GrapheneOS

[void]

How many of you guys actually use GrapheneOS on your primary mobile device?
What drawbacks and concessions should one count with when switching from regular Android?

 

[cckuhqilfownnfctux]

some banks will bitch about not original firmware and refuse to work‍

 

[void]

yeah, I'd turn this into a good thing... it's undesirable anyways to depend‌ on a mobile device that can disappear the next moment with my banking - good‍ motivation to improve the setup

 

[aniglo22]

Drawbacks are definitely that you are failing Google Play integrity/Safetynet .
So you can not‌ use apps , which require more then basic attestation ( e.g Google Pay) .

Before switching check if your banking/financial apps require Play Integrity/SafetyNet .
Just load your apk into‍ jadx and check if libpairipcore.so (in the native libraries folder ) exists .
And also⁠ check if it imports SafetyNet related stuff (e.g com.google.android.gms.safetynet) .

If your app is using⁤ one of these , then the app will not work probably on GrapheneOS.

 

[daniels27]

But then we could use

 

[cckuhqilfownnfctux]

the most bitchy bank apps will not work either.‍ there are like a million of methods to detect if the app runs inside a⁠ virtual machine or on a real unrooted device.

 

[aniglo22]

You are not passing Play integrity or SafetyNet with‍ an Emulator .
And also not all bank apps ship apps with x86_64 architecture .⁠
So you would need to use an Emulator with Arm translation which most likely is⁤ using Houdini or NDK .
And that's also pretty easy to detect and some companies⁣ are already doing it .

 

[0xDEADBEEF]

Almost 0 drawbacks, especially since you can run your 'evil' apps in a separate profile‌ with Google Play Services enabled. I have not run into problems since first installing it‍ ±5 years ago. It has become a lot more usable in the pas 2-3 years,⁠ and for quirks I can rely on my other devices.

 

[aniglo22]

Here is also a list of financial/banking apps and whether they work or not :‌
https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/

 

[aniglo22]

Are you using your device with GrpaheneOS for banking ?
As some EMI's/banks specifically blacklist⁣ GrapheneOS ( e.g Revolut



https://bsky.app/profile/grapheneos.org%2Fpost%2F3lgc3zj3izs2x
)

 

[Martin Everson]

Out of interest what your reasoning for using this OS?

P.S I‍ have never used it as I have a Huawei phone and have HarmonyOS with all⁠ apps I use available to me. I am waiting to upgrade to HarmonyOS Next to⁤ totally get rid of all Android rubbish so interested to know your reason behind wanting⁣ that OS.

 

[cryptofriendly]

Personally, I love my GrapheneOS.
I used it on a secondary device at first,⁠ now switched to it completely.

Drawback: Limited to Pixels.

As even the OS can't override⁤ any safety issues in the hardware, I feel a bit stuck with my Pixel 6.⁣
I don't trust the newer Pixels, one would have to be very naive not to⁢ expect a hardware backdoor,
which overrides the OS. Anyway, one should always view every electronic︀ device as insecure.

 

[wachtwoord]

Don't use online banking on a phone. Giant security threat.

 

[aniglo22]

The older pixel devices use the old Titan⁢ M chip which had some vulnerabilities . (https://blog.quarkslab.com/attacking-titan-m-with-only-one-byte.html)
In your shoes I would︀ definitely upgrade .

 

[void]

easy to say but what do you suggest? I have 27 banking apps installed at‍ this moment and zero time/motivation to play with each and every those to make it⁠ work in the emulated environment

 

[cherry]

Laptop. Browser with VPN

And wean yourself off the need for apps. My phone has Signal, maps, and not much⁠ else. I barely ever take it outside.

GrapheneOS is very good, I very much recommend⁤ it.

 

[void]

well... current primary phone is dying, will need a new⁣ one, time will be inevitably spent to setup new system, hence an ideal opportunity to⁢ do the maximum for my opsec while still being able to keep up with the︀ world - I'd love to use a linux phone but people refuse to use my︁ private server and proprietary app to call and chat with me 😀

 

[void]

most of the idiotic backing services‌ I'm forced to use require their own app for 2FA - horrible trend but it‍ is what it is

 

[cherry]

That sucks. Mine send me a physical card reader device for 2FA.

 

[void]

sadly I cannot live without Whatsapp while traveling as for‍ the rest of the world it represents their interface to the world - I hate⁠ it but don't know how to fight it... I'm all ears if you do