9 ms·

I used to use CalyxOS till GrapheneOS got Google Place Sandbox working. Now there is nothing I can't get working on GrapheneOS. Everything works including Googl

by DirkH 3y ago

I used to use CalyxOS till GrapheneOS got Google Place Sandbox working. Now there is nothing I can't get working on GrapheneOS. Everything works including Google Pay. I just have a user profile for when I need to use an app that needs Google and otherwise my main user profile is just apps that work without Google. To me this is leagues ahead of any other degoogled experience because at any time I can temporarily turn on Google when I need it (and I often do). But it doesn't defeat the purpose because for the most part you can just turn it off

geraldhh 3y ago
sounds about as practical as dualbooting, or is switching user profiles on android considerable more seamless than i care to imagine?
- _rdvw 3y ago
  You can use a work profile via Shelter/Insular instead which makes this entirely seamless, simply swipe right on your launcher to launch work apps. They even get their own VPN slot too!
- sureglymop 3y ago
  It's way more seamless, especially if keeping the google apps in a work profile. Every UI component on android where an app or activity can be chosen (e.g. the share menu) already has a small toggle to toggle between these profiles. The work profile filesystem can also be mounted and is then visible in the file explorer. The only issue is that it's only possible to have one additional work profile. Otherwise full user profiles must be used which are less convenient.
  - DirkH 3y ago
    I use user profiles since I figured I wanted more than just 2 profiles. Am thinking the increased privacy is not worth the decreased convenience and I'd advise others to start using work profiles and only start using user profiles once you have a third use case you're sure you need
- DirkH 3y ago
  It is certainly not perfect but it certainly way faster and seamless than rebooting into another OS. If you don't mind the battery drain and having both profiles running it is just a menu drop down + single button and ~1 second wait and you have your other profile. Personally I hate the battery drain so the process for me is a menu drop + single button and ~3 second wait and then unlock pin and I am in my other profile (not ideal, but far better than anything else if you want degoogled). You can even get notifications from other user profile(s). This is absolutely impossible with dual boot.
prmoustache 3y ago
Probleme about grapheneOS is it only supports newest Pixel phones. They recommend a minimum of Pixel 6 which most people can't afford, even in the second hand market unless they have a broken screen or are in a sorry state while I can get a Samsung Galaxy S9+ in very good shape for the price of a new entry level smartphone and install it with /e/, iodé or divestOS. So I would say they are not targetting the same users and you can't really compare them equally.
- josebama 3y ago
  Using old devices that no longer receive security updates, like the Galaxy S9+ you mentioned, is unsecure. It makes sense that GrapheneOS, a security-oriented OS, only recommends devices that are still getting security updates both for the OS itself but also for hardware firmware, which only the manufacturer of the hardware can provide. There are old versions of GrapheneOS for older devices, and some devices are still in extended support, like the Pixel 4a (although not for long I expect). So if you are OK with the compromised Galaxy S9+, you could also be OK with the compromised Pixel 3a, which received the June 2022 security patch in GrapheneOS[1], while the S9+ received the March 2022 security patch[2] [1]: https://grapheneos.org/releases#2022081800 https://grapheneos.org/releases#2022081800 [2]: https://doc.samsungmobile.com/sm-g965f/dbt/doc.html https://doc.samsungmobile.com/sm-g965f/dbt/doc.html
  - realusername 3y ago
    I think it would be nice for GrapheneOS to have two sorts of distributions, the normal one and another one which could be called "lite" or "legacy" and could support an extended range of devices even if the hardware guarantees aren't as good. There's tons of value on the software side on GrapheneOS and those legacy devices could benefit from it.
  - prmoustache 3y ago
    Well, if you want to be whatanalboutist about security, GrapheneOS running pixels aren't either because the Graphene project do not write, audit and provide the firmwares either.
  - 3y ago
lawn 3y ago
Unfortunately GrapheneOS only supports Pixel phones. So I'm running CalyxOS on Fairphone and I've gotten almost all play store apps to work via MicroG and anonymous login on Aurora store (in-app purchases don't work).
pshirshov 3y ago
This is exactly my story. But NFC payments don't work on Graphene.
- josebama 3y ago
  clarification: NFC payments in Google Pay. For example my bank app has mobile payments implemented and they work on GrapheneOS. AFAIK the only reason why Google Pay NFC payments don't work is because Google Pay keeps a list of hardware and OS that's allowed to use that feature, and GrapheneOS is not in that list. It's not an OS limitation. There was an open issue to spoof this data so that Google Pay NFC payments, among other Google features behind this check, would work. But it looks like it got discarded 2 days ago: https://github.com/GrapheneOS/os-issue-tracker/issues/1986 https://github.com/GrapheneOS/os-issue-tracker/issues/1986
  - Kiuhrly1 3y ago
    I think Graphene spoofs the most basic level of Google's security thing but they never wanted to spoof anything higher because it would just turn into a cat and mouse game that they would eventually lose. They recommend that app developers adopt the much stronger and vendor-neutral Android hardware attestation API instead.
codethief 3y ago
> Everything works including Google Pay. Wait, what? What did I miss here -> https://github.com/GrapheneOS/os-issue-tracker/issues/1986 https://github.com/GrapheneOS/os-issue-tracker/issues/1986 ?
jcul 3y ago
Agree, GrapheneOS is probably the best I've used. The sandboxed Google play works perfectly for me. I actually bought a second hand pixel 6 to install calx or graphene, tried both and found graphene much better. The only things that don't work that I've noticed are android auto (I don't use it anyway), Google passive / offline music recognition, and Google pay. I thought Google pay not working was a known issue, so I'm surprised you say it works for you?
- fifteen1506 3y ago
  He probably doesn't use Google Wallet (which, by the way, appears to now crash at start). Other things which don't work * McDonalds international app ("phone insecure") * Pokemon Go's VR * Android Auto (but will "soon") * Google One's backup & restore

by DirkH 3y ago

geraldhh 3y ago

sounds about as practical as dualbooting, or is switching user profiles on android considerable more seamless than i care to imagine?

_rdvw 3y ago
You can use a work profile via Shelter/Insular instead which makes this entirely seamless, simply swipe right on your launcher to launch work apps. They even get their own VPN slot too!
sureglymop 3y ago
It's way more seamless, especially if keeping the google apps in a work profile. Every UI component on android where an app or activity can be chosen (e.g. the share menu) already has a small toggle to toggle between these profiles. The work profile filesystem can also be mounted and is then visible in the file explorer. The only issue is that it's only possible to have one additional work profile. Otherwise full user profiles must be used which are less convenient.
- DirkH 3y ago
  I use user profiles since I figured I wanted more than just 2 profiles. Am thinking the increased privacy is not worth the decreased convenience and I'd advise others to start using work profiles and only start using user profiles once you have a third use case you're sure you need
DirkH 3y ago
It is certainly not perfect but it certainly way faster and seamless than rebooting into another OS. If you don't mind the battery drain and having both profiles running it is just a menu drop down + single button and ~1 second wait and you have your other profile. Personally I hate the battery drain so the process for me is a menu drop + single button and ~3 second wait and then unlock pin and I am in my other profile (not ideal, but far better than anything else if you want degoogled). You can even get notifications from other user profile(s). This is absolutely impossible with dual boot.

prmoustache 3y ago

Probleme about grapheneOS is it only supports newest Pixel phones. They recommend a minimum of Pixel 6 which most people can't afford, even in the second hand market unless they have a broken screen or are in a sorry state while I can get a Samsung Galaxy S9+ in very good shape for the price of a new entry level smartphone and install it with /e/, iodé or divestOS. So I would say they are not targetting the same users and you can't really compare them equally.

josebama 3y ago
Using old devices that no longer receive security updates, like the Galaxy S9+ you mentioned, is unsecure. It makes sense that GrapheneOS, a security-oriented OS, only recommends devices that are still getting security updates both for the OS itself but also for hardware firmware, which only the manufacturer of the hardware can provide. There are old versions of GrapheneOS for older devices, and some devices are still in extended support, like the Pixel 4a (although not for long I expect). So if you are OK with the compromised Galaxy S9+, you could also be OK with the compromised Pixel 3a, which received the June 2022 security patch in GrapheneOS[1], while the S9+ received the March 2022 security patch[2] [1]: https://grapheneos.org/releases#2022081800 https://grapheneos.org/releases#2022081800 [2]: https://doc.samsungmobile.com/sm-g965f/dbt/doc.html https://doc.samsungmobile.com/sm-g965f/dbt/doc.html
- realusername 3y ago
  I think it would be nice for GrapheneOS to have two sorts of distributions, the normal one and another one which could be called "lite" or "legacy" and could support an extended range of devices even if the hardware guarantees aren't as good. There's tons of value on the software side on GrapheneOS and those legacy devices could benefit from it.
- prmoustache 3y ago
  Well, if you want to be whatanalboutist about security, GrapheneOS running pixels aren't either because the Graphene project do not write, audit and provide the firmwares either.
- 3y ago

lawn 3y ago

Unfortunately GrapheneOS only supports Pixel phones. So I'm running CalyxOS on Fairphone and I've gotten almost all play store apps to work via MicroG and anonymous login on Aurora store (in-app purchases don't work).

pshirshov 3y ago

This is exactly my story. But NFC payments don't work on Graphene.

josebama 3y ago
clarification: NFC payments in Google Pay. For example my bank app has mobile payments implemented and they work on GrapheneOS. AFAIK the only reason why Google Pay NFC payments don't work is because Google Pay keeps a list of hardware and OS that's allowed to use that feature, and GrapheneOS is not in that list. It's not an OS limitation. There was an open issue to spoof this data so that Google Pay NFC payments, among other Google features behind this check, would work. But it looks like it got discarded 2 days ago: https://github.com/GrapheneOS/os-issue-tracker/issues/1986 https://github.com/GrapheneOS/os-issue-tracker/issues/1986
- Kiuhrly1 3y ago
  I think Graphene spoofs the most basic level of Google's security thing but they never wanted to spoof anything higher because it would just turn into a cat and mouse game that they would eventually lose. They recommend that app developers adopt the much stronger and vendor-neutral Android hardware attestation API instead.

codethief 3y ago

> Everything works including Google Pay. Wait, what? What did I miss here -> https://github.com/GrapheneOS/os-issue-tracker/issues/1986 https://github.com/GrapheneOS/os-issue-tracker/issues/1986 ?

jcul 3y ago

Agree, GrapheneOS is probably the best I've used. The sandboxed Google play works perfectly for me. I actually bought a second hand pixel 6 to install calx or graphene, tried both and found graphene much better. The only things that don't work that I've noticed are android auto (I don't use it anyway), Google passive / offline music recognition, and Google pay. I thought Google pay not working was a known issue, so I'm surprised you say it works for you?

fifteen1506 3y ago
He probably doesn't use Google Wallet (which, by the way, appears to now crash at start). Other things which don't work * McDonalds international app ("phone insecure") * Pokemon Go's VR * Android Auto (but will "soon") * Google One's backup & restore