GrapheneOS review by a new user!

someone1223

Hey, new user here! So I following the grapheneOS for some time now, and even did purposely buy a pixel as my next phone. But the stock ROM convenience and adaptive features were holding me back, also I need to run GPay and my bank app. Especially now playing and adaptive charging features was very nice!

Also I very much liked how I get new android version before everyone... until yesterday. I updated to Android 14, and a play system update. I was using a 2nd user profile and was trying to take screenshot of an app. An it "failed to save". Weird, it wasn't a block by the app, it was simply failing. I did have some minor issues like haptics occasionally not working etc. I tried restarting the device, and voila - boot loop. Great. I had to boot into recovery and perform a factory reset to boot again.

Well, I factory reset my device anyway, so I decided to flash graphene. The installation was VERY SMOOTH (great work devs!) with the web installer. The UI felt a bit old at first but quick customisation and adding a wallpaper and it's cooler than pixel stock. The security features like scopes and exploit protection features are very nice. I really liked the auto reboot feature! Also option to completely end session of other user profiles is also very nice. Tried play sandbox on a 2nd profile and hats off to the devs, it worked like a charm. GPay works perfectly (honestly shocked) and my bank app didn't even give me warnings or notices. Perfect! And the best thing is didn't need to turn compatibility mode on or anything too!

With all that said, I do miss some features and also have some suggestions:

Is it possible to port locally run adaptive features like adaptive charging and now playing? It looks like it runs on android system intelligence.. I tried to manually install that but off it requires privileged permissions
A self destruct feature triggered by a specific password at lock screen per user profile would be nice.. If in case we are forced to open some secondary profiles and we want to "show" them they were test profiles with "nothing in them" (keep initial setup otherwise would be too sus)
UI improvements to system update screen (which currently shows progress only as a notification), and not having app optimisation at restart like stock
Much needed UI and UX improvements to base apps, I still have to use gapps (without network ofc) like photos, camera and files to use some of the device features and security

DeletedUser28

someone1223 A self destruct feature triggered by a specific password at lock screen per user profile would be nice.. If in case we are forced to open some secondary profiles and we want to "show" them they were test profiles with "nothing in them" (keep initial setup otherwise would be too sus)

I think an easier option would be to have two PINs for two user profiles. If you enter your second user PIN you go straight to the second user while skipping the primary user profile. This way you can set up a decoy profile and nobody knows you even have the other profile. Lots of legitimate use cases, and also if law enforcement wants to see your phone. The latter might not be relevant for the US (5th + 1st amendment) but even in a pretend-liberal country like the UK you can go to jail for not giving your password.

other8026

someone1223 Is it possible to port locally run adaptive features like adaptive charging and now playing? It looks like it runs on android system intelligence.. I tried to manually install that but off it requires privileged permissions

Maybe, but it's probably not something that would happen. The only way it could happen is if GrapheneOS built many different versions of the same OS since this kind of privileged app would have to be included in the base image. For example, one with adaptive charging, one with android auto, one with both android auto and adaptive charging, one without anything. Maybe you can see how it could get out of hand.

someone1223 A self destruct feature triggered by a specific password at lock screen per user profile would be nice.. If in case we are forced to open some secondary profiles and we want to "show" them they were test profiles with "nothing in them" (keep initial setup otherwise would be too sus)

The project has said many times that they'd like to add this feature, but they want to do it correctly. I think they are busy with other things, like most recently preparing for Android 14. But they've been preparing for months now, so there's work on other features that they've put off. So, it's a thing they also want to implement, but it takes time to do so.

someone1223 UI improvements to system update screen (which currently shows progress only as a notification), and not having app optimisation at restart like stock

Since GrapheneOS is focused on privacy and security, UI things like this aren't a top priority. If a developer were to implement this kind of nicer UI and well, then maybe the project would be okay with including it.

someone1223 Much needed UI and UX improvements to base apps, I still have to use gapps (without network ofc) like photos, camera and files to use some of the device features and security

Maybe you're talking about the base AOSP apps? Many are abandoned by Android, so there's no use in the GrapheneOS developers maintaining them. It would be better if they made their own better, modern apps. I've seen members of the project say they would like to replace all of them.

But in the meantime, there are some community members who help out with some UI improvements, especially GrapheneOS apps.

drinksome34

DeletedUser28 this seems like a very good feature to implement imo

someone1223

DeletedUser28

Or maybe make a completely separate functionality to enter a decoy mode. At lock screen, don't even show the user profile switcher UI. Make it that you can only switch user in an unlocked state. If you enter the decoy password/PIN, then load a decoy profile that the user previously set up to fool whoever is checking on the phone. Make it so that no changes made are saved, not even by exploits. Require a restart to switch back to original profile for increased security. This way user profile function doesn't need to be touched

Monero_lover

DeletedUser28 It would be an awesome feature. I hope it will be included in the future

someone1223

other8026

Regarding adaptive charging, would it be feasible or even possible to develop our own adaptive mechanisms? It just has to be good enough for things like adaptive charging, or maybe even adaptive battery. If not, what about using the same sand boxing tech for google play so that needed users can optionally install the app, or maybe even as a separate optional module through system update?

BTW, nice to know the decoy feature is coming 👍

It's sad android abandoned AOSP apps for GApps, but maybe it's time to add some open source apps to the graphene app store to get going. Is the simple apps suite good? Also maybe you can add f-droid to the app store to get it easily. But having own base apps would be ofc, the best.

matchboxbananasynergy

Hello and welcome @someone1223!

Glad to hear you're enjoying GrapheneOS. Let make take a moment to address your requests:

Is it possible to port locally run adaptive features like adaptive charging and now playing? It looks like it runs on android system intelligence.. I tried to manually install that but off it requires privileged permissions

Possible, yes, but unlikely. Now Playing would require adding a privileged app into the system, which the project is not willing to do. Features like adaptive charging (I assume that is the feature where it stops charging at a certain %) will have to come from AOSP most likely. Implementing them and maintaining them downstream is a not-insignificant draw of resources that can be spent advancing highly requested security and privacy features. GrapheneOS rarely adds non-security and privacy features, and we expect those changes to come from upstream.

A self destruct feature triggered by a specific password at lock screen per user profile would be nice.. If in case we are forced to open some secondary profiles and we want to "show" them they were test profiles with "nothing in them"

"This" is coming. It's ready and will be shipped soon, probably after Android 14 further stabilizes and 8th gen Pixels are supported. I put "this" in quotes because it's not the exact feature we're getting. The duress password feature will allow you to set a PIN/Password that will wipe the device, along with things like any installed eSIMs when inputted in the lockscreen.

UI improvements to system update screen (which currently shows progress only as a notification), and not having app optimisation at restart like stock

Improvements to the updater are generally wanted, but we're very careful when making changes to the updater because it is critical that it is as bug-free as possible (the updater breaking can spell trouble and people can be stuck on an old update not realizing the updater's broken - it is imperative we ensure that doesn't happen. :)) The app optimization after an update is actually intentional. GrapheneOS does AOT (Ahead of time) compilation of apps which takes longer but is more secure. We want to change it so that it takes less time while not reducing security. Doing it the way stock does would be the easy way, but GrapheneOS will continue doing it the more secure way.

Much needed UI and UX improvements to base apps, I still have to use gapps (without network ofc) like photos, camera and files to use some of the device features and security

I think this has already been adequately covered. In the long term we want to replace the AOSP apps, alongside the existing setup wizard and backup app. It is a matter of resources to not only build those things but be able to maintain them going forward, so it might take a while, but it's definitely something that we want and that's planned.

someone1223

matchboxbananasynergy The duress password feature will allow you to set a PIN/Password that will wipe the device, along with things like any installed eSIMs when inputted in the lockscreen.

Don't make the wipe obvious if you can, as that itself might get some in trouble. I like how simpleX chat app implements it, it just opens like nothing with no on boarding or initial setup, but with all chats wiped. You can even preset a new name of your profile to make it seem nothing suspicious happened.

someone1223

matchboxbananasynergy In the long term we want to replace the AOSP apps, alongside the existing setup wizard

Maybe it's better to collaborate with some other open source organisation to make open basic apps while you guys can laser focus on OS security? Also even stock users can also download the apps if they wanted to - a win win

Malternative

someone1223 I would agree with this, if possible, police should not be aware that the device just got wiped.

matchboxbananasynergy

someone1223 The security by obscurity method of "hiding" information or the fact that the phone is being wiped will likely only work until people who are likely going to take your phone in that way find out about the GrapheneOS feature. The moment they determine your phone is running GrapheneOS, they'll also know about the "decoy" feature you propose. Now, they know the data isn't deleted, but hidden. What's more likely going to get you in trouble? At least with the approach proposed in my response, at that point there would be no data to get to.

matchboxbananasynergy

someone1223 Maybe it's better to collaborate with some other open source organisation to make open basic apps while you guys can laser focus on OS security? Also even stock users can also download the apps if they wanted to - a win win

There are some circumstances in which it might make sense, but in the vast majority of cases, it doesn't. 3rd party apps either don't share the same security goals, don't use compatible licensing and are otherwise unreliable. We've found through experience and if we want something done correctly, we usually have to end up doing it ourselves, unfortunately.

someone1223

matchboxbananasynergy Now, they know the data isn't deleted, but hidden.

But the data is deleted, right? It's only hiding the fact that there were data in the phone before by hiding the wiping... And trust me it will help get rid of a lot of trouble and give a lot of deniability, especially if they can't prove whether the self destruct feature has been triggered, or the phone didn't had anything to begin with.

Or just clear the titan keys or something and just break the OS, I can say oh the phone broke and if possible factory reset it from the recovery later.

someone1223

matchboxbananasynergy but apps by default is untrusted as user can install any app, right? So their goals shouldn't even matter? That's why even having play in sandbox is secure, right?