What is the next best thing after GrapheneOS

DeletedUser632

My goal is eventually to migrate GrapheneOS but I've yet to pay off my carrier-locked Pixel so Im stuck on stock for the time being. I also own an iPhone but Im beginning to mistrust Apple. The AI trend has got me concerned that we are regressing in terms of privacy and Im unsure which OS to trust during this transition period. What is the next best after GrapheneOS and what is the recommended configuration?
My main threat I think about is surveillance capitalism

Xtreix

DeletedUser632 What is the next best after GrapheneOS and what is the recommended configuration?

When it comes to security and privacy on mobile devices, the alternative to GrapheneOS is iOS on an up-to-date iPhone, but I objectively think that GrapheneOS is the best option for mobile devices, so there isn't really any other configuration as good as this one available to the general public. There was previously DivestOS, which was a great project aimed at minimizing the attack surface of devices considered insecure, but the project has since ended.

On desktop, the security model is largely flawed. macOS fares a little better, and Windows 11 isn't too bad an option, but there are a lot of bullshit, mainly in the Home version, which you can't revoke. Secureblue.dev is a solution for Linux desktop and Linux server that aims to reduce the insecurity of Linux, It's a great project, but the desktop security model is still problematic, that hasn't changed. You should also familiarize yourself with threat models.

Tandara

Hi there!
You should really look around in this forum, this topic is brought up weekly.
The general consensus is that Iphones are second best option after GOS for mobile. All the other Android ROMs/stock have terrible privacy and security practices

DeletedUser632

Xtreix

Xtreix OK, so just to clarify I am not exactly new in the game. I'm just kind of curious. For desktop I I already daily drive secureblue and macOS my main concern is mobile.and I'm aware of threat modeling, but the privacy goal post seems to be accelerating at a massive pace due to ongoing trends
If iPhone is still the next best thing that is fine but I would like to know how I can do harm reduction while being stuck with Apple

argante

Xtreix Windows 11 isn't too bad an option, but there are a lot of bullshit, mainly in the Home version, which you can't revoke.

I agree with what you wrote. Regarding Windows, I'll just add that it's best to use the LTSC version, which is typically intended for governments or large corporations. It doesn't have all the junk found in the Home and Pro versions. To enhance security, you can use HP Wolf Security (I don't want to marketing them). This solution is closest to QubesOS and is well integrated with Windows. The critical element is replacing the consumer-grade drive with one certified for government agencies. If you look carefully, such a drive has modified firmware, and after unlocking the drive, MFA is still required for the specified resources. This works at a layer below Windows, so even if someone hacks into Windows and has full administrator privileges, they still won't be able to steal resources without additional authorization (which could be provided by, for example, a hardware key).

SirWolf

Xtreix iPhone may be secure enough but it's not privacy friendly. We need both. For more info see https://www.youtube.com/watch?v=XwKryJB6IPg

DeletedUser632

I don't know if I'm just not using the proper keywords on the forum search but I've yet to see any conclusive discussion relating to this
I am aware other AOSP based distributions aren't suffice so I'm not even taking those into account

DeletedUser495

DeletedUser632 the key to finding more relevant results is using your preferred search engine instead of built-in forum search in format

"search term" site: discuss.grapheneos.org

kopolee11

DeletedUser632

If iPhone is still the next best thing that is fine but I would like to know how I can do harm reduction while being stuck with Apple

You could take a look at something like this. Note, I didn't review everything listed here, and even if I did, I'm not qualified to say what would be best. But it may give you some good ideas to consider.

Divby0

[...] closest to QubesOS [...]

Sorry for being OT. But ... wow. I never knew that HP Wolf Security is hypervisor-driven. How exactly does it work? What does it run on?

argante

Divby0

https://discuss.grapheneos.org/d/24352-is-qubes-os-really-secure-what-about-windows-security-in-2025/15

https://discuss.grapheneos.org/d/22654-vanadium-equivalent-for-windows-and-linux/3

DeletedUser632

SirWolf I've seen this video and this is one of things that is strongly convincing me to migrate to graphene as soon as I can but luckily for me, I do not have a device that supports Apple Intelligence and I've disabled Gemini through ADB however I do not trust tech to respect these long-term i am very much anti-AI I want nothing to do with this on my phone if it aint on-device

Divby0

Thank you.

layenok779

I strongly disagree on this topic with the community. Without getting any deep or saying much, privacy and security go hand in hand, and you cant have one without the other. Apple has extremely bad privacy, you cant even turn off you device completely, even if you have powered it off. An android with no identity is any day better than apple. I would say mostly use desktop/laptop and avoid phones as much as possible.

DeletedUser632

layenok779 You just contradicted yourself by suggesting using a less secure platform . Although desktop provide more agency I would still prefer utilizing a phone on top my already existing desktop (Although I will say my counter argument towards that is they do have less sensors so attack vector isnt exactly the same).

In terms of the iPhone I believe you are talking about the "iPhone findable after power off thing" that can be disabled from what i can tell

Fallacy aside do you believe using a Pixel with stock not signed in the main profile utilizing reputable applications better than iOS in terms of privacy?

r134a

layenok779 privacy and security go hand in hand, and you cant have one without the other.

I always had the impression that there indeed needs to be a secure environment for measures taken to improve privacy to be effective, though i believed aswell that u can have pretty good security, not necessarly accompanied with good privacy. (For example Edge)

I agree u can't have privacy without security, but i'm not sure u can't have security without privacy.

raccoondad

layenok779 Apple has extremely bad privacy, you cant even turn off you device completely, even if you have powered it off. An android with no identity is any day better than apple.

Hardware security goes hand in hand with privacy and security as well, which apple wins far more than the majority of android devices, excluding some more higher quality brands.

Pixel devices are also 'never off', there is always something running, however apple devices have their cellular disabled is what's truly important.

Regardless this isn't really a big thing, in my eyes.

Probably9857

r134a i'm not sure u can't have security without privacy.

I think you technically can have security without privacy, but then you need very good security, to the point that you can successfully defend against any potential attacker.

For most people, that is not realistic. Privacy helps this situation by making you less of a target, and thus less likely to require the highest security.

Privacy is actually a form of "security by obscurity", but in a good way.

n3t_admin

r134a I agree u can't have privacy without security

Disagree on this take. Depends on the adversary. Surveillance capitalism doesn't care if your phone's OS is up-to-date with the latest patches or has 50 open CVEs. The data is gathered by (mostly) legal means. That means actively exploiting vulnerabilities in a manner that would be considered "hacking", is gonna get these companies fined huge amounts of cash, since it's illegal. Nobody needs that. Nobody does that. If we're talking about targeted attacks, then sure - lack of security will also compromise privacy.

other8026

Sorry, it may not seem fair considering the topic, but certain OSes just aren't going to be listed here. GrapheneOS has a good reputation for doing well at what it does, but there are other OSes that some say are on a similar level as GrapheneOS in terms of privacy and/or security, but they're objectively not.

There's a lot of misinformation out there about these other OSes. We try to keep information on this forum accurate. Suggestions or discussion of insecure OSes on this forum may end up confusing people who don't know better, whether intentional or not.

If you are curious about other OSes and how they compare, I'd suggest taking a look at this comparison chart https://eylenburg.github.io/android_comparison.htm. For further information, you can try searching this forum. People with access to the project accounts are especially knowledgable, so you can see if you can find what they say about these other OSes here on the forum or elsewhere (official social media accounts are listed at the bottom of the contacting the project section on the website).