GrapheneOS

[void]

How many of you guys actually use GrapheneOS on your primary mobile device?
What drawbacks and concessions should one count with when switching from regular Android?

 

[cckuhqilfownnfctux]

What drawbacks and concessions should one count with when switching from regular Android?

some banks will bitch about not original firmware and refuse to work

 

[void]

some banks will bitch about not original firmware and refuse to work

yeah, I'd turn this into a good thing... it's undesirable anyways to depend on a mobile device that can disappear the next moment with my banking - good motivation to improve the setup

 

[aniglo22]

Drawbacks are definitely that you are failing Google Play integrity/Safetynet .
So you can not use apps , which require more then basic attestation ( e.g Google Pay) .

Before switching check if your banking/financial apps require Play Integrity/SafetyNet .
Just load your apk into jadx and check if libpairipcore.so (in the native libraries folder ) exists .
And also check if it imports SafetyNet related stuff (e.g com.google.android.gms.safetynet) .

If your app is using one of these , then the app will not work probably on GrapheneOS.

 

[daniels27]

Drawbacks are definitely that you are failing Google Play integrity/Safetynet .
So you can not use apps , which require more then basic attestation ( e.g Google Pay) .

Before switching check if your banking/financial apps require Play Integrity/SafetyNet .
Just load your apk into jadx and check if libpairipcore.so (in the native libraries folder ) exists .
And also check if it imports SafetyNet related stuff (e.g com.google.android.gms.safetynet) .

If your app is using one of these , then the app will not work probably on GrapheneOS.

But then we could use

V

Thread 'Android virtualization'

Jan 1, 2025

Looking for hints how to virtualize an Android system and share access amongst multiple users.
One typical use case is to avoid dependency on a single smartphone with installed app that doesn't support alternative devices being associated with the same user account.

• void
• Replies: 6
• Forum: Let's talk body

• 

 

[cckuhqilfownnfctux]

But then we could use

V

Thread 'Android virtualization'

Jan 1, 2025

Looking for hints how to virtualize an Android system and share access amongst multiple users.
One typical use case is to avoid dependency on a single smartphone with installed app that doesn't support alternative devices being associated with the same user account.

• void
• Replies: 6
• Forum: Let's talk body

• 

the most bitchy bank apps will not work either. there are like a million of methods to detect if the app runs inside a virtual machine or on a real unrooted device.

 

[aniglo22]

But then we could use

V

Thread 'Android virtualization'

Jan 1, 2025

Looking for hints how to virtualize an Android system and share access amongst multiple users.
One typical use case is to avoid dependency on a single smartphone with installed app that doesn't support alternative devices being associated with the same user account.

• void
• Replies: 6
• Forum: Let's talk body

• 

You are not passing Play integrity or SafetyNet with an Emulator .
And also not all bank apps ship apps with x86_64 architecture .
So you would need to use an Emulator with Arm translation which most likely is using Houdini or NDK .
And that's also pretty easy to detect and some companies are already doing it .

 

[0xDEADBEEF]

Almost 0 drawbacks, especially since you can run your 'evil' apps in a separate profile with Google Play Services enabled. I have not run into problems since first installing it ±5 years ago. It has become a lot more usable in the pas 2-3 years, and for quirks I can rely on my other devices.

 

[aniglo22]

Here is also a list of financial/banking apps and whether they work or not :
https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/

 

[aniglo22]

Almost 0 drawbacks, especially since you can run your 'evil' apps in a separate profile with Google Play Services enabled. I have not run into problems since first installing it ±5 years ago. It has become a lot more usable in the pas 2-3 years, and for quirks I can rely on my other devices.

Are you using your device with GrpaheneOS for banking ?
As some EMI's/banks specifically blacklist GrapheneOS ( e.g Revolut

https://bsky.app/profile/grapheneos.org%2Fpost%2F3lgc3zj3izs2x

)

 

[Martin Everson]

How many of you guys actually use GrapheneOS on your primary mobile device?

Out of interest what your reasoning for using this OS?

P.S I have never used it as I have a Huawei phone and have HarmonyOS with all apps I use available to me. I am waiting to upgrade to HarmonyOS Next to totally get rid of all Android rubbish so interested to know your reason behind wanting that OS.

 

[cryptofriendly]

How many of you guys actually use GrapheneOS on your primary mobile device?
What drawbacks and concessions should one count with when switching from regular Android?

Personally, I love my GrapheneOS.
I used it on a secondary device at first, now switched to it completely.

Drawback: Limited to Pixels.

As even the OS can't override any safety issues in the hardware, I feel a bit stuck with my Pixel 6.
I don't trust the newer Pixels, one would have to be very naive not to expect a hardware backdoor,
which overrides the OS. Anyway, one should always view every electronic device as insecure.

 

[wachtwoord]

some banks will bitch about not original firmware and refuse to work

Don't use online banking on a phone. Giant security threat.

 

[aniglo22]

Personally, I love my GrapheneOS.
I used it on a secondary device at first, now switched to it completely.

Drawback: Limited to Pixels.

As even the OS can't override any safety issues in the hardware, I feel a bit stuck with my Pixel 6.
I don't trust the newer Pixels, one would have to be very naive not to expect a hardware backdoor,
which overrides the OS. Anyway, one should always view every electronic device as insecure.

The older pixel devices use the old Titan M chip which had some vulnerabilities . (https://blog.quarkslab.com/attacking-titan-m-with-only-one-byte.html)
In your shoes I would definitely upgrade .

 

[void]

Don't use online banking on a phone. Giant security threat.

easy to say but what do you suggest? I have 27 banking apps installed at this moment and zero time/motivation to play with each and every those to make it work in the emulated environment

 

[cherry]

easy to say but what do you suggest? I have 27 banking apps installed at this moment and zero time/motivation to play with each and every those to make it work in the emulated environment

Laptop. Browser with VPN

And wean yourself off the need for apps. My phone has Signal, maps, and not much else. I barely ever take it outside.

GrapheneOS is very good, I very much recommend it.

 

[void]

Out of interest what your reasoning for using this OS?

P.S I have never used it as I have a Huawei phone and have HarmonyOS with all apps I use available to me. I am waiting to upgrade to HarmonyOS Next to totally get rid of all Android rubbish so interested to know your reason behind wanting that OS.

well... current primary phone is dying, will need a new one, time will be inevitably spent to setup new system, hence an ideal opportunity to do the maximum for my opsec while still being able to keep up with the world - I'd love to use a linux phone but people refuse to use my private server and proprietary app to call and chat with me

 

[void]

Laptop. Browser with VPN

most of the idiotic backing services I'm forced to use require their own app for 2FA - horrible trend but it is what it is

 

[cherry]

most of the idiotic backing services I'm forced to use require their own app for 2FA - horrible trend but it is what it is

That sucks. Mine send me a physical card reader device for 2FA.

 

[void]

My phone has Signal, maps, and not much else. I barely ever take it outside.

sadly I cannot live without Whatsapp while traveling as for the rest of the world it represents their interface to the world - I hate it but don't know how to fight it... I'm all ears if you do