Earlier quoted context omitted.
Yes to both.
Thank you!
The last release (as of writing) even had some call recording goodness: https://grapheneos.org/releases#2026021200
Enjoy
GrapheneOS – Break Free from Google and Apple
841–850 of 967 posts
Re: GrapheneOS – Break Free from Google and Apple
#842Earlier quoted context omitted.
I am not sure what you are trying to say. My point is that 1. If you care about privacy, you should care about security. If your email server is compromised and your emails leak in the public internet, then they are not private anymore. 2. GrapheneOS does care about both security and privacy. > explored my phone's capabilities with root. Accessing the sensor devices, inspecting what the different apps do, what the OS…
My phone isn't my email server though? It's not exposed to the public internet. It connects outwards but you can't simply connect inwards to the IMAP client You can invert your logic as well: Why care about security without privacy? If your apps are leaking everything to the internet, what's there to keep secure. One could argue this is the essential dependency, not the other way around, since security depends on the…
> You can invert your logic as well: Why care about security without privacy?
That's EXACTLY my point here. GrapheneOS cares about both, because GrapheneOS considers that they go together.
People come and say "GrapheneOS doesn't understand that people care about privacy and not security, therefore people are happier with less secure systems like /e/OS because /e/OS doesn't care much about security but cares about privacy".
My point is that I care about both, and I am therefore happier with GrapheneOS because GrapheneOS cares about both.
> Note also the part where it says "provide fake data to tracking apps": that's privacy which GOS
GrapheneOS offers such privacy features (like giving a permission to the app but telling the system to feed it dummy data). But yeah, maybe it's not exactly doing what you want (actually it sounds more like you just don't know what GrapheneOS can do, but it's not stopping you), therefore you can probably go around and claim that "GrapheneOS doesn't provide privacy", because why not?
Re: GrapheneOS – Break Free from Google and Apple
#843I personally tend to own two Phones. One all-day carry GrapheneOS device (Pixel 8) and an older WiFi and at home only iPhone for all payment and ensurance stuff. This is inconvenient in some ways, but at least it is sort of privacy as good as it gets while still being able to run official apps when I need them at home. To de-google the phone, I use F-Droid as primary App store, Aurora as fallback for non-f-droid Apps…
What would sandboxing an app like Google Maps look like? There are definitely situations where a sub-par map app would be detrimental. Obviously it's going to send data to Google, but do I have to sign into an account or will it have some other way of identifying my phone if I used a one-off account just for it?
Google Maps is sandboxed even on the stock Pixel OS. Sandboxing is part of the AOSP. GrapheneOS hardens the sandbox a bit, but it's not the most significant feature of the project. What isn't sandboxed on Android OSes that license Google Mobile Services (GMS) is Google Play (Play Store, Play Services and for older installs also Play Services Framework). On GrapheneOS Google Play is sandboxed as well, so it's treated as any other regular app, it's doesn't get priviliged exceptions.
Sandboxing isn't what would prevent an app from sending data. Sandboxing restricts what an app can access on your device because access is gated behind permissions and apps also can't peek into other apps. So it won't just be able to grab and send out data you don't give it access to, which is the most important of course.
You can install Google Maps and use a dedicated Google account for it with limited personal info. You can avoid giving your real name and also giving a phone number if you make your Google account from within the app and on a trusted network (not a VPN adress but public WiFi or cellular). It won't be able to identify your phone using hardware identifiers because non-system apps don't have access to those, the only regular app that might be able to acces such hardware identifiers is an app which is set as the default SMS app. See: https://grapheneos.org/faq#hardware-identifiers
Re: GrapheneOS – Break Free from Google and Apple
#844Earlier quoted context omitted.
Graphene is supposedly working with a major OEM manufacturer to have future device support independent of google, on a flagship device. It's been in the works for awhile but it's very exciting. https://www.androidauthority.com/graphene-os-major-android-o...
I hope it's Fairphone.
It won't be Fairphone. Fairphone is very far removed from the hardware requirements listed here https://grapheneos.org/faq#future-devices They don't seme to take security seriously at the moment, so the chance is low they are going to make the huge leap needed to meet the requirements.
Re: GrapheneOS – Break Free from Google and Apple
#845Earlier quoted context omitted.
You can lock the bootloader again with GrapheneOS and many banking apps work.
You won't pass Google Play hardware attestation that way, and you won't find a bank in Europe or the UK that doesn't require that to log on to their website within five years.
That's a prediction I would disagree with. Firstly, there are application developers which specifically add support for GrapheneOS if they are asked nicely. Secondly, there is a chance that Play Integrity will have to change due to anti-trust regulation.
Re: GrapheneOS – Break Free from Google and Apple
#846This is especially interesting in regard to the recent HN dicussion on spyware by for-profit intel firms having access to Whatsapp, Telegram, Signal, etc. ( https://news.ycombinator.com/item?id=47033976 ) through OS-level no-click hijacks. I wonder how secure GrapheneOS is in that regard, and what the other contenders are?
GrapheneOS have hardened_malloc which is a huge advantage, I think. It makes the weird machines problem much harder. I would say be very careful, because you can still get previews of images, or old and weird media formats that could be exploitable, and android/GrapheneOS doesn't have the same sorts of policy as say Apple with the iMessage blast door. They control safari, etc. Android's attack surface seems pretty ja…
Chromium is the only web engine present on a fresh install. If a user doesn't install a browser with another engine, the attack surface doesn't get increased. Chromium/Blink is more secure than Safari/Webkit overall so I don't really think this is an argument in favour of iOS. iOS for sure does some good things though and is better than Android in some areas.
Re: GrapheneOS – Break Free from Google and Apple
#847This is especially interesting in regard to the recent HN dicussion on spyware by for-profit intel firms having access to Whatsapp, Telegram, Signal, etc. ( https://news.ycombinator.com/item?id=47033976 ) through OS-level no-click hijacks. I wonder how secure GrapheneOS is in that regard, and what the other contenders are?
It's quite secure against casual attacks, but a proprietary mobile platform has inherent issues wrt. withstanding even mildly sophisticated attackers, including mercenary spyware services. You still have a huge attack surface from all sorts of proprietary firmware blobs and hardware IP blocks that are running directly on the SoC. It's not clear that it's really worth even trying to secure it as opposed to just treati…
The firmware being proprietary is compeltely unrelated to how much attack surface it has compared to open source firmware. The only thing that matters is how secure the firmware is.
Re: GrapheneOS – Break Free from Google and Apple
#848Earlier quoted context omitted.
Interesting. What are the alternatives to GrapheneOS that you wouldn't consider a "toy" ?
In my understanding, it's not the OS that makes it a toy but the hardware. I guess something with open schematics (Librem 5, Pinephone) should be better, or an open-hardware device like Precursor.
There is no way to know whether the phone you buy corresponds to the open schematics that are published. It's not verifiable like with software.
Re: GrapheneOS – Break Free from Google and Apple
#849Full control over app permissions GrapheneOS allows for full control over what permissions each application can have. For example, in conventional Android forks, every application by default has granted Network (internet access) and Sensors [...] permissions. Has anyone ever wondered if all apps on a phone need Internet access? Well, Apple made privacy a major selling point, so I'm sure you can do this on iOS, too. /…
Apple's OSes do not include an Application Firewall that allows you to control which app can access the internet. Graphene OS does.
Re: GrapheneOS – Break Free from Google and Apple
#850Earlier quoted context omitted.
If the open hardware offers at least comparable security then maybe. If the hardware is an open book then no. A short list of the hardware security measures necessary to consider it "not a toy" ;) -- https://grapheneos.org/faq#future-devices
I'm not convinced that all of these is required for security. My Qubes OS desktop is probably more secure than any GrapheneOS phone, and it only requires good hardware virtualization for that. > If the hardware is an open book then no. So you choose security through obscurity. I have no further questions.
x86 virtualization isn't perfect at all
QubesOS certainly has some good things going for it with isolation but the guest VMs which run traditional desktop OSes are generally much less secure than mobile OSes like Android OSes and iOS
Iirc it's not even possible to run QubesOS on hardware that has proper verified boot or non-meaningless secureboot.
With regards to security through obscurity, the Pixel firmware isn't obfuscated at all. It's closed source but it's easy to decompile the code and inspect it. They don't try to obfuscate it to make that difficult.