Questions before making the switch.

islandrabbitran

Hey!! Brief introduction: I'm planning on buying a Pixel and installing Graphene, but I have a bunch of questions I need to have addressed beforehand.

Google

Yeah, I know it'd be ideal to completely de-google my device, but being realistic I don't think I'm ready to do it. There's three apps I currently heavily rely on. Google Classroom, which I'm required to use in class, Google Pay (I really like the concept of paying with virtual cards on physical stores) and Google Maps (great navigation and wide information about a sick amount of businesses). I'd like to know if there's any good replacement for these two last applications and how the Sandboxed Google services work. Can I just install them and Google Classroom will run fine?

Music and streaming

I really use Spotify, like a lot. And I love turning auto-play on and letting it play whatever music, so I don't feel like building my own local library would work. Is there any nice client for it or am I fine running the official app. Also, I enjoy watching Netflix and Prime Video but I'm not sure if they'll work using a de-googled Android.

Banking

I've heard of many banking apps not working without SafetyNet, so I'd like to know if the majority of them run on Graphene or not.

Should I really get it?

Apart from all the previous mentioned apps, I'd still use some social media such as Twitter (with an open source client though) or Discord. Having all these closed source apps makes me thing making the switch will not make any noticeable difference, even if I stopped using many closed source apps (which I'll do anyways if I don't switch to Graphene. Should I proceed anyways?

That's all I can think as for now, I really appreciate any replies.

MetropleX

islandrabbitran

Let's run through these one by one:

Google: With sandboxed play services installed Classroom should theoretically work fine. I qualify it because I haven't personally tried Classroom, however Maps will definitely work and will work without Play Services installed. In regards to Google Pay this will not run unless Google decides to whitelist GrapheneOS to enable it to pass SafetyNet in full. Currently GOS only passes BasicIntegrity thanks to verified boot but fails ctsProfileMatch. To pay using NFC you can try something like Stocard as well as Curve Pay depending on your jurisdiction so long as Google Pay isn't available where you reside while Curve is. There will be more but those are the two I am familiar with.

Music and Streaming: Spotify works with and without Play Services absolutely fine. Netflix/Prime Video I have only tested in my Play Services profile and they work with it.

Banking: A fellow mod @akc3n has put together a community sourced project/list to help people determine if their bank works on GrapheneOS which can be found here https://akc3n.org/projects/banking/. If you can't find it you would have to be the person to test and help further the resource to help others by reporting it to him.

Should I really get it?: Obviously people here will be biased but my advice would be to certainly try it first and see how it works and help provide feedback on anything that you feel adds roughness around the edges of your experience. GrapheneOS provides such amazing levels of flexibility and control while offering you approx 95+% broad app compatibility. Only apps with memory corruption of deep SafetyNet integration fall by the wayside as a rule of thumb. Any app prevented from working due to memory corruption is the OS doing it's job to protect you.
At the end of the day if you use our web installer to flash GOS on your new device you won't risk bricking it, you won't need to worry about Warranty etc and you can give yourself enough time to see if it works. Think Dr Pepper what is the worst that can happen? If you don't like it or it doesn't work for you, it's just as easy to flash back to stock. Really though don't hesitate and let your inner power user out and take back control. GrapheneOS is my daily driver with no handicap, I use all the featureset inclusive of sandboxed Play Services with my 'legacy' Google account and more, I haven't looked back.

Oh and Twitter works great as a PWA (Progressive Web App) installed from the browser, not only does it benefit from the OS protections but the hardened browser experience Vanadium offers too.

Just remember whatever issues or questions you have, the entire community is at your fingertips.

evalda

Hello dear Iislandrabbitran! Welcome aboard! 😻

Re: google, please note the goal of GOS is not de-googling... It could be a side effect if you choose not to use google apps... GOS gives you this choice. However there is nothing evil about google... They manufacturer pixel devices and are by far the biggest contributers to AOSP and even Linux.

Re: specific apps, many apps work without Play Services... And the ones that require them you can use with Sandboxed Play Services that provide great compatibility without any special permissions that normal Google Play Services have on Android...

Re: banking apps, see this:
https://github.com/akc3n/banking

It depends a lot on a specific bank... In my case either a bank app or web app work.

Thank you for your interest in GOS! Let us know if there is anything we can help with ❤

islandrabbitran

evalda thanks for your support!

islandrabbitran

MetropleX thanks for your help! Just a few more things.

How do the Sandboxed Play Services exactly work? Why do you have a separate profile for them? Am I safe having everything under the same profile?
If I use GMaps with these Play Services, will the app be able to track my location in the background without me noticing?

Again, thank you very much for the answers and the encouraging message.

MetropleX

islandrabbitran How do the Sandboxed Play Services exactly work? Why do you have a separate profile for them? Am I safe having everything under the same profile?

If I use GMaps with these Play Services, will the app be able to track my location in the background without me noticing?

The sandboxed play services are so named because while they are the standard unaltered Play Services, Google Services Framework and Play Store apps, the OS has integrated a compatibility layer that allows them to run as regular user installed apps instead of having deep level system integration. This places the power to govern their permissions back in the users hands, instead of them being able to grant permissions to themselves or reactivate denied permissions as they are known to do on stock OS between updates etc. This means the only thing they have access to is the network if you give it, phone model and the ability to see what apps you have in a given user profile. This is why I isolate it in it's own profile as well as having the ability to effectively turn them off by using the End Session to shut a user down and place it back at rest (off and fully encrypted). I can then use my phone normally.

As for GMaps it will be able to do anything you grant it the ability to, to prevent background usage, simply grant location only when using the app and for the rest of the time ensure using the QS settings your location toggle is switched off. Can't do anything in the background then. However again using them in a user on their own will allow you to do as above for increased peace of mind. GrapheneOS is about giving you the control to use what you need flexibly across users, within the standard sandbox, etc and silo/isolate apps as you see fit for your usage and or threat model.

jpl1936

For me, I am thinking of creating a separate user profile for installing the Sandboxed Google Play Services. When you are done using those specific apps, you can switch back to the owner profile and end the other session so nothing will be running in the background.

islandrabbitran

MetropleX thanks for all your help! Now I'll have to decide if I actually need to pass SafetyNet and install LOS with Magisk or go for GOS

Arnauld

Hi,
For Spotify I use Spotube...

akc3n

Quick update regarding the banking apps project.

Banking apps project is now located at:
https://privsec.dev/banking

The issue form template has been updated today to include Pixel 7 series as well as our per-app exploit protection compatibility mode option.

I've created a post on some common solutions that may resolve some banking apps compatibility issues:
https://akc3n.page/banking-issues