Hey guys, I have a Google Pixel 8a Smartphone. It is a Degoogled Pixel 8a, currently with Calyxos. Is this the best custom ROM for privacy + security?
I also need to try to make it an Hardened phone. Not a Spy phone…not a Surveillance phone. Basically trying to make it an safe phone, anonymity phone.
What VPN could I use for this phone, and is there any other guides or settings guides you can recommend me.for my phone?
The sim card is a kyc one but im stuck with it.
Thank you.
Hands down the most advanced and secure smartphone os is grapheneOS.
It only runs on pixel devices. App sandboxing, buffer overflow protection, separate users, optional sandboxed google play if you need it for banking apps, automatic reboot after a set time to re encrypt your filesystem, assigning permissions for app access to folders and the list goes on and on.
I prefer Calyxos. over Grapheneos, hence, I’m seeking the most appropriate way to make my Pixel 8a Calyxos phone an Anonymity, a Safe phone.
I want the advice, and want to know what my options are if I stick with calyxos.
Also, recommend settings/configuration guides.
You did ask if it’s the best custom ROM. And the other poster did answer that question pretty well.
If you’re serious about Android privacy, check out ReThink! It blocks everything by default and lets you control exactly which apps or IPs can connect. https://github.com/celzero/rethink-app
What settings are best to implement using rethinkdns is there a good setting / way to configure it. One you can recommend?
Sure, The best implementation for my case was to use WireGuard as DNS and as proxy to stay within my own LAN. Then I enabled the firewall to block everything except LAN network connections. This can be done by going to settings, universal, and enabling everything, then creating an IP rule for 192.168.1.0/24 (and/or network settings ‘do not route private IPs’). You’ll see the logs/stats flood with connection requests. Create whitelists of your apps/stuff you trust from the log and allow only those. I’m certain this is a blunt way to do what I wish to have done, but I simply do not want anything to update or connect to anything besides my own self-hosted services and a couple of developers I trust.
If you are looking for a hardened phone, I would consider trying GrapheneOS for a bit, see if it does what you are looking for. Uses SELinux and a seccomp-bpf policy for app sandboxing, as well as runs a hardened kernel with a hardened memory alloc. Great isolation approach, too, so that you can run apps on a ‘completely different phone,’ so to speak – think of the isolation like a small version of the OS that can keep apps entirely separate. Finally, if desired (and needed for certain apps), you can sandbox all Google services so that they don’t have direct access. It’s is a different approach to, say, microG.
GrapheneOS is all about hardening. Security is solid.
VPN wise, Mullvad wireguard servers are also solid. You can do multihops, which help you obsfucate traffic to degree. They have also been playing around with packet shaping (if you use their app directly).
Sim cards can be swapped out if use a VoIP service like jmp.chat.
What is the best thing to do with Calyxos smart phone for privacy, and anonymity. ? Like how to achieve this simply, and also, what VPN should I use if I stay with Calyxos in my Pixel 8A?
As a calyxOS user, if your key concerns are security and device hardening, I’d recommend you just make a seedvault backup and switch to graphene.
The two projects have somewhat different scopes and I don’t think you’ll achieve the same degree of sw security on calyx.
I prefer Calyxos. over Grapheneos, hence, I’m seeking the most appropriate way to make my Pixel 8a Calyxos phone an Anonymity, a Safe phone.
I want the advice, and want to know what my options are if I stick with calyxos.
Also, recommend settings/configuration guides.
I feel that, I just wanted to set your expectations. I prefer and will continue to use CalyxOS but I have no expectation that they will deliver the same level of protections/mitigations at the OS side as Graphene given their project scope is different.
CalyxOS aims for a private, yet simple (attainable) Android experience, and I align more closely with their ideology on having a FOSS replacement for Google Play Services in MicroG.
I suppose one thing you could levarage is work profiles on Calyx to “jail” apps you do not trust, though I’m not sure that meaningfully builds upon Android 15s own application sandboxing.
Perhaps as a long term goal you could look into making a custom fork of CalyxOS for your device and incorporating parts of Graphene’s hardening but this will be a lot of work.
There’s no shortcut you can use to achieve things simply, especially if you want actual anonymity (an extremely high bar). Installing GrapheneOS is the bare minimum (Calyx doesn’t even come close). Then you need to avoid services that ask for personally identifiable info, use VPN for everything (and use public wifi for initial setup), avoid a KYC SIM or SIM in general (also use airplane mode / wifi whenever you can).
But really I’m guessing you don’t actually need proper anonymity (privacy in general is more reasonable).
if you’re using CalyxOS it is not hardened.
Yep, even LineageOS + MicroG is more secure (providing you have custom keys + avb), but it definitely is more private than stock.
What are you trying to accomplish?
You capitalized spy, surveillance and hardened but I’m not aware of any specifics those words bring to the table when applied to phones.
