What is going on with GrapheneOS?

It certainly is a balance between keeping phones for longer and keeping them secure enough. On the bright side, google is promising 7 years of updates for the pixel 8. We’ll see if they can deliver on it, or perhaps this is a sign that they are about to kill the pixel line. Say what you want about Apple, but their updates usually last as long as the phones are generally still usable, so there is less of a conflict to replace an iphone based on security updates.

I don’t think that I am too paranoid about security, but I do want to be better than average to reduce the chances of getting hacked/phished/infected/voodoo cursed. It’s kinda like bears in the woods. You don’t have to outrun the bear, you just have to outrun your buddy. Sure it might be inconvenient with long passwords and 2fa, but for me, the effort is worth it. Also, I’m not 100% confident in my backups, so I am investing my tech points in phone security.

This CVE was noteworthy and affected some of the pixel phones.

Another disucssion point to make is that GrapheneOS is super limited because of its hardware support. I understand their technical limitations, to an extent. But limiting users of their OS to one manufacturer is stupid asf. The quality and value of Pixel phones have been declining in recent years. I loved my Pixel 3a. I mostly hate my 6 - kinda like how I felt about my old iPhone 8 Plus. It was the last iPhone I ever owned.

The thing is, with DivestOS, I get all the software features I want, and it supports more hardware because of its LineageOS roots. I am really rooting for a Fairphone 6 release in the US market, because if it happens; that’s the phone I want.

And I would like smart phones/tablets that will be as user-friendly as an x86 computer, where I decide which OS and there is no need to modify anything excessively…

7 Likes

I’m more focused on the privacy part. The security doesn’t matter to a degree when you are a technically proficient user and able to disperse data so not everything is lost or leaked.

this looks like a scam site. This is probably not the place to promote piracy.

No sane graphene user is downloading cracked / modded apks.


Actual app repo’s I’d recommend for Graphene are

  • F-Droid
  • Obtainium
  • Aurora Store
2 Likes

I’ve been on Graphene for a while-ish now.

I get my apps on Aurora and F-Droid.

I havent revisited Obtainium because getting the correct app (not a fork and the correct architecture) can be a pain and I dont want to dig through a long list after updates Maybe when it matures enough…

Accrescent is certainly interesting but there are too few apps in it (by design). Eagerly awaiting to see that as well.

Also there is the official built-in App Store from Graphene. I just got a thermometer app there for fun.

1 Like

ohh wow, i thought they had shelved trying to make that work but i must admit my last check of the graphene app store was quite some time ago.

Thank you Eel! i have now taken my Latte’s temperature :face_with_hand_over_mouth:

2 Likes

Any news on Graphene?

Should people still get it?

Still great.

If you have Google Pixel, its best to flash it vs Stock ROM.

4 Likes

Does Graphene block these tracking parameters?

tracking in eula

Short answer: no.

The long answer is that it’s a bit complicated. Screen res and DPI can’t be blocked unless you have a window manager that fakes the resolution (which AFAIK gos doesn’t). But gos does hide some stuff, I think they might be hiding CPU and baseband info (correct me if I’m wrong).

But the root / jailbreak part is something that’s verified through Google Play Integrity Checks. There’s been a fiasco a while back when Authy stopped working on gos, because of that play check. The same APIs are used by other programs from the Play Store to verify if the device is rooted. Of course, gos is not rooted (by design), but the integrity check is too dumb to realize that (it’s just checking some vendor signatures, i.e. google’s, to see if the kernel, initramfs and maybe other things are signed by that certificate and if not, the program refuses to work - the one’s that are the most egregious are usually banking programs, eeww, which people shouldn’t be using anyway fr fr, just use the website).

I know there were some discussions online about some linux privacy nutbar sending 2 known tracker / fingerprint testing sites to a graphene user and the user being bamboozled by how accurate the fingerprinting on vanadium was (showing the screen size, DPI, fingerprint accuracy etc. - because the browser doesn’t block javascript). I wish I saved that discussion, I can’t find it. So no, gos won’t protect you from being identified.

Though gos will prevent some programs from getting actual information about you with their sandboxing techniques (even google play), by giving it false location information, instead of accurate one (if you don’t allow location permissions to it - same for networking, it will pretend like it has given network permissions to a program, but it will act like the device isn’t currently connected to wifi, instead of telling programs that its request for network access was rejected, like android does it).

Setting a phone to airplane mode, to use as a wi-fi only device will completely disable the modem, but I think without physically removing it from the phone (which you can’t, it’s built into the SoC along wifi and BT), there will still be device identifiers related to it (unlike on pinephone, where you shut power off to the modem, completely cutting off any remnant of a device ID).

If you want privacy and getting close to anonymity, then qubes-whonix is the way to go. Make sure to disable JS if you don’t want tracking. If you are forced to use JS, you might want to use a browser that shares its fingerprint with everyone else using it (something like the TOR browser bundle, librewolf, or a hardened firefox profile that was customized to pretend the resolution is a certain common size). Obviously if you log into your device with accounts that lead to your identity, all these steps are for naught.


Back to your question, idk what links were used to show the fingerprintability of vanadium for that gos user, but I think they were fingerprint.com, fingerprintjs.com and / or thumbmarkjs.com.

My issue is that the banks are starting to force me. One bank is moving away from login details to in-app verification.

This is an awful industry trend.

Forcing Play Integrity means people are forced to use googles cancer. It means owning a googled spyware device is not a choice. It means no degoogled devices. It means no Linux phones.

You must either use apples walled garden, or googles walled garden.

I don’t know why they call it Play Integrity, when google has no Integrity…