With the recent news of Apple disabling iCloud encryption in the UK I’m wondering if now is the time to switch from iOS to GrapheneOS, however I have a few questions before I consider switching.
Firstly I know the ideal way to use it is without Google play services, however it looks like thats needed for my banking app (which also apparently only works under the owner profile so I don’t have the option of having a separate profile for Google play apps). I believe it would also be needed for notifications on Whatsapp and Facebook messenger (I know they’re shit but I can’t convince everyone else to move). In terms of how much data Google/Apple can harvest how does GrapheneOS with sandboxed Google play services compare to iOS which I believe also sandboxes all apps by default? I’ve always used iOS previously so I don’t fully understand what Google play services does on stock Android or how much better the sandboxing truly makes it.
Secondly what are the best options for backups? It seems like seedvault is USB only, ideally I’d like to be able to backup to my home server. The main thing would probably just be my photos and Whatsapp messages if its not possible to do full device backups.
I also have a couple of questions about the pixel hardware. There’s currently an offer on so I can currently get a pixel 7a for £280, that seems like a good price but I know the pixel 9a is releasing soon, is the 8a likely to drop much in price after that? I don’t know how quickly the prices drop but considering the 8a is currently £500 I can’t see it dropping to <£300
Also I hear a lot of good things about the pixel cameras, is that still the case with GrapheneOS or is that just because of Google’s proprietary camera app? I’m not a massive camera user so its not a deal-breaker either way.
Lastly, I know this will mostly be speculation but I’d be interested in people’s thoughts on the future of GrapheneOS and alternatives with stuff like the play integrity API. Do you think it will get to the point where 90% of apps no longer function or do you think most developers will ignore it?
[…] I’d like to be able to backup to my home server. The main thing would probably just be my photos […]
For the photos, since you have a home server, have you heard of Immich? For anything else, there was a time when I could have recommended syncthing-android, but development on that has been discontinued, though you can still try using it. Some privacy-conscious cloud services may allow you to sync app folders, backing up WhatsApp that way, but I have no experience with that.
is the 8a likely to drop much in price after that? I don’t know how quickly the prices drop but considering the 8a is currently £500 I can’t see it dropping to <£300
Instead of buying straight from Google, you can consider buying a refurbished 8a off ebay or something local - my last two Pixel purchases have been through that method. It tends to be substantially cheaper than buying new, even as little as 6 months after the product launch, and the 8a launched 9 months ago. Just be cautious of seller ratings, reputations, and consistency - prices are lower there because it’s more of a risk for the buyer.
Looks like there’s an iOS client for immich as well so I will give that a try! I’ll have a look on eBay, my only concern with not buying new would be battery longevity
I think switching from iOS to GrapheneOS doesn’t massively improve your privacy. However it improve your freedom and the control you have on your device. Privacy takes education if you install GrapheneOS and link it to your Google Account and use invasive apps that are not needed to be that so (like a calculator app that access your Pictures and geolocation) will not improve drastically over iOS but will a bit over Stock Android. But unlike iOS you can use you’re phone without accounts and that’s huge.
Where did you see that banking app only works on the main profile ? I personnaly use a seperated user profile for all banking related apps and it just works with the Play Services installed and not signed in getting apps through Aurora Store. Seperated user profile is not conveniante to use daily. If you want quick access to your banking apps you could use a Work Profile, setting it up with the FOSS app Shelter. You can installed the Play Services and the Play Store if needed to that profile and limits some of their permission (some are required for it work properly)
I do backup manually of what I feel is important so I won’t recommend you anything. However if I remember correctly WhatsApp let you do backup only on Google Drive if you’re on Android and iCloud if you’re on an iPhone.
I wouldn’t buy a 7A because of security updates ending in 2028 which is in 3 years already and the battery is worse than the newer models. While the 8 series is ending support in 2030 and 2031 for the 8A. Keep in mind that iPhone are premium devices while Pixel A are midrange, it’s a bit like the SE from Apple. Phone are getting expensive and if I were you I would wait to get lower price on the 8A or 8Pro.
Yeah Pixel Camera is amazing for photography, while lacking behind competition in Portrait Mode (used to be the best) and videos (iPhone are much better). But this is mainly thanks to the Google proprietary camera app. Phone photography is good only thanks to the algorithmes processing the images the hardware isn’t that great. You can still use the stock Secure Camera from Graphene and get good results in great lighting condition however installing Google Camera through AuroraStore or the PlayStore directly will give you better results. But it come with drawbacks as it only support Google Photos to open your previous shots from the camera app. It also asks for Play Services but someone told in the comment that is not the case so maybe it has changed since I did. There is an open source app that fakes the Play Services for Google Camera to work without asking questions. It’s called GCam Services Provider (Photos), you can also bypass the Google Photos limitation by using GCam Photos Preview but this one is a bit clunky to be honest, I hope it will get updated but doesn’t seems to. You can also install modded GCam to bypass all of this but this come with it’s own risk and is mainly focus on non-Pixel devices. But if you really want to try here is a trusted ressources.
This is a valid question and I hope we will be able to live our digital lives without being so dependant from Google or Apple. A great start is by switching to FOSS apps when possible, it’s not a magic solution and come with limitations but as of today it’s my goal even if I still use proprietary app for my bank for exemple.
Since you come from iOS I want to point out that there is Goodwy that’s maintaining amazing foss apps forked from SimpleMobileTools (now Fossify Tools) and applied an Apple inspired UI, you might feel more at home with his apps. Mention to Right Gallery, Right Contact, Right Dialer, Right Messages and Right Files. The apps are asking for internet permission but it’s for paying the premium fee to unlock all feature (you are not forced to pay to unlock them). I made a donation using Bitcoin to the dev because he’s doing great work and never allow the app to have internet permission thanks to GrapheneOS feature.
There is a fairly great ammount on ressources on AlternativeTo regarding Android apps I myself made a couple of list you might want to take a quick look :
- A clean Android setup with the best apps (mostly open source)
- Beautiful Open Source Apps for Android (nice & modern UI/UX) Some apps are not updated anymore!
- The ultimate F-Droid setup (300+ Apps) Need to be updated!
- My privacy & user friendly setup [Dec. 2022] Need to be updated!
Not from me
Thanks that’s very helpful. FYI the banking app info came from here: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/
if you’ve happily consumed apple’s offering up until now, you can just disable iCloud backups and that’s it, nothing essentially changed for you - nobody’s going to go through your phone. that remains as safe as it was a month ago.
I recently made the switch myself. I do use multiple profiles but I don’t think it’s required for me. I was curious to see how it all works. I may end up switching to a work profile instead. I have google play on my main profile mostly for notifications for WhatsApp etc. A banking profile so that banking details are isolated, and anoyher profile for apps I need that I don’t use often and prefer to not have in my main. In a lot of videos its advsed to not use profiles to begin with as I causes a lot of friction and that makes adoption harder. You can always begin using profiles later on.
I am not logged into GPS and it only has network permissions. I connect via NextDNS and there is so little background traffic in thw logs, it’s a refreshing sight.
I have yet to find anything I could do on iOS that i can’t on Graphene. I install most apps via obtainium and the other few that I can’t via aurora store. I use OSS apps whenever possible.
On the graphene website, I would recommend reading their full “Features” page. It explains a lot.
In addition also look at /e/os/ as well. I am currently de googling from my primary phone to a secondary phone (on my old phone; I flashed /e/os/ on it. And it have no Google apps. They have micro g integration built in. And I use “shelter” to create a work profile to isolate the apps that are not privacy focussed and they forever live in that sandbox, and you can turn off and on those apps with one click".) Changing my email address to govt/doctors/etc. And backing up data from google account is taking the longest before I disable that completely.
If GrapheneOS doesn’t look like it will meet your needs, LineageOS w/microG may be best for you.
The main issue is that the learning curve is higher to get it to a state that’s a balance between security and privacy. You have to learn how to install it for your device, set up root with Magisk or the like, install modules that allow your device to pass/bypass google’s SafetyNet Device Assestation, install the module to avoid connecting to google via GPS, set up AdAway, AFWall, Blocker, LSPosed if needed, and get android auto set up if needed. That’s not even including all the device-specific tweaks you’ll end up needing/wanting, or how to manage updates. It’s a lot of work, but in the end you get a phone that acts like a computer you control instead of an “appliance” that works against you.
LineageOS sucks at security, weakens Android’s security model, doesn’t deliver full security patches, to name a few of the problems. Better an updated iPhone and save your files locally than switching to Lineage
PS: I know I’ll get a lot of hates for saying that but I’m being honest
Does LineageOS let you bypass the strong authentication in the play integrity API? That’s probably my main concern with switching over as the main apps I use could become unusable in the future. GrapheneOS is probably a better fit for me at the moment but I have considered other options
Not exactly, no. For instance, I don’t use the Google Play store (i use Aurora Store instead), but I have gotten Android Auto working on my phone. What Google features you’ll be able to get working also depend on the device and android version.
Firstly I know the ideal way to use it is without Google play services, however it looks like that’s needed for my banking app (which also apparently only works under the owner profile so I don’t have the option of having a separate profile for Google play apps).
How do you use microg with graphene? I thought this was unsupported.
You don’t. I was unaware of the hardon gOS had against GmsCore.
Microg pairs best with LineageOS. I’ve done both and I prefer the GrapheneOS sandbox. It actually passes safetynet at the moment.
Just don’t expect RCS messages or NFC payments to work on either.
It is not
You can install Google camera app on GrapheneOS if you want to
Graphene likes to push the use of user profiles (just called “users” in the OS) but I find that to be a trash experience myself. Instead, you can enable work/personal profiles right within the single user account and keep sandboxed Google Play and the apps requiring it all within the work profile. You can restrict location and other permissions for Google and don’t even need to log it in for it to work. You just need the Island or Insular app to enable profiles.
The Google camera app works perfectly for great photos with the pixel hardware and last I checked it doesn’t even require network access or Goodie Play - except it won’t embed GPS in photos without Google.
As you can probably guess, the amount of data Google gets will really depend on your setup! I like to use NextDNS to further filter connections. (Pihole might be better but it’s more effort.)
Regarding seedvault, you can have it save to a webdav location, Nextcloud, or directly on the phone. If saving on the phone you could just have SyncThing or something similar auto sync the file to another device.
Wait, I am new to GrapheneOS and the profiles are a real hindrance. I’ve seen nothing on “work/personal” sub profiles within something like the “owners” profile. That would be a game changer.
Saved. Will be swapping to Graphene as soon as I get a new phone, and that work/personal thing is about to be a life saver for all these garbage apps I’m forced to have installed
Thanks, that’s useful to know!
I run Grapheneos, just been through the setup. Out of about 100 aps 7 needed play. I only actually needed 3 of those. Uber and Lyft in particular and they ran fine with it. The other was my banking app which would not work. For now I will just use my old phone on wifi to deposit checks. After that I will either put it on my wife’s phone or switch institutions.
Play services my understanding is not privilaged on GrapheneOS. Usually it is.
By the way Signal does not need Play Services but it will use them if they are available.
Phone. Look at all the Google phones and divide price by years of support remaining. Best will probably a later a-series phone.
Integrity api. Graphene passes except for highest level. Who knows the future.
How are you installing Signal? I installed it from their website and it was constantly throwing up messages about missing play store.
try molly
Obtainium.
Keep us updated on your transition, I’m curious
Well I’ve now ordered a pixel, I’ll let you know how it goes
Backup. Seedvault can backup to Nexcloud though it is experimental. I use that too but do not fully trust it.
I dump apps that allow that to main storage and just plugin my phone to my laptop and archive main storage. Then I sync apps that incude sync to Nextcloud directly. This is what I have always done even before GrapheneOS. Never used Google Drive.
Do you know if WhatsApp allows dumping to main storage?
No idea.
Keep mind the owner profile also has a work profile too and a private space. Might run in one of those.
The are also 31 user profiles like the owner profile but they do not have private spaces.
SMS is janky outside of the Owner profile. Unfortunately my workplace requires me to respond to SMS at times.
It does not sandbox you out of googles Single Sign-On (SSO), ie, if you sign into any google account in any google app, it will sign you in as that account across all google apps on that profile. I wanted to sign into gmail but not tie the google account to google messages (for RCS).
Use a third party e-mail client
Working on abandoning the gmail accounts entirely tbh. Until then, the native gmail filtering (primary/social/promotions) keeps those inboxes usable. 10+ years of ad spam from signing up for shit… literally a hundred or so emails a day.