GrapheneOS Pixel 7 Pro

I started looking for a new phone when my current one started being a serious detriment to my productivity. I was unable to use apps unless verified by the vendor, I was constantly bombarded by ads on the apps that they did let through, and I was always cautious about using my phone knowing that - without argument - the vendor was monitoring me. Now we all carry around these personal tracking devices, I decided I would have a look what was available.

The first device I found was the PinePhone which had a lot of advantages; it runs Linux, which I am already very familiar with, it also promises open source hardware (which I have found the schematics, but not able to locate the attached licence) at a very affordable price; it is also much cheaper than other options. There are downsides too, and they are enough for me not to pursue this further. Firstly, the hardware is very limited, very underpowered when compared to the phones of today. Secondly, the device is currently very niche, meaning the software available is limited and still in development. Unfortunately, I see the PhinePhone as more of a developer's tool than anyone's phone in its current state.

The PinePhone embodies the issues with the Linux phone, so I had decided. Meaning there are only really three 'flavours' of choice left, all of which are Android based. LineageOS, CalyxOS and GrapheneOS. LineageOS I found very uplifting, as it seems like a very successful project that helps put the power of devices back in the hands of the owners, however, I found that there were some security features missing in LineageOS that were provided in the other operating systems. Both CalyxOS and GrapheneOS are designed to be security focused with overlapping features. In general, I preferred the approach of GrapheneOS with the sandboxed Google Play than the microG implementation to replace the Google Play Store. Even compared to its most similar competitor, GrapheneOS has a lot more security and privacy features.

The major drawback with choosing GrapheneOS was the choice of supported hardware. GrapheneOS is targeted at only the Google Pixel line of phones, and only support the latest 4 generations. Furthermore, Google don't sell all of their phones with the bootloaders unlocked, so buying a used Google phone is always going to be risky, even if they are advertised as being 'Unlocked'. You can of course buy directly from Google, to know that it is unlocked, but I would not do that.

I purchased a used Google Pixel 7 Pro, and have been using GrapheneOS for about 4 months now. The initial installation for the device is very slick. It doesn't require any command line usage, offering a web based installer. However, as this uses a questionable feature (Web USB serial) which sane web browsers don't allow, and so you have to use Chrome (or a select variant). I would recommend the command line installation, for those that aren't 'terminally afraid'.

From my current usage, there are four places to get apps, rated in order of preference:

• F-Droid, can be installed via the inbuilt web-browser 'Vanadium' and - as with all Android operating systems - offers a wide range of open-source apps with useful notes on potential anti-features for each app.
• Obtainium, useful for turning a GitHub into an app store. Licensing is more on the user to research. Provides easy way to install project apps. Has features to keep them updated.
• Aurora Store, an open-source frontend to the Google Play Store. Google has been known to have users banned.
• Google Play Store, this isn't as bad as it sounds. GrapheneOS has already done a lot of work in making this safer.

All apps are sandboxed and permissions for accessing sensors, network, disk, etc., are all individually controlled. One of my favourite features is storage scopes; allowing apps to view some directories, but not others.

If you are on LineageOS and you have hacked the kernel for your own fixes/patches, you might have encountered that 'secure' apps, such as banking apps, refuse to work on your phone. Another advantage of sandboxing apps is these issues should go away IF the app developer has correctly used the Android hardware attestation API instead of the obsolete SafetyNet Attestation API.

I have found GrapheneOS to be a fully functional phone operating system which allows for my own development and modifications while keeping the promises it makes on security and privacy. I would recommend this operating system to anybody with an interest in development or privacy.

Try GrapheneOS here.