Hello, making this post to get some honest, and technical opinions about GrapheneOS. Please do not be bother by this question. No drama here pls 🙏. I’ve heard that there is some of the google code into the “sandbox” feature. Say your opinion below! 👇👇
There’s also CalyxOS, low drama and very reliable. Https://www.calyxos.org
Calyx is unfortunately pretty slow to release security patches, uses privileged apps with root access like microG and the F-Droid privileged extension by default and doesn’t really provide any unique features. All of the privacy features of Calyx are either already present or can be easily replicated in a better form on GrapheneOS. Take Datura Firewall, it’s yet another privileged app with root access which adds unnecessary attack surface, and is less secure than the Graphene equivalent. GrapheneOS implements a network permission toggle, which is embedded in Android’s native permission manager and uses the INTERNET permission to restrict network access. It disables both direct and indirect network access, including the local device network (localhost). GrapheneOS also has a bunch of unique security features, that can’t be found on any other Android ROM, like for example a hardened memory allocator, hardened kernel, secure app spawning, improved SELInux policies, Duress PIN/Password, driver-level USB-C control, Storage Scopes, Contact Scopes and soon App Communication Scopes. GrapheneOS also includes Sandboxed Google Play services, a better GMS implementation than microG, which doesn’t require root and has better app compatibility.
All your points are true, yet still depend on Google in sandboxed form. That negates everything else for me, who wants a reasonably secure device that works out of the box and also respects my privacy.
If a nation-state wants into my phone, it’s delusional to believe even graphene can hold them off, you need real opsec for that, and unfortunately all I’ve seen thus far from graphene guys is cosplaying that the NSA wants your porn selfies.
Graphene and micro g? Cool. Sandboxed Google? Nope.
All your points are true, yet still depend on Google in sandboxed form. That negates everything else for me, who wants a reasonably secure device that works out of the box and also respects my privacy.
Graphene doesn’t “depend” on Sandboxed Play services. In fact, it’s not installed by default, and it is totally optional. Also, Sandboxed Play services doesn’t make your device less secure in any way, it can be installed as a normal user app, you can fully control access to sensitive parts of your device like the microphone, camera, location, etc. through the Android permission manager, and Play services don’t have any special permissions, since it’s not installed as a system app. As far as I’m aware (correct me if I’m wrong) you can’t remove microG on Calyx, since it’s installed as a system app and even granted root privileges. microG is a cheap, hacked together workaround, which requires root to function correctly. This greatly expanded attack surface makes it inherently insecure. microG also requires proprietary Google code to be run, in order to work (most of microG is open source, but it still uses some Google blobs). As far as I’m aware, this Google code is not sandboxed, and simply executed as a child process of microG (which runs as root), meaning that this Google blob is also run as root. This makes microG much more insecure than Sandboxed Google Play services, and it potentially gives Google much greater access to your device compared to the sandboxed approach.
If a nation-state wants into my phone, it’s delusional to believe even graphene can hold them off
The GrapheneOS team never claims that their OS is “NSA-proof”, but they actually look at which parts of the OS are commonly exploited by (nation-state) hackers, and massively improve them. As you can see in this spreadsheet, created by Google’s Project Zero, most vulnerabilities in Android come from memory corruption. That’s why GrapheneOS’s biggest and most important feature is their custom hardened memory allocator. It protects against most memory-related exploits, and is even stronger when used on a device with hardware memory tagging, which is the reason why GrapheneOS currently only supports Google Pixel devices.
Another significant security feature is secure app spawning. Creating new processes via exec (instead of using the traditional Zygote model on Android) randomizes the initial memory layout, which also helps to defend against memory-related vulnerabilities. The aspects I just mentioned are important protections about malware/remote code execution.GrapheneOS also protects your device against physical attacks, e.g. by implementing a driver-based control mechanism for the USB-C port, making it impossible to connect to the device while it’s locked. This protects against forensic data extraction, e.g. using Cellebrite or XRY hardware.
Graphene even has a feature that protects you, when you are forced to give up your password. The Duress feature let’s you set a second PIN/password, which will cause the device to entirely wipe all the encryption keys, which are used for unlocking the device, from the secure element. This process is irreversible, can’t be interrupted and happens instantaneously, making the data impossible to recover.
No one claims that GrapheneOS is 100% secure and will absolutely protect you against NSA hackers, but it is by far the best and most secure mobile OS that’s currently out there. It is easy to use for everyone, and secure enough to be used by high-profile targets like Edward Snowden.
you need real opsec for that
Good OPSEC includes a secure operating system. Calyx is not security focused whatsoever, it rolls back standard AOSP security features, significantly increases attack surface, and doesn’t release security patches regularly.
Happy cake day btw!
Well it’s open source android, if the code is bad, it’s jettisoned. While I cannot stand Google, not every line of code they write is trash.
The sandbox is good and you do not need to install Play if you do not want to. I use f droid where possible.
I want Linux Mobile but it is not ready yet. In the mean time, this is the best we have.
It is full of proprietary software. I wouldn’t call it that open.
You really have 0 understanding on how all this works 😭
Do you? It ships proprietary Google services and encourages closed source solutions. Not only that, but the original developer is convinced that he is the only source of truth.
It does not “ship” them. They are available at your option. Other solutions to solve the google problem such as MicroG have/had several security issues. My favourite was when they leaked user passwords.
It actually doesn’t.
It is the open source code. You can optionally install Google play in a restrictive sandbox if you wish. You do not have to.
I cannot disagree with the last sentence. He has his fair share of issues, but it doesn’t take away from his ability or contributions.
if you have a pixel theres absolutely no reason why you shouldnt use it.
if you dont i dont think its worth to buy one just for graphene
if you have a pixel theres absolutely no reason why you shouldnt use it.
Plenty reasons to not use it on a pixel…I had horrible compatibility with all sorts of banking apps, government 2FA and traffic warning systems, to the point where they just couldn’t work at all. Their sandboxed play services breaks a shitload of day to day convenience and even necessities to increase privacy.
this is a problem with all ROMs, actually.
banking apps especially do everything in their power to block every phone that isn’t stock.
There a lot of ethical reasons to not use it. Also the community tends to be a bit toxic.
Name only one reason that is relevant from a technical standpoint.
I said ethical not technical. Anyway from a technical perspective Graphene os is only supported on a handful of devices so it is off the table for many people.
What are the ethical reasons to not use it?
None. This person doesn’t know what they are talking about and they try to discredit the project based on their personal views and demonize the dev team.
By this logic rpiOS sucks because its only supported on Raspberry PIs. Only Pixel hardware meets the security requirements of Graphene.
Raspberry Pis suck in general as they lack open firmware. You are stuck with the Raspberry Pi kernel and all of its blobs. “Security requirements” is something Microsoft says about Windows 11. If you are concerned about security your best bet is stock software as it is maintained by Google.
Again, you demonstrate that you don’t have the sufficient knowledge. There is no commerical device with open-source firmware. “Security Requirements” are not some kind of marketing bullshit as you seem to think. Graphene’s can be found here: https://grapheneos.org/faq#future-devices
I doubt you understand what any of them mean, since you seemingly think Windows 11 requirements are just random things that are just there to hurt you.
You thinking that Stock Google devices are more secure than GOS simply shows that you fundamentally lack the understanding of how things work. They are built on the same core but Graphene has massively reduced attack surface and fewer ways to exploit remotely. And then we didn’t even talk about the hardened kernel and such.
I wouldn’t try to discredit projects I don’t know anything about if I were you.
https://www.fsf.org/resources/hw/single-board-computers (2021)
https://pine64.org/documentation/ROCK64/
Pine64 boards rarely need proprietary software and they don’t need it to boot like the raspberry pi does. However, that is a discussion for another time.
You are also illustrating my point. The Graphene community has a my way or the highway mentality. As it turns out stock will often be more secure as it will have the latest security updates and will have less people handing it in general so less risk of supply chain attack from a bad actor in the community. However, this is a non issue. I find a lot of the so called security holes to be fairly mild as they require very specific targeting to exploit.
In general, the people around Graphene os and Divest OS are very toxic. In the F-droid board meeting the issue was brought up that the is censorship is promotion happing for Divest OS. People who criticized Divest OS were getting banned. The person who brought this complaint has a page where they go over there beliefs and bring forward evidence. I think they are a bit harsh but they do have a point.
Could you elaborate on the ethical part, please?
Most likely talking about how the lead developer had a mental health crisis and lost his marbles. From what I’ve heard, he has stepped off to take care of that and the project is still going great.
They encourage proprietary software and locked down systems. For instance, they use Google play services instead of microG and they promote the play store. I personally think that F-droid apps are much better from both an software freedom perspective and a privacy perspective. I’m not against people installing proprietary apps as I realize sometimes that is unavoidable but they could at least encourage the use of Foss. Graphene could simply have both F-droid and Aurora store by default and on setup explain the difference. They could even allow the install of Play services instead. However, they don’t even really try. They focus on security which at the end of the day is subjective.
I have been using GrapheneOS on a Pixel 7 Pro for 3 months now. I am BLOWN AWAY at how good it is. I have 3 user profiles. Main profile has no google services at all, and 95% of my apps are running there. Then I have a second user I can switch to that has sandboxed google services and my banking apps on it. I then have a third user that also has sandboxed google services running where I can install any random app that demands google services. (I have only 1 app on that user) . So 99.9% of the time my phone is running with no google services at all. (Side note: without even the sandboxed google services installed, apps need to be left open in the app switcher in order to receive notifications. If you swipe all your apps away, then you won’t receive notifications. This is not a problem for me, as I just keep my messaging apps open in the app switcher. But if it is a problem for you, you would need to run the sandboxed google services).
I see GrapheneOS as a way of removing 99% of all the tracking, spyware and things that I dont like, while still having the convenience of having all the apps and features that are available on a regular smartphone.
There is a learning curve, and many settings to learn and customize. But definitely worth it.
To get a Pixel, instead of paying £900 for a new pixel 8 pro, I paid £300 for a second hand Pixel 7 Pro on eBay that was in perfect condition. So for £300 I now have a privacy phone and an AMAZING camera, which was very important for me the camera.
I don’t trust the google kernel when it comes to privacy or security. You think with how many people use Android and with how bad actors Google are they wouldn’t put a backdoor somewhere?
Everything on Android is half-assed but that’s not Graphene’s fault.
It’s a middleground between a regular stock spyware ROM and a degoogled one with pretty good security thanks to lockable bootloader.
P. S. I can hear the drama coming unfortunately. This ROM’s devs have haters.
Ask me when the NSA knocks at your door, what I think about it? I think it’s a big honeypot.
Think about it, if you were the NSA or the CIA would you push a privacy oriented OS? Honeypot vibes get stronger
