jordand
4 hours ago
I've been running GrapheneOS for 7 months now and I'm not going back. When I bought my Pixel 10 last year, I wasn't actually planning on trying Graphene for a while....until I noticed Google had force bundled a 'Wicked For Good' movie promo theme with the latest security update.
sivers
4 hours ago
Ha! Me too! Exact same. Bought a Pixel 10. Intended to do the default Android for a while. But it was filled with ads for “Wicked” which had me looking at my phone with a sneer on my face I couldn't erase - as if someone had smeared feces all over it and threw it on my bed.
So I jumped straight to GrapheneOS, which was way easier and less extreme than I had been warned. So beautifully minimal, with no crap. Now my phone feels like a simple Linux (Void/Arch) PC. So wonderful.
jordand
4 hours ago
We took control, we're keeping control
joe_mamba
3 hours ago
"took control"?
Brother, you didn't take anything here, you still depend on Google good will allowing the pixel devices to be just open enough so that Graphene can be installed on them, but that can always change in the future devices on a whim or even now via e-fuses on the Tensor SoC.
Google is the one in control here giving you the temporary illusion of control. Kinda like the people plugged into the Matrix. But they can afford to play the long game over years or decades till they monopolize the market and kill any small competitors from becoming threats, and then rug-pull you.
For you to be in control you need a (almost)fully FOSS phone, from HW, to modem, to EFI-boot stack, not just the OS and the temporary permission from the manufacturer of a closed source HW stack to replace their OS.
jitix
2 hours ago
What you are describing is not Google’s alturism but keeping competition in check. If Google didn’t “allow” GrapheneOS it opens up a new market segment for other smartphone manufacturers. Apple really cashed in on privacy for a few years so it’s not unfathomable that Xiaomi or someone else goes all in on “privacy focused android” in absence of pixel+graphene combo.
Edit: Apparently Motorola is doing just that.
wolvoleo
9 minutes ago
I don't think any Chinese company can pull the privacy card. They're bound by their government to spy on their customers just like American ones are.
Otherwise Huawei would have already jumped into that gap. They have their own Google-independent OS now so they could have marketed it to privacy enthusiasts where the lack of Google services would have been a positive not a negative.
ethbr1
33 minutes ago
> Xiaomi or someone else goes all in on “privacy focused android” in absence of pixel+graphene combo
Xiaomi? Privacy?
ignoramous
2 hours ago
> Apple really cashed in on privacy for a few years
Apple didn't "cash in", their marketing dept made sure privacy/security engineering got just enough budget to pull off miracles & then spend even more to successfully make the public forget about the very nasty Celebgate.
ajdude
an hour ago
Years ago I looked into GrapheneOS, and I ultimately didn't go with it because, at least at the time, they only supported pixel phones (specifically pixel phones that Google actively had security updates for). I realized that if I got that OS, I would be at the mercy of Google supporting the device in order to continue using GrapheneOS.
In the end I just opted out of the android ecosystem altogether and went with a flip phone that I used as a hotspot for an iPod touch (we only used over VPN with locked down DNS and nothing google related).
My privacy lasted about two weeks, because unfortunately Spotify was able to fingerprint that device to Facebook.
singpolyma3
3 hours ago
TBF if Google locked down the devices like that it would be a GPL violation. Not their first or whatever but still, there's a reason for them not to do that beside "being nice"
yjftsjthsd-h
2 hours ago
Would it? IANAL, but AIUI the only GPL component is Linux on GPLv2 which requires providing code but not giving the ability to install it
fluidcruft
2 hours ago
Not really. Tivo did that eons ago. Whether you view this as a "flaw" or "feature" of GPLv2 it's ultimately why GPLv3 now exists.
The Linux kernel developers see what Tivo did as a "feature" rather than a "flaw" and refuse GPLv3.
wolvoleo
5 minutes ago
It's also because so many Linux developers are on the payroll of big tech. Look at all the submissions. And look at the key people in the Linux Foundation. All a bunch of business suits with compromised motives.
Linux is no longer the community-driven choice. It's big business with billions hanging on the line. The grassroots origins are long over.
StrLght
3 hours ago
And how many options are there exactly? How many of them are capable of at least making and receiving a phone call without any issues 99% of the time?
While I agree with your general sentiment, I feel necessary to acknowledge that it's just not there (yet?). GrapheneOS is a great option if you want to have a fully working and secure device.
matheusmoreira
2 hours ago
You're not wrong, but we gotta do what we can and take every advantage we can get.
jordand
2 hours ago
Your point is valid and yeah, it's a never-ending fight just to keep the control we have. Things like the Play Protect API and loads of Android apps being coupled to Play Services is it's own big challenge we're stuck with just to stay within the Android ecosystem
cluckindan
3 hours ago
There is no FOSS modem. The baseband is a separate computer operating on a lower level than the OS.
Your provider can run arbitrary code there.
genxy
3 hours ago
Let them eat steak!
theandrewbailey
4 hours ago
When I got a new phone last year, I purposely got a Pixel (open box 9a) to put GrapheneOS on it immediately. Been happy living the de-Googled Android life since.
I was sad that I had to go through the OOBE setup on the stock image to unlock the bootloader. At least it doesn't force an internet connection and login, unlike Windows.
sowbug
3 hours ago
If it's any consolation, the wipe* requirement before unlocking the bootloader is generally a good thing, even if it's inconvenient. Someone who is targeting your personal data gets access to your encrypted phone, either by stealing it or in an evil maid situation. They unlock the bootloader and install privileged code that helps them recover the symmetric encryption key or intercept your PIN. Then they either have your data or wait for you to enter the PIN. In theory recovery shouldn't be possible (access to the key depends on a secure element that rate limits brute-force attacks), but security bugs do happen. Wiping* your data before removing the bootloader's signing requirement is an extra layer of protection.
*It doesn't actually wipe your data; it just destroys the symmetric key, making the data permanently unreadable.
qurren
4 hours ago
Is it possible to install basic Google apps like Gmail, Calendar, Maps, Drive without googlifying the whole phone?
I'm not looking to fully de-Google but I want Google as apps and not my OS.
upboundspiral
9 minutes ago
Yes absolutely.
You can install nonprivileged google stuff on the main account.
Alternatively you can setup a private space (accessible to the main user but mostly separate from the main system) with a few clicks in the settings.
If you prefer more friction / isolation you can setup a separate user where you can install the google stuff.
handedness
an hour ago
I run a litany of Google (and other corporate/business apps) apps in Private Space under the owner's profile, which is only unlocked when I need it for something. That space's connection can go out over a WireGuard tunnel if I need those apps to be on any specific networks, while the rest of the phone's traffic is unaffected. The file systems stay functionally separate (although that's not a major concern given how file encryption is handled, plus the dream that is Storage Scopes), and that space has its own camera app and such.
The Owner profile itself doesn't run Google Play Services, so when that Private Space is locked and dormant it's effectively a degoogled stack.
Some will invariably argue that an old pocket-sized Linux PC with a cellular modem is a superior experience, and for some specific things it may well be, but GrapheneOS is the only viable option for someone looking for a user-respecting modern phone with very few limitations.
drnick1
2 hours ago
> I'm not looking to fully de-Google but I want Google as apps and not my OS.
This is entirely possible as other posters have explained. But I think it kind of defeats the point of Graphene, at least somewhat. Google is already profiling every aspect of your life by reading your emails, files, calendar, location, etc? In that case, OS access becomes moot.
I think that GrapheneOS makes most sense as part of a broader move towards privacy-respecting alternatives. I see the sandboxed Play Services as something useful perhaps in a secondary user profile, for the odd commercial app required and only available from the Play Store.
fooqux
2 hours ago
I agree and have moved mostly away from everything Google. But it's hard to replace maps. I know open street maps exists but it's hard to beat Google's data gathering.
wolvoleo
2 minutes ago
I think OSM is way way better. It has ever little path in the hills I walk. On Google Maps I'm just walking in a featureless green blob.
Maybe for cars Google is better but I don't use those.
eblanshey
an hour ago
I use Google Maps on Graphene. It works perfectly. You still get the benefits of the rest of the phone being degoogled. Just allow it to access your location only when you're actively using the app. When it's closed, it's closed.
theandrewbailey
an hour ago
I've been using HERE WeGo on GrapheneOS for almost a year. I had to install a text to speech engine in order to get voice directions.
handedness
an hour ago
I've settled on running CoMaps in the Owner profile, with Google Maps/Waze/etc. in the Owner profile's Private Space for when they're necessary.
fooqux
an hour ago
Can that setup work with android auto? If so, I'll need to try that.
donalhunt
an hour ago
There are players in the OpenStreetMap ecosystem attempting to change that. I know the team behind Organic Maps are actively working to make their app as viable as possible by sourcing appropriate data for example.
DarkUranium
12 minutes ago
Organic Maps is amazing.
I actually find that it blows Google Maps out of the water for cycling (which is why/how I discovered it). I haven't really used it for driving much because my own car has a builtin nav, so can't really comment on that.
YMMV of course.
hxorr
3 hours ago
I believe one of Graphene OS's main features is that they allow you to run google play services in a sandboxed environment, so you can run your standard google apps but without the standard android deal where google play services has unfetteted access to all your phone's location/data/etc info
hiitsmyaccount
3 hours ago
Yes, you install the Google Play store via the GrapheneOS App Store. The OS comes with like 5 apps out of the box. The rest is up to you.
Biggest caveats that I've encountered: tap to pay via Google Wallet is a no go, Android Auto can be flaky, MDM managed work profiles don't work at the moment, and some apps that use the Google Play integrity API fail to validate and refuse to work (I've only encountered one app that fails, and plenty others that work.)
In general, I'm moving towards a de-Googled life and GrapheneOS is a great entrypoint towards that.
handedness
an hour ago
My end-run around Google's absurd unwillingness to certify GOS for Google Pay has been Garmin Pay, which has worked virtually everywhere I've ever tried it.
I'm hopeful that an OEM Motorola device will get certified for Google Pay.
y2244
3 hours ago
Tap to pay is mostly NFC? So is there an alternative app?
jordand
2 hours ago
Curve Pay has worked well for me. Only good alternative as it doesn't depend on Google Play Services too
wolvoleo
3 hours ago
Yes you can use Curve pay.
Edit: Apparently that's Europe only? I'm in Europe so yeah. I didn't know that.
vrganj
3 hours ago
There's Curve Pay in Europe. In the US, I'm not sure.
notRobot
4 hours ago
Yes, you can have sandboxed Google apps: https://grapheneos.org/usage#sandboxed-google-play
genpfault
3 hours ago
What's the app data backup/restore story on GrapheneOS?
My understanding is that even with pseudo-D2D (device-to-device) transfers Seedvault doesn't backup everything[1].
Are there more-functional, non-root, local (non-cloud) alternatives?
[1]: https://github.com/seedvault-app/seedvault/wiki/FAQ#why-do-s...
handedness
an hour ago
Seedvault is still woefully insufficient, but it sounds like there's work being done to replace it. I can't imagine the enterprise crowd will overlook that and I'm hoping the Motorola partnership enables faster development.
lucb1e
2 hours ago
Not without root, no
FloatArtifact
2 hours ago
Any issues with banking insurance or healthcare applications?
sharts
32 minutes ago
Makes you wonder who are clown employees coming up with these nonsense decisions
RachelF
3 hours ago
I too, liked it.
However, some apps that I need for work, like Microsoft Authenticator, no longer work under GrapheneOS.
https://www.theregister.com/on-prem/2026/03/10/microsoft-tig...
eszed
3 hours ago
Yeah, I'm hanging on with GrapheneOS (on a Pixel) until their native-hardware (Motorola) phones come out, which hopefully will solve this. As I understand it, third-party (banks and so forth) app vendors have to accept their security attestation, which they don't right now, but (I hope) will with Motorola behind them.
Gigachad
an hour ago
I hate how common it's become for companies to force you to install things on your personal phone. Even worse is some of them demand you install a MDM profile on your personal phone which feels 1000% over the line of reasonable.
_carbyau_
an hour ago
From the linked article it seems this is related to Entra accounts which are Azure cloud related.
palata
3 hours ago
Microsoft Authenticator works on my GrapheneOS (not rooted).
idiotsecant
3 hours ago
Sounds like your work has been using your personal phone for free
Sarkie
3 hours ago
Google Authenticator works?
gonzalohm
3 hours ago
I think Google authenticator implements the standard OTP which lots of apps (including keepass) should support. Microsoft uses their own propietary crap
saintfire
3 hours ago
I use a basic OTP password instead of Microsoft's ironically less secure (see SMS as 2FA) with my work MS account. Perhaps your org disabled it but it is definitely something a Microsoft account can do.
Randomno
3 hours ago
> Wicked For Good
Is this an antithesis to Don't Be Evil?
yogthos
2 hours ago
Same, I've got a Pixel 9 and GrapheneOS works perfectly on it. I really love having full control over the OS on my phone and being able to decide what actually runs on it.