DeGoogle Yourself

GrapheneOS is unmatched when it comes to security features including hardening. Don’t get me wrong calyx is great and when you like to use microG then it’s there. With graphene you can also install google play and framework (if you wish so) but in a different approach. It’s like a normal app. So you can do it with network access given or not even etc… it’s worth to test out also the profiles and separate your life into profiles… you can have on one google service on one not etc… and all getting push notifications. Most banking apps work (to be honest very had any issues.)

With calyx like I say it’s a privacy but not security hardened approach. And calyx been back in security updates what been pushed from google sometimes for months. For me it’s a clear choice but it’s your call…

There are 3 important factors that drove me to CalyxOS rather than GrapheneOS:

1/ There's no way in HELL I'm buying a Pixel phone and giving my money to Google for the privilege of not being tracked by Google. That's really too rich for me.

2/ I want a repairable device.

Therefore I bought a FairPhone 4 (repairable and not Google), and only CalyxOS supports it - of those two that is.

And finally 3/ The GrapheneOS community is toxic. Although in fairness, now that the Chief Toxic Officer is gone, maybe it's gotten better. At any rate, the Calyx community is completely peaceful and exemplary compared to Graphene.

This may not matter to you, but it seems to me like a sane thing to do not to trust software made by someone who talks that much shit.

If you have a pixel I recommend graphene and if not I recommend calyx. Graphene has some lower-level security primitives and their sandboxing between profiles is very good. I recommend not installing Google Play Services on your main profile (ideally in none but you might not have that luxury).

Security and privacy require diving into the topic, though. You can still easily do non-secure, non-anonymous things in either case. Sometimes people even seem to do riskier things when they think their privacy tools are there, and end up being less private and secure as a result of not knowing how the threats work.

I use calyx on a spare phone, graphene on my regular. Graphene is better security wise, and better privacy wise.

If your device can run graphene is go for it.

Graphene for example are using a sandbox Google play that's not have any special privileges. Which you can choose to use or not. Or use in a separate profile. Calyx comes with microg from the start. Which still uses proprietary stuff. Just the hardened malloc and other stuff under the hood on graphene makes it a better option

Both are good solutions however if you're on a supported phone I would pick GrapheneOS every single day.

CalyxOS (and the supported devices) expose you to a classic “evil maid attack” applied to phones. There's also other privacy implications of mishandled stuff in CalyxOS.

If you want a detailed explanation read this https://lemmy.world/comment/4962467 and my comments bellow it:

As usual if you’re looking to have any security (Verified boot) GrapheneOS + Pixel phone is the only options. I really don’t get it how come people(...) are okay with having a phone with all their personal data and logins without verified boot. Stolen / lost phone and game over.

Doesn’t Android have file based encryption by default since a while now??

if someone can compromise your bootloader in an hotel or some other public place then they’ll get to your data either way once you turn on the phone. This is one very small and very important detail that all those tech youtubers pro-privacy, security and whatnot love to ignore as it is the really hard one that makes all the difference. Secure boot is a complex subject and it requires a lot of work and checks to make sure nobody tempered with your device and Graphene / Pixel are the ones that really give a shit about that (except for Apple that wants to block jailbreaking and pirated Chinese app stores at all costs).

switching to another ROM on a phone with non re-lockable bootloader is a downgrade from the stock ROM?

It depends on your goal. If you plan to have any kind of boot / data security and the device can't be re-locked with an alternative ROM you're essentially better with the stock ROM in a locked state. Now that's kind of personal choice, I believe the instant damage done by someone stealing your phone and getting your data (because your bootloader was unlocked) is considerably larger than the privacy implications of running the stock / vendor Android. For what's worth if you can root your stock Android and firewall everything that seems suspicious it might be better than running an alternative ROM without a secure boot. Even with an alternative ROM you can run into privacy issues, take for example here CalyxOS running on Qualcomm CPUs. What's interesting here is that this issue doesn't happen in Graphene because they're actually better.

https://eylenburg.github.io/android_comparison.htm

After having done some recent experimentation: from a usability perspective.

Graphene Exclusive:

• sandbox google if you want it
• can disable apps, so they never run, but still get updates. ( This is great for those apps you want on demand i.e. food, hotels, movie, banking, etc)
• elegant cross user notifications, so if you're in your banking user account, you can see you got a text message on your social user account. And switch over quickly
• security scopes for contacts, and media- you can choose exactly what to share with a app when they ask for access to media. This might now be a general Android 14 feature I'm not sure

Calyxos Exclusive

• share VPN via tethering and profiles (lineage os too)
• work profile for EVERY user account (normally only the owner account can set up a work profile. This is the only ROM I'm aware of that allows this.)

Honestly, I would like the vendors to incorporate each other's features. I don't see why not since they're both open source.

When traveling, the ability to share a tethered VPN is an absolutely killer feature. You don't need travel routers.

Sorry for necroing an old thread. But it's relevant