4 ms·

Is it possible to install basic Google apps like Gmail, Calendar, Maps, Drive without googlifying the whole phone? I'm not looking to fully de-Google but I wan

by qurren 4mo ago

Is it possible to install basic Google apps like Gmail, Calendar, Maps, Drive without googlifying the whole phone? I'm not looking to fully de-Google but I want Google as apps and not my OS.

notRobot 4mo ago
Yes, you can have sandboxed Google apps: https://grapheneos.org/usage#sandboxed-google-play https://grapheneos.org/usage#sandboxed-google-play
hxorr 4mo ago
I believe one of Graphene OS's main features is that they allow you to run google play services in a sandboxed environment, so you can run your standard google apps but without the standard android deal where google play services has unfetteted access to all your phone's location/data/etc info
hiitsmyaccount 4mo ago
Yes, you install the Google Play store via the GrapheneOS App Store. The OS comes with like 5 apps out of the box. The rest is up to you. Biggest caveats that I've encountered: tap to pay via Google Wallet is a no go, Android Auto can be flaky, MDM managed work profiles don't work at the moment, and some apps that use the Google Play integrity API fail to validate and refuse to work (I've only encountered one app that fails, and plenty others that work.) In general, I'm moving towards a de-Googled life and GrapheneOS is a great entrypoint towards that.
- y2244 4mo ago
  Tap to pay is mostly NFC? So is there an alternative app?
  - vrganj 4mo ago
    There's Curve Pay in Europe. In the US, I'm not sure.
  - wolvoleo 4mo ago
    Yes you can use Curve pay. Edit: Apparently that's Europe only? I'm in Europe so yeah. I didn't know that.
  - jordand 4mo ago
    Curve Pay has worked well for me. Only good alternative as it doesn't depend on Google Play Services too
  - cyberax 4mo ago
    I extracted a chip (by dissolving the plastic in acetone) from my card and glued it to the wriststrap of my Pebble watch :)
    - distances 4mo ago
      When using contactless payment with my card, about 10% of the time the payment terminal tells me to insert the card to the reader slot instead and enter my PIN. I assumed this is a general security feature, but I guess it depends on the issuing bank then. This in Europe.
      - cyberax 4mo ago
        Well, I still have a backup physical card. It just is annoying to get it out of my wallet.
        Spare_account 4mo ago
        [dead]
    - pezgrande 4mo ago
      Nice hack but sounds quite unsafe, I like having to unblock de phone in order to use it.
  - dgrabla 4mo ago
    Paypay works as well (at least in Germany)
  - subscribed 4mo ago
    Garmin Pay, Samsung pay if you have a compatible bank and card, PayPal in Germany and sometimes banks' own systems. I had a very weird (bad) experience with Curve support so I couldn't recommend it. NFC payments work, it's only Google who claims a phone not patched for 8 years is safe and secure, but phone with working hardware attestation and patched 6 months ahead of everyone else is insecure.
- handedness 4mo ago
  My end-run around Google's absurd unwillingness to certify GOS for Google Pay has been Garmin Pay, which has worked virtually everywhere I've ever tried it. I'm hopeful that an OEM Motorola device will get certified for Google Pay.
  - microtonal 4mo ago
    Depends as bit on the country and bank. I also use Garmin Pay, but my bank only supports adding their credit card (not debit card) and a substantial portion of shops here only supports contactless payment through debit cards (credit cards have historically not been popular here). So I get to use contactless payment at maybe 50% of the stores, which is annoying, because it's sometimes hard tot tell ahead of time.
- qurren 4mo ago
  > MDM managed work profiles Do you mean actual employer-spyware MDM work profiles? I suppose I never expected those to work. Or do you mean things like Shelter, which uses work profiles and which I use to quarantine certain less-trusted apps?
  - hiitsmyaccount 4mo ago
    Yes, I mean MDM work profiles. I play an IT guy at work and am a Google Workspace admin. We have it running in BYOD mode and it's actually not intrusive at all. The most sensitive data you can see as an admin is what apps are installed in the work profile, the phone's make + model, and the version of Android. Nothing like location, charge level, or anything outside of the work profile. I'm fine with running it on my personal device (I actually really like the way it functions), but it's borked on current versions of GOS.
    - nekusar 4mo ago
      How to say "I work for a company too cheapass to provide work devices". Its all fun and games until the company gets hit with a lawsuit and discovery hits your phone and ALL your accounts, corporate and personal.
      - Uvix 4mo ago
        Some people don’t want to carry two devices and prefer BYOD, even if the company offers a work phone.
        nekusar 4mo ago
        Its all fun and games until the company gets hit with a lawsuit and discovery hits your phone and ALL your accounts, corporate and personal. Ive been through a corporate discovery when oracle sued a company I worked at. Im fucking glad that my work devices were purely owned by the company. NEVER FUCKING LET WORK AND NONWORK STREAMS CROSS.
- strcat 4mo ago
  Android Auto is fully supported and shouldn't be any more flaky than it is on the stock OS. It's often flaky due to a bad USB connection or problematic implementation in the car. That's just how it is everywhere. Google Wallet bans using anything other than an unmodified Google Mobile Services stock OS but there are alternatives in certain regions. In Europe, there are a lot of banking apps with tap-to-pay compatible with GrapheneOS and also Curve Pay. PayPal also has a limited tap-to-pay launch in Germany.
drnick1 4mo ago
> I'm not looking to fully de-Google but I want Google as apps and not my OS. This is entirely possible as other posters have explained. But I think it kind of defeats the point of Graphene, at least somewhat. Google is already profiling every aspect of your life by reading your emails, files, calendar, location, etc? In that case, OS access becomes moot. I think that GrapheneOS makes most sense as part of a broader move towards privacy-respecting alternatives. I see the sandboxed Play Services as something useful perhaps in a secondary user profile, for the odd commercial app required and only available from the Play Store.
- fooqux 4mo ago
  I agree and have moved mostly away from everything Google. But it's hard to replace maps. I know open street maps exists but it's hard to beat Google's data gathering.
  - handedness 4mo ago
    I've settled on running CoMaps in the Owner profile, with Google Maps/Waze/etc. in the Owner profile's Private Space for when they're necessary.
    - fooqux 4mo ago
      Can that setup work with android auto? If so, I'll need to try that.
      - NoGravitas 4mo ago
        I use CoMaps in the owner profile with Android Auto. Only caveat is that even with Android Auto developer mode enabled, I still had to install CoMaps from Play Store to get it to show up in Android Auto.
  - donalhunt 4mo ago
    There are players in the OpenStreetMap ecosystem attempting to change that. I know the team behind Organic Maps are actively working to make their app as viable as possible by sourcing appropriate data for example.
handedness 4mo ago
I run a litany of Google (and other corporate/business apps) apps in Private Space under the owner's profile, which is only unlocked when I need it for something. That space's connection can go out over a WireGuard tunnel if I need those apps to be on any specific networks, while the rest of the phone's traffic is unaffected. The file systems stay functionally separate (although that's not a major concern given how file encryption is handled, plus the dream that is Storage Scopes), and that space has its own camera app and such. The Owner profile itself doesn't run Google Play Services, so when that Private Space is locked and dormant it's effectively a degoogled stack. Some will invariably argue that an old pocket-sized Linux PC with a cellular modem is a superior experience, and for some specific things it may well be, but GrapheneOS is the only viable option for someone looking for a user-respecting modern phone with very few limitations.
upboundspiral 4mo ago
Yes absolutely. You can install nonprivileged google stuff on the main account. Alternatively you can setup a private space (accessible to the main user but mostly separate from the main system) with a few clicks in the settings. If you prefer more friction / isolation you can setup a separate user where you can install the google stuff.
strcat 4mo ago
Yes, those are all compatible and the only way to use them is as regular sandboxed apps without any special access. Sandboxed Google Play can be installed in the profiles of your choice. Installing it in the main Owner user is a valid choice and doesn't at all ruin what GrapheneOS provides but you can make a dedicated work profile or Private Space for it to keep it separate. Only apps in the same profile can see it and use it, so you can control which apps will use their functionality depending on it that way.

by qurren 4mo ago

Is it possible to install basic Google apps like Gmail, Calendar, Maps, Drive without googlifying the whole phone? I'm not looking to fully de-Google but I want Google as apps and not my OS.

notRobot 4mo ago

Yes, you can have sandboxed Google apps: https://grapheneos.org/usage#sandboxed-google-play https://grapheneos.org/usage#sandboxed-google-play

hxorr 4mo ago

I believe one of Graphene OS's main features is that they allow you to run google play services in a sandboxed environment, so you can run your standard google apps but without the standard android deal where google play services has unfetteted access to all your phone's location/data/etc info

hiitsmyaccount 4mo ago

Yes, you install the Google Play store via the GrapheneOS App Store. The OS comes with like 5 apps out of the box. The rest is up to you. Biggest caveats that I've encountered: tap to pay via Google Wallet is a no go, Android Auto can be flaky, MDM managed work profiles don't work at the moment, and some apps that use the Google Play integrity API fail to validate and refuse to work (I've only encountered one app that fails, and plenty others that work.) In general, I'm moving towards a de-Googled life and GrapheneOS is a great entrypoint towards that.

y2244 4mo ago
Tap to pay is mostly NFC? So is there an alternative app?
- vrganj 4mo ago
  There's Curve Pay in Europe. In the US, I'm not sure.
- wolvoleo 4mo ago
  Yes you can use Curve pay. Edit: Apparently that's Europe only? I'm in Europe so yeah. I didn't know that.
- jordand 4mo ago
  Curve Pay has worked well for me. Only good alternative as it doesn't depend on Google Play Services too
- cyberax 4mo ago
  I extracted a chip (by dissolving the plastic in acetone) from my card and glued it to the wriststrap of my Pebble watch :)
  - distances 4mo ago
    When using contactless payment with my card, about 10% of the time the payment terminal tells me to insert the card to the reader slot instead and enter my PIN. I assumed this is a general security feature, but I guess it depends on the issuing bank then. This in Europe.
    - cyberax 4mo ago
      Well, I still have a backup physical card. It just is annoying to get it out of my wallet.
      - Spare_account 4mo ago
        [dead]
  - pezgrande 4mo ago
    Nice hack but sounds quite unsafe, I like having to unblock de phone in order to use it.
- dgrabla 4mo ago
  Paypay works as well (at least in Germany)
- subscribed 4mo ago
  Garmin Pay, Samsung pay if you have a compatible bank and card, PayPal in Germany and sometimes banks' own systems. I had a very weird (bad) experience with Curve support so I couldn't recommend it. NFC payments work, it's only Google who claims a phone not patched for 8 years is safe and secure, but phone with working hardware attestation and patched 6 months ahead of everyone else is insecure.
handedness 4mo ago
My end-run around Google's absurd unwillingness to certify GOS for Google Pay has been Garmin Pay, which has worked virtually everywhere I've ever tried it. I'm hopeful that an OEM Motorola device will get certified for Google Pay.
- microtonal 4mo ago
  Depends as bit on the country and bank. I also use Garmin Pay, but my bank only supports adding their credit card (not debit card) and a substantial portion of shops here only supports contactless payment through debit cards (credit cards have historically not been popular here). So I get to use contactless payment at maybe 50% of the stores, which is annoying, because it's sometimes hard tot tell ahead of time.
qurren 4mo ago
> MDM managed work profiles Do you mean actual employer-spyware MDM work profiles? I suppose I never expected those to work. Or do you mean things like Shelter, which uses work profiles and which I use to quarantine certain less-trusted apps?
- hiitsmyaccount 4mo ago
  Yes, I mean MDM work profiles. I play an IT guy at work and am a Google Workspace admin. We have it running in BYOD mode and it's actually not intrusive at all. The most sensitive data you can see as an admin is what apps are installed in the work profile, the phone's make + model, and the version of Android. Nothing like location, charge level, or anything outside of the work profile. I'm fine with running it on my personal device (I actually really like the way it functions), but it's borked on current versions of GOS.
  - nekusar 4mo ago
    How to say "I work for a company too cheapass to provide work devices". Its all fun and games until the company gets hit with a lawsuit and discovery hits your phone and ALL your accounts, corporate and personal.
    - Uvix 4mo ago
      Some people don’t want to carry two devices and prefer BYOD, even if the company offers a work phone.
      - nekusar 4mo ago
        Its all fun and games until the company gets hit with a lawsuit and discovery hits your phone and ALL your accounts, corporate and personal. Ive been through a corporate discovery when oracle sued a company I worked at. Im fucking glad that my work devices were purely owned by the company. NEVER FUCKING LET WORK AND NONWORK STREAMS CROSS.
strcat 4mo ago
Android Auto is fully supported and shouldn't be any more flaky than it is on the stock OS. It's often flaky due to a bad USB connection or problematic implementation in the car. That's just how it is everywhere. Google Wallet bans using anything other than an unmodified Google Mobile Services stock OS but there are alternatives in certain regions. In Europe, there are a lot of banking apps with tap-to-pay compatible with GrapheneOS and also Curve Pay. PayPal also has a limited tap-to-pay launch in Germany.

drnick1 4mo ago

> I'm not looking to fully de-Google but I want Google as apps and not my OS. This is entirely possible as other posters have explained. But I think it kind of defeats the point of Graphene, at least somewhat. Google is already profiling every aspect of your life by reading your emails, files, calendar, location, etc? In that case, OS access becomes moot. I think that GrapheneOS makes most sense as part of a broader move towards privacy-respecting alternatives. I see the sandboxed Play Services as something useful perhaps in a secondary user profile, for the odd commercial app required and only available from the Play Store.

fooqux 4mo ago
I agree and have moved mostly away from everything Google. But it's hard to replace maps. I know open street maps exists but it's hard to beat Google's data gathering.
- handedness 4mo ago
  I've settled on running CoMaps in the Owner profile, with Google Maps/Waze/etc. in the Owner profile's Private Space for when they're necessary.
  - fooqux 4mo ago
    Can that setup work with android auto? If so, I'll need to try that.
    - NoGravitas 4mo ago
      I use CoMaps in the owner profile with Android Auto. Only caveat is that even with Android Auto developer mode enabled, I still had to install CoMaps from Play Store to get it to show up in Android Auto.
- donalhunt 4mo ago
  There are players in the OpenStreetMap ecosystem attempting to change that. I know the team behind Organic Maps are actively working to make their app as viable as possible by sourcing appropriate data for example.

handedness 4mo ago

I run a litany of Google (and other corporate/business apps) apps in Private Space under the owner's profile, which is only unlocked when I need it for something. That space's connection can go out over a WireGuard tunnel if I need those apps to be on any specific networks, while the rest of the phone's traffic is unaffected. The file systems stay functionally separate (although that's not a major concern given how file encryption is handled, plus the dream that is Storage Scopes), and that space has its own camera app and such. The Owner profile itself doesn't run Google Play Services, so when that Private Space is locked and dormant it's effectively a degoogled stack. Some will invariably argue that an old pocket-sized Linux PC with a cellular modem is a superior experience, and for some specific things it may well be, but GrapheneOS is the only viable option for someone looking for a user-respecting modern phone with very few limitations.

upboundspiral 4mo ago

Yes absolutely. You can install nonprivileged google stuff on the main account. Alternatively you can setup a private space (accessible to the main user but mostly separate from the main system) with a few clicks in the settings. If you prefer more friction / isolation you can setup a separate user where you can install the google stuff.

strcat 4mo ago

Yes, those are all compatible and the only way to use them is as regular sandboxed apps without any special access. Sandboxed Google Play can be installed in the profiles of your choice. Installing it in the main Owner user is a valid choice and doesn't at all ruin what GrapheneOS provides but you can make a dedicated work profile or Private Space for it to keep it separate. Only apps in the same profile can see it and use it, so you can control which apps will use their functionality depending on it that way.