springonion

Hey, let me preface this by saying I'm not here to invalidate your experience. I'd just like to understand what happened so, if you want, feel free to shoot me a dm anytime.

First off, let’s address the security features of Graphene OS. A lot of the security of Graphene OS comes from AOSP itself.

So, I started off by hand-picking the security improvements that I deemed to be the most important but I came to the conclusion that my efforts were futile. There are just that many improvements across the board; the website is full of in-depth explanations, I highly recommend you check it out: https://grapheneos.org/features

The argument itself isn't very sound to me. All of these other operating systems are... also based on AOSP. So any improvements they make are also brushed aside? Let's disregard the fact they often deteriorate the security of AOSP rather than improving on it...

For instance, it has a hardened kernel and restricts access. I think this is actually pretty useful but I haven’t seen a need for it much in the real world.

Here you go, the Cellebrite Premium documentation. This one's from July this year, it shows they have no dice at GrapheneOS devices:

https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation

The tightened permissions are nice, and I think that is the main benefit of Graphene OS over AOSP.

Also includes network and sensors permissions, alongside alternatives to the ordinary storage and contacts permissions in the form of storage & contacts scopes.

However, from my perspective, you should not run apps that are bad for privacy. Running it in the web browser will be more secure than bare metal could ever be.

Yes an installed app does have more access than if the service was just running through the browser. However sometimes you may be forced to install the app, then you have to bite the bullet - but also remember you are given the tools to reduce its privacy impact. The aforementioned improvements to the permissions system allows you to tame even particularly hideous apps and profiles allow for even more isolation if desired.

One place I strongly disagree with Graphene OS is the sandboxed Google services framework. They say having Google in a sandbox is more secure. It may be more secure, but it isn’t going to be as private as MicroG. The real benefit of MicroG is that it is community-built. It isn’t a black box like Google framework, and any data sent back is randomized. I think it is a mistake for Graphene OS not to have support for it, even if it is also run in a sandbox.

Common misconception. Micro-G downloads and runs proprietary Google Play code for some functionality, and gives it privileged access too. Recommend reading this excellent forum post: https://discuss.grapheneos.org/d/4290-sandboxed-microg/11

Another thing I have noticed is that Graphene OS prioritizes security above all else. That doesn’t mean it isn’t private as it itself is great for privacy. However, if you start installing privacy-compromising applications such as Gmail and Instagram, your privacy is quickly lost. The apps may not be able to compromise the OS, but for them to be used, they need permissions. To be fair, this is a problem that is not unique to Graphene OS, but I think its attempts to be closer to Google Android make it more tempting for people to stick to poor privacy choices.

I think other ROMs such as Calyx OS take the ethical component much more seriously. Unlike Graphene, it promotes F-droid and FOSS software like MicroG. Graphene purely focuses on security while Calyx OS focuses on privacy and freedom. On first setup, it offers to install privacy-friendly FOSS applications such as F-droid and the like. I realize that MicroG is not perfectly compatible, and some people need apps, but I think alternatives are going to always be better.

GrapheneOS doesn't dictate what services you should use or what ideology to follow. We do educate users about the risks and also benefits some services have over others so you have the full picture and can make an informed decision. No one is stopping you from running a de-googled setup, which by the way is the default out-of-the-box experience on GrapheneOS unlike on many other mobile operating systems that do make connections to Google, that includes CalyxOS. You can run a full FOSS setup too, perhaps with the help of the excellent app store Accrescent that we have been outspoken about and provide a mirror for easy and safe installation. F-Droid functions no different and if you really want to, MicroG is possible to get up and running too. Though you might have to make your own build to give it the privileged access it requires.

One of the most annoying parts about Graphene OS is the development team and some of the community. They refuse to take criticism and have been known to delete any criticism of Graphene OS. Not only that, they have a history of trying to harm any project or person they don’t like.

I don't know where that's from. We're happy to dive into technical debates and explain our line of thinking, valid issues are acknowledged as such and dealt with. Take the fairly recent dns traffic leak outside of the vpn tunnel for example. It affects Android as a whole, we developed and pushed out a fix for it.

Here is a page that isn’t written by me that sums it up

Looks like someone went off rails here and developed an unhealthy obsession. /shrug

GrapheneOS has something in store for everyone. The fully de-googled setup by the common definition a lot of people strive for is a fully supported configuration, it comes that way out of the box in fact, making zero connections to Google - unlike many other operating systems. But you can also transform it into a more "regular" phone by installing Google Play and all the bells and whistles and enjoy the benefits while still feeling save, thanks to the app sandbox applying to it. So you can take away its permissions and feel rest assured it can't snoop on you even if it wanted to. Or you take a middleground somewhere inbetween if that's your cup of tea; functionality is an important factor for many, and there's little you need to sacrifice.

The problem with this is that so many apps use Google Play Services. If I didn’t want a phone that used Google, I wouldn’t use an OS that bent backwards to make it work.

GrapheneOS doesn't "bend backwards" to make apps relying on Play Services work. Sandboxed Google Play is highly compatible and all you need to do is install the apps, just like you would any other apps. The argument that since many apps require Google Play Services, you should use stock OS where they have privileged access rather than being sandboxed doesn't make a lot of sense.

The sandbox model is OK in theory, except when your bank app asks for permissions for microphone, camera, contacts and files, and refuses to start without them.

The app model is a bit broken IMO and GrapheneOS both enables and perpetuates it.

Apps installed on operating systems that don't have a sandbox and thus a permission model get access to straight up everything. Your scenario is exactly why GrapheneOS features contact and storage scopes; as an alternative to the regular permissions for more granular control. You can grant an app only a subset of contacts/files or nothing at all, the app won't complain since on its end, everything's been supposedly granted. There are more planned features to address other permissions in a similar way. Furthermore you could put it in its own little box via a secondary profile (you can have up to 32), and have that only run when you need it.

I might be being a bit naïve here, but Android 14 came out in October, 4 months prior to LOS 21, which is not particularly long. Android 13 is still supported by upstream. This sounds a bit like running RHEL or Debian vs bleeding edge Arch, no? It’s a common debate whether RHEL systems are constantly out of date, the counterargument being that vulnerabilities are often found in new software versions. Without real statistics about security vulnerabilities over time it’s difficult to make an informed decision about software version policies.

4 months without proper patches to known vulnerabilities is very long. Previous versions of Android aren't properly supported; they only receive a subset of patches, not nearly everything. In fact, not even Android 14 is currently getting full patches. At the time of writing, for a device to be properly patched, it must be on Android 14 QPR3. It's why we put great care in porting everything over as quickly as possible. You don't have to make guesses about vulnerabilities, you can simply look at all of the known vulnerabilities that haven't been patched yet, or will never be patched, in previous Android versions. It's not a matter of "what if", it's what's actually happening.

GrapheneOS ships with a sandboxed, FOSS Google Play Services which can optionally do a bunch of Google things (use their APIs, login to Google etc.) plus they have some hosted services that can substitute Google services (like geolocation).

GrapheneOS doesn't ship with any Google services by default. We do provide an easy and safe way to install the Google Play components if desired, they are run under the same sandbox and constraints as any other ordinary app you install. Because they expect privileged access that they don't get on GrapheneOS, we add a compatibility layer that essentially teaches them to work under the normal circumstances that is the sandbox. If you don't want them you don't have to do anything, they are not present in that case.

LineageOS basically doesn’t ship with any Google Play style API/frameworks at all. It’s a pure AOSP experience. Any apps on F-Droid work but third party apps (like ones found on Google Play) are hit and miss. If you can just use F-Droid for all of your apps then LineageOS is probably a much more private and secure offering.

LineageOS does make connections to Google by default, as does AOSP. GrapheneOS changes those connections while LineageOS doesn't. They can be viewed here:

https://eylenburg.github.io/android_comparison.htm

Keep in mind, that table isn't exhaustive. It lists the regular connections AOSP makes and how each OS handles them, but doesn't include information on any additional connections that occur.

You can absolutely download apps from F-Droid on GrapheneOS, what makes you think you can't, and how did you conclude that LineageOS is more private and secure?

Both GrapheneOS and LineageOS publish monthly updates with upstream security patches for all supported devices.

LineageOS is pretty commonly behind on updates. As an example, it seems that LineageOS 21 (based on Android 14 QPR1) came out in February of this year.

https://9to5google.com/2024/03/12/lineageos-21-review/

You cannot ship the full security patches without being on the latest version of Android, which is Android 14 QPR3 now. Of course, if the device is EOL, that's doubtly the case, and no OS can fix that.

Apparently both GrapheneOS and LineageOS connect to connectivitytest.gstatic.com via http as a Captive Portal test by default,althoughh this was as of 2019-2020 and both might have changed since then.

I don't know if this was the case in 2019, but it certainly isn't the case now. On GrapheneOS, you have the choice of using the GrapheneOS server for the internet connectivity check, changing it to Google's server or even disabling it altogether.