I’m considering the switch to GrapheneOS, so I watched this interview with one of the members of the GrapheneOS team, and honestly, I feel it was a great general introduction to it and touched on common features and misconceptions.

For those who don’t know, it’s one of the most secure and private mobile operating systems out there. Some things that I took away:

  1. They touched upon MAC randomization. I researched a bit on my own about what the need for it is. Apparently, it’s standard practice to randomize MAC addresses when scanning WiFi connections. However, GrapheneOS (and Pixel firmware) are even better at this, as they make sure they don’t leak any other identifiers when doing so. They also allow you to get a new random MAC for every connection that you make (not sure whether this is very useful, as this can cause problems). On a related note, even when WiFi/Bluetooth are “off,” stock Android can still scan in the background to improve location accuracy (by matching visible networks/devices against Google’s database). So basically, even with WiFi/Bluetooth off, Google still knows where you are. In GrapheneOS, this option is off by default.

  2. They have their own reverse proxies that they use to talk to Google on your behalf when needed.

  3. Apparently, in the USA you can be compelled to provide a fingerprint or Face ID. Courts have ruled this doesn’t violate the 5th Amendment because it’s physical, not testimonial. BUT you cannot be compelled to provide a password/PIN. That’s considered testimonial evidence, protected by the 5th Amendment. GrapheneOS has a two-factor system where, after using your fingerprint, you still need to enter a PIN, so it helps with this. They also have a BFU state after reboot, which is the safest and requires you to enter your full passphrase.

  • mazzilius_marsti@lemmy.world
    link
    fedilink
    arrow-up
    7
    ·
    edit-2
    10 days ago

    2 months GOS user here on Pixel 9. So far so good. You do have a lot more controls over the traditional Android phones. In fact, you have too much that for average user, i think it can be a bit overwhelmed.

    PROFILES

    For eg, you can easily install Google apps and use them like a normal phone. Problem is on Graphene, you have many ways to set this up. You can:

    a) install in your main profile and be done

    b) install Gapps in main the private space within main profile

    c) some crazy stuff like install Gapps in the private space of a secondary profile, which you lock using a completely different password.

    I spent too much time in this loop lol. Finally i settle on: all daily apps in main profile and sensitive apps live in a separate profile (banks, important docs).

    SECURITY

    1. Next the security features in GOS are amazing. You can control every single permissions that an app can do. I mean every thing including the system Phone app. I can go 100% paranoid and prevent the Phone app from Phone logs, microphone and Phone. Essentially making the Phone app useless… Very very nice but you need to experiment with your apps and see which permisions you can deny and which you cant. On normal Android? You can deny some apps but the system ones, you cant.

    2. I especially like the USB c feature. I leave mine on Charge only. So the port only functions to charge my phone. This cuts off every other connections: plug into PC, plug into car for Android Auto…etc. I like it that way. .

    Btw, Android auto works great too if you need it. .

    OS is so minimal that you will need to install essential apps on your own. For eg, i use Florisboard for keyboard, MiX for file manager.

    1. I really like the screenlock options on GOS. You can set:

    a) your usual password, pin, fingerprint

    AND

    b) a secondary pin that can be scrambled at random. So you unlock with your fingerprint then you need to enter that 2nd pin or password to enter the phone. EVERY single time. And it is scrambled too so you dont have to worry about people tracing your fingers.

    AND

    c) the Duress pin. This is like the nuke PIN. You set this up and hypothetically you are in a dangerous situations (thieves want you to unlock, local police abuse your phones…etc), you can enter this instead of your normal screen lock pin/password and every data is nuked. I havent tried it yet because i spent too much time set my phone rhe way I like it lol. If somebody tries it out, pls let me know.

    INSTALLATIONS

    Stupidly easy. On the OG Pixel, if you want to install LineageOS, you have to be very careful. Beside downloading the ROM, you need to flash a custom recovery like TWRP. Then becaude it is a Pixel, you nees to be careful which slot to flash the ROM. Flashing to the wrong one will brick the phone.

    On Graphene? It is literally plug your phone in and open the browser where the install notes are. The ONLy technical thing I need to do during the process waa enable bootloader unlock. Everything else was like “GOS finishes this, GOS finishes that, can you press this button, GOS is rebooting…”. .Very very simple.

    **SOME HELPFUL POINTS (i hope) **

    1. dont treat this as a Degoogle phone. .You can but the strong point of GOS is security.

    2. some features are not available compare to like.Samsung’s ONE UI . For eg, only allows an app to connect to 5G and not wifi.

    3. dont create a super complicate setup. The backup process will a pain.

  • ☂️-@lemmy.ml
    link
    fedilink
    arrow-up
    6
    ·
    edit-2
    10 days ago

    the only bad thing about graphene is that it needs an expensive pixel. and how they are mostly unobtanium.

    • Luffy@lemmy.ml
      link
      fedilink
      arrow-up
      3
      ·
      edit-2
      10 days ago

      Just doing some TP math for you.

      A xiamoi Redmi something something is about 130€. A pixel 8a is 370€ or a 9a 500€.

      With the xiaomi, you are getting no security updates for more than a year. For a pixel 8a, you get 6 years and 7 with the 9a. Therefore, if you want to keep your phone up to date because your Banking app needs those to work, you are looking at about 65/71€ per year. Also, if you want to keep it longer, you can use it for longer, with the build quality and a battery change up to 10 years or so.

      Also, anecdotally, those cheap phones are built like shit, run like shit, and you are genuinely better off buying a Samsung galaxy S7 and daily driving that. (Which I got when the S10 first came out, and BTW is still holding strong when I need a second phone in case I loose my pixel 7, after 6 years, unlike my huawei P30 which didn’t last a year until it started getting to 100°C when being on, and lagging to the point of being unusable.)

      • ☂️-@lemmy.ml
        link
        fedilink
        arrow-up
        1
        ·
        edit-2
        10 days ago

        pixels cost as much as an actually good used car here.

        180 euro is basically minimum wage here. none of the phones you mentioned are affordable at all.

        edit: just noticed it says 130 not 180, but still.

      • ☂️-@lemmy.ml
        link
        fedilink
        arrow-up
        2
        ·
        edit-2
        10 days ago

        i’m not sure what the problem is, but they are crazy expensive and hard to find in south america, and probably many other places.

    • outbloodyrageous@mander.xyz
      link
      fedilink
      arrow-up
      1
      ·
      9 days ago

      That has been my major issue with Pixel along with their poor quality control. I hope the new OEM they are targeting will be more widely available worldwide and affordable enough for the average person

      • ☂️-@lemmy.ml
        link
        fedilink
        arrow-up
        2
        ·
        edit-2
        9 days ago

        oh shit yeah, that too. i always forget their bad QC compared to their price.

    • Sasquatch@lemmy.ml
      link
      fedilink
      arrow-up
      2
      ·
      9 days ago

      I believe if you are compelled by police to unlock your device, and you wipe it instead, you may be charged with destruction of evidence, or at least obstruction of justice

  • soldan@lemmy.ml
    link
    fedilink
    arrow-up
    5
    ·
    edit-2
    9 days ago

    grapheneOS is a great system, it’s a shame about the absurd accusations made against eOS and iodé. On the other hand, the biggest problem with grapheneOS is its exclusivity: it only works on certain Pixel models, which are very difficult to find and expensive. Here in South America, it’s very difficult to find a Pixel, not to mention that they’re prohibitively expensive. But I suppose if you need that level of security, you’ll pay whatever it takes.

  • deathmetal27@lemmy.world
    link
    fedilink
    arrow-up
    5
    ·
    10 days ago

    Is switching to GrapheneOS reversible?

    I was wondering whether it affects warranty or hinders seeking service if there’s any problem in the phone.

  • Eat_Your_Paisley@lemmy.world
    link
    fedilink
    arrow-up
    5
    ·
    10 days ago

    I’ve been using Grapheme on a Pixel 8 Pro for about 6 months it’s been an adventure. There are so many options to lock stuff down but when you try full lock down some apps don’t work and the error messages they throw don’t say much so you in harden one thing at a time to make them work. This is not a phone you can just throw your SIM in and expect it to be just like your old phone.

    I do feel pretty confident with this phone on a Cabe SIM but you do need to commit.

  • emotional_soup_88@programming.dev
    link
    fedilink
    English
    arrow-up
    5
    ·
    11 days ago

    Great summary! Thanks for this! If I were to make the switch to GOS - which I am considering, Samsung user ATM, I’d never travel abroad - especially to and from the US - with my daily GOS driver. I’d travel with a backup phone that contains nothing. A new SIM card and some random chat app for communication with my loved ones. This is for plausible deniability (if I indeed were involved in anti government activism etc) and to avoid all the fuss. Not unlocking my phone gets me into trouble. Wiping my phone gets me into trouble. In that case, I just leave my daily driver at home.

  • PM_ME_YOUR_BOOBIES@lemmy.world
    link
    fedilink
    arrow-up
    2
    ·
    10 days ago

    For point 1, you can choose the MAC privacy settings on a per-connection basis. For example, my MAC is randomized periodically on all connections except my home network, where I use my device MAC.

    • Auli@lemmy.ca
      link
      fedilink
      English
      arrow-up
      1
      ·
      10 days ago

      I mean that is standard on all mobile OS. IOS has it standard android has it.

  • Pearl@lemmy.ml
    link
    fedilink
    arrow-up
    3
    arrow-down
    5
    ·
    10 days ago
    • Mac randomization is also on ios
    • Apple provides an ip hiding proxy service
    • ios has BFU where biometric is disabled. And holding power button disables biometric unlock. And nothing is better than just having biometric unlock turned off.
    • Coleslaw4145@lemmy.world
      link
      fedilink
      arrow-up
      6
      arrow-down
      1
      ·
      10 days ago
      • Apple also collects a massive amount of data on their users. But thats ok apparently as long as they just say “trust me bro”.
      • Doomsider@lemmy.world
        link
        fedilink
        arrow-up
        1
        ·
        10 days ago

        They definitely use your data to market to you on their platform. They might not be selling your data outside their network, but does that suddenly make it okay? They are still using your data to their enrich themselves.