After using LineageOS for long time, I have finally moved to GrapheneOS. I use a lot of banking and financial apps which I never felt comfortable using on LineageOS due to lack of proper sandboxing, unlocked bootloader etc.
GrapheneOS works flawlessly just like Android. You don’t even notice there’s hardening underneath. Also it protects from Google’s evil location tracking using WiFi/Bluetooth or even when the Location is turned off. I don’t understand how people in general are comfortable with Google tracking all the time. You can use Google Play and Play Services in a sandbox that works just like regular installation, but without deep tracking.
If you haven’t tried GrapheneOS, try it. You won’t go back to regular Android.
GraphmemeOS
People contemplating moving to graphene, do be aware that banking etc. absolutely can be a major PITA on graphene as well. Several official apps used where i live cannot work in graphene, even with sandboxed play services installed, making day-to-day life functionally impossible with graphene. Luckily reverting to stock android is easy, although I probably wouldn’t have bought a pixel phone if I was planning on using stock OS.
“Making day to day life functionally impossible” is a bit drastic. I think that depends on each individual person, their needs both in terms of banking and privacy.
My banking app doesn’t work on Graphene but I also couldn’t care less. I can just as easily log in to my account via my browser on my phone if I need to do something and it isn’t exactly hard, it takes all of 30 seconds more than using an app.
I realise in some other countries you don’t have that option but were I in the same situation for me that would be enough to change banks, I don’t want to be forced to use an app for anything.
Everyone has different lengths they are willing to go to to protect their privacy and I’m willing to make my life slightly harder where as others may not but I think saying it makes life functionally impossible is a bit of an overstatement and it needs to be judged based on individual needs.
There is a list of what banking apps work and what don’t.I’ll post it in a top level comment for visibility.
The thing is, I’d need the government 2FA app (which doesn’t work in graphene) when logging in to my bank on a browser as well, so that doesn’t change anything.
And I can’t do anything, I can’t check my digital mailbox (not email, we have something specifically for official communication with bank, government etc.), I can’t log in to check messages from my kids school, I can’t order a doctors appointment…you get the picture.
Yeah i understand what you are saying and that is why everyone’s individual needs come into play.
I don’t know what country you are in and that can obviously affect things, my banks 2FA is an SMS. I have options in terms of the other things you mentioned, where as you may not have.
Banking compatability by country. In my experience even banking apps not mentioned also work. https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/
Isn’t it only Google Wallet that doesn’t work? I actually cancelled a bank account I had because their app only worked with Google Wallet. Some banks roll their own NFC payment thing.
I’m on CalyxOS btw, not Graphene.
No that doesn’t work either, but we use a 2FA app to enable mobile banking access, SS access, school communications/message board etc., basically anything that requires you to prove your identity. That app doesn’t work in graphene at all, it flat out refuses and states the OS isn’t secure or the app isn’t installed from a valid source, so all things dependant on this doesn’t work on graphene.
Edit: a lot of other things also fail because graphene apparently doesn’t pass the google play safety check either.
Some banking apps won’t run without SafetyNet (technically now Play Integrity). Pure AOSP doesn’t have it, and AOSP distributions with sandboxed play services or whatever usually fail the hardware attestation requirements. There are some other reasons banking apps won’t work, but a lot of it is similar stuff.
Well, I never really missed being able to pay via NFC on a phone, but I also never done it. My NFC chip in my card works fine.
When my baking app started detecting my rooted phone, I just switched to using their web-app via Firefox, which allows you to create a direct link to it as an “App”. Which is probably better anyway, than installing random proprietary apps on a phone. And logging into it every time is also easy with a password manager.
So I guess, as long as the banks still offer a website, I am good.
If they can get it to work on non-Google devices, I will consider it. Right now Graphene compatibility is extremely limited. I basically have to give Google money to avoid Google.
🤪
Have people forgotten about the used market? Buying things second hand is the way.
Doesn’t change that this only runs on Pixel devices. I simply don’t want a Pixel device for various reasons. Used or not, Graphene won’t run officially on a Sony, a Fairphone, etc.
If the security benefits of a pixel is less important then the fact Google made it then GOS is simply not meant for you.
Its silly people complain about it being only compatible for pixels but never seem to blame other android brands for making significantly less secure phones. The responsibility should be put on phone makers to create secure phones that meet GOS requirements, not to expect GOS to make a less secure OS.
The whole AOSP environment is very Google centric so its pretty weird to think because your not buying a pixel that you are somehow avoiding Google.
My country’s second hand market sucks donkey balls. Import fees are crazy if you even dare to use Amazon instead of cheap Chinese shop. I just wanna scream.
I’m always wary of buying second hand phones. How healthy is that battery going to be?
Buy a Pixel second hand. Then you’re just reimbursing someone who already made that mistake. ;)
Just research ahead and don’t buy one with a known hardware defect such as the 5As which are notorious for frying motherboards and screens. Went through 5 of them with the extended warranty over my phones life and they all died while in my hand abruptly. Less than a year or life per device almost always failing around 8 months for me.
If grapheneOS wasn’t so damn good I would’ve left pixels after that, Pixel XL abruptly died, 2XL had both cameras and the fingerprint sensor die out of nowhere, then the 4 5As. On an 8a right now and love it so fingers crossed it lasts!
If they had a user repairable device that ran it I’d buy it in a heartbeat
Yeah, it’s kind of wild and ironic that one of the most private OSes requires a Google phone.
Not only that but it relies on the Pixel’s black box “Titan” security chip, that google pinky-promised to open source but never did…
The Titan security chip is not a black box. The Titan M1 gas been scrutinazed by blackhat: https://dl.acm.org/doi/fullHtml/10.1145/3503921.3503922
Just because something is not open source does not mean you can’t verify it (no, i’m not shilling closed slurce; no i don’t think closed > open; no i don’t think closed source is more secure)
I just looked it up and GrapheneOS only works on google hardware? So you had to give google some money first or did you get it to work on something else?
Yeah the fact that Pixel Phones are the defacto standard for privacy phones is absurd. It’s guaranteed chock full of hardware surveillance tools you can’t remove with custom roms or kernels.
Outside of the Pixel lineup, custom rom support is almost non-existant in 2024. it’s wild, you can get the same or better hardware for half the price.
Xiaomis and some other chinease brands have decent custom rom support, but no grapheneos and no bootloader relocking (except some oneplus phones)
I have a Xiaomi, I love their hardware and the fact that it’s bugged by a foreign nation rather than my own. But Xiaomi software is garbage and flashing is an absolute pain. I looked at what rom support modern Xiaomi devices have and I am not impressed. It’s almost all half baked or not privacy oriented. I’ve been struggling with one of said ROMs for years.
I am sick of flashing one-off ROMs without proper support or OTA, and constant system level bugs.
I’d love to have a manufacturer with open-source/open hardware focused cheap high performance repairable hardware and with privacy ROMs as a first-class citizen. Like a Fairphone if it was good.
But sadly all of these devices end up with bad support too in the end.
I think the main issue is that most ROM developers today only buy the most high end flagship devices, since those are the only ones that get any decent support. I’m guessing that’s because they all got high paying tech jobs now.
If you buy one used that is how you can get around giving Google money.
From a security standpoint it might give you a temporary benefit since all of Google’s tracking IDs will be associated with the original owner. On a new phone I figure it’s associated with you immediately.
Not really. You carry arround a Google devices and people notice the brand and devices are more valuable when also desired second hand.
All of this supports Google
Graphene uses the same sandboxing as AOSP. If you are talking about Google services framework then that makes a little sense but by itself the apps are about the same in terms of security.
