Things that make me angry about my current smartphone Samsung Galaxy S21Ultra on a Verizon plan is the mandatory software updates in which they install WITHOUT MY PERMISSION stupid apps like Netflix and addictive gambling games and stacking block games and Candy crush. God knows what else they install without my permission. I don’t want any of it!
Next phone I buy I want to start with a clean slate, I’m not going to affiliate with any conglomerate like Verizon or AT&T or Sprint or T-Mobile etc, I prefer to go rogue somehow,
which smartphone do you recommend that has no bloatware and it’s customizable?
The only recommendation I can provide is a Google Pixel device with GrapheneOS. Graphene is only designed to work on Pixels because they are (allegedly) the most secure mobile phone hardware-wise. Once you flash Graphene, it’s up to you to install any apps beyond the basic browser (Vanadium), gallery, camera, caller, SMS, PDF viewer, contacts, file manager, and security/system apps. No Google involved without your permission, though you will have to install Google services, available via a Graphene mirror and sandboxed for privacy, IF you want to install an eSIM after flashing Graphene. If you’re interested in further information, please let me know. I use it, love it, and am happy to provide any information you may need to decide if it’s a good fit for you or not.
What is the root scene on Graphene? I know the dev is pretty against it but I like having root access after being used to it. Is it possible to easily root it without any integrity issues later on?
It’s not supported. According to the devs rooting defeats the purpose of Graphene OS.
Yeah I have read that. And couldn’t find any reason why. When I ask about root people only say "if you want root, graphene isn’t for you"😅
Rooting defeats androids security model and allows for further exploitation. Graphene most likely does support it because any AOSP OS that is geared towards security isn’t going to leave a big hole in their security allowing malware or bad actors to modify system files (or install a rootkit).
Desktop Linux allows root access and is still secure. Allowing root access doesn’t make it insecure.
Desktop linux isn’t the same as Android, which is why I said the “Android security model”. Android is a mobile operating system and must protect against the fact that it will be in unknown environments all the time. It must protect against physical attacks, software attacks, and partially sandbox apps. Root breaks app sandboxing and allows for modifying system files and reading internal app storage. The system image is immutable and modifications/settings are made on top.
Linux desktop isn’t more secure out of the box. The general user account shouldnt be a sudoer. Immutable OSes are more secure and help pervent rootkits and other attacks. PCs are most often stationary and stored in a private location. Laptops are weak against attacks because you can boot to a different OS from usb without passworded BIOS. Desktop OSes are the geared for the same kinds of protections.
There is good reason why Android is far more secure than Linux mobile.
Oh okay thanks!
GrapheneOS significantly increases security, rooting does the exact opposite
It looks like the verified boot security feature of Graphene effectively prevents rooting the OS. I understand wanting root access, it does provide some nice features, but I don’t have any need for it. I don’t have any bloatware embedded to remove, and I don’t need to mod any system apps, so I haven’t looked into it much. I know the dev says it isn’t planned because it massively increases attack surface, which I personally agree with, but it would be nice to have the option via a separate version of the OS or something. If you need root access, I would suggest looking into LineageOS. It’s similar in privacy to Graphene and last I knew could be rooted. Graphene is very focused on security as well as privacy, and for me is a best of both worlds, but if you want to modify the system for various power-user type features, it might not be for you.
Yeah I’m currently running LineageOS. I wanted root mainly for adblock (modifying
/etc/hosts
) and AppOps. Does Graphene have those features built in?Check out DivestOS. It’s a fork of lineage with a focus on better security and privacy. Not restrictive like Graphene. Rootable via magisk.
So far I’m liking it. Great battery life (lowest I’ve ever seen) even on my 5 year old phone.
No, it doesn’t. I use 95% FOSS software, so anything that might have ads just gets denied network permission entirely. As for AppOps, I just looked it up, and that would be something I’d like to see developed as a feature of Graphene. It seems like a genuinely useful, and at the very least privacy-protecting, app. I don’t use copy/paste via keyboard, and despite it not having network permissions, I’d still deny it clipboard access simply because it doesn’t need it.
Okay. Thanks a lot! :)
For security reasons GrapheneOS doesn’t allow the modification of system files. You can achieve the same thing with DNS though. Either self-host a Pi-Hole or AdGuard Home, or use something like NextDNS.
You can root on GrapheneOS. You do it exactly the same way you’d do it for the stock Google ROM:
- Have an unlocked bootloader. Yes, this means that it “”“defeats the purpose of GrapheneOS”“”, if the purpose of GrapheneOS isn’t for you to avoid Google’s privacy nightmare. I use GrapheneOS for privacy moreso than security, and not being able to block ads properly is irritating.
- Install the Magisk app.
- Extract the
boot.img
from the GrapheneOS image and patch within Magisk. - Flash the patched boot image in the bootloader.
The main annoyance with this is that you’ll have to do that dance every month when a security patch gets released, but for me, it’s better than vomiting from exposure to ads on mobile.
What is the patching process when running with Majisk, without OTA? It looked like quite a PITA to me, but I’m using Graphene for the same reason you are.
Edit: I found this
After sideloading an update I’d probably have to do what Trevor posted.
Not OP but interested in both privacy and high-tech features. My current (stock) pixel 4a device has a worse camera than many other phones, but the software compensates a lot, netting better picture quality overall very often. I’m wondering how much of that is lost when using graphene instead of stock android, do you know?
Similarly with the latest gen pixels having AI features built in, I’m assuming much of that is software that’s not as easily installed somewhere else…
I’m not sure what the GrapheneOS stock camera app does under the hood, but if it’s not enough for you, you have the option of installing Google’s Pixel Camera app from the Play/Aurora store if you want to compare. I don’t imagine it would require Google Play Services to run on devices older than 8 since they don’t have the AI integration, but I could be wrong. You can easily deny the app network permissions to ensure that the app isn’t sending your photos to Google. As far as the AI features go on newer devices, I could see those requiring Google Services installed to work, but again, they’re available through a Graphene mirror, run sandboxed for privacy, and can be denied network permissions. I’m satisfied with how my pictures turn out (7 Pro), but I may try Pixel Camera out just to see what the difference is.
If you do that I’d be very interested to see the results! Especially things like night sight, my gf’s camera is as night blind as she is 😅
It’s been a couple years since I tried the graphene camera, but (at the time) it’s essentially trash in comparison to the Google camera. I just use the gCam without internet permissions and call it a day.
But I’m not hardcore tin-foil ‘the NSA will use your office mirrors reflection to precisely heat up a 2mm space on the side of your phone that somehow enables Bluetooth and with that the G + glowy bois will exfiltrate your data at 10Kb/s’. I want additional security hardening and some privacy additions, but I also use the play services and store, like a typical user. Yada yada threat model yada yada - I just want my phone to simply function at the end of the day. Middle of the road, if you will, between stock os users and the guy that’s now boarding up all his windows because of the 2mm Bluetooth mystery vulnerability.
Unknown about the claimed AI features - my 8 pro is in transit. But I can check in a few days, if interested.
Get a used pixel for $100. Factory reset on arrival, and install Graphene OS. Do not install gapps.
Ignoring the gapps part is… Tricky.
Why? By default gapps doesn’t come with ROMs. Its usually more work to install gapps.
Well yeah…but eventually you end up needing some banking app or some other crap that might need G-Services.
Nope. Never needed it. Just dont use that crap.
I wouldn’t put anything financial on a phone, anyway. Use a secure laptop for that.
Except, in my country, the banking website will NEED a token generated on the banking app. Internet banking assumes a smartphone with their app…or it’s completely blocked what you’re allowed to do.
Which country? All countries I know about like this allow hardware tokens as an alternative to a smartphone with a TPM
I wouldn’t recommend a Pixel older than the Pixel 6 as these will soon be EOL.
deleted by creator
Google Pixel with GrapheneOS
Heads up, the bootloader cannot be unlocked if you buy a pixel through Verizon. You have to buy it straight from Google if you want to install anything custom.
Source: I have a pixel 6 pro from Verizon that I got originally thinking to try out grapheneOS.
And if your bootloader is unlocked, VZ is likely to lock you out of VoLTE/HD Voice/WiFi calling/etc.
I mean, you could go to T-Mobile who don’t currently play these specific games with devices, but then you’re trading coverage for features/freedom.
All carriers, wired and wireless, need to be regulated as DUMB PIPES. Title 2 for everyone. That’s what we’re paying for: Not “the Verizon experience” or “the pride and accomplishment of being an AT&T customer.” Let me buy a phone, and do with it whatever it is technologically capable of doing on your network. The network provider doesn’t need to provide any Android/iOS tech support if they keep it simple and stay out of the customer-fuckery business.
No bloat? Stay away from Samsung then.
Another vote for fairphone here, but for reasons others failed to mention: replaceable battery, so even after 2 years, it can feel like new and keep most of its value (to resell if wanted); 5 years of updates + warranty; support for after market roms. Then there’s also the fair ethics part of it
How are you killing your battery after two years?
Even my cheapshit Honor 9 lasted six before it started getting random shutoffs.
Not killing, but degrades in performance because batteries have a limited amount of charge cycles. The more intensive you use your phone, the faster the battery degrades
old phones have batteries that are meant to last
For best privacy AND security, Pixel 8 or 8 Pro with GrapheneOS. Nothing else compares. The Pixel 8 series are also the first that support hardware memory tagging, basically making them immune against 70% of all exploits.
Removed by mod
A Google Pixel running GrapheneOS is your best option. Graphene doesn’t have any Google services by default, no bloatware at all, maximum privacy and security. It’s super easy to install, you can check out this video guide or just read their official documentation.
Another video about GrapheneOS that I totally recommend: https://youtube.com/watch?v=yTeAFoQnQPo
I recommend this after the install: https://youtube.com/watch?v=BymH90zFe30
Here is an alternative Piped link(s):
https://piped.video/watch?v=yTeAFoQnQPo
https://piped.video/watch?v=BymH90zFe30
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
How well does apps that require locked bootloaders, non-rooted device etc. work on grapheneOS? We have an official 2FA app in my country that’s used for digital identification for everything from banking to social security services. Right now it isn’t working on my oneplus 9p with lineage, despite using magisk and passing safetynet check, because it still detects that my phone is rooted.
GrapheneOS is built to work with a locked bootloader, in fact, relocking the bootloader is a step in the installation guide. It’s not rooted by default and the GOS team highly recommends against rooting, all apps should work as long as they only require SafetyNet basic integrity. If they require full integrity, they won’t work on GrapheneOS because the OS has to be manually whitelisted by Google in order to pass the full integrity check. Most apps (including banking or government apps) only mandate basic integrity though, full integrity is rarely required. It should definitely work better than LineageOS.
Hmm, my lineage OS phone passes basic integrity check, and my banking apps all work as intended, as do other government apps. But this damn 2FA app is still complaining and refuses to work, saying the phone is insecure.
Maybe a fair phone? https://shop.fairphone.com/fairphone-5
Short summary:
- no bloatware
- 5y waranty
- easily Repairable
- Planned to receive 5 android major version upgrades
Addition:
- several unsolved (hardware) issues in the past
- security patches are far too late
- 8 years support
- Using the promoted /e/ results in loss of support (you habe to flash back FairphoneOS). Maybe this has changed as they are sellig phones with preinstalled /e/ by themselves
- Screws in the FP4 where very low in quality
- above-average batterie drain
- no bloatware
Does it come without GApps? Most people don’t need half of those
It is google Android but they do not pay for the name so they call it ‘FairphoneOS’. It comes with all the standard GApps.
It is google Android but they do not pay for the name so they call it ‘FairphoneOS’.
That’s not how that works, they call it FairphoneOS because they added their own customizations. Default Android is pretty barebones nowadays so nobody uses that. You dont have to pay Google to use the Android name
Personally waiting for the shiftphone 8. Fairphone 5 is also a possibility if you value ethics. These should be less bloated than most I believe. The pixel is nicer than most mainstream phones. As it just comes with the vendor who made Android and their proprietary bs instead of yet another layer. The best way to eliminate bloat is a custom rom. Pixel supports GrapheneOS and I believe all of them will be supported by CalyxOS. (They made a build for the newest released shiftphone)
Google Pixel. I dont know I want to keep my 4a actually as its small, nice and has a headphone jack.
The 4a is end of life and shouldn’t be used anymore.
Lots of good advice here, but many might be too extreme. I find such all-or-nothing approach intimidating for people who just started to think about improving their privacy situation.
Let’s see… you are angry about bloatware. It can come from two sources - mobile service carrier and phone manufacturer. How to get rid of it?
- Buy only “unlocked” phones. Then the carrier will not be able to push anything to your phone. You will also be free to change the carrier as you wish.
- Buy phones from manufacturers that don’t install too much bloatware. Google Pixel has only Google apps, Motorola also is almost vanilla Google. Fairphone is more exotic, but an interesting option. iPhone is OK too if you want Apple ecosystem, but customization is not a thing there.
Now, we are in a privacy focused community and I saw your later comments about Google being an opposite of privacy. I would argue that vanilla Pixel is much better than bloated and locked Samsung already. I see you get recommendations to replace the OS that your new phone might run, and these are valid, but come with significant downsides. There are other ways to improve your privacy stance by changing the way how you use your phone without changing what phone or what OS you run on it.
Warning about bringing an unlocked phone to Verizon (even if it’s a current flagship Apple/Samsung/Google device): 50/50 they’ll lock you out of WiFi calling/HD voice, etc. Because they’re dicks.
Do be careful, your choices are very limited. All the carriers in the US, except TMobile today, have a whitelist of devices. Even if you make your own phone or buy an awesome phone from out of market, it won’t work.
Technically, there is no reason it won’t work. But the carriers block it from registering on the network unless roaming. Our non-American devices have been kicked off every network now except TMobile.
So your choice is really just the small list of devices they choose to support and 75% are the same phone. Samsung whatever with some various sized screen and various sized storage. Or Apple iWhatever.
They make your life hell with a non-standard carrier phone. And yes I’ve been buying out of region phones for 20 years now, even back with Windows Mobile and Palm devices with 2G text based web. Every year it gets harder and harder.
Im using my imported Zenfone 9 on AT&T without (much) issue. I did have to change some settings using ADB/terminal as root to enable volte so i can make calls since the phone doesn’t support all the bands used.
deleted by creator
I have a Xperia 1.
It has a flagship SoC, but it also has a SD card slot, a headphone jack, no notch or cutout, front firing stereo speakers and a nice blocky look without a massive camera bump.
The downside is software support can be a bit spotty and the cameras are made for manual use, as opposed to being AI-driven point-and-shoot things. That last one could be a positive depending on your preference, though.
But overall? I’m very satisfied, and I went there specifically because I was tired of the ongoing Apple-ification of Samsung in the first place. You may want to consider coming to the dark side and incentivizing Sony to keep making a phone with a feature set, instead of copy-pasting Apple’s or Samsung’s playbook.
Perhaps Fairphone?
Those are plagued with security issues.
I’m interested in reading about those. Dou you have a link or a list of some of those issues?
Removed by mod