I see quite a few people claiming that Graphene OS is the only way to stay private on Android or that anything but Graphene OS is insecure. In this post, I will describe why I personally do not care for Graphene OS and some alternatives I would suggest.

First off, let’s address the security features of Graphene OS. A lot of the security of Graphene OS comes from AOSP itself. In fact, AOSP has a very good track record. If you get malware on your device, you most likely can just uninstall it. For reference, here is the Android security page: https://source.android.com/docs/security/features

There are some Graphene OS unique security features. For instance, it has a hardened kernel and restricts access. I think this is actually pretty useful but I haven’t seen a need for it much in the real world. The tightened permissions are nice, and I think that is the main benefit of Graphene OS over AOSP. It is also nice that device identifiers are restricted from a privacy perspective. However, from my perspective, you should not run apps that are bad for privacy. Running it in the web browser will be more secure than bare metal could ever be.

One place I strongly disagree with Graphene OS is the sandboxed Google services framework. They say having Google in a sandbox is more secure. It may be more secure, but it isn’t going to be as private as MicroG. The real benefit of MicroG is that it is community-built. It isn’t a black box like Google framework, and any data sent back is randomized. I think it is a mistake for Graphene OS not to have support for it, even if it is also run in a sandbox.

Another thing I have noticed is that Graphene OS prioritizes security above all else. That doesn’t mean it isn’t private as it itself is great for privacy. However, if you start installing privacy-compromising applications such as Gmail and Instagram, your privacy is quickly lost. The apps may not be able to compromise the OS, but for them to be used, they need permissions. To be fair, this is a problem that is not unique to Graphene OS, but I think its attempts to be closer to Google Android make it more tempting for people to stick to poor privacy choices.

I think other ROMs such as Calyx OS take the ethical component much more seriously. Unlike Graphene, it promotes F-droid and FOSS software like MicroG. Graphene purely focuses on security while Calyx OS focuses on privacy and freedom. On first setup, it offers to install privacy-friendly FOSS applications such as F-droid and the like. I realize that MicroG is not perfectly compatible, and some people need apps, but I think alternatives are going to always be better.

One of the most annoying parts about Graphene OS is the development team and some of the community. They refuse to take criticism and have been known to delete any criticism of Graphene OS. Not only that, they have a history of trying to harm any project or person they don’t like.

Here is a page that isn’t written by me that sums it up: https://opinionplatform.org/grapheneos/index.html I think their take is fairly extreme, but I agree with them in many ways. I also understand how upsetting it can be to be censored.

    • jet@hackertalks.comEnglish
      12·
      3 months ago

      It’s just a table of features for MANY oses, which table entry did you find to be incorrect?

      This is a comparison of popular Android “ROMs” (or better: AOSP distributions). Please note I’m not affiliated with any of these projects and I am not giving any specific recommendation. If you think anything is factually incorrect, please let me know.

    • Andromxda 🇺🇦🇵🇸🇹🇼@lemmy.dbzer0.comEnglish
      61·
      3 months ago

      It’s literally an objective comparison that factually compares individual aspects of various Android ROMs. How would you even introduce bias into this? It’s not like the author is talking about his opinion or anything, it’s a factual comparison table.

      • Possibly linux@lemmy.zipOPEnglish
        13·
        3 months ago

        It can be factual but still biased. They list features that are the main selling points of Graphene OS.

        • Andromxda 🇺🇦🇵🇸🇹🇼@lemmy.dbzer0.comEnglish
          3·
          3 months ago

          I looked at some other ROMs, and I could hardly find any feature that’s worth including in the comparison table. Specifically, I looked at the features page of CalyxOS: https://calyxos.org/features/

          • The Firewall is listed in the table, GrapheneOS also has it (it provides a better solution, but that’s not too important for now)
          • microG is also listed in the table
          • the Wi-Fi and Bluetooth timers from the “Device security” section are not covered, but these aren’t unique to CalyxOS. From looking at the screenshots on the website, I actually think that the code was simply copied from GrapheneOS (which is not an issue btw, GrapheneOS is FOSS software. But this is not a unique Calyx feature)
          • USB-C control is covered in the comparison table, and it also shows that CalyxOS uses a much weaker implementation of it, which is simply based on Graphene’s old code, before they replaced with a newer, better implementation

          ⚙️ Privacy settings lets you see what apps are requesting which permissions

          That’s an AOSP feature I guess

          • The following point:

          🤫 Sensitive Numbers privacy. Calls to numbers for help lines such as domestic violence, child abuse, suicide hotlines are not recorded in the call log.

          📇 Access these numbers in the Helplines Dialer entry.

          is not an OS feature, as it’s simply implemented in the Dialer, which can freely be changed by the user. Putting this in an OS comparison table wouldn’t make any sense, as it isn’t an OS feature, but rather a feature of an individual app.

          • Seedvault backups are included in the comparison table
          • Work profiles are a stock AOSP feature, it doesn’t make sense to include this, as it isn’t unique to any ROM
          • The dialer is mentioned again. I already explained why it doesn’t make sense to include it.
          • They mention Cromite and the Tor Browser, both are apps that can be downloaded by the user
          • Aurora and F-Droid can also be installed by the user, they’re not unique features

          ⌛ Auto-reboot device when not unlocked for a certain period requiring entering PIN/password again

          🙈 Scramble lockscreen PIN

          These two points also use the original GrapheneOS code and they aren’t unique to Calyx. Sure, these could be included, but it wouldn’t give Calyx any advantage.

          • Next they mention that they bundle Signal and K-9 Mail. Again, these apps can simple be installed by the user. Having Signal pre-installed shouldn’t be a selling point for a custom ROM. If someone doesn’t know how to install Signal on their own, maybe they shouldn’t be using a custom ROM in the first place.

          (Sorry for the bad formatting btw, but it should still be understandable)

          The comparison table is absolutely not biased. It is clear that it’s focused on security, and it factually compares the security features of different ROMs. Feel free to create your own objective, factual comparison table that focuses on other aspects.