Considering GrapheneOS: Questions about compatibility

Franco

Hello, I am new and opening this thread to seek advise. I have a few questions about installing GrapheneOS on a Pixel. I have a Samsung A53 that is factory default and I already started to use opensource apps.

I would like to enhance my privacy on my smartphone, removing bloatware, and deGoogling it as part of a larger ongoing effort to reorganize my digital footprint. I think that GrapheneOS could help me with this.

I am still hesitating because:

I would need to invest in a new phone. My Galaxy A53 is only 2 years old
I am not sure about the compatibility of the applications due to the Play Integrity API. If an application works today, there is a risk that it may not work after some updates.
If it happens, the application Support would probably reply that they don't support custom ROM or that the phone is rooted

After reviewing the documentation and this forum, I believe I should be able to install most of the applications I need:

A government app for managing passport, taxes, accessing gov services etc. it won't work on GrapheneOS => the app is critical but I don't use it often. I can keep it on my current phone and use it when needed.
Google Map: I am testing Organic Maps for everyday life, hiking, and cycling. For specific cases, such as navigating public transportation in cities, I could use Google Maps in the Sandboxed Google Play or Transportr (which I still need to test).
Instant messaging: Whatsapp should work on GrapheneOS. Telegram: both official and FOSS Clients should work (without voice for the FOSS one?). And finally, Signal. No Facebook Messenger etc.
My commuter/ticketing/mobility app: Not sure how well it will work. It appears compatible with GrapheneOS for main features, but user experiences varies with with some functionalities.
=> Not essential, but very convenient. Workaround: to use my physical transport card and check the timetable on the website.
My banking applications: according to this website, I am lucky because both the authenticator and the banking apps seems working.
Biometric authentication to access my IT system at work: I find no feedback online.
The official documentation states that the application does not work on jailbroken phones or if they are rooted. The phone must also support the Trusted Execution Environment on Android.
=> if it does not work, I would have to use my current Samsung at work.
2FA: I am using Aegis, it should work
Email, VPN, Drive, Pass: I am using Proton solution. I do not expect any issues, except the email notification working with Google Play. But You Have Mail on F-Droid should allow notifications to work

In short, the transition to GrapheneOS should be possible. However, buying a new phone makes me overthink a lot. Based on your experience, do you see any potential blocking points or risks?

Thanks for the help!

Probably9857

Franco

Seems like you have done thorough research!

I don't see any risks or issues other than those you yourself have identified.

yellow-leaves

Franco After reviewing the documentation and this forum, I believe I should be able to install most of the applications I need:

A government app for managing passport, taxes, accessing gov services etc. it won't work on GrapheneOS => the app is critical but I don't use it often. I can keep it on my current phone and use it when needed.

Depending which government ID you need it may just work (though a significant proportion of user have problems with theses kind of apps).
The one I personally require works perfectly fine on GOS though it shows a popup claiming that the app won't work without Google play services (even though it does and have been for years)

Franco Google Map: I am testing Organic Maps for everyday life, hiking, and cycling. For specific cases, such as navigating public transportation in cities, I could use Google Maps in the Sandboxed Google Play or Transportr (which I still need to test).

I'm using Osmand.
It works alright though it seems to lack many addresses (street numbers) when traveling outside large cities.

Transportr Been using it to plan my local trips and it's works fine though lacks traffic info.

Franco Biometric authentication to access my IT system at work: I find no feedback online.
The official documentation states that the application does not work on jailbroken phones or if they are rooted. The phone must also support the Trusted Execution Environment on Android.
=> if it does not work, I would have to use my current Samsung at work.

GrapheneOS's TEE is more secure than stock android and GrapheneOS is neither a jailbrake nor does it grant you root access and therefor I see no argument to as to why it shouldn't work.

Franco 2FA: I am using Aegis, it should work

An excellent choice, works flawlessly on GOS

Franco

Probably9857
Many thanks for your reply. I ordered a Pixel today.

I have also applications like Komoot, Strava and Garmin.
I am not yet sure how I will deal with them. Maybe I can find an open-source component that would allow me to prepare the itineraries on my computer and then import/export to and from an open-source solution on my phone to keep these apps away. I will do my homework, unless someone can direct me to a handy solution.

Thank you again.

Michiel

Franco The Strava app depends on Google Play Services and its web app and website are practically unusable on a phone. The only good news is that - at least in the EU - you can revoke many privacy intruding permissions in its settings.

Franco

@Probably9857 , @Michiel and @yellow-leaves

Thank you very much for all your replies, that helps me a lot.
I have successfully installed GrapheneOS on my Pixel and I am setting up the applications. So far everything seems to work, the migration it is still work in progress.

I have a follow-up question: I have a dilemma regarding location services. I need an application to authenticate and connect to my workstation at work, which checks my location since I’m not allowed to work from overseas.

According to a colleague who is also using GrapheneOS, the application works well but the GPS takes time to acquire my location and struggles indoors, which is frustrating when I need it to connect or unlock my session (happening a couple of times a day). In contrast, my current Samsung phone provides immediate location access using Google services.

I’m considering two options:

Use my Samsung phone as a dedicated device for accessing my workspace (I would have to take it every-day and connect it to Internet via the hotspot of the Pixel)
Create a dedicated user profile (which cannot run in the background) on my new GrapheneOS and allow it access to Google’s precise location services only when unlocking my session.

Would the second option make sense and could it work this way?
I understand that it is not ideal from privacy perspective, but I am trying to find the right balance between privacy and convenience. Thank you again for your help.

PS: I could just try, but to onboard the app on a new phone is a process that requires some actions, so I am trying to assess the option first.

trilogy6202

Franco Create a dedicated user profile (which cannot run in the background) on my new GrapheneOS and allow it access to Google’s precise location services only when unlocking my session.

I'm not sure that you can configure location service separately in a user profiles. Some settings are global and I think this might be one of them.

Probably9857

trilogy6202

The option to reroute location requests exists per profile. I would assume it works per profile also, but I have not verified that.

Logically, it seems like it would have to work, because Play Services may not be installed in every profile.

Franco

Assuming the location option works (as I expect it does), that sounds like an excellent use for a second profile.

Franco

Thank you @trilogy6202 and @Probably9857 for your responses.

For testing purpose I just tried with Organic Map in the dedicated User profile where I unchecked "Reroute Location requests to the OS" and selected "improve location accuracy".

created a new User (cannot run in the background)
I allowed access to Google’s precise location services
Indoor, Organic Map is able to catch the location immediately

At the same time, I launched Organic Map from my Owner profile

Indoor, Organic Map was unable to get the location

My concern now is more about the cost of the privacy aspect. I am not sure if I should use this, or would it be better to accept using a dedicated second phone for work. I am not logged into Google Services with this user account, so I am not sure about the impact.

Probably9857

Franco

I don't see any privacy loss from using a second profile compared to a different phone. In fact, I think it is more private.

With secondary profile:
Google knows the location of the device only when the profile is active. Google may or may not be able to link the device to your identity.

With a Samsung phone:
Google knows the location of the device any time it is powered on, along with potentially much more data that could be used to link the device to your identity. Samsung is also collecting various data.

MeanMrMustard

Probably9857
"With secondary profile:
Google knows the location of the device only when the profile is active. Google may or may not be able to link the device to your identity."

Along with that, Google has limited ability to ascertain your identity by you just logging in due to the fact that they don't have access to the phone's IMEI, etc.

It's other data, such as contact lists, that help them out in the endeavor.

I'm about to the point where I have to login to Google to get my TickTick app to work. 😥

I have to research using a throwing Gmail account for that though. It's an app that I use a LOT and need to get notifications from it so it can't reside in it's own private profile.

Franco

Hello again. I just tested the authenticator application mentioned above. Surprisingly, it is not able to capture the location quickly enough, sometimes not even before the timeout. I am surprised because when I launch Organic Map, it detects my exact location immediately.

I will try to understand the underlying issue with the location system, why Organic map is able to get my location immediatly but not the Authenticator.

In the meantime I re-configured my Samsung for this purpose, I will have to bring both phone when I work.

But that is fine and it not blocking. I can already says that my migration to GrapheneOS is successful, thanks Everyone.

Snibby

Franco At least on stock OS, there is a setting to enable "location accuracy", which uses not only your GPS but also sends wifi, bluetooth, ... data to google to more easily pinpoint your location. I'm not sure, but it could be that an app can choose to use this "location accuracy" mode or not. Maybe in this case Organic maps is using it while your other app isn't? Just a wild guess though.

Franco

Snibby
Yes, indeed, I activated the 'Location Accuracy' option in GrapheneOS, along with Wi-Fi and Bluetooth scanning.

I also checked Organic Maps, which has a specific setting for using Google Location Services. When I activated Wi-Fi and Bluetooth scanning, my indoor location jumped from a precision of 50 meters to the exact location instantly. However, this did not happen with my professional app.

I'm unsure how my app is obtaining the location. I will write to my Support out of curiosity.