What about LineageOS with a non-Google app store?
We're using some Xiaomi devices we purchased, and I'm currently seething. I can't root without 'unlocking', which is a process that requires me to activate a Mi Account, which then requires my email and a SIM (?!), and 'find my device' (location) to even allow installation of apps via USB. To unlock the computers I bought, so I can use the root account, to install an alternate.
Seems the prison walls are just set far enough away that we don't notice.
tl;dr, in order to get some privacy, I'm being asked to associate my IMEI, my IMSI, my email, and my location.
Mere tamper-evidence - having a "bootloader unlocked" warning on boot - isn't obvious enough for a new user who has just bought the phone for the first time. So all manufacturers have added time locks and anti-fraud detection for bootloader unlocking. The time lock in particular is the best way to cut down this effect during the early sales process after which time it's hard to catch up in review score. But a time lock can only be implemented securely via a remote server out of the user's hands.
Xiaomi getting the telemetry is a cherry on top, but it's not originally nefarious - or at least - it's less nefarious than the problem it's intending to solve
The "we're protecting people from themselves" argument seems spurious.
Because it isn't the argument at all? The goal is to protect your reputation from having malware and ad laced versions of your latest hardware flooding the market (and hitting the news). Users are just a secondary concern.
In a way, it’s to protect naive users. And it still allows you to root the phone - go through this idiocy once and then never worry about it again.
adb shell pm uninstall -k --user 0 com.[miui,android,xiaomi].<appname>
You can also grab a used device with a confirmed unlocked bootloader. You usually have to ask a seller, and some won't know the answer, but you can provide the steps for them to determine this.
I really have enjoyed the LineageOS and it's been great to have a phone that isn't as dumb as a flip phone but doesn't have all the bloatware and spying of other devices. The security around the bootloader is my biggest concern.
https://www.reddit.com/r/LineageOS/comments/ev9c4v/is_androi...
FBE is only secure when the system partitions have dm-verity enforced and verity is only enforced when the bootloader is locked.
FDE is a bit more resilient with an unlocked bootloader since there is less data left unencrypted.
However in either scenario without a locked bootloader and verity it is trivial for an attacker to insert malicious code that can then run once your device is unlocked and send off your files.
(I believe this is an example of an evil maid attack, although that name for it is somewhat new to me.)
A locked bootloader would prevent such code from being installed, or at least refuse to run it.
If you're in a position that your chain of custody is broken, just wipe, revert the device to stock signed binaries, confirm by locking the boot loader again, then unlock and re-flash your custom binaries.
Or am I missing something here?
The Play store and what it gives you is incredibly hard to live without, unless you really just want to use your phone for texting, browsing, and calling. If you're a minimalist, then great. If you're accustomed to what a smartphone can do, not so great.
The alternative app stores are full of unimpressive, small scale apps. Dozens of calculators and little games, but no maps apps (of worth), no yelps, no IMDb (which I use often), no Sheets or Photos, the list is huge. I'm sorry but these apps make a smartphone worthwhile.
To avoid such a spartan experience, I ended up just installing microG (an open source replacement for Google's Play Services) and Aurora (a replacement Play store client, which allows me to install most apps from the Play store).
The problem is that most modern apps require a mammoth cloud backend, which costs big money to run, which means you're going to need a huge company running it. You'll never find big scale apps like this on F-droid.
I use them all the time for tracking expenses, tracking information for myself, creating forms and responses, etc.
And let me tell you, I almost never have to open up the playstore except for updating my banking apps, because f-droid has a much better selection of apps anyway.
For example, NewPipe is a much superior alternative to the official youtube app and it even works perfectly fine without a youtube account. I don't have to ever worry about having my google account deleted because NewPipe backs up my subscriptions to xml.
I can only recommend this approach of "degoogling" but still having the ability to fall back in case it is really needed. But so far microG has been great, they even implemented the Covid Exposure Notification framework very quickly.
OSMAnd
>no yelps, no IMDb
What do these apps provide that the mobile sites don't?
In particular, I seem to recall if you landed on Yelp, a lot of content was "here's 150 pictures, but you can only see 3 on the browser."