Hacker News Reader

Comment by salusinarduis | Hacker News Reader

I use GraphineOS and LineageOS without Google Play Services. They are great and are suitable replacements for Apple and Google.

- Osmand(FOSS) for maps (supports being fully offline!)

- Signal and Discord for messaging (Discord is sandboxed)

- Newpipe(FOSS) for Youtube

- F-droid(FOSS) for my FOSS appstore

- APKmirror for the few non-free apps I need

- Libretorrent(FOSS) and VLC(FOSS) for watching movies

- Firefox(FOSS) and Vanadium(FOSS) for browser

- K9 Mail(FOSS) for email

- Infinity(FOSS) for Reddit

- Secur(FOSS) for 2FA

- Taskkeeper(FOSS) for reminders

Almost everything you need is in the F-droid FOSS app repository. It all works, and it works well. You can buy a used Pixel 3a for around $80 on Ebay and have a better experience in every category than iOS, hardware and software.

The only limitation is push notifications, which isn't a problem because FOSS apps like Signal bundle their own notification system that does not use Google Play Services. Discord however, does not get push notifications (which I wouldn't want anyway)

View on HN

There's an app available on f-droid called Aurora Store that lets you download apks from the Play Store directly, avoiding the need for stuff like APKMirror (where you don't know where or what happens to the apk you're downloading). On desktop you can use the program Raccoon for the same.

Thanks for the suggestion!

> ...and have a better experience in every category than iOS, hardware and software.

Really? I tried GrapheneOS on a Pixel 4A, and without exaggerating or trying to come off sensationalist the experience was really tepid compared to iOS, and even "normal" Android. Stuttering and jerky UI (which often also wanted to take a brief nap), very poor GPU hardware acceleration support, notably worse battery life, loads of things that just didn't work well (or at all) without Gapps, and trying to get Play Services shoe-horned into GrapheneOS was still quite the bug-ridden hassle. Additionally, the Open Camera app produced rubbish results compared to Google's native Android camera app, which matters a lot to me.

I'm surprised to hear you say that. I've played the most demanding Android games on the Pixel 3a with no issues. I've never experienced anything but a butter smooth UI on Graphine or Lineage to be honest. The battery life has been all day for me even when using GBA emulators for multiple hours a day.

I agree the default camera app of Graphine isn't great, but it's picture quality better than the iPhone I came from (iPhone SE gen1)

Can you install GCam as apk from somewhere? Will it work? I use GCam on the default Android (8) on my Nexus 6P and it works well. I am thinking of upgrading to Pixel 2XL or 3A and install Lineage OS with GCam, so I believe it would be a much better experience than the default ROM on a Pixel. But I have no idea whether GCam would work in LOS.

I use this: https://github.com/lukaspieper/Gcam-Services-Provider to make the GCam app work

You should be able to get GCam via Aurora Store by setting the spoofing to a Pixel device, but newer versions of GCam check for something that cannot be spoofed with an app (issue #22 in above github) so you have to get a modded GCam app if you want to user newer versions and use an android rom that does not spoof this.

The mid-level processor on the Pixel 4a may just not be performing to your expectations. A phone with a high-end processor would perform better. For GrapheneOS, the fastest compatible phone available (used/refurbished) right now is the Pixel 4 (or Pixel 4 XL).

Also, if you are using a Pixel phone with a non-default flavor of Android, the Google Camera app still works if you download it manually. APKMirror is a trustworthy app source run by Android Police:

https://www.apkmirror.com/apk/google-inc/camera/

(For Pixel phones using an older Android version, you may have to use an older version of Google Camera if the current version does not work.)

It performs worse than my 10 year old iPhone 4S. It really shouldn't have to.

On my Nexus 6P I use GCam v. 5.2.019.188906351 and it performs really great! It is quite slow with HDR+ (but usable), and almost on par with the default camera without HDR+ (still producing great camera quality). I am curious whether the experience is similar on a Pixel line, with Lineage OS (or any other custom ROM).

Pixel 4 running graphene. I'm sure it's fine by android standards, but if you're used to iOS, it is unbearable.

Going back to iPhone as soon as I've got some free time to get everything set up again.

Unrelated, but I'm still very surprised there's no standard way of doing live photos on Android. They really do add a lot to the experience of reviewing old memories and Google has had at least 5 years to catch up.

Software patents are often used to stifle competition.

I'm running GrapheneOS on a 4a right now and it's smooth like butter - maybe you needed to wait for a few updates. The camera has improved a lot as well but is still not close to the stock google camera.

It seems like what you're looking for is CalixOS + microG.

I run GrapheneOS on a 4A with TMobile and the frequent reports of people trying to call me telling me my line is out of service and days where calls won't initiate from my phone at all makes me want to run back to my iPhone.

The tethering seems to be pretty flakey as well with me often having to reboot the phone.

I've been using GrapheneOS on a 4A with TMobile as my daily driver for over a year and have had none of these issues. Never had an out-of-service notice from someone calling me, never had a call not initiate, and tethering works great.

Maybe it's something to do with OpenGapps? I never installed it or microG, I'm perfectly happy with just Fdroid.

>very poor GPU hardware acceleration support

Pretty sure GrapheneOS doesn't do anything to change GPU h/w acceleration.

Pretty sure GrapheneOS didn't even engage with GPU HW acceleration. Everything felt like software framebuffer.

This in fact sounds quite exaggerated. I've had nothing like this experience with the Pixel 4a. Battery life has been exceptional, UI works fine, Play Services work with about 90% of the apps I tried. Google Camera worked also with Play Services so you don't have to use Open Camera.

Do banking applications work? I mean as in "I buy X online. It requires me to login to my bank application and press 'confirm'. I perform this sequence, and online purchase is completed. "?

Some will, however I have heard some of these apps have janky hooks into Android's trust system which will break them on non-google distros.

Personally I wouldn't suggest having banking apps on a phone.

You can always use the web browser if you absolutely must access those accounts.

I will try to do so with web account, however I doubt it will work..

Most banks in EU require phone app based confirmations for transfers and other operations (according to PDS2 directive).

Visa and Mastercard also introduced 3DSecrue system which piggybacks on the same system of confirmations. Vendors are incentivised to adopt it by lower rates.

In essence when paying with card or making a wire transfer (or using some instant transfer method, for example Blik in Poland), you get notification on you phone asking you to confirm operation, even if you initiate it from your account in the browser.

In essence Bank apps became 2FA devices. The only way to avoid it is to opt-out of the App 2FA and use paper one-time code pad. You regularly then get sent a list of codes by snail mail, which you have to type to confirm operations.

It depends per bank; mine discontinued the paper OTP pad as well as the SMS codes, and gave me a separate 2FA device when I didn't want to use their app. I don't think banks can force you to have a smartphone yet.

> separate 2FA device

FYI in New Zealand a few banks can provide a device (e.g. RSA SecurID) for proper non-bank 2 factor auth with consumer accounts. However some major banks only use phones for 2FA (app or SMS).

The norms seem to vary considerably depending on country.

Which banks provide a device?

I have had SecurID tokens for ASB and SBS accounts. I have been told Westpac does not provide secure 2FA. I am not sure about other banks.

Does nobody in the EU do computers ? How do they pass asinine laws like this ? I mean, from the outside, it always appears as though the EU is much better than the US when it comes to consumer rights, but it always feels like they don't have a very good grip on technology.

It's hard to explain but Poland got hooked on mobile payments/banking, the adoption is very high and one of the major players is home grown.

Btw, I live in Poland, and I use my banking app for internet payments and NFC payments using Pixel with CalyxOS.

So it's possible to do that with some of the banking apps.

I don't think this was driven by law, but by an appropriate wish to increase transaction security (you really shouldn't use SMS for this anymore).

There are some rules here that are nonsense, such as know-your-customer laws that force me to enter my home address even when the product or service (say, a concert or train ticket) is delivered to me entirely electronically.

Most of the move to purely electronic payment is driven by the market and the large banks; e.g. in the Netherlands we actually never had laws that force shops to accept cash as payment.

I agree that you shouldn't use SMS. My point was that unless the law (if there is one), requires that 2FA be enabled in an accessible way, the banks will do their own thing with the phone push notification system. The 2FA situation is quite bad in the US too, but a small no. of banks do offer TOTP.

This whole situation caused me to throw up my hands in Thailand and now I pay for most everything in cash since it's still a cash-friendly nation.

Where I live, the authentication systems implemented by banks are also used for verifying user identity to various other services, including governmental ones.

Basically, there's a common (government-backed) user identification system which hooks up to interfaces that banks provide. When you're logging in to an online service that requires strict identification of the user (such as ones that would require an official id document if done in person), you first pick the bank you're using, and the service forwards you to the bank's website. Once you log in with your bank credentials, the original requesting website gets informed that you've provided valid login information, and the identity that the login matches with.

I don't know the exact technical details of how that works, but essentially the bank also acts as a user identification service for various official and governmental online services. It's treated as similar to proving your identity with a document, or to signing a document with your signature.

I don't know if this is a common thing in other European countries, but if it is, that might be a reason why the EU has an interest in enforcing 2FA.

You're not strictly required to use a smartphone, as at least my bank has other means of 2FA that satisfy the regulatory requirements, but they are more cumbersome.

> Where I live

Do you live in Denmark perchance?

> I don't know if this is a common thing in other European countries

There is a similar system implemented in Poland and works very well.

> I don't think banks can force you

They can and do. There are a number of banks where you have absolutely no choice.

you have a choice to not be their customer.

unless of course they are all equally bad :)

My bank uses SMS. It's simple and platform agnostic: even a Nokia 3310 is compatible x)

also not very safe. Attacker can duplicate your sim. This way he can call the bank and use the mobile numer as to restore bank account details. At least in Poland

Didn't know this was driven by PDS2. As much as I appreciate the convenience, I still find the whole drive fucking annoying - especially that, with all the talk about data portability, I still can't get a simple API endpoint I could point a script at to fetch me my account's balance.

Yes, I'm bitter. If there's ever a bank that puts end-user automation first, I'll switch in a second.

If you are in the UK, Starling offers a relatively simple API.

From all the banks I've tried over the years I always check for this feature, sometimes asked and never got what I wanted. "No the API is only available for our 100k a month or more users" is the closest I got.

However when I really wanted a solution i build a small service that receives the confirmation SMS most banks offers and pushes my balance in a small API.

The number one reason to use a banking app on your phone is to deposit a paper check by taking a photo of it. I am not aware of a bank that lets you do that from a webpage.

Vanguard works on my completely google-free phone, although I had to change the OS language to English because w/ Android set to French their app would force the use of commas as the cents separator, then complain that commas are not a valid character. Another fun thing was it uses its own internal camera app, which would focus the preview, then completely ignore the focus setting and take a blurry photo of the check. Eventually I figured out the camera's default focus length and take the photo from that distance.

What kind of purchase/checkout system works like this? I have never seen one, but if I had, I would not complete the transaction.

amazon paysend many others do too. bank is Boursorama

Is this something more popular outside of the US where credit/debit cards are not as ubiquitous?

Maybe. I never owned a credit card, however I also basically didn't use cash for years, only debit card

I've had a US debit card where 3D secure was triggered.

It usually happens when someone pays with a credit or debit card. If the confirmation is not given in the app within a certain time limit, the bank rejects the card transaction.

Edit: to clarify, my comment is about the UK, and it does not happen with most card transactions; "usually" here refers instead to card transactions being the usual trigger (in my experience) for this app-based authentication flow.

"Usually" is a bit of sticky word here. Your usual is not my usual, hence my questioning of it. My experience is US centric, so I'm assuming non-US but non-US is a really big place.

I think it's called 3D-Secure for debit/credit cards. In Ukraine for example it is pretty much a normal path for online payments. Also our "credit" cards aren't the same your "credit" cards. Ours are basically the same as debit cards but with added overdraft amount and different service fees. They are created by the same banks as debit cards, not by a separate corporations.

Online purchases with UK bank accounts often require this. Some banks use an OAuth-style redirect instead. I think the merchants get lower rates if they enable this feature (called "3D secure") because it lowers the risk of fraud.

It's basically 2FA for online transactions, which seems very sensible to me.

Most in EU do this or will do - it’s part of EU bank regulation (PSD2). SMS isn’t considered safe anymore and debit/credit card payments are confirmed through banking apps (you get a push and confirm).

Wait, but smartphones are less safe than SMS. The attack surface of SMS is your surrounding, the attack surface of a smartphone is entire world, and virus infections happen much more regularly than sim copies.

That's not the issue though. I can log in to my cell account and see the content of every sms i send and receive. an app establishes an encrypted connection between your phone and the bank. sms is open to the public.

in addition, you don't need to copy a sim. you can copy a cell tower. which the authorities do all the time, without any warrants, and capture data en-masse. The fake cell tower fits in a backpack.

But it's not just the cops capturing your cell data. It's anyone, they've been doing it for over a decade, and it's cheap and easily accessible.

https://www.vice.com/en/article/vv7zn9/surprise-scans-sugges...

Reading the comment I was confused as well - it sounds as if the user provides his banking login to the merchant as part of the checkout process. However they mean that the transaction has to be approved via banking app, not unlike a 2FA authenticator app.

I switched to /e/ rather recently, and it also just happen that I am in the process of switching banks, which means I currently have two banking apps on my phone.

Both are rather strict on having a clean, non rooted, non modified phone. Currently, they both work without any caveats, but I had to install magisk, add them to magisk hide, and use the magisk renaming feature to have them work.

I recently had a bank detect Magisk Hide. Since on principle, I don't think it's their business what I do with my phone, especially once added Magisk Hide, I went into my branch, told them just that and asked for everything in cash to move to a different bank. These are the same banks that only have SMS for 2FA and it's required.

I also ironically had to install Magisk on my previously unrooted LineageOS phone in order to convince a bank app my phone is not rooted.

I just use the website

On /e/OS with microG, I successfully use the apps for Starling Bank and Hargreaves Lansdowne. Nationwide and Nivo also both work. (these are all UK services, not sure how far they are known elsewhere)

> I mean as in "I buy X online. It requires me to login to my bank application and press 'confirm'. I perform this sequence, and online purchase is completed. "

Huh? This is not a real thing.

It is real and absolutely routine.

Bog standard in Germany

Thanks for the list!

> You can buy a used Pixel 3a for around $80 on Ebay

It's worth noting that GrapheneOS recommend Pixel 4a or newer for best support: https://grapheneos.org/faq#recommended-devices

I use the exact same setup, works like a charm. I can definitely recommend it for anyone concerned with the privacy issues of current mobile OSes. Furthermore, it never feels limited after getting used to this suit of apps, which may take up to a week at most.

I prefer FairEmail (FOSS) over K9 Mail because it's more modern.

I also recommend CutTheCord as a Discord client. It's not FOSS because it's based on the official client but it's privacy oriented.

https://gitdab.com/distok/cutthecord

Could you elaborate on what you mean by "Discord is sandboxed"? Are you using an app to sandbox it?

Could be using [Shelter](https://github.com/PeterCxy/Shelter) to isolate apps. I don't know how effective it really is.

Insular is another app that activates the Android work profile: https://secure-system.gitlab.io/Insular/

Both Shelter and Insular are effective for isolating your files, contacts, and phone logs in each profile. If you are using a VPN, it is limited to the profile that the VPN app is installed on, and you need to install and run it again on the other profile to cover the apps in that profile.

Same here. I can also recommend :

- Organic Maps which is cleaner than Osmand

- KeepassDX for password management

- AntennaPod for podcasts

- I have a Tutanota email address. Their app is fully open source, downloadable on FDroid's main repos.

Organic maps isn't there yet IMO. OSMand is huge, but it's the only app to match Google Maps features.

I can also recommend BRouter (with OSMand) for bike navigation. It's ugly and hacky, but once it works, bike navigation is much, much better than Gmaps'. E.g. it's not sending you down cobblestone roads all the time.

OSMAnd is visually difficult to parse (especially at a glance) and fairly complicated to use. It is not a good map app.

Fun, I guess this is just a question of habit. Nowadays I use OSMAnd mostly, and when I have to use Google's Maps (OSMAnd's search isn't great, and public transportation isn't there), I'm lost, and the app never shows the information I want.

It's happened to me a lot of times with Google's Maps (with regard to how frequent I use Google's Maps) that I'm looking for something, I KNOW it's there, I'm searching for it (like "groceries" for a grocery store), and the only way Google's Maps would ever show it to me is by zooming it until the ONLY thing on screen is building, and then it does display it.

I had the same feeling. I now use Organic Maps which I find much better.

You mentioned Signal and Discord for "messaging". Can you or someone else confirm that video calls work with GrapheneOS or LineageOS. I am getting ready to try these but I am still not sure video calling works. When reading about them I cannot find much discussion of this particular application.

I can confirm that video calls work in Signal on Android flavors that don't use Google Play Services, including both GrapheneOS and LineageOS.

Thank you. Much appreciated. :)

(Perhaps WhatsApp might work as well, since, IME, it can be sideloaded and will work without a functional Google Play Services.)

Signal is specifically designed to work without Google Play Services, so expect a 1:1 experience when using it with these privacy conscious distros.

I'm confident Whatsapp will work, but I have not tried. Push notifications will not work without Google Play Services.

According to Plexus, WhatsApp works perfectly on Android without Google Play Services, whether or not you have microG installed.[1] I think they implement their own push notification system if you download directly from them,[2] though I haven't confirmed this.

Discord works perfectly with microG, and has a 3/4 rating without it since notifications will only work if you have microG.

[1] https://plexus.techlore.tech/applications/whats-app

[2] https://www.whatsapp.com/android/

[3] https://plexus.techlore.tech/applications/discord

IME, the notifications do work. I downloaded .apk directly from WhatsApp.

> expect a 1:1 experience

Push notifications are bad and it drains significantly more battery.

What do you use for photo management?

The default Gallery app is functional, and there are other FOSS options such as LeafPic and Simple Gallery.

- LeafPic Revived: https://f-droid.org/en/packages/com.alienpants.leafpicrevive...

- Simple Gallery Pro: https://f-droid.org/en/packages/com.simplemobiletools.galler...

If you are looking for a hosted service to back up your photos, Stingle is an end-to-end encrypted photo hosting service. Alternatively, you can use Nextcloud to self-host. Both are FOSS on the client side, and Nextcloud is also FOSS on the server side.

- Stingle: https://stingle.org

- Les Pas gallery app for Nextcloud: https://github.com/scubajeff/lespas

I just reinstalled my FP2 with LineageOS and microG after reading your post.

I've tried Osmand and found it way too slow/janky for everyday use (since it has to render the tiles locally and doesn't seem to pre-render for scrolling).

Newpipe loads videos much slower than the official app and occasionally fails completely (likely because YouTube changed something).

F-droid (regular, non-root install) shows me notifications to update apps, then when I tap them, I get a "there was a problem parsing the package" - this is a bug that has remained unfixed for over 5 years (https://gitlab.com/fdroid/fdroidclient/-/issues/669).

It's not impossible to use a FOSS phone, but it's truly painful.

If you don't like Newpipe you can use Youtube Vanced which is basically a pwned version of the native Youtube app. I've had some stutters with Newpipe but overall I like it.

Osmand really isn't bad, sure it's a little bit slower to render but we're talking maybe 500-1000ms on a Pixel 3a.

Regarding F-Droid you're right it is quite buggy, but thankfully once you've got the apps you want you don't really need to use it except to update.

Skytube is also a good YT client available on F-Droid

As mentioned elsewhere, Organic Maps provides a much smoother OSM experience (fork of older maps.me version)

If you wanted to install something like WhatsApp or Lyft would it work?

Yes they will work, however to get notifications when the apps are closed you would need to have to some form of Google Play Services. I suggest MicroG if you are intending to do this since it seems to be the least invasive.

In my personal case though, I would still not use MicroG, and would just leave the app open until I am done using it. This is easier on Android because apps are not suspended in the same manner iOS apps are.

What about when the phone locks? My phone is set to autolock after 1 minute. Leaving an app open just to receive notifications seems like a waste of battery.

If your phone is locked you will most likely not get the notifications, it just depends on the app. I do agree it can waste battery.

It's important to remember this is only a concern on non-free apps. The FOSS apps have very low power background services that check for notifications without the app running.

I use /e/os. It is based on LineageOS, is completely de-googled and has MicroG integrated. MicroG means push notifications with apps like WhatsApp will work. https://e.foundation/

Almost all of these just need a browser, without any apps. I personally don't need any notifications, but I'm retired so it's easier.

Reply on news.ycombinator.com