Things that make me angry about my current smartphone Samsung Galaxy S21Ultra on a Verizon plan is the mandatory software updates in which they install WITHOUT MY PERMISSION stupid apps like Netflix and addictive gambling games and stacking block games and Candy crush. God knows what else they install without my permission. I don’t want any of it!
Next phone I buy I want to start with a clean slate, I’m not going to affiliate with any conglomerate like Verizon or AT&T or Sprint or T-Mobile etc, I prefer to go rogue somehow,
which smartphone do you recommend that has no bloatware and it’s customizable?
The only recommendation I can provide is a Google Pixel device with GrapheneOS. Graphene is only designed to work on Pixels because they are (allegedly) the most secure mobile phone hardware-wise. Once you flash Graphene, it’s up to you to install any apps beyond the basic browser (Vanadium), gallery, camera, caller, SMS, PDF viewer, contacts, file manager, and security/system apps. No Google involved without your permission, though you will have to install Google services, available via a Graphene mirror and sandboxed for privacy, IF you want to install an eSIM after flashing Graphene. If you’re interested in further information, please let me know. I use it, love it, and am happy to provide any information you may need to decide if it’s a good fit for you or not.
Not OP but interested in both privacy and high-tech features. My current (stock) pixel 4a device has a worse camera than many other phones, but the software compensates a lot, netting better picture quality overall very often. I’m wondering how much of that is lost when using graphene instead of stock android, do you know?
Similarly with the latest gen pixels having AI features built in, I’m assuming much of that is software that’s not as easily installed somewhere else…
I’m not sure what the GrapheneOS stock camera app does under the hood, but if it’s not enough for you, you have the option of installing Google’s Pixel Camera app from the Play/Aurora store if you want to compare. I don’t imagine it would require Google Play Services to run on devices older than 8 since they don’t have the AI integration, but I could be wrong. You can easily deny the app network permissions to ensure that the app isn’t sending your photos to Google. As far as the AI features go on newer devices, I could see those requiring Google Services installed to work, but again, they’re available through a Graphene mirror, run sandboxed for privacy, and can be denied network permissions. I’m satisfied with how my pictures turn out (7 Pro), but I may try Pixel Camera out just to see what the difference is.
If you do that I’d be very interested to see the results! Especially things like night sight, my gf’s camera is as night blind as she is 😅
It’s been a couple years since I tried the graphene camera, but (at the time) it’s essentially trash in comparison to the Google camera. I just use the gCam without internet permissions and call it a day.
But I’m not hardcore tin-foil ‘the NSA will use your office mirrors reflection to precisely heat up a 2mm space on the side of your phone that somehow enables Bluetooth and with that the G + glowy bois will exfiltrate your data at 10Kb/s’. I want additional security hardening and some privacy additions, but I also use the play services and store, like a typical user. Yada yada threat model yada yada - I just want my phone to simply function at the end of the day. Middle of the road, if you will, between stock os users and the guy that’s now boarding up all his windows because of the 2mm Bluetooth mystery vulnerability.
Unknown about the claimed AI features - my 8 pro is in transit. But I can check in a few days, if interested.
What is the root scene on Graphene? I know the dev is pretty against it but I like having root access after being used to it. Is it possible to easily root it without any integrity issues later on?
It’s not supported. According to the devs rooting defeats the purpose of Graphene OS.
Yeah I have read that. And couldn’t find any reason why. When I ask about root people only say "if you want root, graphene isn’t for you"😅
Rooting defeats androids security model and allows for further exploitation. Graphene most likely does support it because any AOSP OS that is geared towards security isn’t going to leave a big hole in their security allowing malware or bad actors to modify system files (or install a rootkit).
Desktop Linux allows root access and is still secure. Allowing root access doesn’t make it insecure.
Desktop linux isn’t the same as Android, which is why I said the “Android security model”. Android is a mobile operating system and must protect against the fact that it will be in unknown environments all the time. It must protect against physical attacks, software attacks, and partially sandbox apps. Root breaks app sandboxing and allows for modifying system files and reading internal app storage. The system image is immutable and modifications/settings are made on top.
Linux desktop isn’t more secure out of the box. The general user account shouldnt be a sudoer. Immutable OSes are more secure and help pervent rootkits and other attacks. PCs are most often stationary and stored in a private location. Laptops are weak against attacks because you can boot to a different OS from usb without passworded BIOS. Desktop OSes are the geared for the same kinds of protections.
There is good reason why Android is far more secure than Linux mobile.
Oh okay thanks!
GrapheneOS significantly increases security, rooting does the exact opposite
It looks like the verified boot security feature of Graphene effectively prevents rooting the OS. I understand wanting root access, it does provide some nice features, but I don’t have any need for it. I don’t have any bloatware embedded to remove, and I don’t need to mod any system apps, so I haven’t looked into it much. I know the dev says it isn’t planned because it massively increases attack surface, which I personally agree with, but it would be nice to have the option via a separate version of the OS or something. If you need root access, I would suggest looking into LineageOS. It’s similar in privacy to Graphene and last I knew could be rooted. Graphene is very focused on security as well as privacy, and for me is a best of both worlds, but if you want to modify the system for various power-user type features, it might not be for you.
Yeah I’m currently running LineageOS. I wanted root mainly for adblock (modifying
/etc/hosts) and AppOps. Does Graphene have those features built in?Check out DivestOS. It’s a fork of lineage with a focus on better security and privacy. Not restrictive like Graphene. Rootable via magisk.
So far I’m liking it. Great battery life (lowest I’ve ever seen) even on my 5 year old phone.
I’ll try that thanks!
No, it doesn’t. I use 95% FOSS software, so anything that might have ads just gets denied network permission entirely. As for AppOps, I just looked it up, and that would be something I’d like to see developed as a feature of Graphene. It seems like a genuinely useful, and at the very least privacy-protecting, app. I don’t use copy/paste via keyboard, and despite it not having network permissions, I’d still deny it clipboard access simply because it doesn’t need it.
Okay. Thanks a lot! :)
For security reasons GrapheneOS doesn’t allow the modification of system files. You can achieve the same thing with DNS though. Either self-host a Pi-Hole or AdGuard Home, or use something like NextDNS.
You can root on GrapheneOS. You do it exactly the same way you’d do it for the stock Google ROM:
- Have an unlocked bootloader. Yes, this means that it “”“defeats the purpose of GrapheneOS”“”, if the purpose of GrapheneOS isn’t for you to avoid Google’s privacy nightmare. I use GrapheneOS for privacy moreso than security, and not being able to block ads properly is irritating.
- Install the Magisk app.
- Extract the
boot.imgfrom the GrapheneOS image and patch within Magisk. - Flash the patched boot image in the bootloader.
The main annoyance with this is that you’ll have to do that dance every month when a security patch gets released, but for me, it’s better than vomiting from exposure to ads on mobile.
Oh okay. Thanks! Does it pass the integrity checks?
What is the patching process when running with Majisk, without OTA? It looked like quite a PITA to me, but I’m using Graphene for the same reason you are.
Edit: I found this
After sideloading an update I’d probably have to do what Trevor posted.
Get a used pixel for $100. Factory reset on arrival, and install Graphene OS. Do not install gapps.
Ignoring the gapps part is… Tricky.
Why? By default gapps doesn’t come with ROMs. Its usually more work to install gapps.
Well yeah…but eventually you end up needing some banking app or some other crap that might need G-Services.
Nope. Never needed it. Just dont use that crap.
I wouldn’t put anything financial on a phone, anyway. Use a secure laptop for that.
Except, in my country, the banking website will NEED a token generated on the banking app. Internet banking assumes a smartphone with their app…or it’s completely blocked what you’re allowed to do.
Which country? All countries I know about like this allow hardware tokens as an alternative to a smartphone with a TPM
I wouldn’t recommend a Pixel older than the Pixel 6 as these will soon be EOL.
+1 for pixel. I just ordered a 7a for grapheneos.
everyone’s recommending Pixel. That’s good to know.
ok but we’re all here because we’re interested in privacy, so please tell me what does Google Pixel have anything to do with privacy??
“Google” & “Privacy” are contradictions.
GrapheneOS, a privacy/security focused operating system is compatible with a limited amount of devices. The pixel series is part of those compatible devices.
They use Graphene. That’s the point. Pixels are unfortunately the only supported devices. That’s why I won’t use Graphene as I would never support google. A pity, many do
I personally think this might be a “vote with your vallet” situation. Signaling to Google (and to other manufacturers) that people appreciate openness in their smartphones. Knowing Google though, it’s unlikely they will get it.
People or rather I didn’t buy pixel as its more privacy friendly but its the only one available here that let’s me install another ROM on day 1 without voiding warranty. And grapheneos being one of the best privacy focused ROM only available for pixel and that pretty much every ROM is available on pixel is another reason. I was basically forced into buying a google product as everyone else void warranty on unlocking boot loader or they don’t have much of a custom ROM scene.
r o m?
range of motion
Read only material
That’s all I’ve got
Read-Only Memory
thank you
I can’t tell if you’re being sarcastic or not but look it up yourself if you actually don’t know
Read Only Memory
If you just want something that’s more privacy-minded out of the box without messing about with custom ROMs etc, maybe consider an iPhone?
I will never buy an Apple product.
It is not privacy minded unfortunately. No major smartphone brand has privacy.
+1 for iPhone. Is it as private as GrapheneOS? No. Is it more private than almost all out of the box android phones? Yes.
Apple still use a lot of your data, although they at least claim to anonymise most of it. But that data stays internal to try boost more apple sales, and isn’t sold to other companies. I’d rather 1 company have my information than 100.
Any apple apps you don’t want are easily removed once it’s set up and they don’t come back with updates etc.
This is the privacy community, I wouldn’t consider iOS appropriate here at all, since you really can’t do anything to limit the data collection. Especially not for a “what phone should I get” question. If someone already has an iPhone, asking what you can do is a good question (“not much” is the answer you’ll get).
Is it better out if the box than most Androids? Probably, maybe, depending on how that’s defined. But I can quickly make most Androids far better than iOS, even ones with a lot of vendor bloat.
For example, I recently cleaned up a Verizon Samsung just using the Universal Android Debloat Tool. This is stuff I used to do manually with ADB.
Then adding a VPN and I could restrict apps calling home and bypass Google DNS.
You can even disable google services, play, etc, and just don’t use a google acccount on the phone.
Weirdly in this case I think I agree. You can look at my previous comments about how much I hate Apple but it seems to me that OP isn’t too technical and installing a custom ROM might not be what they’re after. iPhones don’t have any of those annoying games and stuff preinstalled, as long as the carrier doesn’t install stuff. I’d suggest a refurbished unlocked iPhone though, to save some money. Make sure the previous owners account is removed from the device or else it’ll probably just be a paper weight.
If OP is open to custom ROMs then GrapheneOS is a great choice but LineageOS and DivestOS are also great options for someone that wants to get started with privacy and they support a lot more devices, that can be got for cheaper than an iPhone/Pixel. Again, I’d recommended a refurbished, carrier unlocked phone that is supported by one of these projects
Its not hard to flash a rom these days, unlike ten years ago.
Now developers post instructions for each device type. Look at Lineage, Graphene, DivestOS. Very good instructions from all of them, including installing ADB on Windows or Linux.
Of the dozens (hundreds?) of times I’ve flashed over the years, I’ve bricked 1 device, and that was from experimenting and not following instructions, I knew it was risky.
And with Pixel it’s about as straightforward as it gets.
They are good products, even if they don’t have the nerdy cool factor. Each day I’m working on old C/C++ code in Linux, so having my phone be a reliable appliance instead of yet another computer to fuck around with is totally fine for me. I liked my past Android phones too though.
No carrier bloatware and very long software support.
I carry an iPhone for work, corp IT manages it, I use little more than comm stuff there, so theres no advantage to having an Android. (Before that my work phone was a blackberry, because I need work calls, email, messaging, etc to just work, and you couldn’t beat the battery life).
My personal is Android, because I want the tools I can use there.
Two very different use-cases.
And I really dislike iOS UI/UX, the limitations are very constricting. But for the basics it “just works”, but it isn’t something to recommend for privacy.
Yep, there were times when I was having a good time rooting and even overclocking my Android phone. Automating stuff with good old Tasker too.
But like I said, the “app launching appliance” life is all food for me now.
Plus I have an Apple Watch and like it, and my entire family uses iPhones. So whatever ecosystem inertia/lock-in could be there, is there.
Removed by mod
Another vote for fairphone here, but for reasons others failed to mention: replaceable battery, so even after 2 years, it can feel like new and keep most of its value (to resell if wanted); 5 years of updates + warranty; support for after market roms. Then there’s also the fair ethics part of it
How are you killing your battery after two years?
Even my cheapshit Honor 9 lasted six before it started getting random shutoffs.
old phones have batteries that are meant to last
Not killing, but degrades in performance because batteries have a limited amount of charge cycles. The more intensive you use your phone, the faster the battery degrades
Maybe a fair phone? https://shop.fairphone.com/fairphone-5
Short summary:
- no bloatware
- 5y waranty
- easily Repairable
- Planned to receive 5 android major version upgrades
Addition:
- several unsolved (hardware) issues in the past
- security patches are far too late
- 8 years support
- Using the promoted /e/ results in loss of support (you habe to flash back FairphoneOS). Maybe this has changed as they are sellig phones with preinstalled /e/ by themselves
- Screws in the FP4 where very low in quality
- above-average batterie drain
I have the fp5 and flashed e/os myself. Im very happy with it. You need to flash it back when you want to sent it in (they have the instructions on there own page). Build Quality is nice. Repairs are simple. The price for spareparts is reasonable. And they really try to make a difference here and that is why i support them. Are they perfect? No? But who is? And you need to start from somewhere i think.
- no bloatware
Does it come without GApps? Most people don’t need half of those
It is google Android but they do not pay for the name so they call it ‘FairphoneOS’. It comes with all the standard GApps.
Now for the important question though:
Do they allow the user to uninstall those apps like any other app?
It is google Android but they do not pay for the name so they call it ‘FairphoneOS’.
That’s not how that works, they call it FairphoneOS because they added their own customizations. Default Android is pretty barebones nowadays so nobody uses that. You dont have to pay Google to use the Android name
They really need to sponsor graphene to get it officially supported on fairphone. Cant recommend fairphone when you are stuck with google tracking everything you do on stock android.
Google Pixel with GrapheneOS
Heads up, the bootloader cannot be unlocked if you buy a pixel through Verizon. You have to buy it straight from Google if you want to install anything custom.
Source: I have a pixel 6 pro from Verizon that I got originally thinking to try out grapheneOS.
And if your bootloader is unlocked, VZ is likely to lock you out of VoLTE/HD Voice/WiFi calling/etc.
I mean, you could go to T-Mobile who don’t currently play these specific games with devices, but then you’re trading coverage for features/freedom.
All carriers, wired and wireless, need to be regulated as DUMB PIPES. Title 2 for everyone. That’s what we’re paying for: Not “the Verizon experience” or “the pride and accomplishment of being an AT&T customer.” Let me buy a phone, and do with it whatever it is technologically capable of doing on your network. The network provider doesn’t need to provide any Android/iOS tech support if they keep it simple and stay out of the customer-fuckery business.
You dont have to buy straight from Google, just literally from anywhere else than Verizon.
Google Pixel with GrapheneOS.
I keep seeing this idea everywhere. Buy a Google phone and install another OS.
It is completely absurd to fund the exact adversaries you are running away from, while consuming, without contributing a dime, merely a piece of free software. (It is only a small piece of freedom because none of the hardware is free, and some binary blobs [incl. potential backdoors] will still be present in the alternative OS no matter which one it is.)
This is unsustainable, terrible, damaging advice. Stop giving it.
Buy a pixel off marketplace then. You can brag about saving e-waste.
Google isn’t a bad company, just a product of poor regulation. They have amazing engineers and produce valuable hardware and that should be praised.
Its the business side of things which needs massive regulation and an ethics check.
It is not about “bragging” or whatever. Nor is it about “bad” or “good”.
By funding or promoting the use of Google products, you would be funding litigation and influence such as lobbying to keep poor regulation as it is, if not worse. You would be funding their acquisitions of great tech and startups that might offer a more ethical and/or free technology. You would be funding their poaching of said engineers and valuable hardware intellectual property.
Simply put, it is a counterproductive and an unsustainable practice.
That being said, their amazing engineers, and technical value of their hardware are irrelevant to this community, post and comment. That simply doesn’t excuse their entire business model being built on breaches of privacy and other forms of curbing user freedoms.
The bottom line is that GrapheneOS is the most security-focused mobile operating system available, and the Google Pixel is pretty well the only mainstream phone with an unlockable bootloader.
If Alphabet were to ever lock down the Pixel’s bootloader, the GOS devs would undoubtedly jump ship to a lesser available platform in order to continue the project. But until then, no other hardware comes close with respect to embedded security.
Im going to do this and leave every social media except some federated instances.
Already went with Linux and FOSS years ago. Finally time to say good riddance to everything that doesnt align for what I stand for. I like it better anyway
I have a Xperia 1.
It has a flagship SoC, but it also has a SD card slot, a headphone jack, no notch or cutout, front firing stereo speakers and a nice blocky look without a massive camera bump.
The downside is software support can be a bit spotty and the cameras are made for manual use, as opposed to being AI-driven point-and-shoot things. That last one could be a positive depending on your preference, though.
But overall? I’m very satisfied, and I went there specifically because I was tired of the ongoing Apple-ification of Samsung in the first place. You may want to consider coming to the dark side and incentivizing Sony to keep making a phone with a feature set, instead of copy-pasting Apple’s or Samsung’s playbook.
Same boat here, I have the 5 II and I absolutely love it. Great size, the camera is OK on auto but can do wonders in manual mode (depending on your skill).
The lack of software support is a bummer though. I was surprised it’s not in LineageOS’ official support anymore…Do you use any custom ROM on your Xperia?
Nope. Honestly, I stopped tinkering with that stuff altogether ages ago. It’s a candybar that gives me text messages and takes photos, I don’t need to make it my own.
No bloat? Stay away from Samsung then.
A Google Pixel running GrapheneOS is your best option. Graphene doesn’t have any Google services by default, no bloatware at all, maximum privacy and security. It’s super easy to install, you can check out this video guide or just read their official documentation.
Another video about GrapheneOS that I totally recommend: https://youtube.com/watch?v=yTeAFoQnQPo
I recommend this after the install: https://youtube.com/watch?v=BymH90zFe30
Here is an alternative Piped link(s):
https://piped.video/watch?v=yTeAFoQnQPo
https://piped.video/watch?v=BymH90zFe30
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
How well does apps that require locked bootloaders, non-rooted device etc. work on grapheneOS? We have an official 2FA app in my country that’s used for digital identification for everything from banking to social security services. Right now it isn’t working on my oneplus 9p with lineage, despite using magisk and passing safetynet check, because it still detects that my phone is rooted.
GrapheneOS is built to work with a locked bootloader, in fact, relocking the bootloader is a step in the installation guide. It’s not rooted by default and the GOS team highly recommends against rooting, all apps should work as long as they only require SafetyNet basic integrity. If they require full integrity, they won’t work on GrapheneOS because the OS has to be manually whitelisted by Google in order to pass the full integrity check. Most apps (including banking or government apps) only mandate basic integrity though, full integrity is rarely required. It should definitely work better than LineageOS.
Hmm, my lineage OS phone passes basic integrity check, and my banking apps all work as intended, as do other government apps. But this damn 2FA app is still complaining and refuses to work, saying the phone is insecure.
Yeah, that’s because your phone is rooted. By default you can’t get root on GrapheneOS so it should work there.
For best privacy AND security, Pixel 8 or 8 Pro with GrapheneOS. Nothing else compares. The Pixel 8 series are also the first that support hardware memory tagging, basically making them immune against 70% of all exploits.
Removed by mod
Get a Pixel
Install grapheneos after
I also caved for a pixel (4a) for my last phone, it still has Google’s bloatware (can’t remove youtube music app for example), but at least it doesn’t have Samsung’s bloatware in addition.
Still interested where this thread goes in other options though, as it’s getting worse in battery life and I’m also looking out for something new.
Flash a third party OS like Graphene/Lineage/DivestOS. No more bloat.
A Pixel is rootable, which would enable you to remove whatever you want. Though I prefer starting clean.
Will a pixel respect my wishes for them to not install game apps behind my back?
And how can I buy one without bloatware already loaded on it? When I bought this phone I had to delete so much bloatware.
Only buy the Pixel if you are going to install GrapheneOS on it. GrapheneOS is de-googled and has no bloat pre-installed.
Pixel is stock android and is guaranteed to not have bloat unless some carrier is involved in it. Whenever anyone here suggests pixel they are definitely doing it for custom ROM like grapheneos and its pointless to buy otherwise.
Just avoid carrier-branded phones. Those are often boot locked.
Google Pixel. I dont know I want to keep my 4a actually as its small, nice and has a headphone jack.
The 4a is end of life and shouldn’t be used anymore.
I know the mantra
