I've always found it strange that GrapheneOS only runs on Google hardware. Can anyone explain this choice?
There are others e.g. Motorola ones or Fairphone, that also allow this but it's a good idea to focus on a specific set of devices keeping maintenance as low as possible and security focus as high as possible.
There are alternatives like /eOS/ or CalyxOS supporting more devices and I experienced exactly this "no longer supported" issue with my Xiaomi A2, which suddenly disappeared from the list of supported devices (see https://calyxos.org/news/2021/03/29/mi-a2-ten-firmware/).
Neither /e/ or CalyxOS is a hardened OS. They provide much weaker protection against these attacks than the stock Pixel OS or especially an iPhone. They're weakening privacy and security substantially including lagging many months and even years behind on standard security patches. CalyxOS has not shipped the June 2025-06-05 patch level or later. /e/ is regularly many months behind on OS and browser security patches along with very often being a year or more behind on kernel updates and firmware/driver updates.
See https://discuss.grapheneos.org/d/24134-devices-lacking-stand... with in-depth information about /e/ on Fairphone devices with links to multiple articles from third party security researchers covering it and other information.
Those non--Pixel devices do not provide a secure base either.
[1]: https://discuss.grapheneos.org/d/23886-partnership-between-g...
> These devices meet the stringent privacy and security standards and have substantial upstream and downstream hardening specific to the devices
It still seems strange. A big part of GrapheneOS is to provide a safeguard from Googles data hoarding, yet it works primarily on Google phones.
No.
GoS have provided a lot of patches upstream, Some of which were even applied. Despite that they wouldn't get early access to A16 just because. Access EVERY vendor promising to preinstall privileged Google services has.
Allegedly Google security team was very happy about that idea, but got vetoed by management.
That's the most confusing part. IMO GrapheneOS is not mainly about "provide a safeguard from Googles data hoarding", instead this is more like a side quest.
GrapheneOS is about creating a mobile OS that is more secure against advanced threats [0] than anything else, including stock Pixel OS and iOS.
[0] Currently my rule of thumb is, anyone who can find and write exploits for new memory corruption bugs for the wanted attack surface, or who can buy such capability, qualifies as advanced threat. Hence Cellebrite qualifies as a borderline "advanced threat".
Naturally if you continue to use Google services then the data hoarding continues.
Remember the context is having a *secure* handset in hand.
I still it's superior to any stock Android OS but the risks associated with giving up freedom for security must be considered. The ideal is to have security while simultaneously maintaining our power as the owners of the machine.
You have a very special threat model, which you for some reason always call the best or the only one reasonable. In reality, depending on the user's threat model, your approach can fail miserably. For example, if my threat model includes that Google can utilize their control over the hardware to undermine my security, then your approach fails [0]. And this is a real-world example.
Don't get me wrong, I still agree that your approach is very secure, it should exist, and you're doing an amazing job for the Community. Just that you shouldn't behave as it's the only viable one.
It's not GrapheneOS itself that's doing this. It's technology like hardware attestation. Stock Android is rapidly becoming just as bad as iOS in this regard.
Remote attestation is a technology that enables discrimination against us. By using it, corporations can tell we've "tampered with" our own phones by doing things such as installing GrapheneOS. That's simply not a power I want them to ever have. They should be none the wiser.
The problem is they will abuse that power to deny service to anyone who isn't using a phone owned by corporations. GrapheneOS itself will probably be among the casualties. Bank apps work on it for now but there's no guarantee at all that they'll keep working in the future. Banks can just flip a switch and the apps simply stop working. No valid attestation that a corporation such as Samsung owns your phone? No service. Discrimination.
For corporations, device security means their app is secure from us. They should never be safe from us. That is my ideological point. We should be able to do anything we want, and they should be able to do nothing we don't allow.
I understand that you're doing your best to use this cryptography to protect us. I really respect the work that's being put into GrapheneOS. In fact I'd be using it right now if I could get my hands on a Pixel.
I'm just saying this hardware attestation technology enables discrimination against us.
> secure
Different threat models exist. For example: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...
Also, what I predicted has just happened: https://news.ycombinator.com/item?id=45208925