6 ms·

I got it installed last weekend, really powerful mobile OS. I did do about three weeks of research, as I worried that maybe a number of apps wouldn't run on it

I got it installed last weekend, really powerful mobile OS. I did do about three weeks of research, as I worried that maybe a number of apps wouldn't run on it or needed some form of deep attestation. Didn't find much, OpsGenie and other work apps are happy with the GOS level of attestation provided. Great to have Google kicked off the phone. So nice to shut off the network permission for any apps that only require an internet connection to serve ads. One tip from me, if you came from stock Pixel: You can download the default Pixel sounds and set them up like it was. Have a look for "Your New Adventure" online, the message sound is "Eureka".

exe34 1y ago
> So nice to shut off the network permission for any apps that only require an internet connection to serve ads. For those of us who aren't ready to cut the umbilical cord to the mothership, you can also root/firewall on normal android to stop this. In fact I choose to not be able to use banking apps in order to cut out the crappy ads.
- morserer 1y ago
  Root, while more efficient, isn't strictly necessary. AdAway (FOSS, F-Droid) can run without root using the stock Android VPN backend.
  - exe34 1y ago
    I use both adaway and AFWall+, as I don't like random apps making random connections, even if it's not for adverts. Once google play store ate my monthly data allowance, and it will never happen to me again.
  - strcat 1y ago
    RethinkDNS is implemented as a VPN service but it has support for local filtering combined with optionally using a WireGuard VPN or multiple chained WireGuard VPNs. You can have both via the VPN service API rather than choosing one or the other. No need for app accessible root access.
- Harvesterify 1y ago
  For those who don't want to root the phone, you can still avoid most of the ads by using a filtering DNS server with the Private DNS functionality on stock Android ROMs (or only at browser level if your favorite browser support DNS over HTTPS). It comes with some minor usability issues with captive Wifi portals sometimes, but the trade-off of not having ads in app or while browsing is way worth it IMHO.
  - strcat 1y ago
    You can use RethinkDNS and avoid compatibility issues with captive portals. This is one of the options we recommend for GrapheneOS users. RethinkDNS is implemented as a VPN service but it has support for local filtering combined with optionally using a WireGuard VPN or multiple chained WireGuard VPNs. Android's captive portal handling works with a VPN and VPN leak blocking active since the connectivity checks are specially marked as not going through the VPN and so is the captive portal handling component opened by the captive portal notification. Private DNS is still missing support for this and also has the issue of causing DNS leaks for secondary profile VPNs.
    - codethief 1y ago
      I've heard good things about RethinkDNS but I've been waiting for integration with Tailscale[0], which doesn't sound entirely trivial[1]. :'-( [0]: https://github.com/celzero/rethink-app/issues/1047 https://github.com/celzero/rethink-app/issues/1047 [1]: https://github.com/tailscale/tailscale/issues/12280 https://github.com/tailscale/tailscale/issues/12280
  - tsoukase 1y ago
    I put a Private DNS ('controld' for that matter) and never looked back. No more private VPNs with Blokada, no more block list updates. You choose if you want ad, tracker or adult blocking, without hassle, for free.
- backscratches 1y ago
  Graphene has a really great sandboxed google servicen implementation, so barring a handful of banking apps not working, switching to graphene is a very gentle cutting of the mothership. For me it was very subtle, with better battery life!
- jeroenhd 1y ago
  Even without root, a VPN-style firewall will work against all non-system apps. The downside of this approach is that you can't combine one with another VPN app.
  - username135 1y ago
    Are you referring to something like Karma on fdroid?
    - jeroenhd 1y ago
      Yes. I used to run NetGuard, but Karma seems to work very similarly. It looks like there's an app on F-Droid called "Rethink" that promises to do both firewalling, DNS blocking, and offers a WireGuard VPN. That seems promising, though I must add that I haven't tested it myself.
      - DeepSeaTortoise 1y ago
        Rethink isn't quite ready yet. Depending on your use case you can go without getting thrown off by a bug for weeks, but when it fails it can be quite annoying. And don't use the GPlay version, but the FDroid or GitHub one. On the other hand, the functionality is top notch. Easily the best integration of consumer level DNS + firewall blocking in any application on any platform. Just block everything of an application by default and then watch the connection logs for the app and start unblocking stuff via ips, domains or wildcards until the app starts working again.
      - johnisgood 1y ago
        I have been using Rethink, I think it is great.
  - strcat 1y ago
    RethinkDNS is implemented as a VPN service but it has support for local filtering combined with optionally using a WireGuard VPN or multiple chained WireGuard VPNs. You can have both via the VPN service API rather than choosing one or the other. No need for app accessible root access.
- jrexilius 1y ago
  The Netguard app worked well for me for that on vanilla burners and such. No root, "VPN" that I had block pretty much everything but the browser and Signal.
- strcat 1y ago
  > For those of us who aren't ready to cut the umbilical cord to the mothership You can use Google apps and apps depending on them on GrapheneOS via sandboxed Google Play. The vast majority of Android apps can be used. You don't need to stop using Google apps/services or other mainstream apps to use GrapheneOS. It's likely nearly all the apps you use or even all of them work on GrapheneOS. There's a per-app exploit protection compatibility mode toggle (and finer-grained toggles) to work around buggy apps with memory corruption bugs. We avoid turning on features breaking non-buggy apps by default and hardware memory tagging is temporarily opt-in for user installed apps not marked as compatible due to how many memory corruption bugs it finds. A small number of apps are unavailable due to checking for a Google certified device/OS via the Play Integrity API. These are mostly banking apps, but most banking apps do work on GrapheneOS. There are tap-to-pay implementations which can be used on GrapheneOS in the UK and European Economic Area. Several banking apps recently explicitly added support for GrapheneOS via hardware-based attestation as an alternative to the Play Integrity API. We're pushing for more apps to do this and for regulation disallowing Google from providing an API to app developers for enforcing devices licensing Google Mobile Services. Play Integrity API often portrayed as a security feature but Google chooses not to enforce a security patch level. They're permitting devices with years of missing important privacy and security patches but not a much more private and secure OS. Only their strong integrity level has a patch level check, but the check is only done for recent Android versions and only requires they aren't more than 12 months behind on patches which serves no real purpose. > you can also root/firewall on normal android This is different from our Network permission which not only blocks direct access but also indirect access via APIs requiring Android's low-level INTERNET permission. Our Network permission also pretends the network is down through many of the APIs. For example, scheduled jobs set to depend on internet access won't run.
1vuio0pswjnm7 1y ago
"Great to have Google kicked off the phone" Except the default browser is Chromium with some changes This reminds me of a recent HN comment I saw that suggested using Firefox was "kicking Google where it hurts" or something like that Like Firefox, this project depends on Google. For the hardware, the web browser and who knows what else It even offers a sandboxed Google Play Store It tries to copy Google paternalism It swaps a Google mothership for a Graphene mothership What if the computer owner does not want a mothership Can connections to Graphene servers be blocked, i.e., are these connections optional or mandatory Even Netguard which works on any hardware and does not require root makes unnecessary connections to ipinfo.io servers effectively giving them a list of almost every domain the user's phone trying to access If the concern is apps that only require internet connection for ads, Netguard solves that problem without root Most apps but not all will try to connect to the internet at some point, even if you never use them The user-hostile design of Android is that apps keep running in the background after they are "closed" (There are crude apps one can use to automate manually killing each process with "Force stop" but no one uses them. This doesn't prevent apps from trying to access the internet on some preset schedule) Netguard will show when apps try to connect and block the connections. It provides DNS logs and PCAPs. One does not even need Netguard to see this subversive activity Try this at home Enable IP forwarding on a computer you can control, i.e., one that is running an OS you can compile yourself such as Linux or BSD Put the phone on the same network as this computer Set the phone's gateway address to the address of the computer Run tcpdump on the computer and filter for the phone's IP address
- reincoder 1y ago
  I work for IPinfo. What is the context mentioning us here? I'm unsure if graphene uses our data. We process trillions of requests at the moment. I have no clue which services or software even use our data, let alone identifying individual IP addresses. Is making a connection to our API a cause for concern? If that is the case, we welcome OSS projects to user our local IP databases, which includes our free IPinfo Lite database that we primarily designed for firewall and privacy applications.
  - deleted 1y ago
    [deleted]
yellowapple 1y ago
I've got a Pixel 9a expected to arrive today, specifically for it to run GrapheneOS. One of my old phones was a Nexus 6P running CopperheadOS (prior to the dispute that spawned GrapheneOS), and it was great back then. Looking forward to how things have progressed in the years since. I wish GrapheneOS would support non-Pixel hardware, though, specifically my Fairphone 4. I get why that probably won't ever happen, but it feels like a massive regression in terms of repairable hardware to move away from that.
- W3zzy 1y ago
  Don't you have Lineage OS on you phairphone?
  - yellowapple 1y ago
    Yes, but there are various annoyances that I was tired of dealing with: - RCS chats not sending/receiving, which has caused me to not be able to receive or send messages from/to multiple group chats with friends/family (probably going to be an issue with GrapheneOS, but at least plenty of people have reported that to be possible to work; currently doing the "disable RCS and wait 10 days" dance, so we'll see how that shakes out) - Every other reboot the speakers would fail to initialize, meaning I couldn't hear anything except through Bluetooth (massive problem for getting up in the morning if I'm relying on my phone's alarms!). - Microphone quality was inconsistent; sometimes I'd sound fine, and other times I'd sound muddy. Also not an issue through Bluetooth; it was just the phone's built-in microphone(s). These were probably fixable issues, but I'm lazy and I wanted to give GrapheneOS a go, anyway (and so far I'm pretty happy with it, minus RCS still being a work-in-progress).

exe34 1y ago

> So nice to shut off the network permission for any apps that only require an internet connection to serve ads. For those of us who aren't ready to cut the umbilical cord to the mothership, you can also root/firewall on normal android to stop this. In fact I choose to not be able to use banking apps in order to cut out the crappy ads.

morserer 1y ago
Root, while more efficient, isn't strictly necessary. AdAway (FOSS, F-Droid) can run without root using the stock Android VPN backend.
- exe34 1y ago
  I use both adaway and AFWall+, as I don't like random apps making random connections, even if it's not for adverts. Once google play store ate my monthly data allowance, and it will never happen to me again.
- strcat 1y ago
  RethinkDNS is implemented as a VPN service but it has support for local filtering combined with optionally using a WireGuard VPN or multiple chained WireGuard VPNs. You can have both via the VPN service API rather than choosing one or the other. No need for app accessible root access.
Harvesterify 1y ago
For those who don't want to root the phone, you can still avoid most of the ads by using a filtering DNS server with the Private DNS functionality on stock Android ROMs (or only at browser level if your favorite browser support DNS over HTTPS). It comes with some minor usability issues with captive Wifi portals sometimes, but the trade-off of not having ads in app or while browsing is way worth it IMHO.
- strcat 1y ago
  You can use RethinkDNS and avoid compatibility issues with captive portals. This is one of the options we recommend for GrapheneOS users. RethinkDNS is implemented as a VPN service but it has support for local filtering combined with optionally using a WireGuard VPN or multiple chained WireGuard VPNs. Android's captive portal handling works with a VPN and VPN leak blocking active since the connectivity checks are specially marked as not going through the VPN and so is the captive portal handling component opened by the captive portal notification. Private DNS is still missing support for this and also has the issue of causing DNS leaks for secondary profile VPNs.
  - codethief 1y ago
    I've heard good things about RethinkDNS but I've been waiting for integration with Tailscale[0], which doesn't sound entirely trivial[1]. :'-( [0]: https://github.com/celzero/rethink-app/issues/1047 https://github.com/celzero/rethink-app/issues/1047 [1]: https://github.com/tailscale/tailscale/issues/12280 https://github.com/tailscale/tailscale/issues/12280
- tsoukase 1y ago
  I put a Private DNS ('controld' for that matter) and never looked back. No more private VPNs with Blokada, no more block list updates. You choose if you want ad, tracker or adult blocking, without hassle, for free.
backscratches 1y ago
Graphene has a really great sandboxed google servicen implementation, so barring a handful of banking apps not working, switching to graphene is a very gentle cutting of the mothership. For me it was very subtle, with better battery life!
jeroenhd 1y ago
Even without root, a VPN-style firewall will work against all non-system apps. The downside of this approach is that you can't combine one with another VPN app.
- username135 1y ago
  Are you referring to something like Karma on fdroid?
  - jeroenhd 1y ago
    Yes. I used to run NetGuard, but Karma seems to work very similarly. It looks like there's an app on F-Droid called "Rethink" that promises to do both firewalling, DNS blocking, and offers a WireGuard VPN. That seems promising, though I must add that I haven't tested it myself.
    - DeepSeaTortoise 1y ago
      Rethink isn't quite ready yet. Depending on your use case you can go without getting thrown off by a bug for weeks, but when it fails it can be quite annoying. And don't use the GPlay version, but the FDroid or GitHub one. On the other hand, the functionality is top notch. Easily the best integration of consumer level DNS + firewall blocking in any application on any platform. Just block everything of an application by default and then watch the connection logs for the app and start unblocking stuff via ips, domains or wildcards until the app starts working again.
    - johnisgood 1y ago
      I have been using Rethink, I think it is great.
- strcat 1y ago
  RethinkDNS is implemented as a VPN service but it has support for local filtering combined with optionally using a WireGuard VPN or multiple chained WireGuard VPNs. You can have both via the VPN service API rather than choosing one or the other. No need for app accessible root access.
jrexilius 1y ago
The Netguard app worked well for me for that on vanilla burners and such. No root, "VPN" that I had block pretty much everything but the browser and Signal.
strcat 1y ago
> For those of us who aren't ready to cut the umbilical cord to the mothership You can use Google apps and apps depending on them on GrapheneOS via sandboxed Google Play. The vast majority of Android apps can be used. You don't need to stop using Google apps/services or other mainstream apps to use GrapheneOS. It's likely nearly all the apps you use or even all of them work on GrapheneOS. There's a per-app exploit protection compatibility mode toggle (and finer-grained toggles) to work around buggy apps with memory corruption bugs. We avoid turning on features breaking non-buggy apps by default and hardware memory tagging is temporarily opt-in for user installed apps not marked as compatible due to how many memory corruption bugs it finds. A small number of apps are unavailable due to checking for a Google certified device/OS via the Play Integrity API. These are mostly banking apps, but most banking apps do work on GrapheneOS. There are tap-to-pay implementations which can be used on GrapheneOS in the UK and European Economic Area. Several banking apps recently explicitly added support for GrapheneOS via hardware-based attestation as an alternative to the Play Integrity API. We're pushing for more apps to do this and for regulation disallowing Google from providing an API to app developers for enforcing devices licensing Google Mobile Services. Play Integrity API often portrayed as a security feature but Google chooses not to enforce a security patch level. They're permitting devices with years of missing important privacy and security patches but not a much more private and secure OS. Only their strong integrity level has a patch level check, but the check is only done for recent Android versions and only requires they aren't more than 12 months behind on patches which serves no real purpose. > you can also root/firewall on normal android This is different from our Network permission which not only blocks direct access but also indirect access via APIs requiring Android's low-level INTERNET permission. Our Network permission also pretends the network is down through many of the APIs. For example, scheduled jobs set to depend on internet access won't run.

1vuio0pswjnm7 1y ago

"Great to have Google kicked off the phone" Except the default browser is Chromium with some changes This reminds me of a recent HN comment I saw that suggested using Firefox was "kicking Google where it hurts" or something like that Like Firefox, this project depends on Google. For the hardware, the web browser and who knows what else It even offers a sandboxed Google Play Store It tries to copy Google paternalism It swaps a Google mothership for a Graphene mothership What if the computer owner does not want a mothership Can connections to Graphene servers be blocked, i.e., are these connections optional or mandatory Even Netguard which works on any hardware and does not require root makes unnecessary connections to ipinfo.io servers effectively giving them a list of almost every domain the user's phone trying to access If the concern is apps that only require internet connection for ads, Netguard solves that problem without root Most apps but not all will try to connect to the internet at some point, even if you never use them The user-hostile design of Android is that apps keep running in the background after they are "closed" (There are crude apps one can use to automate manually killing each process with "Force stop" but no one uses them. This doesn't prevent apps from trying to access the internet on some preset schedule) Netguard will show when apps try to connect and block the connections. It provides DNS logs and PCAPs. One does not even need Netguard to see this subversive activity Try this at home Enable IP forwarding on a computer you can control, i.e., one that is running an OS you can compile yourself such as Linux or BSD Put the phone on the same network as this computer Set the phone's gateway address to the address of the computer Run tcpdump on the computer and filter for the phone's IP address

reincoder 1y ago
I work for IPinfo. What is the context mentioning us here? I'm unsure if graphene uses our data. We process trillions of requests at the moment. I have no clue which services or software even use our data, let alone identifying individual IP addresses. Is making a connection to our API a cause for concern? If that is the case, we welcome OSS projects to user our local IP databases, which includes our free IPinfo Lite database that we primarily designed for firewall and privacy applications.
- deleted 1y ago
  [deleted]

yellowapple 1y ago

I've got a Pixel 9a expected to arrive today, specifically for it to run GrapheneOS. One of my old phones was a Nexus 6P running CopperheadOS (prior to the dispute that spawned GrapheneOS), and it was great back then. Looking forward to how things have progressed in the years since. I wish GrapheneOS would support non-Pixel hardware, though, specifically my Fairphone 4. I get why that probably won't ever happen, but it feels like a massive regression in terms of repairable hardware to move away from that.

W3zzy 1y ago
Don't you have Lineage OS on you phairphone?
- yellowapple 1y ago
  Yes, but there are various annoyances that I was tired of dealing with: - RCS chats not sending/receiving, which has caused me to not be able to receive or send messages from/to multiple group chats with friends/family (probably going to be an issue with GrapheneOS, but at least plenty of people have reported that to be possible to work; currently doing the "disable RCS and wait 10 days" dance, so we'll see how that shakes out) - Every other reboot the speakers would fail to initialize, meaning I couldn't hear anything except through Bluetooth (massive problem for getting up in the morning if I'm relying on my phone's alarms!). - Microphone quality was inconsistent; sometimes I'd sound fine, and other times I'd sound muddy. Also not an issue through Bluetooth; it was just the phone's built-in microphone(s). These were probably fixable issues, but I'm lazy and I wanted to give GrapheneOS a go, anyway (and so far I'm pretty happy with it, minus RCS still being a work-in-progress).