any graphene os users here who would like to discuss the experience and how to achieve this and that?
graphene os - practical talk
- Thread starter void
- Start date
Good in theory, in practice many apps donāt work. It takes more than just an os to make a phone secure. See here: Secure communication devices
after almost two years I can say it works surprisingly well, except google pay and curve I don't recall anything that wouldn't work for me
I don't see any better yet practically usable alternative - however it doesn't fully meet my requirements when it comes to "resilience" and app isolation...
many banking apps don't work, BT becomes unreliable etc. The phone is no longer suitable for everyday full usage
GrapheneOS user here. Happy to share experience and talk through how to set things up.
Iāve run almost every flavour of secure comms/OS imaginable, including some of the commercial ones, but ended up sticking with GrapheneOS plus an iPhone/iPad for other business use.
I used to travel with multiple Pixels, but nothing draws more unwarranted attention from government parasites than walking around with a stack of post-crypto phones. On top of that, iOS/iPadOS remains far better supported for the banking apps that now strictly enforce Play Integrity.
I run about 10 profiles on the Pixel and use those as the isolation boundary. For each profile I have Seedvault set up to back up to a WebDAV location of my choosing.
On the resilience side I completely feel you. It happened to me recently that some freshly installed profiles werenāt configured properly for backups. If you donāt explicitly specify certain files/directories, Seedvault simply wonāt back them up. That wiped quite a bit of history and made recovery impossible.
Where possible I try to avoid Wi-Fi and run a couple of layers of active/passive network protection (think something along the lines of SASE, but working across multiple layers).
What are you trying to achieve specifically? Happy to go into more detail on profiles, Seedvault config, network hardening or whatever.
Iāve run almost every flavour of secure comms/OS imaginable, including some of the commercial ones, but ended up sticking with GrapheneOS plus an iPhone/iPad for other business use.
I used to travel with multiple Pixels, but nothing draws more unwarranted attention from government parasites than walking around with a stack of post-crypto phones. On top of that, iOS/iPadOS remains far better supported for the banking apps that now strictly enforce Play Integrity.
I run about 10 profiles on the Pixel and use those as the isolation boundary. For each profile I have Seedvault set up to back up to a WebDAV location of my choosing.
On the resilience side I completely feel you. It happened to me recently that some freshly installed profiles werenāt configured properly for backups. If you donāt explicitly specify certain files/directories, Seedvault simply wonāt back them up. That wiped quite a bit of history and made recovery impossible.
Where possible I try to avoid Wi-Fi and run a couple of layers of active/passive network protection (think something along the lines of SASE, but working across multiple layers).
What are you trying to achieve specifically? Happy to go into more detail on profiles, Seedvault config, network hardening or whatever.
I run a very similar setup - two pixel phones, two laptops, many server-side components, decent wireguard network with disposable exit nodes registered and paid anonymously or hijacked network components (private Tor network in essence š)
anyways... graphane does the job - 95% user experience satisfaction, including dozens of banking apps
however I'm focused a lot on disaster recovery and backup - basically I want each of my toys to be completely useless for anyone who steals or finds it if lost and I want to be able to immediately switch to my server system or backup device
when it comes to graphene the seedvault backup is pretty useless - it saves some time to recover a profile from backup but most of the apps need activation not only on a different hw but also when recovered on the same phone - this sucks and I'm not happy with current state of things
also native profiles are incredibly clumsy and slow to use, same with work profiles (island, etc.) - I fancy very different solution when it comes to app isolation and there doesn't seem to be anything acceptable to meet my requirements as I consider every app installed a potential threat and malicious code running on my device and it needs to get sandboxed
anyways... graphane does the job - 95% user experience satisfaction, including dozens of banking apps
however I'm focused a lot on disaster recovery and backup - basically I want each of my toys to be completely useless for anyone who steals or finds it if lost and I want to be able to immediately switch to my server system or backup device
when it comes to graphene the seedvault backup is pretty useless - it saves some time to recover a profile from backup but most of the apps need activation not only on a different hw but also when recovered on the same phone - this sucks and I'm not happy with current state of things
also native profiles are incredibly clumsy and slow to use, same with work profiles (island, etc.) - I fancy very different solution when it comes to app isolation and there doesn't seem to be anything acceptable to meet my requirements as I consider every app installed a potential threat and malicious code running on my device and it needs to get sandboxed
Alert Alert...latest news....re. Graphene OS...
Man charged for using phoneās āduressā password to wipe data - July 24, 2026
Another article about this story: U.S. Prosecutes Man Accused of Using GrapheneOS Duress Password to Wipe Phone
Govern yourself accordingly
Man charged for using phoneās āduressā password to wipe data - July 24, 2026
Another article about this story: U.S. Prosecutes Man Accused of Using GrapheneOS Duress Password to Wipe Phone
Govern yourself accordingly
that's why plausible deniability features are absolutely essential (ideally combined with steganographical storage) - in this regard it makes no sense to me that Graphene has visible profiles - the logical approach is unlock screen that opens profile based on PIN submitted instead of a silly list of available profilesAlert Alert...latest news....re. Graphene OS...
Man charged for using phoneās āduressā password to wipe data - July 24, 2026
Another article about this story: U.S. Prosecutes Man Accused of Using GrapheneOS Duress Password to Wipe Phone
Govern yourself accordingly
almost nobody needs NSA-proof solution - we just need to fool the airport monkeys and other collaborants by showing them what they expect to see - we just need them to make some non-negligible effort (submit some proof of work) which is almost always a big enough barrier