Hacker News Reader

Comment by netdevphoenix | Hacker News Reader

>With GrapheneOS, you can install the Play Services, the Play Store

Why use GrapheneOS if you are going to install Google Services anyway? The whole point of Graphene is to have a fully locked down OS that still works as it should. A mobile fortress basically. Installing Google Services defeats the point imo as it opens multiple security holes in the fortress.

May as well just install the stock os. At the end of the day, once Google stops shipping sec updates for your phone, firmware updates stop so that's it really. Graphene cannot give you the firmware updates anyway. And at that point, you have a vulnerable phone. I think graphene os makes more sense if you go all in. Otherwise there is no much point really.

View on HN

> The whole point of Graphene is to have a fully locked down OS that still works as it should.

Not at all. The reasons I use GrapheneOS:

- Better security than other alternatives, even with the Play Services. A lot of hardened stuff, very quick updates.

- Play Services run in the sandbox, in terms of privacy that's not worse than microg, but I find it more convenient (I used both)

- More control over the app permissions, notion of "scopes", etc.

That absolutely is not the point of the project and completely misses out on the many general privacy improvements that GrapheneOS makes, as well as the huge privacy improvement offered by running Play Services in the untrusted and unprivileged user-app sandbox.

https://grapheneos.org/features#sandboxed-google-play https://grapheneos.org/faq#hardware-identifiers

It doesn't open up any holes since google play services are not allowed any special access on grapheneOS and run as a regular sandboxed app. You can make a separate user profile just for google apps.

It does if you want to fully use google play services. If you run google play services as a regular app, you cannot use banking apps, whatsapp (app works but no backups to gdrive) or uber for drivers. And you also cannot do purchases in the app store sadly. If you can live with this then fine.

It just seems odd to me, may as well install LineageOs if you just want an alternative android os really. You get more privacy controls than stock android. I just feel that the whole point of graphene is to be able to have a private phone and live outside big tech and you pay a price for that.

If you don't really care that much about privacy and are happy to let google apps run in the background then data about you can still reach the mothership but your smartphone experience is quite degraded imo

> If you run google play services as a regular app, you cannot use banking apps, whatsapp (app works but no backups to gdrive) or uber for drivers. And you also cannot do purchases in the app store sadly. If you can live with this then fine.

I do at least some of those, so I can say you are making wrong claims. I won't test all of them, it would be your job to test them before claiming that they don't work.

> It just seems odd to me, may as well install LineageOs if you just want an alternative android os really.

GrapheneOS is a lot more secure, and in my experience I get better support than I did with /e/OS.

> You get more privacy controls than stock android.

I do on GrapheneOS, even though I installed the Play Services and Play Store. I love being able to run them in the sandbox!

> I just feel that the whole point of graphene is to be able to have a private phone and live outside big tech and you pay a price for that.

Well you are not forced to install the Play Services. But if you own a phone that is supported by GrapheneOS, I would say it's a better choice than anything else out there.

I am currently using 4 banking apps from 3 different banks on GrapheneOS, they all work just fine. I'm also using WhatsApp and would not use the backup feature to Google Drive even on PixelOS. Uber (haven't tried the for drivers app), and other ride hauling apps also work fine.

Why would I choose LineageOS instead of GrapheneOS? I can't see any benefits in using LineageOS, I only see major drawbacks.

Why is it always 0 or 1 with privacy? Why can't I use GrapheneOS with sandboxed Google Play Services? Seems like the best option. I can still use all the apps I want and also get privacy and security benefits. I only give Google what I want and still get to live like a normal person, without making huge compromises on security, privacy, usability and GrapheneOS has been the most stable OS I've used. More stable than the stock PixelOS.

> It does if you want to fully use google play services. If you run google play services as a regular app, you cannot use banking apps, whatsapp (app works but no backups to gdrive) or uber for drivers. And you also cannot do purchases in the app store sadly. If you can live with this then fine.

This has nothing to do with it being sandboxed. You are talking about the SafetyNet api, which makes sure the device is using the "official" android version.

And no, not every banking app requires this.

> Why use GrapheneOS if you are going to install Google Services anyway? ... > May as well just install the stock os ... > I think graphene os makes more sense if you go all in. Otherwise there is no much point really.

No, Grapheneos is quite more secure than stock os when comes to handling google play service if you need to use it.

https://grapheneos.social/@GrapheneOS/113459782313987260

> At the end of the day, once Google stops shipping sec updates for your phone, firmware updates stop so that's it really.

That is true. Graphene does not hide that. If you want to live without any influence of google use iOS/MacOS or Windows.

The security you get is not free. The price you pay is functionality. Can't buy subs or buy apps on the app store. Forget about using banking apps on your phone and resign yourself to use Whatsapp with no cloud backups.

Imo, installing a Google app on your phone is living under the influence of Google. The apps can still run in the background and collect and ship info about you. Less influence sure, but still a ton if they get to run background services.

> The price you pay is functionality.

Everything I want to do works on GrapheneOS. Actually better than it did on /e/OS.

> Can't buy subs or buy apps on the app store. Forget about using banking apps on your phone and resign yourself to use Whatsapp with no cloud backups.

I use at least some of those, so... you make wrong claims :-).

> Imo, installing a Google app on your phone is living under the influence of Google.

You're entitled to your opinion. IMO, if you use microg you still allow your non-Google apps to contact Google. If you use Android apps, or if you use the web, you're under the influence of Google. That sucks, but that's how it is.

> Can't buy subs or buy apps on the app store. Forget about using banking apps on your phone

This is just plainly wrong. Im doing both with GrapheneOS.

Now I understand why GrapheneOS main developer comes out as crancky some times. People often comment stuff they, straight out, have no idea about.

Sandboxing.

Also: If there’s no upstream security patches, you throw away the device.

With alternative OS, you’ll often get backported security patches.

Either way, upstream patch guarantee date is your deciding factor when buying - not OS.

Reply on news.ycombinator.com