3 ms·

GrapheneOS is a locked-down, security-hardened system that's good if you need absolutely maximal security (e.g. journalists, activists, folks targeted by state

GrapheneOS is a locked-down, security-hardened system that's good if you need absolutely maximal security (e.g. journalists, activists, folks targeted by state actors). LineageOS is a more of an open system for tinkerers who want to play outside Google's walled garden. You can have root to control your own device on Lineage, but not Graphene.

arcanemachiner 11mo ago
I believe you can root GrapheneOS. It just breaks the security model, so it's not recommended to do so.
- ForHackernews 11mo ago
  Ah, you're right: https://github.com/schnatterer/rooted-graphene https://github.com/schnatterer/rooted-graphene I stand corrected. Still, as you say, less point in it since it breaks their security model.
  - preisschild 10mo ago
    > I stand corrected. Still, as you say, less point in it since it breaks their security model. It breaks the entire point of the security model on ALL android devices. It isnt recommended on any Android distribution. It doesnt matter if its LOS or GOS
    - ForHackernews 10mo ago
      Honestly don't care for the idea of a system secured from its owner. If I wanted to use iOS, I would.
      - preisschild 10mo ago
        > Honestly don't care for the idea of a system secured from its owner It's not. It's making your data secure more secure from attackers.
        ForHackernews 10mo ago
        Not having root prevents me from taking proper backups that include app data, it prevents me from using Aegis to import TOTP codes from Authy. I get that on some abstract level it is more "secure" from any malicious software that might find its way onto the device, but the practical upshot is largely obstructing the user from using the system. Have you ever had to work on a locked-down machine at an office? I don't need Google or Graphene to play IT department for me.
        preisschild 10mo ago
        > Not having root prevents me from taking proper backups that include app data You can handle this better without root. GrapheneOS includes SeedVault per default for example. > Have you ever had to work on a locked-down machine at an office? Fortunately I'm the admin at work :) > I don't need Google or Graphene to play IT department for me. GrapheneOS is security+privacy first and "enabling root" compromises on this. Thats why its not recommended.
        ForHackernews 10mo ago
        As I'm sure you're aware, SeedVault won't backup app data if the app authors have opted out of it. Again, this is an example of a system serving masters other than the device's owner.
jasonvorhe 11mo ago
It's not really locked down. You can toggle or enable some of the more activist-orientated features. The only limitation I'm aware of is that some apps requiring the strongest Play Integrity setting (ChatGPT, some banks, very few airline apps) just won't work on GrapheneOS.

arcanemachiner 11mo ago

I believe you can root GrapheneOS. It just breaks the security model, so it's not recommended to do so.

ForHackernews 11mo ago
Ah, you're right: https://github.com/schnatterer/rooted-graphene https://github.com/schnatterer/rooted-graphene I stand corrected. Still, as you say, less point in it since it breaks their security model.
- preisschild 10mo ago
  > I stand corrected. Still, as you say, less point in it since it breaks their security model. It breaks the entire point of the security model on ALL android devices. It isnt recommended on any Android distribution. It doesnt matter if its LOS or GOS
  - ForHackernews 10mo ago
    Honestly don't care for the idea of a system secured from its owner. If I wanted to use iOS, I would.
    - preisschild 10mo ago
      > Honestly don't care for the idea of a system secured from its owner It's not. It's making your data secure more secure from attackers.
      - ForHackernews 10mo ago
        Not having root prevents me from taking proper backups that include app data, it prevents me from using Aegis to import TOTP codes from Authy. I get that on some abstract level it is more "secure" from any malicious software that might find its way onto the device, but the practical upshot is largely obstructing the user from using the system. Have you ever had to work on a locked-down machine at an office? I don't need Google or Graphene to play IT department for me.
        preisschild 10mo ago
        > Not having root prevents me from taking proper backups that include app data You can handle this better without root. GrapheneOS includes SeedVault per default for example. > Have you ever had to work on a locked-down machine at an office? Fortunately I'm the admin at work :) > I don't need Google or Graphene to play IT department for me. GrapheneOS is security+privacy first and "enabling root" compromises on this. Thats why its not recommended.
        ForHackernews 10mo ago
        As I'm sure you're aware, SeedVault won't backup app data if the app authors have opted out of it. Again, this is an example of a system serving masters other than the device's owner.

jasonvorhe 11mo ago

It's not really locked down. You can toggle or enable some of the more activist-orientated features. The only limitation I'm aware of is that some apps requiring the strongest Play Integrity setting (ChatGPT, some banks, very few airline apps) just won't work on GrapheneOS.