Stock OS before removed

8v55

What steps to install GrapheneOS while minimizing risks associated with the stock OS before its removed? For example, sharing your GPS location and device identifiers such as IMEI with Google or other entities.

DeletedUser69

8v55 what are your options for installation? I haven't tried that yet, but my next GrapheneOS will (I hope) be installed from my current GrapheneOS device using web installer.

faxe

8v55 I usually set up my new phones in the shopping center where the store where I buy my devices is located since they have free wifi there.

8v55

DeletedUser69 I'm happy in installing from a already GrapheneOS device but am concerned about stock OS potential data transmission during initial internet connection for OEM unlocking. Can you provide some options to prevent or reduce this?

Probably9857

Here are my thoughts (subject to correction or improvement by others):

Acquire the device as anonymously as possible, to avoid linking the IMEI to your real identity
Go to a location without cellular coverage, to avoid the IMEI being linked to a location. However, you will need internet access for the installer device. Maybe a basement, concrete bunker, Faraday cage, etc.

If you don't have a location without cellular coverage where you could install, the next best would be a location far from where you live, work, or spend significant time - ideally where lots of other people are around. The IMEI will be known to have been at this location, but if neither the IMEI nor the location can be linked to you, then that should be OK. Try to avoid having some other device with you that will reveal your presence at this location.

In the case that the IMEI is linked to your identity, then i would further advise to keep the phone in Airplane Mode at all times when using it.

Do not insert a SIM, especially not a SIM tied to your real identity.
Turn on the phone. Do not connect to any wireless networks. Get through the setup screens.
Follow the GrapheneOS installation instructions
When you boot the phone after installing, immediately turn on Airplane mode (before leaving the location where you did the install).

DeletedUser87

Probably9857 to add to that reply; avoid taking any Bluetooth (and obviously Wi-Fi enabled) devices also as they are most likely in Google's database from constant scanning from other devices. Best case: just the phone. And if you want to go the extreme route, cover the cameras with tape, same as the microphones before turning on the phone. This will make tracking it REALLY hard, since you eliminate all possibilities. (If you are even more paranoid, put on gloves to prevent the fingerprint scanner to get your fingerprints).

horde

Probably9857 Go to a location without cellular coverage, to avoid the IMEI being linked to a location. However, you will need internet access for the installer device. Maybe a basement, concrete bunker, Faraday cage, etc.

But you will need internet connection to unlock OEM in Google stock OS so you can install GrapheneOS.

faxe advice is very great.

stupidcreature

DeletedUser87 speakers can still be used as microphones so taping it up is pointless; and even if you get rid of the speakers, good luck getting rid of the gyroscope

DeletedUser87

stupidcreature that's true, but such generic 'mumbled' noise will hardly be useful unlike very specific sounds. Just wanted to add some suggestions to decrease attack surface.

DeletedUser69

Don't worry too much, just install GrapheneOS and enjoy "sandboxed Google free" experience (i.e. don't go for Google Play as tempting as it may be).You'll be much better off than most of the folks on this forum. But beware of the steep learning curve.

Guillaume

DeletedUser69 I confirm it's abrupt😂

ryrona

When I had bought my phone, I started it up with stock OS, without having any SIM card inserted. I skipped creation of Google account in setup wizard, and skipped setting up anything else I could skip too. Ie, I set a simple PIN, no fingerprint unlock or anything like that. I connected to my home Wifi. Let it install all OS updates. Factory defaulted after that. Then OEM unlocked it and began installing GrapheneOS.

This way, no information about my phone would be associated with any Google account, email address or phone number. I think this is the minimal information one could leak.

Probably9857

ryrona

That's what I would personally do also.

But even without SIM, the phone still connects to cellular network, revealing IMEI and location. The IMEI may already be linked to you through purchasing the phone. It will now also be linked to where you live. If you ever connect to a cellular network with that device, you could be identifiable. It will depend on threat models whether that is a real risk.

Hb1hf

horde But you will need internet connection to unlock OEM in Google stock OS so you can install GrapheneOS

That's what I was thinking. Don't you need to set up the phone first, to get to that? Use a Google account?

Probably9857

horde

horde But you will need internet connection to unlock OEM in Google stock OS

That is a good point. So, I guess there is no way to avoid revealing the IMEI + location to the cellular network. If that is a risk, then it is even more important to acquire the device anonymously.

horde

Hb1hf No, Google account is not needed.

ryrona

Probably9857 True, but I intended to and do use cellular with a SIM now when on GrapheneOS, so they still have my IMEI and precise location either way. That is not an issue in my threat model. Totally okay they know where the real life me is, and that it is me who owns this specific phone, as long as they have no clue what I am using my phone for or are doing on it.

The most important in most threat models is to have multiple separate identities and keep their activities totally isolated from each other. So real life me and what devices I own and where I am is still the real life me. But ryrona is someone else, some random GrapheneOS community member. Totally okay people know what ryrona writes on the internet. But there must not be any ties between the real me and ryrona. I have more identities than this though.