Decisions, decisions.

Krwck

Hello everyone.

 I'm hoping this community can lead me in the right direction.

For the past couple of months I've been reading up on Graphene, CalyxOS, and e.Foundation (w/Murena). I'm trying to figure out what would best fit my needs.

I've already eliminated my Google accounts. I use Aurora & FDroid. I honestly couldn't careless about using the Playstore. 90% of the time, I use my phone for finance, browsing the net, and work related stuff. The only apps I use from Aurora are stock related stuff. And those aren't really necessary. The rest of my apps are from FDroid. And I just add a shortcuts, from the browser (Brave), to my home screen.

I started learning towards e.Foundation. Mainly because of Murena. I know that it runs off of LineageOS. I know some of the pros and cons. I really like the fact that they took the time to implement their own apps to make the transition easier. However, I don't like that the stable versions are on the phones they sell overseas. Yes, they have some stable versions for older Galaxy's (S7-S9) but it doesn't seem worth it. Though, I'm still rocking my LGV30 ThinQ. 😆

I ruled out CalyxOS based on the above info. If I truly want the best security, I'm going with Graphene. But it's not always about the best security either.

The only issue I have with Graphene is, and please correct me if I'm wrong (this is what I'm trying to find out), there's no preinstalled "suite" (maybe I'm using the wrong word for it).

If I go with Graphene, I need a good, secure cloud based account. One account that can do it all. I have a Proton account but i don't care for it, even though they just implemented Drive. Everything is till clunky and slow. I also recently started using Murena, but I can't run the apps on my phone. I'm sure I couldn't run those apps on Graphene either. I could use NextCloud, like I'm doing now, but it's not the same. Some things, like their email, can only be accessed through the browser.

If someone can suggest a suite or a good, stable workaround, I'm all ears. That would push me to go with Graphene. Otherwise, I would lean more towards e.Foundation.

And in all honesty, lately I feel like I'm going nuts over all this privacy stuff.

Bottom line, I don't want anything to do with Google, Apple, or any other company that sells my info.

Any insight or suggestions would be highly appreciated.

Thanks in advance.

Krwck

Krwck. One more thing, or should I just buy a phone I can root and delete Google services?

MetropleX

GrapheneOS is a hardened OS providing substantially better privacy and security: https://www.grapheneos.org/features

CalyxOS substantially weakens the security model and isn't providing users with full privacy or security updates on a regular basis. CalyxOS is not simply not hardened. It's blatantly not private or secure. How long will it be before CalyxOS users receive the 2022-08-05 and higher security level? Last year, CalyxOS users went almost 4 months without receiving half of the monthly privacy and security patches and currently doesn't even have the latest security patch which is dependent on upgrading to Android 13 which they are yet to do.

Branding and market a product as private and secure does not make it private or secure. Something being presented as an alternative to using Google services doesn't make it private. Also, CalyxOS always uses multiple Google services, even if you do only care about that...

GrapheneOS developed our sandboxed Google Play compatibility layer as a replacement for the legacy microG approach offering poor app compatibility and which has serious security issues. microG is missing important parts of the security model and important security checks.

CalyxOS also bundles microG and while you can "opt out" from 'using' it you can't opt out of it being included as a privileged system app loaded with Google libraries and services. microG doesn't provide broad app compatibility. You can't use whatever apps you want from the Play Store. You can only use a subset of apps working with the small portion of Play services reimplemented by microG. You also sacrifice a lot of security with the approach it uses.

CalyxOS is not a hardened OS and doesn't preserve the privacy or security model. It's far closer to LineageOS than GrapheneOS.

/e/ runs proprietary Play services code inside each app using Play services with far more privileges than it has on GrapheneOS where the app sandbox and permission model is substantially improved. microG itself runs proprietary Play services code with elevated privileges.

microG exists in order to run proprietary apps, yet it can only make a small subset of them work and substantially reduces the security of the OS. Many of the other changes in LineageOS and /e/ also reduce both privacy and security of users. They are worse off, not better off.

The cloud service offered by /e/ also recently (May 27) went through 'service maintenance' which leaked their users data.

Source:

GrapheneOS Project Twitter Account
/e/ Maintenance: https://community.e.foundation/t/service-announcement-26-may/41252
/e/ Report of leak: https://community.e.foundation/t/service-announcement-26-may/41252/10
/e/ Leak r/privacy post: https://www.reddit.com/r/privacy/comments/v07oor/ecloud_leaked_other_users_data_during_maintnance/
MicroG 'leaks' https://community.e.foundation/t/microg-leaks-personal-data/2879
MicroG storing passwords in plaintext: https://github.com/microg/GmsCore/issues/1567

As far as a 'suite' is concerned, I am not providing recommendations or advocating for these services but Cryptpad and Skiff are services I know of. A featurette was produced by Naomi Brockwell : NBTV here: https://www.youtube.com/watch?v=-4MpHf4XOMw

GrapheneOS is a security first OS giving you the control over your privacy. The choice to use it, even if you...

Krwck feel like I'm going nuts over all this privacy stuff.

...is a no brainer, you can benefit from GrapheneOS' full feature set even if you wanted to throw your privacy out the window and still be better off than stock or the aforementioned options which reduce BOTH.

GrapheneOS is for Everyone™

abcZ

Krwck Some things, like their email, can only be accessed through the browser.

Nextcloud is NOT an email server at all. There are, I believe, a few different plug-ins for nextcloud that implement email clients, but again, nextcloud is NOT an email server.

You really should be using a proper email client on your phone, like fairemail or k9mail. You can use that to connect to ANY email server that implements proper protocols (smtp, imap).

tkssx

I am a relatively new user to GrapheneOS (since June), but here are my 2 cents...

In GrapheneOS (and Android in general), you can mix and match whatever apps and sync accounts/providers (for contacts, calendars, etc.) you want. You don't have to commit to one monolithic ecosystem, whether it's Google or another. Google (and Apple) sort of made me forget that concept because they slowly built their version of every possible app and service, and made me start to subconsciously believe I had to buy into the whole package for things to work seamlessly.

GrapheneOS comes with a small list of essential apps pre-installed: Calculator, Clock, Camera, Browser (Vandadium), Files Explorer, Photo Gallery, Contacts, Messages, Phone, Keyboard. These are "hardened" by GrapheneOS for security and privacy. You can individually replace these if you want (I don't because I like them), and add whatever you want.

For example:

I use Google Calendar for calendars since I have to collaborate on calendars with others
I use ProtonMail for email (but also GMail until I migrate over to ProtonMail completely). I am not using Proton for their Calendar, Drive, or VPN.
I use Mullvad for VPN
I use EteSync for contacts. I am not using EteSync for their calendars or tasks.
I use Google Drive until I migrate my personal files over to Syncthing. But even after using Syncthing for my personal files, I will still need collaborate with others using Google Docs, Sheets, Slides.
I use Simple Notes for my tasks/notes to pair with a physical journal

I can see why a monolithic, ecosystem can be attractive but personally I have really enjoyed the process of picking and choosing the right app and service for the job at hand.

Krwck

I appreciate the response. After I posted everything, I started to realize that I don't necessarily need everything in one place. I could essentially just keep most of my stuff on my phone and move important things to an external drive. There's always that option.

I mainly just want to sync my calendar, email, and contacts.

It looks like I will become an official Graphene member soon. 😁

alex_herrero

I'd suggest Proton for mail, maybe even calendar and drive, and etesync for contacts (or even calendar). But that's just my experience. You'll probably be better trying it yourself to see what fits you best.

Andy

Back in 2020 I bought an ePhone OMG! and soon wrote on their very hostile forum….

Thanks Manoj & alexis I now have the shiny nearly new phone. The very expensive 273,56€ price paid for the phone above market price is okay if the difference is used to install the OS and also help the e.foundation journey.
I am not sure about just what I have bought? I thought that I was getting a de-googled phone that respects my privacy? With my previous old Samsung Slll mini I can turn most google stuff off fairly easily and kill mobile data, wifi, location, GPS and bluetooth etc in just one swipe and one click.
Now just as with my wife’s Moto G I spent an hour or more with my S7 ePhone denying permissions to this that and about everything – it seems to be riddled with google. What on Earth is microG other than google? Why won’t it let me turn off connection to google servers and deny permission for network based location – terrible!
Was hoping that I could get far away from google and USA Inc. but looks like I have just spent a lot of money to get into bed with them and can’t even kill location of the bed.

Their top Samsung expert, Archje, resigned due to their treatment towards me being effectively silenced and trolled by the ePhone fanboys. There is a shedload of material out there such as “/e/ – privacy-enabled Android ROM, or Evil Corp? · InfoSec Handbook” and a damning article in the highly authoritative German publication Der Spiegel.

I returned the expensive S7 ePhone for a full refund due to MicroG and location issues – had to keep ePhone in a Faraday pouch. I then used this money to buy a Pixel 3a off eBay and installed Graphene-OS – happiness restored. A brilliant combination IMHO.