Need help with self education resources for privacy conscious switch from IOS to Graphene

Good news everyone, :yay: I see the light!
But not really, actually I only feel where the light is coming from, sorta.

TLDR

I want to understand how to approach choosing the source for the app and how to then verify that it is coming from the source that I’m getting it from. (Running graphene on pixel).

Evaluating the following options:

  • Accrescent
  • Obtanium
  • Aurora Store
  • fDroid

What I mean by ‘How to choose’

I want to understand how to be sure that you download secure versions of the apps (at least to the degree that the dev constructed it) because my ‘fear’ is that whilst I will be chasing privacy with all these options - without understanding how to choose installation sources - I will never get the piece of mind that I’ve set out to achieve with this transition.

Whilst I would appreciate any input - in particular I am also looking for pointers to self educate myself on general approach which would then help guide my decision making for myself.

The long of it.

I have used ios devices for the past decade and whilst I do the couple of extra steps, provided by the os, to enable more privacy - I grow more sus that if not already but in another 5 years apple will be selling the users info much same as google has been. (See news for introducing ads in apple maps in some regions, haven’t seen it myself though yet). The whole ai on the phone and anonym collecting doesn’t sit well with me either.

Normally I am quite tech savvy, but as we all know this is very relative and most of the time I feel that I am completely out of my depth with the stuff anyway :man_shrugging:

The road so far:

At launch i bought pixel 8, and tried to just jump into it, but couldn’t, later on I’ve identified the reasons and this time before fully switching - I want to tackle these first one by one, and then switch.

  1. No clear Idea how to set up the phone the secure way, but retain all the functionality that I expect from the phone - what I see as understanding the trade offs and making them consciously where needed.
  2. No infrastructure for syncing/backing up the contacts, calendars and files.
    I have an unraid server at home. And whilst i use syncthing for files,
    For contacts and calendars I’d like to set up docker container (which I don’t have set-up - because I’d like to set it up as a regular docker container or docker compose, and not as an unraid app, since there is no official one and I don’t want to set up ‘my’ cloud through somebody else. BUT so far i’ve found little to no tutorials on how to do so - so I have no clue how to set it up that way yet).
  3. Another major one is app selection. I have used only IOS for so long that some apps that I rely on once if a full moon are simply not there, and all you have is ad-filled apps. I am more than willing to pay a one time payment for good apps, but everyone is transitioning to stupid subscriptions and in the eu i can’t even pay properly - because I will have to create a google account with a credit card, because the last time I gave them random info and then tried to redeem a gift card - they locked the gift card (2 separate phones, 2 separate gift cards), and guess how easy it is to use those cards??? - by providing your fu**** ID to google* :facepalm:
  4. Lastly is a feature that is important for me - translation of text on device (this i still don’t even have the slightest idea of how to tackle as of yet). I leave in a german speaking country - and my german is not fluent - so it helps me a lot when I get a giant email to be able to quickly scan it on the go, in order to understand if it requires attention right now, or can wait. And in english this takes me considerably less time. IOS has a built feature like that (privacy is out of question there) and it is one that I rely heavily on almost daily.

New Chapter.

I bought iphone 15 end of last year on discount after returning my pixel 8.
TADA - end of story :scream_cat:
And it has been working as fine as all the iphones before it, which is a good thing - since it is predictable.
But the mind bug stayed right by my side. The problem is - there is simply not enough time, most of the time, to circle back to these things that you have to figure out, and that in short term will hinder your productivity…

Last week I spotted a unopened pixel 9a for 300 eu money (which on this side of the pond is vEry cheap), and jumped the gun the same day, installed graphene on it and it has been happily sitting on my desk, shinny and full of unknowns… But this time - I will take my time, fully setting it up - deciding what to do with all my workflows one by one and then commit properly (maybe in time for new hardware vendor collab of grapheneOS (please let it be Sony with a headphone Jack)).

Which kinda brings me to the main question that I’m asking:

How do I install apps on these thing? :gigathink:

  • I will most likely set-up the phone without profiles as I am not sure what benefit will those give me, since the introduction of private spaces - which is for now the way I plan to set it up. (I did set-up the profiles last time). In one of those spaces I will be running google services for notifications as I will need it for some of the apps.
  • Last time I used obtanium and the links directly from devs, preferring to use github.
    • The problem with this approach was - I was all the time not sure if I actually had increased my privacy going that route or decreased my security. I see on their github that they recommend AppVerifier, which is available from accresent, so this is planned as a first stop for me (i didn’t see that one last time around).

For other stores - I know the overviews, but don’t fully understand why fdroid gets such a bad rep.

I hope that this was logical enough of a text to make sense and thank you for reading through that outpour :srs:

The thing I am looking for here - is to learn how to approach choosing the source for the app and how to then verify that it is coming from the source that I’m getting it from.

And to have it relatively hassle free maintainable afterwards.

1 Like

Brief update on what I’ve settled on so far.

I stumbled across a graphene os forum thread that heavily critiqued fdroid.
And then re-read through the faq on the main page more attentively.

In the end - I’ve settled on running obtanium and accresent on the main user, and google services and play store in the private space for basically everything else.

The problem that remains is that I have maximum 6-10 apps that I’d care to install on the main profile directly, but I can’t seem to find a decent way to verify them when downloading from github or web sites directly…

If anyone can point me in the direction of where to find the verification hashes for the following apps - that’d be great, although it seems that the devs simply didn’t make them available…

List of apps that I need the source for hashes:

  • proton mail
  • proton vpn
  • obsidian
  • Fintunes (or another decent jellyfin music player)

Another question

  • that I have right now is which client of syncthing to use - the official one has been discontinued last year, and I can’t understand the difference between the two…
  • also if anyone can point me in a direction of a good rss feeder - that would be great (ideally, not necessarily based around nextcloud)