphene equivalent. GrapheneOS implements a network permission toggle, which is embedded in Android's native permission manager and uses the INTERNET permission to restrict network access. It disables both direct and indirect network access, including the local device network (localhost). GrapheneOS also has a bunch of unique security features, that can't be found on any other Android ROM, like for example a hardened memory allocator, hardened kernel, secure app spawning, improved SELInux policies, Duress PIN/Password, driver-level USB-C control, Storage Scopes, Contact Scopes and soon App Communication Scopes. GrapheneOS also includes Sandboxed Google Play services, a better GMS implementation than microG, which doesn't require root and has better app compatibility.
All your points are true, yet still depend on Google in sandboxed form. That negates everything else for me, who wants a reasonably secure device that works out of the box and also respects my privacy.
If a nation-state wants into my phone, it's delusional to believe even graphene can hold them off, you need real opsec for that, and unfortunately all I've seen thus far from graphene guys is cosplaying that the NSA wants your porn selfies.
Graphene and micro g? Cool. Sandboxed Google? Nope.
@RubberElectrons @privacy @foremanguy92
I've been using CalyxOS for a year now and I like it so much. I also tried GrapheneOS but I consider that sandboxed apps are harder to manage than microG in Calyx. I chose simplicity.
Its all google code what are you talking about.
I assume they mean proprietary code blobs.
I like it
I don't trust the google kernel when it comes to privacy or security. You think with how many people use Android and with how bad actors Google are they wouldn't put a backdoor somewhere?
its open source and well audited, so no I don't think they have it backdoored. they get all the info they want from people using google play services at a privileged level, running chrome, and using their other dozen services that come bundled with stock android
Unless you want to tell me that the Android kernel is the first OS kernel without bugs, it takes at the very least one bug to be left intentionally unfixed and shared with the feds to introduce a backdoor. I wouldn't consider it infeasible with how large the android kernel is, and how high a barrier of entry kernel dev is. If the bug is found, just move to the next one. Normally I wouldn't be so paranoid, but this is Google we're dealing with, on one of, if not the most popular kernels on the planet.
Right
Ask me when the NSA knocks at your door, what I think about it? I think it's a big honeypot.
Think about it, if you were the NSA or the CIA would you push a privacy oriented OS? Honeypot vibes get stronger
Toxic culture run by someone who is questionable at best. Honestly I don't see a need for it. It is certainly not the only option.
Not the only one but its factually the best one. Questionable to me is your expertise on this topic when you deter people from using the best option, based on your unrelated, subjective, non-technical views.
There isn't a factual"best" one as peoples needs vary completely. That's why I say the Graphene community is toxic. They are convinced that there is only one way to do things.
Graphene is useless to me because I have no need or want for a Pixel or even a new phone. How can it be the "best" for me if I can't even use it? As it turns out there is no right answer. It might work for you but that doesn't make it the best for everyone.
Can you elaborate on that? What do you mean?
The person you are referring to did actually step down as lead developer.. Best to be more informed before making claims. Could you elaborate on why you consider it toxic? I've yet to find the Graphene community toxic myself.
They still have a lot of control though. Also I find that Graphene community thinks it is better than everyone else. I don't have a problem with people being proud the problem is that Graphene is spreading false information like every other ROM is insecure. That's not the case especially in terms of security as anything but stock is less secure. From a privacy perspective non google is better than Google but everyone seems to skip over that. People will say "Lineage OS uses Google DNS" but in reality your ISP could be using Google DNS the key it to setup Private DNS which takes only a few minutes to do. Graphene isn't the only option. In reality there are tradeoffs everywhere.
The fact that the larger community only knows of Graphene OS and stock is a bit scary.
They will never be more toxic than proprietary software.
Well it's open source android, if the code is bad, it's jettisoned. While I cannot stand Google, not every line of code they write is trash.
The sandbox is good and you do not need to install Play if you do not want to. I use f droid where possible.
I want Linux Mobile but it is not ready yet. In the mean time, this is the best we have.
Okay but all the apps developed for android will now being useless?
What do you mean?
You can use sandboxes play store if you wish.
It is full of proprietary software. I wouldn't call it that open.
You really have 0 understanding on how all this works 😭