9 ms·

One way to be a little less constantly violated by your phone is to run GrapheneOS, instead of iOS or ordinary Android: https://grapheneos.org/ https://graphene

by neilv 3y ago

One way to be a little less constantly violated by your phone is to run GrapheneOS, instead of iOS or ordinary Android: https://grapheneos.org/ https://grapheneos.org/

blameitonme 3y ago
They only seem to support pixel, although pixels can be bought for cheap when compared to iphones, they're still expensive for countries which are still developing. For example Im using a device which is 1/4th the price of cheapest first hand pixel that I can get :(
- notpushkin 3y ago
  LineageOS is supported on a bit more devices, and works with microG if you're willing to sacrifice Google Pay for better battery life and less privacy violations: https://lineage.microg.org/ https://lineage.microg.org/
  - snapplebobapple 3y ago
    This worked ok, but wasn't as nice as grapheneos' solution so I ended up upgrading to a pixel once my cheap chinesium phone was sufficiently old and haven't looked back since. If you do the microg route you should be using a throw away gmail account you don't care about losing with the aurora store (if you need access to the google play store) because there is a non zero chance they ban your account.
    - notpushkin 3y ago
      > a throw away gmail account you don't care about losing with the aurora store They also have a pool of accounts you can use by clicking “anonymous”. They do get banned frequently, and you have to re-login once in a while (for me it's almost every time I want to download something new again), but it is definitely usable.
      - wkat4242 3y ago
        It's a lot less usable lately because of the "Oops this account is rate limited" error unfortunately. Sometimes it takes me 10 tries. Updates are fine though, it's just searching for new apps that trigger it.
        notpushkin 3y ago
        Yeah, I thought search was completely broken tbh. Usually I search in browser then use “Open in app” to open in Aurora and download. Maybe they can add some web scraping thing to sidestep this issue completely?
  - sspiff 3y ago
    Interesting, can I still use the Play Store with mircoG? I already run LineageOS, but with Play services. I would like to be able to ditch Play services, but still need the Play store for things like my banking app, and an app to log in to government services.
    - mindslight 3y ago
      You can install apps from Play Store with Aurora Store, which is in F-Droid. I'd say it's a toss up whether specific apps will definitely work. But if they don't I'd recommending segmenting between different physical devices, and making the one that lives in your pocket as secure as possible. It's likely that you don't need to run banking and government apps on the same device that's privy to your movement.
      - sspiff 3y ago
        In my country (Belgium), mobile payments are a big thing using the national payment network (Bancontact). Lots of small shops don't accept cards and only do mobile payments because of the lower transaction fees. These mobile payments only work with your banks app or a dedicated app (Payconiq). My current approach is to put all these apps in my work profile which I can turn off (using Insular from F-Droid). Only apps for which I need background activity or instant notifications (Signal, an open source podcast app, and sadly WhatsApp) are installed in the main profile. Sadly, this approach still requires me to have Google services always running in the background for a functioning Play store in my work profile.
      - notpushkin 3y ago
        I've heard something about using Play Store proper with microG, but obviously that's very flaky. Aurora Store is the way to go. And banking / government apps tend to work in Europe (at least the ones I have tried). Notable exceptions for me are Revolut (shame!) and McDonalds (who knew microG is the healthier option haha). Of course, in the US things might be vastly different.
  - HansHamster 3y ago
    LineageOS unfortunately dropped support for my Moto G4 relatively quickly after I installed it and it only was supported up to Android 7.1. I have been running an unofficial build of 8.1 ever since, but that is also horribly outdated by now.
    - tortoise_in 3y ago
      Dude buy something new
      - HansHamster 3y ago
        But why waste the money? I intend to use this thing until it breaks...
        slikrick 3y ago
        it's not a waste of money, that android version is a security mess
        HansHamster 3y ago
        It is for me. And there is nothing important on my phone so it is not a huge concern. And why do we have to accept that phones just turn into garbage after a few years? Even my old 2009 laptop* still runs an up-to-date OS but my 2016 phone is obsolete after 2-3 years? * but I have to admit that the hardware is quite slow
        eks391 3y ago
        > And why do we have to accept that phones just turn into garbage after a few years? Even my old 2009 laptop* still runs an up-to-date OS but my 2016 phone is obsolete after 2-3 years? It is because computers run one of a few available OS's. The OS is being maintained by the distributer (MS, Apple, Google) and your hardware is good as long as the drivers are still receiving updates. Phones are different because even though everyone only uses iOS or Android, every Android manufacturer puts their own layer onto Android, so Google can continusously update it but the manufacturer might not. Most companies only maintain their phones for about 3 years, giving a significantly reduced lifetime than computers. It still works fine, from from a security perspective, keeping the phone without patch support is a bad idea.
  - wkat4242 3y ago
    Yeah I love MicroG. But I really wish there was a big-tech-free payment solution :(
    - notpushkin 3y ago
      Yeah. It's either that or state-supported systems (UPS in India, SBP and MirPay in Russia). Cryptocurrencies could be the answer but governments would never let that happen I think.
- neilv 3y ago
  Even in the US, the limited hardware support is a barrier right now, especially with having to find a unit that has an unblockable bootloader. But it's still doable for many people. I most recently bought a second-hand Pixel 6a for GrapheneOS, and BYOD it to an inexpensive no-contract plan. Pixel 6a units with unlockable bootloaders are currently $235+ on US eBay, which is less than new current Pixels and iPhones bought outright, but more than many lower-end devices, and more upfront than people pay for contract plans that toss in a phone.
- milosmns 3y ago
  Can you share some examples? It's very interesting because 1/4 of Pixel 6a would be around 80 EUR... so I wonder about your environment and what workarounds you have for these problems.
  - blameitonme 3y ago
    So I'm in India, and pixel 6a seems to be of 30999 Rupees on Flipkart (amazon like online store) The device I use regularly is moto g14 which is at about 8500 online, with discounts can go for 8000. Honestly there is no work around as the moto g14 comes with a 4gb ram and 128 GB internal storage, 6.5 inch screen and 5k mah battery, it can do pretty much anything. I've just started working full-time after college and now I earn more than enough to buy pixels or iphones but currently the money is going on other important things that were pending
- callalex 3y ago
  Aren’t those kind of phones typically infested with malware from the manufacturer to begin with, making Google’s stalking the least of your worries?
- diego_sandoval 3y ago
  I got lucky and bought a barely used Pixel 3a for ~ $130 USD. But yes, it was hard to find. It was much easier to find a Pixel 4 or a 4a, but those were too expensive for me.
gjsman-1000 3y ago
… as long as you trust the developers, and their ability to secure themselves, of course. I mean, if I was a three letter agency, sneaking into some GrapheneOS developer’s basement to add a camera to record his keystrokes would be the easiest trade ever for all the paranoid people using it. It’d be way easier than sneaking into Apple or Google. Might even be worth violating internal law to do it; because getting caught is extremely unlikely, and forgiveness is easy. Edit: Also, don’t forget that, if you should get arrested, “he used GrapheneOS” is 100% going to be used against you in court. You might use technical arguments or principled reasoning, but that doesn’t resonate with juries. Unfortunately, using extra-strong privacy tools is perfect for framing you as a criminal.
- tomrod 3y ago
  You make a convincing argument. I'm switching to GrapheneOS for my next phone upgrade. Here is the source code: https://grapheneos.org/source https://grapheneos.org/source > “he used GrapheneOS” is 100% going to be used against you in court. I look forward to using this as a litmus test for legal representation.
  - gjsman-1000 3y ago
    Are you personally capable of ensuring: A. The builds match the code? B. The NSA hasn’t stolen the signing key and isn’t feeding you customized images? True, you can’t verify that with iOS or Android either. I am saying though that trusting my security because it’s safer… by being in some guy’s garage feels like an odd trade. One that shouldn’t be casually ignored, at least.
    - stavros 3y ago
      No I'm not. Does that mean I might as well cc the NSA to all my emails? Your comment is basically "is it perfect? No? Then it's not better".
      - gjsman-1000 3y ago
        I’m saying that, if people who use it aren’t careful, they could end up like the university kid. There was a university that received a bomb threat over Tor. They found one student who used Tor on the network at around the right time, and because he was the only Tor user, he’s in jail for a very, very long time. That kid was at Harvard, his persuer the FBI. If you are going to use GrapheneOS, don’t be naive and think it will make you agency-proof. If anything it probably flags you to their attention.
lawn 3y ago
There are other alternatives as well; LineageOS, /e/OS and CalyxOS that might be more your taste.
- fodmap 3y ago
  Also Volla OS.
BlueTemplar 3y ago
It's still based on Android though - so isn't it building on sand ? Isn't it better to focus our efforts on projects unrelated to Android, especially since some viable ones have appeared recently : Librem 5 and especially PinePhone.
- jacooper 3y ago
  No it isn't, as unlike the others, grapheneOS is actually usable and dailyable.
  - fsflover 3y ago
    I doubt grapheneOS requires much less effort to daily drive than others. Sent from my Librem 5.
    - eks391 3y ago
      There's some hiccups when you first set GrapheneOS up, but after that it is as smooth as, and blends in with, any other Android device. I've never used Librem or PinePhone to comment on them
    - ryukafalz 3y ago
      As an owner of both a Librem 5 and a Pixel 6a running GrapheneOS I can confirm that the latter has been much more reliable and has taken substantially less work to get to the point where I can daily drive it. The Librem 5 is not there yet, and while I would like it if it were I'm not currently very optimistic about that.
    - bkallus 3y ago
      In the past year, I have used a pinephone+keyboard with Arch, a oneplus 6t with postmarketOS, and a pixel 7a with GrapheneOS. In my opinion, Graphene is significantly easier to daily drive because the applications are designed for a phone's form factor.
      - fsflover 3y ago
WD40forRust 3y ago
Based fellow GrapheneOS enjoyer!
drowsspa 3y ago
Sadly device attestation has all but destroyed installing other OS. I couldn't use government or banking apps back in my old phone with LineageOS.
- treyd 3y ago
  In my experience, most banking apps are horrible and not worth using over accessing the bank's browser version.
  - pydry 3y ago
    You don't get payment notifications when you use the browser version and you can't log in with a fingerprint scanner.
    - treyd 3y ago
      I don't need payment notifications (I check it regularly anyways) and I actively don't want to use biometrics for logins, so there's 0 loss for me.
  - _dain_ 3y ago
    Some banks, especially newer ones, don't even have a browser version. Or they do, but they require you to use the app for 2FA.
    - ungamedplayer 3y ago
      When the app itself is also the second factor.
- nfriedly 3y ago
  I'm running lineageOS, and I had to root the phone to make one banking app work (and Netflix and some games.) It actually passes SafetyNet out of the box, but there's a CTS profile check that some apps do in addition to SafetyNet, and I had to root the phone to make it provide a profile that those apps are happy with. And then I had to install a SafetyNet bypass, because fixing the CTS profile broke SafetyNet. It un-roots itself every time I install an update, which is kind of a pain in the ass, but someone wrote a script to re-root lineageOS (from a desktop computer), so it's not too bad these days.

by neilv 3y ago

One way to be a little less constantly violated by your phone is to run GrapheneOS, instead of iOS or ordinary Android: https://grapheneos.org/ https://grapheneos.org/

blameitonme 3y ago

They only seem to support pixel, although pixels can be bought for cheap when compared to iphones, they're still expensive for countries which are still developing. For example Im using a device which is 1/4th the price of cheapest first hand pixel that I can get :(

notpushkin 3y ago
LineageOS is supported on a bit more devices, and works with microG if you're willing to sacrifice Google Pay for better battery life and less privacy violations: https://lineage.microg.org/ https://lineage.microg.org/
- snapplebobapple 3y ago
  This worked ok, but wasn't as nice as grapheneos' solution so I ended up upgrading to a pixel once my cheap chinesium phone was sufficiently old and haven't looked back since. If you do the microg route you should be using a throw away gmail account you don't care about losing with the aurora store (if you need access to the google play store) because there is a non zero chance they ban your account.
  - notpushkin 3y ago
    > a throw away gmail account you don't care about losing with the aurora store They also have a pool of accounts you can use by clicking “anonymous”. They do get banned frequently, and you have to re-login once in a while (for me it's almost every time I want to download something new again), but it is definitely usable.
    - wkat4242 3y ago
      It's a lot less usable lately because of the "Oops this account is rate limited" error unfortunately. Sometimes it takes me 10 tries. Updates are fine though, it's just searching for new apps that trigger it.
      - notpushkin 3y ago
        Yeah, I thought search was completely broken tbh. Usually I search in browser then use “Open in app” to open in Aurora and download. Maybe they can add some web scraping thing to sidestep this issue completely?
- sspiff 3y ago
  Interesting, can I still use the Play Store with mircoG? I already run LineageOS, but with Play services. I would like to be able to ditch Play services, but still need the Play store for things like my banking app, and an app to log in to government services.
  - mindslight 3y ago
    You can install apps from Play Store with Aurora Store, which is in F-Droid. I'd say it's a toss up whether specific apps will definitely work. But if they don't I'd recommending segmenting between different physical devices, and making the one that lives in your pocket as secure as possible. It's likely that you don't need to run banking and government apps on the same device that's privy to your movement.
    - sspiff 3y ago
      In my country (Belgium), mobile payments are a big thing using the national payment network (Bancontact). Lots of small shops don't accept cards and only do mobile payments because of the lower transaction fees. These mobile payments only work with your banks app or a dedicated app (Payconiq). My current approach is to put all these apps in my work profile which I can turn off (using Insular from F-Droid). Only apps for which I need background activity or instant notifications (Signal, an open source podcast app, and sadly WhatsApp) are installed in the main profile. Sadly, this approach still requires me to have Google services always running in the background for a functioning Play store in my work profile.
    - notpushkin 3y ago
      I've heard something about using Play Store proper with microG, but obviously that's very flaky. Aurora Store is the way to go. And banking / government apps tend to work in Europe (at least the ones I have tried). Notable exceptions for me are Revolut (shame!) and McDonalds (who knew microG is the healthier option haha). Of course, in the US things might be vastly different.
- HansHamster 3y ago
  LineageOS unfortunately dropped support for my Moto G4 relatively quickly after I installed it and it only was supported up to Android 7.1. I have been running an unofficial build of 8.1 ever since, but that is also horribly outdated by now.
  - tortoise_in 3y ago
    Dude buy something new
    - HansHamster 3y ago
      But why waste the money? I intend to use this thing until it breaks...
      - slikrick 3y ago
        it's not a waste of money, that android version is a security mess
        HansHamster 3y ago
        It is for me. And there is nothing important on my phone so it is not a huge concern. And why do we have to accept that phones just turn into garbage after a few years? Even my old 2009 laptop* still runs an up-to-date OS but my 2016 phone is obsolete after 2-3 years? * but I have to admit that the hardware is quite slow
        eks391 3y ago
        > And why do we have to accept that phones just turn into garbage after a few years? Even my old 2009 laptop* still runs an up-to-date OS but my 2016 phone is obsolete after 2-3 years? It is because computers run one of a few available OS's. The OS is being maintained by the distributer (MS, Apple, Google) and your hardware is good as long as the drivers are still receiving updates. Phones are different because even though everyone only uses iOS or Android, every Android manufacturer puts their own layer onto Android, so Google can continusously update it but the manufacturer might not. Most companies only maintain their phones for about 3 years, giving a significantly reduced lifetime than computers. It still works fine, from from a security perspective, keeping the phone without patch support is a bad idea.
- wkat4242 3y ago
  Yeah I love MicroG. But I really wish there was a big-tech-free payment solution :(
  - notpushkin 3y ago
    Yeah. It's either that or state-supported systems (UPS in India, SBP and MirPay in Russia). Cryptocurrencies could be the answer but governments would never let that happen I think.
neilv 3y ago
Even in the US, the limited hardware support is a barrier right now, especially with having to find a unit that has an unblockable bootloader. But it's still doable for many people. I most recently bought a second-hand Pixel 6a for GrapheneOS, and BYOD it to an inexpensive no-contract plan. Pixel 6a units with unlockable bootloaders are currently $235+ on US eBay, which is less than new current Pixels and iPhones bought outright, but more than many lower-end devices, and more upfront than people pay for contract plans that toss in a phone.
milosmns 3y ago
Can you share some examples? It's very interesting because 1/4 of Pixel 6a would be around 80 EUR... so I wonder about your environment and what workarounds you have for these problems.
- blameitonme 3y ago
  So I'm in India, and pixel 6a seems to be of 30999 Rupees on Flipkart (amazon like online store) The device I use regularly is moto g14 which is at about 8500 online, with discounts can go for 8000. Honestly there is no work around as the moto g14 comes with a 4gb ram and 128 GB internal storage, 6.5 inch screen and 5k mah battery, it can do pretty much anything. I've just started working full-time after college and now I earn more than enough to buy pixels or iphones but currently the money is going on other important things that were pending
callalex 3y ago
Aren’t those kind of phones typically infested with malware from the manufacturer to begin with, making Google’s stalking the least of your worries?
diego_sandoval 3y ago
I got lucky and bought a barely used Pixel 3a for ~ $130 USD. But yes, it was hard to find. It was much easier to find a Pixel 4 or a 4a, but those were too expensive for me.

gjsman-1000 3y ago

… as long as you trust the developers, and their ability to secure themselves, of course. I mean, if I was a three letter agency, sneaking into some GrapheneOS developer’s basement to add a camera to record his keystrokes would be the easiest trade ever for all the paranoid people using it. It’d be way easier than sneaking into Apple or Google. Might even be worth violating internal law to do it; because getting caught is extremely unlikely, and forgiveness is easy. Edit: Also, don’t forget that, if you should get arrested, “he used GrapheneOS” is 100% going to be used against you in court. You might use technical arguments or principled reasoning, but that doesn’t resonate with juries. Unfortunately, using extra-strong privacy tools is perfect for framing you as a criminal.

tomrod 3y ago
You make a convincing argument. I'm switching to GrapheneOS for my next phone upgrade. Here is the source code: https://grapheneos.org/source https://grapheneos.org/source > “he used GrapheneOS” is 100% going to be used against you in court. I look forward to using this as a litmus test for legal representation.
- gjsman-1000 3y ago
  Are you personally capable of ensuring: A. The builds match the code? B. The NSA hasn’t stolen the signing key and isn’t feeding you customized images? True, you can’t verify that with iOS or Android either. I am saying though that trusting my security because it’s safer… by being in some guy’s garage feels like an odd trade. One that shouldn’t be casually ignored, at least.
  - stavros 3y ago
    No I'm not. Does that mean I might as well cc the NSA to all my emails? Your comment is basically "is it perfect? No? Then it's not better".
    - gjsman-1000 3y ago
      I’m saying that, if people who use it aren’t careful, they could end up like the university kid. There was a university that received a bomb threat over Tor. They found one student who used Tor on the network at around the right time, and because he was the only Tor user, he’s in jail for a very, very long time. That kid was at Harvard, his persuer the FBI. If you are going to use GrapheneOS, don’t be naive and think it will make you agency-proof. If anything it probably flags you to their attention.

lawn 3y ago

There are other alternatives as well; LineageOS, /e/OS and CalyxOS that might be more your taste.

fodmap 3y ago
Also Volla OS.

BlueTemplar 3y ago

It's still based on Android though - so isn't it building on sand ? Isn't it better to focus our efforts on projects unrelated to Android, especially since some viable ones have appeared recently : Librem 5 and especially PinePhone.

jacooper 3y ago
No it isn't, as unlike the others, grapheneOS is actually usable and dailyable.
- fsflover 3y ago
  I doubt grapheneOS requires much less effort to daily drive than others. Sent from my Librem 5.
  - eks391 3y ago
    There's some hiccups when you first set GrapheneOS up, but after that it is as smooth as, and blends in with, any other Android device. I've never used Librem or PinePhone to comment on them
  - ryukafalz 3y ago
    As an owner of both a Librem 5 and a Pixel 6a running GrapheneOS I can confirm that the latter has been much more reliable and has taken substantially less work to get to the point where I can daily drive it. The Librem 5 is not there yet, and while I would like it if it were I'm not currently very optimistic about that.
  - bkallus 3y ago
    In the past year, I have used a pinephone+keyboard with Arch, a oneplus 6t with postmarketOS, and a pixel 7a with GrapheneOS. In my opinion, Graphene is significantly easier to daily drive because the applications are designed for a phone's form factor.
    - fsflover 3y ago

WD40forRust 3y ago

Based fellow GrapheneOS enjoyer!

drowsspa 3y ago

Sadly device attestation has all but destroyed installing other OS. I couldn't use government or banking apps back in my old phone with LineageOS.

treyd 3y ago
In my experience, most banking apps are horrible and not worth using over accessing the bank's browser version.
- pydry 3y ago
  You don't get payment notifications when you use the browser version and you can't log in with a fingerprint scanner.
  - treyd 3y ago
    I don't need payment notifications (I check it regularly anyways) and I actively don't want to use biometrics for logins, so there's 0 loss for me.
- _dain_ 3y ago
  Some banks, especially newer ones, don't even have a browser version. Or they do, but they require you to use the app for 2FA.
  - ungamedplayer 3y ago
    When the app itself is also the second factor.
nfriedly 3y ago
I'm running lineageOS, and I had to root the phone to make one banking app work (and Netflix and some games.) It actually passes SafetyNet out of the box, but there's a CTS profile check that some apps do in addition to SafetyNet, and I had to root the phone to make it provide a profile that those apps are happy with. And then I had to install a SafetyNet bypass, because fixing the CTS profile broke SafetyNet. It un-roots itself every time I install an update, which is kind of a pain in the ass, but someone wrote a script to re-root lineageOS (from a desktop computer), so it's not too bad these days.