Reclaiming Mobile Privacy with GrapheneOS

They don't know much about it and haven't used it. CalyxOS isn't a hardened OS and isn't at all comparable to GrapheneOS. They recently didn't even ship half the baseline Android security patches for 2 months, let alone providing much better patching and substantially hardening the privacy and security of the OS. Unfortunately, they've chosen to promote it through inaccurate talking points about GrapheneOS and fabricated stories about our developers. They've heavily invested in this. You can see their developers doing it earlier today. You'll see it in every thread about GrapheneOS on this site from people promoting CalyxOS, which again, is a highly insecure non-hardened OS rolling back the Android security model substantially and not shipping full baseline Android patches on time. I don't understand why they come to pick this fight. GrapheneOS provides far better privacy, security and usability (much broader app compatibility).

I am able to run all banking apps from my 3 different banks that I use. Try it, you might be surprised.

GrapheneOS has the sandboxed Google Play compatibility layer. Most banking apps work fine on GrapheneOS. Certain banking/financial services check for a Google certified OS via remote attestation. SafetyNet attestation is deprecated and being shut down and the Play Integrity API is the current way. Both of these support hardware-based attestation available on every device launched with Android 8 or later which cannot be spoofed.

You should read https://grapheneos.org/usage#banking-apps and https://grapheneos.org/articles/attestation-compatibility-gu.... GrapheneOS has full hardware-based attestation support and we use it ourselves in a much more secure way than this weak anti-fraud approach. The long-term solution is convincing major apps wanting to deploy this to allowlist GrapheneOS via hardware attestation.

We currently choose not to ship patches spoofing the traditional software-based SafetyNet attestation / Play Integrity API attestation. The reason for this is because we don't really want to ship a set of hacks which will stop working when they improve it and will permanently stop working when a service starts checking for strong verification. Having users start depending on Google Pay NFC payments working and then having it go away would be a problem for a production quality OS in a way that it wouldn't for a hobbyist project where expectations are different. We don't want to essentially commit to providing something we know is impossible to keep providing due to hardware attestation.

You can only spoof the weak basic verification, and whether it passed strong verification is always there in the result. It's only a matter of time before those services require it. It's based on when they're ready to start phasing out support for devices launched with Android 7.x and earlier along with a few phones that shipped with broken verified boot / attestation support even after it was required such as OnePlus. They can require it only for certain features if they want. Android 10+ is needed for security updates, so if they truly do care about security, nearly 100% of devices launched with Android 7.x and earlier are irrelevant now since only a small portion got upgraded to Android 10 (almost none beyond it) and those are now losing security support. Android 10 will be losing security support soon.

We may reconsider and ship spoofing for the legacy software-based attestation (known as non-strong verification by those APIs) if not shipping it becomes an adoption issue due to others shipping it. It doesn't mean we think it's a good idea but we'd rather have people using a more secure OS than a highly insecure one often without proper security patches and a fake patch level displayed...

GrapheneOS is a hardened OS. It not only preserves the whole standard privacy and security model including all the hardware-based security features but also substantially improves it. https://grapheneos.org/features provides an overview of only the improvements made by GrapheneOS compared to Android 13 (specifically, the stock Pixel OS). We make a fair number of upstream contributions and those aren't listed on our features page once they're shipped by the stock Pixel OS.

GrapheneOS provides our sandboxed Google Play compatibility layer allowing using the Google Play apps as regular apps in the full standard app sandbox with no special access or privileges. We've made them work like any other apps, with absolutely no ability to do something a regular user installed app can't do. You also don't need to grant them permissions to use 95% of functionality and can revoke our added Sensors toggle (Network COULD be revoked and you can use GSF + Google Camera + Google Photos with Network revoked from each but most of Play services exists to provide Google services so it would somewhat defeat the purpose, but it's possible).