Security of GrapheneOS with Google Services

Nullify

I just got my Pixel 8 Pro so that I can utilize the Memory Tagging feature to further secure myself. I know Google Services on GrapheneOS is not advised when it comes to absolute security.

But my question is: Because I need banking software to run on it (which requires Google Services), how much of GrapheneOS' security do I lose, in comparison to when i dont have Google Services? Will It still be more secure than LineageOS (where I am coming from) and Stock Android?

nologo

Nullify Will It still be more secure than LineageOS (where I am coming from) and Stock Android?

Yes, it will be. LineageOS, no matter how nice, is not secure at all. You miss lots of security patches and there's no verified boot. Stock PixelOS is more secure than LineageOS, but does off course have very privacy invasive Google apps and services and Gemini AI crap. On GrapheneOS, Google Play Services runs as a regular Android app, without special privileges, which makes GrapheneOS the better choice. Even, or especially, if you need Google Play Services.

W1zardK1ng

Nullify You are wrong!
Sandboxed Google Services on GrapheneOS is the one advised when it comes to absolute security.
There is no other app store you are get apps with the level of security that is provided by google play store.(Accrescent exists but have very limited apps).

You don't loose any any security, LineageOS/Stock Android is nowhere near to GrapheneOS in terms of security.

Delaney

Nullify I know Google Services on GrapheneOS is not advised when it comes to absolute security.

What does absolute security even mean?

Google play services on GrapheneOS is more secure than running Google play services on other OSes because on GrapheneOS, Google play services runs as a regular sandboxed app with no special permissions.

I doubt you would be compromising much on security if you installed Google play services on GrapheneOS, since it is effectively just another app you install like any other.

Nullify

I also saw some posts about being able to have Profiles where I can have Google Services on one and not on the other. How does that work, exactly? Does it Sandbox the User Profiles into their own instance of the system/sub-system or are they fooled into thinking that they're a software on a system level when they're not?

W1zardK1ng

Nullify User profile are kind of like different user account on your windows/mac pc.
But here its more secure than a desktop, its having their own encryption keys, vpn slot etc. once a user profile is deleted all data in that profile is gnone and cant be recovered. its like you use 2 different phones.

If you want you can create a secondary user account or private space install play services there and install your apps that are depended on play services, this is more for a privacy reason than security.

Apps in the same profile can communicate each other using IPC but really shared using IPC is not exactly unsure. also remember that many apps uses google analytics and other code from google so even if you dont have play service installed there maybe apps sharing data to google servers.

If you are a new user, start with the owner profile, install play services there, login with a new throwaway gmail and get your apps from playstore. this way you have minimal to no impact on your usability. slowly you can start splitting apps into multiple user accounts for the compartmentalization.

Nullify

nologo do you know of anything like MindTheGapps but without the AI Bullshit and minimal amount of apps on it like Only having Google Play Store, and basic Google Play Services so that i can have apps like banking on it? Also, it may be the case on Graphene but i just want to make sure, does Graphene Spoof the Device info like HW and SF?

Nullify

W1zardK1ng

User profile are kind of like different user account on your windows/mac pc.
But here its more secure than a desktop, its having their own encryption keys, vpn slot etc. once a user profile is deleted all data in that profile is gnone and cant be recovered. its like you use 2 different phones.

If you want you can create a secondary user account or private space install play services there and install your apps that are depended on play services, this is more for a privacy reason than security.

Apps in the same profile can communicate each other using IPC but really shared using IPC is not exactly unsure. also remember that many apps uses google analytics and other code from google so even if you dont have play service installed there maybe apps sharing data to google servers.

If you are a new user, start with the owner profile, install play services there, login with a new throwaway gmail and get your apps from play store. this way you have minimal to no impact on your usability. slowly you can start splitting apps into multiple user accounts for the compartmentalization.

That is very good to know. This is valuable to me. Because I am thinking of 3 Profiles: Personal Google-less profile (Owner), Google, and Work.

This sounds like its just the right OS for me. Thank you for the info.

Are there any fun facts about Graphene's Privacy and Security? What about Linux software compatibility (like running .Net, for instance (its optional for me. But would be sick to have as i do some development in C# for causal non-serious programming)).

W1zardK1ng

Nullify If you are speaking about LineageOS, they install these packages as system apps that is not the way how things works in GrapheneOS.

GrapheneOS has a compatibility layer providing the option to install and use the official releases of Google Play in the standard app sandbox. All of your banking apps works on GrapheneOS other than the ones which deliberately block alternative oses.
Read https://grapheneos.org/usage#sandboxed-google-play

There is no Spoofing of Device info like HW and SF and its not a correct way to do things if any other apps are using it.

W1zardK1ng

Nullify That is very good to know. This is valuable to me. Because I am thinking of 3 Profiles: Personal Google-less profile (Owner), Google, and Work.

Instead of there you can use owner + private space and a user profile.
Private spaces are exactly like user profile with the option to control clipboard sharing. Its much convenient than separate profiles.

Nullify What about Linux software compatibility (like running .Net, for instance (its optional for me. But would be sick to have as i do some development in C# for causal non-serious programming)).

There is an experimental Linux development environment which you can enable by enabling the developer options, i have used it much as thats not something i need in my life. Also you can connect your device to a monitor and use it along with the desktop mode.

Nullify Are there any fun facts about Graphene's Privacy and Security?

You dont have to go extreme with profile setups and app installation sources on GrapheneOS, use if how you use a regular phone its much safer and private than any other OSes and with that way you wont feel like missing out on anything and tends to stick with the OSes for long term.

Nullify

W1zardK1ng Thank you for the reference. I'll get to it as soon as I can. As for when I said "Spoofing", what I mean is something like how Zen (or even Tor, at this point) spoofs itself as a generic Windows 11 device running the average resolution of 1920x1080, or 1366x768 etc. So with the example in mind, what I'm specifically asking is whether it hides itself as the Stock Android OS instead of GrapheneOS as in GrapheneOS.

W1zardK1ng

Nullify There were some values changed to from grapheneos to generic ones when some apps started blocking grapheneos by checking that value, it should be somewhere in the release notes or some other posts, i dont remember what are those.

But as whole GrapheneOS is not trying to spoof it to look like any other device or a genuine pixel os.

charles25565

W1zardK1ng You're referring to the changes in this release:

https://grapheneos.org/releases#2025012600

Nullify

W1zardK1ng why does it not spoof itself? is it because it would cause potential security risks because apps would behave differently orrr... ?

charles25565

Nullify They could, but they don't, because it really is a lot of work to circumvent Play Integrity, and each state only lasts for a week or so until they need new state to bypass it again.

W1zardK1ng

Nullify Spoofing something to look like something else is not the correct way to do things. Forget about spoofing things its not reliable and safe.

The only thing currently causing issues in GrapheneOS is the play integrity api check by apps. If the team spoof it to look a certified device, everything will work including the tap to pay in google wallet but its just matter of time google block it and everyone who uses those features will start complaining like the things broke and the OS is not reliable.

This is an issue from the Google side, google should change it. the device integrity level exists purposely to ban using a non stock OS or non google certified devices.

There are some apps checking the play integrity api blocking GrapheneOS, i believe the devs of that apps are lazy because there is better way to check integrity without google and there are some other apps doing it in that way.

In googles and others apps who block GrapheneOSs opinion a pixel 3 running stock os without any security updates for years is safer than pixel 9 running with GrapheneOS because they allow their app on those old devices but not on the safest device. Hope at one point this will change.

Read https://grapheneos.org/articles/attestation-compatibility-guide