12 ms·
I've been running GrapheneOS for 7 months now and I'm not going back. When I bought my Pixel 10 last year, I wasn't actually planning on trying Graphene for a w
by jordand 4mo ago
I've been running GrapheneOS for 7 months now and I'm not going back. When I bought my Pixel 10 last year, I wasn't actually planning on trying Graphene for a while....until I noticed Google had force bundled a 'Wicked For Good' movie promo theme with the latest security update.
- sivers 4mo agoHa! Me too! Exact same. Bought a Pixel 10. Intended to do the default Android for a while. But it was filled with ads for “Wicked” which had me looking at my phone with a sneer on my face I couldn't erase - as if someone had smeared feces all over it and threw it on my bed. So I jumped straight to GrapheneOS, which was way easier and less extreme than I had been warned. So beautifully minimal, with no crap. Now my phone feels like a simple Linux (Void/Arch) PC. So wonderful.
- jordand 4mo agoWe took control, we're keeping control
- joe_mamba 4mo ago[flagged]
- cluckindan 4mo agoThere is no FOSS modem. The baseband is a separate computer operating on a lower level than the OS. Your provider can run arbitrary code there.
- opan 4mo agoI thought the PinePhone community had succeeded in making custom firmware for the modem in the PinePhone, though I'm not sure of the legality of actually using it. Plus both PinePhone and Librem 5 had a killswitch to disconnect the modem at least.
- singpolyma3 4mo agoTBF if Google locked down the devices like that it would be a GPL violation. Not their first or whatever but still, there's a reason for them not to do that beside "being nice"
- yjftsjthsd-h 4mo agoWould it? IANAL, but AIUI the only GPL component is Linux on GPLv2 which requires providing code but not giving the ability to install it
- singpolyma3 4mo agoYes. GPLv2 specifically contains a clause that you must provide "scripts to control compilation and installation" Source you can't compile or install onto the device wouldn't be very useful.
- fluidcruft 4mo agoNot really. Tivo did that eons ago. Whether you view this as a "flaw" or "feature" of GPLv2 it's ultimately why GPLv3 now exists. The Linux kernel developers see what Tivo did as a "feature" rather than a "flaw" and refuse GPLv3.
- wolvoleo 4mo agoIt's also because so many Linux developers are on the payroll of big tech. Look at all the submissions. 95% are just big tech. And look at the key people in the Linux Foundation. All a bunch of business suits with compromised motives. Serving their company above the community. There's only a few unencumbered people in there now. Linux is no longer the community-driven choice. It's big business with billions hanging on the line. The grassroots origins are long over.
- singpolyma3 4mo agoTiVo never prevented installing your own build in the device. They only prevented running their proprietary app on top of it when you had done so.
- genxy 4mo agoLet them eat steak!
- StrLght 4mo agoAnd how many options are there exactly? How many of them are capable of at least making and receiving a phone call without any issues 99% of the time? While I agree with your general sentiment, I feel necessary to acknowledge that it's just not there (yet?). GrapheneOS is a great option if you want to have a fully working and secure device.
- matheusmoreira 4mo agoYou're not wrong, but we gotta do what we can and take every advantage we can get.
- jordand 4mo agoYour point is valid and yeah, it's a never-ending fight just to keep the control we have. Things like the Play Protect API and loads of Android apps being coupled to Play Services is it's own big challenge we're stuck with just to stay within the Android ecosystem
- jitix 4mo agoWhat you are describing is not Google’s alturism but keeping competition in check. If Google didn’t “allow” GrapheneOS it opens up a new market segment for other smartphone manufacturers. Apple really cashed in on privacy for a few years so it’s not unfathomable that Xiaomi or someone else goes all in on “privacy focused android” in absence of pixel+graphene combo. Edit: Apparently Motorola is doing just that.
- ignoramous 4mo ago> Apple really cashed in on privacy for a few years Apple didn't "cash in", their marketing dept made sure privacy/security engineering got just enough budget to pull off miracles & then spend even more to successfully make the public forget about the very nasty Celebgate.
- thewebguyd 4mo ago> Celebgate That was a phishing campaign, not a breach.
- deleted 4mo ago[deleted]
- ignoramous 4mo agoMy point isn't about engineering.
- ethbr1 4mo ago> Xiaomi or someone else goes all in on “privacy focused android” in absence of pixel+graphene combo Xiaomi? Privacy?
- wolvoleo 4mo agoI don't think any Chinese company can pull the privacy card. They're bound by their government to spy on their customers just like American ones are. Otherwise Huawei would have already jumped into that gap. They have their own Google-independent OS now so they could have marketed it to privacy enthusiasts where the lack of Google services would have been a positive not a negative.
- ajdude 4mo agoYears ago I looked into GrapheneOS, and I ultimately didn't go with it because, at least at the time, they only supported pixel phones (specifically pixel phones that Google actively had security updates for). I realized that if I got that OS, I would be at the mercy of Google supporting the device in order to continue using GrapheneOS. In the end I just opted out of the android ecosystem altogether and went with a flip phone that I used as a hotspot for an iPod touch (we only used over VPN with locked down DNS and nothing google related). My privacy lasted about two weeks, because unfortunately Spotify was able to fingerprint that device to Facebook.
- opan 4mo agoI would highly recommend LineageOS. Supports non-Pixel phones, some of them many years old (although now that I double check, the Galaxy S3 and OnePlus One aren't on the devices list anymore, I guess they do stop supporting old stuff eventually...). The OnePlus 5 is still supported and was released in 2017. For anything older than that, I guess I'd recommend looking into postmarketOS.
- joe_mamba 4mo ago> at least at the time, they only supported pixel phones At the time? They still are the only devices officially supported. Having your freedom be tied to a handful of devices from Google, is a massive supply chain risk.
- edwcross 4mo agoDoes it affect the photo quality? It used to require letting go of the default photo app and thus a downgrade in photo processing.
- theodric 4mo agoInstall a 3rd party GCam and then the answer is no https://www.celsoazevedo.com/files/android/google-camera/ https://www.celsoazevedo.com/files/android/google-camera/
- cwillu 4mo agoThat sounds like the answer is actually yes: we're not talking about the lack of a camera app, but the lack of a camera app that knows the details of the usually-proprietary camera firmware
- oynqr 4mo agoYou can install both the regular GCam as well as third party mods. Actual GCam feels worse to me.
- t0bia_s 4mo agoProblem with stock Google camera app is that it made horrible HDRlike images even with HDR turned off. You cannot adjust amount of reduced highlights and increased shadows which makes images unrealistic with lack of depth.
- Cider9986 4mo agoNo, if you install the Google camera there is no difference in quality and by revoking network you don't lose privacy.
- dns_snek 4mo ago> by revoking network you don't lose privacy Be careful, apps can still communicate with other apps, e.g. revoking the network permission doesn't stop apps from fetching and displaying ads over the network. I don't know enough about Android internals to understand the mechanisms behind it, but clearly there are ways for apps to exfiltrate data. > Trying to use Network as a complete data exfiltration toggle isn't the intended purpose, and you should always consider apps within the profile being able to communicate for ALL data and access including permissions. It is not something only relevant to Network. https://discuss.grapheneos.org/d/4024-in-what-extent-can-apps-communicate-with-each-other/10 https://discuss.grapheneos.org/d/4024-in-what-extent-can-app... https://github.com/GrapheneOS/os-issue-tracker/issues/2197 https://github.com/GrapheneOS/os-issue-tracker/issues/2197
- Cub3 4mo ago> it was filled with ads You bought a phone from an advertising company?
- dackdel 4mo agofor some reason i read that in archer(animated) voice.
- harvey9 4mo agoDon't recall my old nexus devices having ads in the OS. Disappointing where Google has taken this.
- ClikeX 4mo agoTechnically they already did a built in ad with Android KitKat. Mostly benign, but I do remember being at an Android event and KitKats samples being given out to everyone. As well as KitKat wrappers being branded with the Android logo for a while.
- yard2010 4mo ago"Do you not?"
- fg137 4mo agoIt's not like buying from Samsung is any better.
- petre 4mo ago
- OtomotO 4mo agoWhat about banking Apps? No problem there? Some of them have ridiculous secur... compliance rules.
- Semaphor 4mo agoThe vast majority work, check this list for details: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/ https://privsec.dev/posts/android/banking-applications-compa...
- goerg 4mo agoThere is a list of compatible banking apps: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/#international-banking-apps https://privsec.dev/posts/android/banking-applications-compa...
- kakacik 4mo agoBig list, unfortunately one of my banks is not there (BCGE, Switzerland), most probably meaning I can't even login into ebanking in any other way since they have their properietary authentication app (CrontoSign, also not listed). Its rather small regional/cantonal bank so I get it, even though that region is Geneva, mecca of (some types of) banking. Other banks that I use are there. Almost perfect...
- flexxxxxxxxxer 4mo agoMy banking apps were missing in list too, it doesn't mean that they are not working. You can test and report on that issue tracker about your banking app if it works :)
- Semaphor 4mo agoBeing missing means they haven’t been tested, not that they don’t work. Generally they probably only don’t work if they require the google play verification thingy
- Scrounger 4mo ago
- teekert 4mo agoiOS is also going into this direction, just open the AppStore, it’s all the cheapest most horrible apps. Temu (shop like you don't give a s* about the planet), addictive AI Waifu’s (who needs human interaction anyway), clean your stuff but fake-time-wasting style (it's free dopamine!), search option’s first hit is often scammy (ie search for MS Authenticator). I feel that Steve ("If you want pr0n get an Android") would turn around in his grave from the sight of this. Its just a matter of time before this cesspool will leak into the rest of the OS, AppStore shows us the temptation is too big for Apple. When my iPhone 12 mini dies it’s /e/OS or GrapheneOS for me. My devices should serve me and my thoughts are my own.
- port11 4mo agoThe AppStore has been like that for eons, but then again I don’t know a single person that uses it or checks the “content” posted there. It’s an utter waste of time. I don’t think it will leak. After the U2 debacle, Apple might have learned not to push too hard on this front.
- strcat 4mo agoYou should read https://discuss.grapheneos.org/d/24134-devices-lacking-standard-privacysecurity-patches-and-protections-arent-private https://discuss.grapheneos.org/d/24134-devices-lacking-stand... about /e/ and also look at what they say about devices with strong privacy and security including but not limited to https://grapheneos.social/deck/@GrapheneOS/116353973732143171 https://grapheneos.social/deck/@GrapheneOS/11635397373214317....
- teekert 4mo agoI'm aware of this discussion, I don't really like the way the Graphene people communicate, also against FairPhone. But nevertheless I'm looking forward to their Motorola offer that should come any minute now?
- Cider9986 4mo agoGrapheneos communicates with facts, not opinions. It can come off as abrasive but it's never unfounded attacks or opinions.
- theandrewbailey 4mo agoWhen I got a new phone last year, I purposely got a Pixel (open box 9a) to put GrapheneOS on it immediately. Been happy living the de-Googled Android life since. I was sad that I had to go through the OOBE setup on the stock image to unlock the bootloader. At least it doesn't force an internet connection and login, unlike Windows.
- qurren 4mo agoIs it possible to install basic Google apps like Gmail, Calendar, Maps, Drive without googlifying the whole phone? I'm not looking to fully de-Google but I want Google as apps and not my OS.
- notRobot 4mo agoYes, you can have sandboxed Google apps: https://grapheneos.org/usage#sandboxed-google-play https://grapheneos.org/usage#sandboxed-google-play
- hxorr 4mo agoI believe one of Graphene OS's main features is that they allow you to run google play services in a sandboxed environment, so you can run your standard google apps but without the standard android deal where google play services has unfetteted access to all your phone's location/data/etc info
- hiitsmyaccount 4mo agoYes, you install the Google Play store via the GrapheneOS App Store. The OS comes with like 5 apps out of the box. The rest is up to you. Biggest caveats that I've encountered: tap to pay via Google Wallet is a no go, Android Auto can be flaky, MDM managed work profiles don't work at the moment, and some apps that use the Google Play integrity API fail to validate and refuse to work (I've only encountered one app that fails, and plenty others that work.) In general, I'm moving towards a de-Googled life and GrapheneOS is a great entrypoint towards that.
- y2244 4mo ago
- RachelF 4mo agoI too, liked it. However, some apps that I need for work, like Microsoft Authenticator, no longer work under GrapheneOS. https://www.theregister.com/on-prem/2026/03/10/microsoft-tightens-authenticator-checks-on-android-and-ios/5224719 https://www.theregister.com/on-prem/2026/03/10/microsoft-tig...
- Sarkie 4mo agoGoogle Authenticator works?
- gonzalohm 4mo agoI think Google authenticator implements the standard OTP which lots of apps (including keepass) should support. Microsoft uses their own propietary crap
- saintfire 4mo agoI use a basic OTP password instead of Microsoft's ironically less secure (see SMS as 2FA) with my work MS account. Perhaps your org disabled it but it is definitely something a Microsoft account can do.
- Peanuts99 4mo agoProper Microsoft authenticator setup is more secure than OTP because it's pushed based and doesn't allow users to copy paste their OTP codes into phishing sites. Google also prefer push based MFA for this reason.
- saintfire 4mo agoPush based, sure. Allowing SMS, I still hold, undermines all of this. They "secure" this behind password which you entered to trigger the SMS push in the first place. Offering an "out" to a more secure flow means your secure flow may as well not exist. Additionally, phishing a pushed OTP is not really much harder since you can trigger the push and then just have the user finish off the flow for you, provided they don't read the IP or whatever you display them (they won't, they think they're signing in), effectively the same as a TOTP.
- Randomno 4mo ago> Wicked For Good Is this an antithesis to Don't Be Evil?
- genpfault 4mo agoWhat's the app data backup/restore story on GrapheneOS? My understanding is that even with pseudo-D2D (device-to-device) transfers Seedvault doesn't backup everything[1]. Are there more-functional, non-root, local (non-cloud) alternatives? [1]: https://github.com/seedvault-app/seedvault/wiki/FAQ#why-do-some-apps-not-allow-to-get-backed-up https://github.com/seedvault-app/seedvault/wiki/FAQ#why-do-s...
- lucb1e 4mo agoNot without root, no
- handedness 4mo agoSeedvault is still woefully insufficient, but it sounds like there's work being done to replace it. I can't imagine the enterprise crowd will overlook that and I'm hoping the Motorola partnership enables faster development.
- 3092-8121-9924 4mo ago> Seedvault is still woefully insufficient Ever since seedvault implemented local D2D API for app data availability and changed their repository format (inspired by restic's hashing) I've grown to trust seedvault enough that it's my sole phone backup. Seems to schedule/backup/restore just fine, even cross-device. Gets all the apps and files I care about. Incremental runs are slow but efficient (<1MB transferred). I have some UX gripes and would prefer if key and snapshot management was more flexible but the sentiment I see seems to be rooted in the earlier days when seedvault was more naive. Look forward to a GOS-native solution all the same.
- handedness 4mo agoThanks for your report. I'll give it another look.
- subscribed 4mo agoBackup situation is absolutely awful, don't count on it.
- FloatArtifact 4mo agoAny issues with banking insurance or healthcare applications?
- t0bia_s 4mo agoWhy would you use app for actual insuranceb or even healthcare?
- FloatArtifact 4mo agoThis is not really about me, but understanding if these apps have issues running under the OS. These type of apps typically have extra "security" features.
- t0bia_s 4mo agoSuch as? If there is dependency on proprietary software, you can install it on GOS if you want and consider it more "safe".
- FloatArtifact 4mo ago> Such as? If there is dependency on proprietary software, you can install it on GOS if you want and consider it more "safe". Again, this isn't about me. I'm fine giving up some convenience, but I know other people aren't. The average person is just going to simply install the app. Part of me asking this questions is gauging average user experience.
- Cider9986 4mo agoBanking 90+% of apps work. Some apps officially support GrapheneOS. The vast vast majority of apps (99%+) are compatible and those that are broken is due to bugs in the apps which GOS catches, but these exploit protections can be disabled, and apps that use the monopolistic play integrity api. The only apps that are permanently broken are those using the strongest play integrity api which is security theatre. Here's a community created list of banking applications and their current status on GOS. https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/ https://privsec.dev/posts/android/banking-applications-compa...
- yogthos 4mo agoSame, I've got a Pixel 9 and GrapheneOS works perfectly on it. I really love having full control over the OS on my phone and being able to decide what actually runs on it.
- sharts 4mo agoMakes you wonder who are clown employees coming up with these nonsense decisions
- nsonha 4mo agowould it have the desktop mode and linux terminal? That's the only reason I'm eyeing a Pixel
- a022311 4mo agoYep, I've used both. Desktop mode isn't exactly there yet, but hopefully with the general availability it will get with Android 17, it'll smoothen out. As for the Linux terminal I ended up sticking with a fork which provides a few extra features (https://github.com/outlawsanzhang/koiTerminal https://github.com/outlawsanzhang/koiTerminal)
- nsonha 4mo agoI have a samsung too, I only really need the dex mode in so far as I need the wired external screen support. Gonna run terminal or vnc fullscreen anyway
- flexxxxxxxxxer 4mo ago[dead]
- samplatt 4mo agoHow's the P10 camera on graphene? Literally 90% of the reason I'm on a pixel is because I love the low-light smarts that the camera software has, but I don't know if I'll lose that with Graphene.
- Aissen 4mo agoYou can install the Google Camera, if you use sandboxed Google Play. It has all the same features AFAIK.
- Itoldmyselfso 4mo agoIt works exactly the same as in the original "Pixel OS", you just install the same camera app from Play store.
- allthetime 4mo agoI want to run graphene but I make android apps and need to test on device with a somewhat standard setup… login with google, etc. is this reasonable to do with graphene?
- nicce 4mo agoHmm, you should have cheaper and separate phone for work anyway?
- allthetime 4mo agoIt is my cheaper separate phone. Main phone is iPhone which I can test iOS on. Android is mostly for testing, and backup/utility on long trips.
- toxicunderGroov 4mo agoI'd get a 2nd phone for that and it never leaves the house/location - living inside a bag with conductive material
- deleted 4mo ago[deleted]
- Cider9986 4mo agoYes, GOS has excellent compatibility with Google. The play services are sandboxed like a normal app and work great.
- StrangeSound 4mo agoDoes this mean I could install Google wallet? I feel like this would be the only thing really stopping me.
- Cider9986 4mo agoNo, unfortunately. If you live in the EU then you can use curve pay which can tap to pay. Why is no tap to pay significant enough to stop you from switching to a phone that is private and secure? You can just carry a card and tap—they're tiny.
- bigiain 4mo agoMemories of Apple force pushing a U2 album to everyone's iPod (or maybe iPhone) back in the day.
- IdiotSavage 4mo agoOr the more recent memory of the F1 ad pushed via the wallet app.
- LeoPanthera 4mo agoThat was a hilariously tone-deaf incident, but it's hardly comparable. Google pushed ads. Apple gave you a free album.
- davidwritesbugs 4mo agoYes, but a _U2_ album. An ad is 30 seconds of irritation, but a U2 album is like having broken glass sown under your skin.
- molybd3num 4mo agoyeah but you aren't forced to listen to it
- lisnake 4mo agoFor people with no other albums, Carplay was playing that U2 album automatically when they enter their car. So some people were forced to listen to it :-)
- nicman23 4mo agoyeah the pixel 10 pro - which i have - only saving grace is graphene..
- amelius 4mo agoHappy GrapheneOS user here too since 2+ years now. Small point of critique: it would be nice if it was a little bit easier to switch between personas, for example by simply scrolling to a different workspace. Because now the feature is mostly unused on my phone.
- mFixman 4mo agoWhat's the status of banking apps, Google / Microsoft authenticator, and Google Wallet? Those were the things preventing me from abandoning stock Android.
- herrherrmann 4mo agoYou can check this crowdsourced list for the compatibility of banking apps: https://github.com/PrivSec-dev/privsec.dev/blob/main/content/posts/android/Banking%20Applications%20compatibility%20with%20GrapheneOS.md https://github.com/PrivSec-dev/privsec.dev/blob/main/content... Authenticators should work normally, as far as I know (unless Google Authenticator does anything special). Can’t say anything about Google Wallet. There might be more lists/forums where people share which setups are (not) working well for them. In general, I had these concerns as well until a few months ago. But I am much more optimistic these days that things will just work well out of the box (have read many positive sentiments in blog posts and here on Hacker News).
- synergy20 4mo agohold on, are you saying graphenos has no ads everywhere? I need swap it in then
- aaron_m04 4mo ago> [...] until I noticed Google had force bundled a 'Wicked For Good' movie promo theme with the latest security update. This is how users learn to not update anything.
- chuckadams 4mo agoWon't matter when they force the updates anyway. You think that's your phone?
- ddejohn 4mo agoWhat are you using for cell service? Been wanting to switch to GOS for years, but I've also been really uninterested in having to find a new service provider (currently using fi).