I use grapheneOS, it's the reason I bought a pixel but not for nefarious reasons but rather I don't like how much control Google has (it's ironic I had to buy a google phone) on android phones even from other manufacturers and the targeted marketing and information that I would be giving out. I also don't like that Android implimented the feature where you couldn't access the Android>Data folder for 'security reasons' and have to plug it into a computer to access any of those sub folders, it's my phone let me do what I want with it. Graphene lets me access any of those folders without issue
the fact that they refuse to consider other phones ie fairphone or nothing phones that have the bootloader relockable is the reason that i do not use graphene.
it seems like a great os but i am not giving google money to get away from google.
Fairphone is dangerously insecure. Nothing phone is not much better.
It's not only the design of the hardware, but also patches for vulnerabilities and delivering updates for several years.
You're suggesting it's ideological (which is completely untrue), while the fact is: pixels are at the very moment the only Android hardware secure enough to even care about hardening: https://grapheneos.org/faq#future-devices
(there's little sense in securing the OS if the hardware doesn't allow disconnecting the USB or there is no secure element throttling PIN attempts, right?)
I cannot find any of Fairphone technical documentation that would provide details on their implementation of the TEE/HSM.
As of now I believe it's only Pixel's Titan and Samsung's KNOX that provide a discrete secure element on Android devices.
On vendor:
Drivers, firmware patches, OS upgrades are a necessity, not an option: most security and privacy updates are not backported. Vendor can't just wait for AOSP to deliver all the patches. Vendor must show a track record providing updates to their hardware
- After a lengthy two-year delay, the phone got a taste of Android 12 in February 2023, with Android 13 arriving relatively quickly in October 2023. For Android 14, Fairphone promised to roll out the update in H2, 2024, almost a year after Google released it. Now, with less than two months left in the year, the company is postponing the update's release to 2025. -- https://www.androidpolice.com/fairphone-4-long-delayed-andro...
- their Security Bulletin patches are consistently 1-2 months behind
- Fairphone 5 is still on Android 14 (since Jul 2024). Android 15 has been released in September 2024. Year and a half later AOSP is on Android 16.
For comparison GrapheneOS had eight releases in July alone (GrapheneOS had a full A16 release on 30th of June for all supported devices).
Security patches are usually released within one-three days (or earlier, from the tree, without waiting for being published in the bundle)
GOS Release for Pixel 9 was ready three days after the device launch.
Android 16 was released less than half a month before the release of the FP6, which itself is less than a month ago. Seems reasonable that it wouldn't ship the latest version under those circumstances.
After a lengthy two-year delay, the phone got a taste of Android 12 in February 2023, with Android 13 arriving relatively quickly in October 2023. For Android 14, Fairphone promised to roll out the update in H2, 2024, almost a year after Google released it.
It is also worth mentioning that Android Security Bulletins generally only contain backports of patches for High and Critical vulnerabilities. Most non-Pixel/GrapheneOS phones only get all the other fixes when moving to the next major release [1]. So getting the next major Android release is important (getting to a recent patch-level alone is not enough).
I can completely understand that Graphene does not want to support Fairphone and others, their security/privacy goals are the complete opposite of what those phones provide.
> what are you talking about? are you talking about the kernel or the vendor?
Yes. See my response to the sibling comment (I don't want to pollute the discussion with sending twice the same)
> please tell me graphene is not rawdogging Alphabet's compiled stuff
What do you mean? Patching and compiling AOSP tree like every OEM does is "rawdogging Alphabet's compiled stuff" now?
Or allowing users to run unprivileged/sandboxed Google services in the isolated user profile they choose?
> if so they ought to be replaced anyways for a secure phone. please tell me graphene is not rawdogging Alphabet's compiled stuff.
Say you don't know what GOS does without saying that out loud.
> if you are talking about tpm and other stuff, eh. they are closed source anyways and i, as a user, cannot actually validate them
Yeah, closed source BUT they exist so for example there's actual, physical throttling of the PIN, Weaver token is stored in the safe place, and we can have downgrading protection support, etc
They don't refuse other manufacturers, it's quite the opposite -- GrapheneOS provides list of requirements for future device support. AFAIK Fairphone and Nothing don't fit more than a few requirements from this list.
Oh, I forgot to add and can't edit my comment, so: they are talking with another OEM about the potential alternative hardware for the future GOS.
I hope it's something good. But in reality it's probably Samsung which is the only other vendor bothered enough to add a basic secure element. Maybe they will upgrade it?
I hope it's something good. But in reality it's probably Samsung which is the only other vendor bothered enough to add a basic secure element. Maybe they will upgrade it?
I think it is unlikely that Samsung is interested in the relatively small market that GrapheneOS still is. I mean, if they cared, they would allow you to unlock the bootloader without blowing the Knox eFuse.
As far as I understand the next-generation Qualcomm CPU will have the required security CPU security features. There separate secure elements on the market, everyone outside Google/Apple/Samsung is either penny pinching or doesn't care about security. But it's perfectly possible to develop a phone with a secure element if you want to. So there is probably a smaller phone manufacturer that is willing to make a design with a secure element.
Samsung devices have basically everything except hardware memory tagging, afair (which is allegedly being added now?), and it looks like it's possible to both OEM unlock and relock the bootloader?
> We have talks with a large Android OEM ongoing and they're doing initial work towards supporting GrapheneOS. We hope there will be another device we can support in 2026 or 2027 based on this. Qualcomm releasing MTE support this year is key and appears to be happening.
> The initial devices built for us by an OEM are going to be their regular devices improved to meet our security and support time requirements. We aren't going to have much influence over the initial hardware. If GrapheneOS on these devices is highly successful, then we can make the business case that it makes sense to have custom hardware and firmware beyond meeting our minimum requirements. Our minimum requirements cannot require more than what we have on current devices.
A.K.A: the minimum requirements are current requirements (currenly only met by Pixels)
You can't OEM unlock Snapdragons/North American models.
I just have a hard time believing that Samsung is working to improve GrapheneOS compatability with their devices when they don't even allow you to unlock the bootloader in certain regions, and they're chasing a very Apple-like ecosystem approach where many device features require you to go all in on Samsung products (ex. their earbuds and watches are both hamstrung if you don't use them with a Samsung phone).
Verizon pixels also can't be OEM unlocked. That doesn't make them unsuitable for GOS.
(I've seen both watch an buds used with Motorola phones just fine, not sure what are the issues? Genuinely curious, one of the users is eyeing phone upgrade, I might steer them the galaxy way if that improves their experience)
(oh, and I know their trackers work really good only with Samsung phones, but that's the consequences of Samsung making good choices and Google making bad choices)
> Verizon pixels also can't be OEM unlocked. That doesn't make them unsuitable for GOS
Everything I'm seeing says that Verizon Pixels can't install Graphene, since Verizon doesn't let you unlock the bootloader. [1]
Galaxy Buds come with 3 Bluetooth codecs: SBC, AAC, and Samsung's proprietary codec. SBC and AAC are low-quality, low bandwidth codecs. Samsung's proprietary codec supports high bit rates, but only Samsung phones support their codec.
Competing non-Samsung & non-Apple earbuds will typically also support other codecs, like aptx-HD, aptx-Adaptive, and LDAC. These are all high-quality codecs, that are supported on every new Android phone except for Samsungs.
The Galaxy Watch situation has improved. I think all that's currently missing is a couple of health features like the ECG when not using a Samsung phone. Last time I checked, there was a modded apk out there that you could install to get the full functionality.
tl;dr galaxy buds will have subpar audio quality when connected to a non-Samsung phone, galaxy watch requires sideloaded apk for certain health features.
Thank you so much for your responses, this is extremely useful (especially the ECG part since my olderly relative is considering getting the latest Galaxy Watch for ECG)
And with your first paragraph, 100% correct. Verizon Pixels cannot be oem unlocked which means they cannot have the bootloader unlocked, which means GOS cannot be installed.
I think there's a typo in my response which you rightly corrected.
The claim I was responding to:
> You can't OEM unlock Snapdragons/North American models
The response was supposed to mean that you can unlock North American Pixels, except for these from Verizon.
Not sure what you are saying. In the Android space, only Pixels have a good secure element and Samsung has an acceptable secure element. Of those only Pixel allows unlocking the phone without blowing an eFuse. So, Pixel is currently the only phone that allows installing an alternative OS and provides a secure element.
Most phones without a separate secure element do not protect against brute-force PIN attacks, etc.
As is often said, the most secure phones are:
Pixel with GrapheneOS > iPhone >> Pixel with PixelOS >>>>>> anything else
> I don't like how much control Google has (it's ironic I had to buy a google phone) on android phones even from other manufacturers and the targeted marketing and information that I would be giving out.
To a normie non-tech person, buying a several hundred dollar Google phone, only to delete Google from it sounds stupid, like you've set your money on fire.
Yes, I recently bought a Pixel and immediately installed GrapheneOS.
