Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS – Break Free from Google and Apple

blog.tomaszdunia.pl

Post reply on HN
Print view View original

101–110 of 967 posts

Re: GrapheneOS – Break Free from Google and Apple

#101

Post by palata »

realusername wrote: post #52
SockThief wrote: post #31

Earlier quoted context omitted.

Consider this (by Graphene OS): https://discuss.grapheneos.org/d/24134-devices-lacking-stand... /e/OS community talking about it: https://community.e.foundation/t/article-from-grapheneos-abo... And then maybe this: https://eylenburg.github.io/android_comparison.htm Hope that helps.

I like GrapheneOS but they fail to understand in this post that the #1 security concern an android user face is the lack of privacy. Sure they have hardened everything but realistically, that's not the main threat for your average user. Their top contribution to android is the sandboxed Google Play, by far.

I think it's more of a marketing claim from less secure systems that "privacy is not security, and GrapheneOS focuses on security while we focus on privacy".

GrapheneOS does care about both, quite obviously. And GrapheneOS tends to say that if your security is bad, then it is affecting your privacy too. Whereas others say "sure, we break the Android security model by unlocking the bootloader and signing our system with the Google test keys, but your apps will contact Google through microG instead of the Play Services, so it's more private". Which is worth what it is worth...

Re: GrapheneOS – Break Free from Google and Apple

#102

Post by subscribed »

mentalgear wrote: post #13

This is especially interesting in regard to the recent HN dicussion on spyware by for-profit intel firms having access to Whatsapp, Telegram, Signal, etc. ( https://news.ycombinator.com/item?id=47033976 ) through OS-level no-click hijacks. I wonder how secure GrapheneOS is in that regard, and what the other contenders are?

Hard to say how it fares against those specific attacks but some of the vulnerabilities that will go out in the mid-2026 on the mainstream handsets are already patched: https://grapheneos.org/releases#2026021200

(it's not magic. All big vendors have these details, just choose to take their sweet time to patch them. GOS has partnered with a major OEM vendor who provides them with access)

Other than the specific patches above, there's a list of generic GOS features: https://grapheneos.org/features#exploit-protection

All in all you're probably much safer.

Re: GrapheneOS – Break Free from Google and Apple

#103

Post by realusername »

scheeseman486 wrote: post #92
realusername wrote: post #73

Earlier quoted context omitted.

I disagree, privacy is an essential part of security, if there's no privacy, then there's no security. That's also why I don't keep anything important on my phone as I don't trust what's going on there despite having all the secure features that you would want.

Other way around, actually. It's possible to make concessions to privacy, like providing crash reports, or running applications in sandboxes which limits what they can harvest, while keeping the platform secure. Any privacy you have on a system is reliant on no one tampering with that system and on software behaving itself. Without security, you can't trust the system to implement any privacy.

I also disagree with that, I trust my Linux distribution to behave well much more than I trust any Android platform and it doesn't even have much app sandboxing at all.

You can't fix a lack of trust like you have in Android with technical solutions. The flaw in Android is fundamentally a social problem.

Re: GrapheneOS – Break Free from Google and Apple

#105

Post by bergheim »

Been using this for about a year on a p9 pro. It works very well. I hear the google tap to pay does not work, but I've never tried it. However Vipps with their tap to pay works fine. BankID works but not with biometric login, which some things require IIRC. And for some reason DnB private works fine, but you are not allowed in on the corp app.

It's mind boggingly stupid that they lock down apps like this, when you can just open the thing in a website anyway. I can use my bank on some linux distro, crazy that they trust me since it is not Windows - the truly secure OS!

Knew about those things before I started, so all in all I'm pretty happy. I'd recommend NOT using different users for different things (I started with banking etc in one profile, that ended up being a huge PITA and according to their docs it is mostly security theater anyway). Happy tinkering!

Re: GrapheneOS – Break Free from Google and Apple

#106

Post by palata »

lejalv wrote: post #93
palata wrote: post #80

Earlier quoted context omitted.

I have been a user of /e/OS for 5 years, and also of GOS and would like to share my opinion on this: > it's worth noting that the GOS community is absurdly toxic to anyone doing anything privacy-related that isn't under the banner of GOS What I have seen (and I am not involved in any of those projects) is that GOS does care a lot about security, has a higher quality in that regard than anything else, and tends to be…

/e/OS/ was bad with updates for a long time (I had to switch 2022). IodéOS is very good at it, in my experience (I have used all three)

> /e/OS/ was bad with updates for a long time (I had to switch 2022).

In my case, it was a few months ago, so end of 2025.

I think it's just that they can't possibly support thousands of Android devices. I just don't like that they are not being very clear about it. You would think that buying a phone through Murena would guarantee some kind of support, but it actually doesn't.

Re: GrapheneOS – Break Free from Google and Apple

#107

Post by ozlikethewizard »

Myzel394 wrote: post #10

I've been using GrapheneOS for about 3 years now. For the most part, it works very well. I don't have any issues with banking apps, nor any other closed source apps. I'm using two profiles both with sandboxed Google play installed. I'm logged in into my private Google account on the work profile. However, there was one case that lead me to thinking about ditching grapheneos to this day. I installed Uber on my phone a…

Maybe not being able to use Uber isn't the downside you think it is though. UK centric view but call a cab and pay in cash, you haven't comprimised your security and you're not engaging with an unethical business.

Re: GrapheneOS – Break Free from Google and Apple

#108

Post by palata »

galangalalgol wrote: post #67
gf000 wrote: post #54

Earlier quoted context omitted.

Android is a Linux OS and is eons ahead anything that would sit on top of "GNU/Linux" userspace. Why start from scratch?

Yeah, just need to decide where to start the fork. The larger problem is radio firmware. FCC regs were the initial excuse, for wifi and Bluetooth too, but we need to open up the source for all of these and allocate money for enforcement if we are truly worried people are going to start adding wifi channels etc. Open firmware phone radios would let you do things like truly turning off the radio when wifi was present,…

The good news being that the work made by Linux on Mobile projects regarding the radio firmware benefits AOSP projects, and inversely, right?

Re: GrapheneOS – Break Free from Google and Apple

#110

Post by zozbot234 »

mentalgear wrote: post #13

This is especially interesting in regard to the recent HN dicussion on spyware by for-profit intel firms having access to Whatsapp, Telegram, Signal, etc. ( https://news.ycombinator.com/item?id=47033976 ) through OS-level no-click hijacks. I wonder how secure GrapheneOS is in that regard, and what the other contenders are?

It's quite secure against casual attacks, but a proprietary mobile platform has inherent issues wrt. withstanding even mildly sophisticated attackers, including mercenary spyware services. You still have a huge attack surface from all sorts of proprietary firmware blobs and hardware IP blocks that are running directly on the SoC. It's not clear that it's really worth even trying to secure it as opposed to just treating it like an untrusted toy.
Post reply on HN