Initial Impressions of GrapheneOS
Initial Impressions of GrapheneOS
About a week ago, I finally made the decision to flash GrapheneOS on my Pixel 6. I've been thinking about moving to GrapheneOS for months but was afraid to do so because of missing functionalities or app incompatibility that would result in my Pixel 6 becoming unusable. Even though I could just re-flash stock Android should I encounter those issues, I didn't want to bother.
However, last week, I decided to set aside my fears and made the move to GrapheneOS. Whatever fears or concerns I had about missing functionalities or app incompatibilities were completely unfounded. Flashing of GrapheneOS was really easy, thanks to the instructions they provided on their website. The sandboxed Google Play environment still allowed me to download the key apps I needed, whether it be the mobile game that I'm currently playing or a smart home app (e.g. Ring) or a banking app (e.g. Chase). They all worked as expected, though my banking apps required me to turn on Exploit Protection Compatibility Mode, something that was explained to me in one of the Graphene Discussion Boards. Android Auto was another app that I needed for driving, and thanks to the latest update that was made by the GrapheneOS makers, I had no issues in setting up Android Auto to work with my car. That was a huge relief for me!
That being said, there is one thing that is not working, but it's not that important of a feature for me, and that is NFC. Prior to making the move, I did not use NFC that much for payments, although my car app did have a Remote Key function that relied on NFC. As far as I can tell, it looks like NFC is not usable in GrapheneOS. There's probably a good security and/or privacy reason for this, but I do wish something could be implemented for it, as it can be quite convenient. Again, it's not that important of a feature for me to have right now...more of a "nice to have" feature...but I wonder if the GrapheneOS developers are looking into this.
Anyways, it's only been a week since I made the move. I'm sure more use cases will come up the more I use GrapheneOS, and instead of fear, I find myself excited at testing out more apps and functionalities on the OS. Traveling is one scenario I have not yet tried, but that's because I'm not leaving town to go anywhere. That's one set of scenarios that I look forward to trying out.
If anyone has any other advices or information they have about their experience with GrapheneOS, I would welcome it. And for those who are still undecided about moving to GrapheneOS, I hope this post relieves some of your anxieties or worries about making the transition.
NFC for security related things relies on certificates that belong to Google. GrapheneOS / LineageOS etc could make their own and put forward to the banks/credit card companies/car companies etc but the likelihood that they'd get them signed and approved is basically nil.
Pretty much the same core issue that means you can't run streaming services at 4K outside mainstream devices like Chromecast or Nvidia Shield etc. You can't make it work on a HTPC or a cheap Android TV stick from AliExpress, because it lacks the certificates to authenticate to Netflix etc. As well as HDCP and other DRM which is needed.
Graphene is amazing! Switched from Calyx last week and couldn't be happier. Scopes are the best thing ever. App "needs" to read contacts? Yeah, you can read the one fake contact that the scope allows you to.
Yeah, the Scopes feature is really nice! I often wonder why some apps require reading every single contact or need access to every folder/directory in your phone. In my use case, there are a few apps that require access to storage or contacts, but thanks to Scopes, I can limit it to just a specific folder or a small group of contacts. Everything else is off limits, and I like that.
Can you use the seedvault backup to restore on graphene? I run calyx and am happy but curious about graphene.
yes but I think they are planning on changing the backup method
Regarding seedvault, I tried to do a backup of my phone, once I got it setup, but it seems like backup function is not working very well. I tried external USB thumb drive and Internal Storage, but neither of those options resulted in a successful backup. I did some search on the GrapheneOS Discussion Board (thread), and it seems like the Seedvault version that is currently part of the build is out-of-date. They may push a newer version in the next update.
I swapped to it at the start of the year. I've been really enjoying it so far. I'm down to a single app which requires Google Play Services installed. As it's only one app I've created a second profile specifically for it and only have Google services installed in that one. I've disallowed it running in the background too, so my phone is never running the services outside the brief times I need to use the app.
Losing contactless payments was a minor inconvenience, but I picked up one of the cases which can fit a couple of cards inside as an alternative.
Yeah I honestly don't understand why people cling to the contactless payment as this thing they can't possibly fathom losing. It's moderately more convenient, sure, but you're still pulling a thing out of your pocket and putting it up to the machine. It doesn't seem like that big of a loss to me for all the benefits of being on graphene or lineage.
I've been really considering switching to grapheneOs, But I'm a therapist and we have to use Google voice for our office numbers. Does Google voice still ring through if it's in a sandboxed environment?
Yes, it works for me
It does, you have nothing to worry about.
My only problem with GrapheneOS is when I record the screen on Vanadium browser it doesn't capture the audio
I'd like to see some features as:
-
Block Screenshot whole system
-
True Black Mode to make the most of the OLED screen
-
Extreme Power Saving
-
Block recharging when it reaches 80% to preserve battery health
- Although not OOTB, I can recommend SaverTuner for that.
I don't know if is a good option because I need to use adb to write some settings this could break the security model of the system but thanks for your recommendation
- That's already implemented in Firmware/Android: https://github.com/GrapheneOS/os-issue-tracker/issues/379
-
NFC works, you just cannot use it for Google Pay.
Why would you use Google Pay if you care about privacy? It's not like credit cards have been decommissioned.
Oh, I don't use Google Pay with NFC. Prior to flashing GOS on my Pixel 6, the only time I used NFC was to unlock my car when I didn't have the physical key fob with me. That was done through my car manufacturer's mobile app (BMW). However, when I went to set up the digital key after flashing GOS, the app told me that it couldn't set up the digital key, because I was using an unsupported version of Android.
I'm in a similar place as the OP.
One question I have is about Vanadium. This is chrome based, right? Is it really the best/most secure browser? Aren't the better secured flavors of Firefox better (LibreWolf, Fennic, etc.)?
It depends. I use GrapheneOS to avoid Google as much as possible, not to be the most secure thing in the world. I use Firefox with addons for a much less annoying browsing experience.
The GrapheneOS team has written extensively on why they advise against the use of Firefox in their Usage Guide.
Everything the Gos team does it's from a Security perspective and nothing more. There is no issue with FF, they are simply stating that of you have extreme security concerns (threat model of avoiding NK nation state actors for example) you should use the browser they spent all this effort hardening and to work specifically with GOS
You beat me to it! I was gonna mention the same thing. However, I don't think it may be that big of a deal if you use Firefox or some flavor of it. The one term I often hear about GrapheneOS and other AOSPs like it is "threat model", and depending on that model, you may not necessarily be impacted if you decide to use something other than the stock browser.
That's not to say the GrapheneOS developers are wrong in their Usage Guide. I'm sure they looked into this extensively, hence the usage guide.
I don't really feel like they explained much in terms of why just a lot of detail around what they believe. The tldr seems to be that Firefox isn't truly secure but Google's work is.
All the talk about Tor also seemed to go back and forth between "this is the best and that's why we use that approach" and "it's not very good but will be eventually".
Nothing they wrote was clear to me honestly. I do find it hard to believe that Firefox is inherently insecure and that the extensions many rely on for privacy reasons are all bullshit security theatre...
I have no problem using NFC with GrapheneOS on a Pixel 4A.
I think NFC is fine, it's the proprietary parts of Google Pay that GrapheneOS can't do
I've been using it pretty routinely on lineage.
Odd, I have used NFC before on lineage OS, but not for payments, obviously.
This only affects payments using nfc as graphene os certificate would not match Googles.
I replied elsewhere to questions but wanted to share my two cents.
I've been nothing but impressed with GOS, from it's installer to it's everyday use, and really neat security quirks.
However, I've been in non stop mental anguish from the Google pixel 7 series hardware. I was told this wasn't really as much as an issue with pre-6 series pixels but Jesus tap dancing Christ I have the 7 series.
Fingerprint sensor flat out does not work. It's not a true hardware based like old versions, it's off the main screen. Not being dramatic, I see about a 99/100 failure rate. I learned it works better in humid climates. So if you're in a dry climate you're SOL. But even in humidity it's still shitty. To get around this, I have to blow on my screen with hot air before being able to use it. Yes, I've done every trick in the book, including reenrolling the same finger, etc.
I cannot STAND the volume keys on the same side as the lock botton. Maybe this is just preference.
I've encountered other annoying shit that is either AOSP based or directly from GOS, just like horrible horrible horrible password manager integration, such as autofill not working in 50 percent of all forms.
Issues with the lock screen being garbage. Ie whatever behavior it has to work for unlock does not work well. Sometimes I have to swipe up 10 plus times to get to the PIN screen.
There are many features removed that were argued as security concerns which I do understand but drive me nuts. Native keyboard lacks tons of features one such is swipe/Swype. Haven't been able to use speech to text either.
Copy and paste is painful.
Autofill for MFA Stuff doesn't work.
There is no face id system period, I believe stock pixel 7 series does include this support and it actually works.
I could go honestly go on and on. I wish I could go back to the ease of use of an iphone but the peace of mind of security is worth the pain to me.
I will finish by saying that out of all the Google free custom ROMs for Android, GOS has the absolute best google services implementation with it's sandboxing feature. This still does not include support for NFC tap payments. This isn't GOS fault though
Can't answer on the hardware since I don't have the 7 , but keyboards are plenty around . I use gboard and remove network permissions ( jay GOS) why force a specific one on people? Just use the one you want. Passwords keepassDX , MFA aegis. Copy paste I havent thought about it guess what you compare to.
I have tried several keyboards actually. Gboard is the least shitty, and yes I do have network perms enabled :p
The one thing I've had issues with has been sending files to other devices over Bluetooth, but receiving hasn't been a problem. Has anyone else had this issue & been able to fix it?
You had me almost convinced to try this on mine up until the NFC. I use contactless payments on mine at 90% of the places I shop, so that is a deal breaker for me.
NFC works fine on GOS, however, Google does not consider it a approved os so itb failure attestation, any form of NFC payment will not work because of this. It's not because of GOS or hardware, it's literally Google being cunts.
Just to be clear NFC works fine, you can use Yubikeys all day, and certain other NFC style tokens like a train ticket or what have you do work as well.
Can you not just get one of those wallet-cases and put your contactless card in the same place as your phone?
I already have a really nice wallet and phone case. Things are hard enough as it is to fit into my pockets. I personally have no problems with my Pixel 6 and I really don't want to create them without a really good reason.
Having the digital wallet has saved me multiple times in the past with fraudulent payments and lost/damaged cards. When you are waiting for your new card in the mail, the digital payment system that is linked with your bank/CC is still able to be used in the meantime. That means I can go get groceries and gas. I have had it take over a week to get a new card. If I am traveling/out of town, then it is even a bigger mess.
I understand that Google is evil, but there are some things that I am ok with them tracking, such as my location with Google Maps Timeline. As long as I can mostly block out the advertising on my phone with AdGuard, that will just have to be enough at this time.
Аnd all your privacy ends when you insert a SIM card into your phone. Not sarcasm, but kind of....
👍
I haven't been able to get the Chamberlin Myq app working which is why I'll probably switch back to the stock image. It won't let me login and keeps giving a 401.122 error even after disabling all of the security settings for that specific app.
I had the same problem after flashing GOS onto my device, but my wife who uses an iPhone also had that problem. I don't recall how she eventually logged in though, but when I searched online about the 401.122 error message, I got answers that suggest it could be a problem on MyQ's end.
I saw that as well but my wife on stock android didn't have any issues and it's also been over a month since the first time I tried.
Tbf, that could just be the MyQ app. I recently moved into a house that had that system installed in the garage and I spent hours trying to get the damn thing to work. The app and the system are hot garbage.
Ended up ditching it for a Meross garage opener which is much more consistent.