5 ms·

When I got a new phone last year, I purposely got a Pixel (open box 9a) to put GrapheneOS on it immediately. Been happy living the de-Googled Android life since

When I got a new phone last year, I purposely got a Pixel (open box 9a) to put GrapheneOS on it immediately. Been happy living the de-Googled Android life since. I was sad that I had to go through the OOBE setup on the stock image to unlock the bootloader. At least it doesn't force an internet connection and login, unlike Windows.

qurren 4mo ago
Is it possible to install basic Google apps like Gmail, Calendar, Maps, Drive without googlifying the whole phone? I'm not looking to fully de-Google but I want Google as apps and not my OS.
- notRobot 4mo ago
  Yes, you can have sandboxed Google apps: https://grapheneos.org/usage#sandboxed-google-play https://grapheneos.org/usage#sandboxed-google-play
- hxorr 4mo ago
  I believe one of Graphene OS's main features is that they allow you to run google play services in a sandboxed environment, so you can run your standard google apps but without the standard android deal where google play services has unfetteted access to all your phone's location/data/etc info
- hiitsmyaccount 4mo ago
  Yes, you install the Google Play store via the GrapheneOS App Store. The OS comes with like 5 apps out of the box. The rest is up to you. Biggest caveats that I've encountered: tap to pay via Google Wallet is a no go, Android Auto can be flaky, MDM managed work profiles don't work at the moment, and some apps that use the Google Play integrity API fail to validate and refuse to work (I've only encountered one app that fails, and plenty others that work.) In general, I'm moving towards a de-Googled life and GrapheneOS is a great entrypoint towards that.
  - y2244 4mo ago
    Tap to pay is mostly NFC? So is there an alternative app?
    - vrganj 4mo ago
      There's Curve Pay in Europe. In the US, I'm not sure.
    - wolvoleo 4mo ago
      Yes you can use Curve pay. Edit: Apparently that's Europe only? I'm in Europe so yeah. I didn't know that.
    - jordand 4mo ago
      Curve Pay has worked well for me. Only good alternative as it doesn't depend on Google Play Services too
    - cyberax 4mo ago
      I extracted a chip (by dissolving the plastic in acetone) from my card and glued it to the wriststrap of my Pebble watch :)
      - distances 4mo ago
        When using contactless payment with my card, about 10% of the time the payment terminal tells me to insert the card to the reader slot instead and enter my PIN. I assumed this is a general security feature, but I guess it depends on the issuing bank then. This in Europe.
        cyberax 4mo ago
        Well, I still have a backup physical card. It just is annoying to get it out of my wallet.
        Spare_account 4mo ago
- drnick1 4mo ago
  > I'm not looking to fully de-Google but I want Google as apps and not my OS. This is entirely possible as other posters have explained. But I think it kind of defeats the point of Graphene, at least somewhat. Google is already profiling every aspect of your life by reading your emails, files, calendar, location, etc? In that case, OS access becomes moot. I think that GrapheneOS makes most sense as part of a broader move towards privacy-respecting alternatives. I see the sandboxed Play Services as something useful perhaps in a secondary user profile, for the odd commercial app required and only available from the Play Store.
  - fooqux 4mo ago
    I agree and have moved mostly away from everything Google. But it's hard to replace maps. I know open street maps exists but it's hard to beat Google's data gathering.
    - handedness 4mo ago
      I've settled on running CoMaps in the Owner profile, with Google Maps/Waze/etc. in the Owner profile's Private Space for when they're necessary.
      - fooqux 4mo ago
        Can that setup work with android auto? If so, I'll need to try that.
        NoGravitas 4mo ago
        I use CoMaps in the owner profile with Android Auto. Only caveat is that even with Android Auto developer mode enabled, I still had to install CoMaps from Play Store to get it to show up in Android Auto.
    - donalhunt 4mo ago
      There are players in the OpenStreetMap ecosystem attempting to change that. I know the team behind Organic Maps are actively working to make their app as viable as possible by sourcing appropriate data for example.
- handedness 4mo ago
  I run a litany of Google (and other corporate/business apps) apps in Private Space under the owner's profile, which is only unlocked when I need it for something. That space's connection can go out over a WireGuard tunnel if I need those apps to be on any specific networks, while the rest of the phone's traffic is unaffected. The file systems stay functionally separate (although that's not a major concern given how file encryption is handled, plus the dream that is Storage Scopes), and that space has its own camera app and such. The Owner profile itself doesn't run Google Play Services, so when that Private Space is locked and dormant it's effectively a degoogled stack. Some will invariably argue that an old pocket-sized Linux PC with a cellular modem is a superior experience, and for some specific things it may well be, but GrapheneOS is the only viable option for someone looking for a user-respecting modern phone with very few limitations.
- upboundspiral 4mo ago
  Yes absolutely. You can install nonprivileged google stuff on the main account. Alternatively you can setup a private space (accessible to the main user but mostly separate from the main system) with a few clicks in the settings. If you prefer more friction / isolation you can setup a separate user where you can install the google stuff.
- strcat 4mo ago
  Yes, those are all compatible and the only way to use them is as regular sandboxed apps without any special access. Sandboxed Google Play can be installed in the profiles of your choice. Installing it in the main Owner user is a valid choice and doesn't at all ruin what GrapheneOS provides but you can make a dedicated work profile or Private Space for it to keep it separate. Only apps in the same profile can see it and use it, so you can control which apps will use their functionality depending on it that way.
sowbug 4mo ago
If it's any consolation, the wipe* requirement before unlocking the bootloader is generally a good thing, even if it's inconvenient. Someone who is targeting your personal data gets access to your encrypted phone, either by stealing it or in an evil maid situation. They unlock the bootloader and install privileged code that helps them recover the symmetric encryption key or intercept your PIN. Then they either have your data or wait for you to enter the PIN. In theory recovery shouldn't be possible (access to the key depends on a secure element that rate limits brute-force attacks), but security bugs do happen. Wiping* your data before removing the bootloader's signing requirement is an extra layer of protection. *It doesn't actually wipe your data; it just destroys the symmetric key, making the data permanently unreadable.
- Markoff 4mo ago
  AFAIK you can't unlock bootloader without wiping the data, that's my experience from last 15 years unlocking bootloaders on various phones so it's kinda pointless to wipe data prior wiping them again during the bootloader unlocking process
  - sowbug 4mo ago
    We're saying the same thing. The bootloader unlocking process includes a step that destroys the FDE key.
Sophira 4mo ago
While the OOBE of the stock image doesn't force an Internet connection, the ability to unlock the bootloader does - whether you can do it or not depends on the phone manufacturer's desire, and Android for some reason uses an Internet connection to check that. My understanding is that it is impossible to unlock the bootloader on a new recent (Android 7+ at least; possiblt earlier) Android phone until it has connected to the Internet. After that, the ability to unlock the bootloader is permanent.
- Markoff 4mo ago
  it should be possible on Sony and OnePlus phones and maybe other brands, though it can require obtaining code from internet on other device, but the device being unlocked itself doesn't need to have internet connection
  - a96 4mo ago
    I think LG had a system for getting unlock codes as well, but they closed it a long time ago. Any other manufacturer may alter the deal any time. In case you have such a phone, dear reader, consider getting your code if you still can even if you won't use them yet.
- dlenski 4mo ago
  Yep, on older phones it was certainly possible without an Internet connection. On the Nexus 5, you could just `fastboot oem unlock` right out of the box, install TWRP (custom "recovery") and install CyanogenMod/LienageOS, without ever booting the stock ROM. On my Moto G4 Play and Moto X4, you had to get an unlock code from the Motorola website (based on the phone serial number I think) and waive some warranty terms, but once retrieved at least the phone didn't need to be online to unlock the bootloader. The process on the newer Pixels is disappointingly intrusive, like basically everything Google has done for the last decade.
  - Markoff 4mo ago
    If it is any consolation it became intrusive on pretty much every single brand nowadays, if they at least offer bootloader unlocking option.

qurren 4mo ago

Is it possible to install basic Google apps like Gmail, Calendar, Maps, Drive without googlifying the whole phone? I'm not looking to fully de-Google but I want Google as apps and not my OS.

notRobot 4mo ago
Yes, you can have sandboxed Google apps: https://grapheneos.org/usage#sandboxed-google-play https://grapheneos.org/usage#sandboxed-google-play
hxorr 4mo ago
I believe one of Graphene OS's main features is that they allow you to run google play services in a sandboxed environment, so you can run your standard google apps but without the standard android deal where google play services has unfetteted access to all your phone's location/data/etc info
hiitsmyaccount 4mo ago
Yes, you install the Google Play store via the GrapheneOS App Store. The OS comes with like 5 apps out of the box. The rest is up to you. Biggest caveats that I've encountered: tap to pay via Google Wallet is a no go, Android Auto can be flaky, MDM managed work profiles don't work at the moment, and some apps that use the Google Play integrity API fail to validate and refuse to work (I've only encountered one app that fails, and plenty others that work.) In general, I'm moving towards a de-Googled life and GrapheneOS is a great entrypoint towards that.
- y2244 4mo ago
  Tap to pay is mostly NFC? So is there an alternative app?
  - vrganj 4mo ago
    There's Curve Pay in Europe. In the US, I'm not sure.
  - wolvoleo 4mo ago
    Yes you can use Curve pay. Edit: Apparently that's Europe only? I'm in Europe so yeah. I didn't know that.
  - jordand 4mo ago
    Curve Pay has worked well for me. Only good alternative as it doesn't depend on Google Play Services too
  - cyberax 4mo ago
    I extracted a chip (by dissolving the plastic in acetone) from my card and glued it to the wriststrap of my Pebble watch :)
    - distances 4mo ago
      When using contactless payment with my card, about 10% of the time the payment terminal tells me to insert the card to the reader slot instead and enter my PIN. I assumed this is a general security feature, but I guess it depends on the issuing bank then. This in Europe.
      - cyberax 4mo ago
        Well, I still have a backup physical card. It just is annoying to get it out of my wallet.
        Spare_account 4mo ago
drnick1 4mo ago
> I'm not looking to fully de-Google but I want Google as apps and not my OS. This is entirely possible as other posters have explained. But I think it kind of defeats the point of Graphene, at least somewhat. Google is already profiling every aspect of your life by reading your emails, files, calendar, location, etc? In that case, OS access becomes moot. I think that GrapheneOS makes most sense as part of a broader move towards privacy-respecting alternatives. I see the sandboxed Play Services as something useful perhaps in a secondary user profile, for the odd commercial app required and only available from the Play Store.
- fooqux 4mo ago
  I agree and have moved mostly away from everything Google. But it's hard to replace maps. I know open street maps exists but it's hard to beat Google's data gathering.
  - handedness 4mo ago
    I've settled on running CoMaps in the Owner profile, with Google Maps/Waze/etc. in the Owner profile's Private Space for when they're necessary.
    - fooqux 4mo ago
      Can that setup work with android auto? If so, I'll need to try that.
      - NoGravitas 4mo ago
        I use CoMaps in the owner profile with Android Auto. Only caveat is that even with Android Auto developer mode enabled, I still had to install CoMaps from Play Store to get it to show up in Android Auto.
  - donalhunt 4mo ago
    There are players in the OpenStreetMap ecosystem attempting to change that. I know the team behind Organic Maps are actively working to make their app as viable as possible by sourcing appropriate data for example.
handedness 4mo ago
I run a litany of Google (and other corporate/business apps) apps in Private Space under the owner's profile, which is only unlocked when I need it for something. That space's connection can go out over a WireGuard tunnel if I need those apps to be on any specific networks, while the rest of the phone's traffic is unaffected. The file systems stay functionally separate (although that's not a major concern given how file encryption is handled, plus the dream that is Storage Scopes), and that space has its own camera app and such. The Owner profile itself doesn't run Google Play Services, so when that Private Space is locked and dormant it's effectively a degoogled stack. Some will invariably argue that an old pocket-sized Linux PC with a cellular modem is a superior experience, and for some specific things it may well be, but GrapheneOS is the only viable option for someone looking for a user-respecting modern phone with very few limitations.
upboundspiral 4mo ago
Yes absolutely. You can install nonprivileged google stuff on the main account. Alternatively you can setup a private space (accessible to the main user but mostly separate from the main system) with a few clicks in the settings. If you prefer more friction / isolation you can setup a separate user where you can install the google stuff.
strcat 4mo ago
Yes, those are all compatible and the only way to use them is as regular sandboxed apps without any special access. Sandboxed Google Play can be installed in the profiles of your choice. Installing it in the main Owner user is a valid choice and doesn't at all ruin what GrapheneOS provides but you can make a dedicated work profile or Private Space for it to keep it separate. Only apps in the same profile can see it and use it, so you can control which apps will use their functionality depending on it that way.

sowbug 4mo ago

If it's any consolation, the wipe* requirement before unlocking the bootloader is generally a good thing, even if it's inconvenient. Someone who is targeting your personal data gets access to your encrypted phone, either by stealing it or in an evil maid situation. They unlock the bootloader and install privileged code that helps them recover the symmetric encryption key or intercept your PIN. Then they either have your data or wait for you to enter the PIN. In theory recovery shouldn't be possible (access to the key depends on a secure element that rate limits brute-force attacks), but security bugs do happen. Wiping* your data before removing the bootloader's signing requirement is an extra layer of protection. *It doesn't actually wipe your data; it just destroys the symmetric key, making the data permanently unreadable.

Markoff 4mo ago
AFAIK you can't unlock bootloader without wiping the data, that's my experience from last 15 years unlocking bootloaders on various phones so it's kinda pointless to wipe data prior wiping them again during the bootloader unlocking process
- sowbug 4mo ago
  We're saying the same thing. The bootloader unlocking process includes a step that destroys the FDE key.

Sophira 4mo ago

While the OOBE of the stock image doesn't force an Internet connection, the ability to unlock the bootloader does - whether you can do it or not depends on the phone manufacturer's desire, and Android for some reason uses an Internet connection to check that. My understanding is that it is impossible to unlock the bootloader on a new recent (Android 7+ at least; possiblt earlier) Android phone until it has connected to the Internet. After that, the ability to unlock the bootloader is permanent.

Markoff 4mo ago
it should be possible on Sony and OnePlus phones and maybe other brands, though it can require obtaining code from internet on other device, but the device being unlocked itself doesn't need to have internet connection
- a96 4mo ago
  I think LG had a system for getting unlock codes as well, but they closed it a long time ago. Any other manufacturer may alter the deal any time. In case you have such a phone, dear reader, consider getting your code if you still can even if you won't use them yet.
dlenski 4mo ago
Yep, on older phones it was certainly possible without an Internet connection. On the Nexus 5, you could just `fastboot oem unlock` right out of the box, install TWRP (custom "recovery") and install CyanogenMod/LienageOS, without ever booting the stock ROM. On my Moto G4 Play and Moto X4, you had to get an unlock code from the Motorola website (based on the phone serial number I think) and waive some warranty terms, but once retrieved at least the phone didn't need to be online to unlock the bootloader. The process on the newer Pixels is disappointingly intrusive, like basically everything Google has done for the last decade.
- Markoff 4mo ago
  If it is any consolation it became intrusive on pretty much every single brand nowadays, if they at least offer bootloader unlocking option.