Things that make me angry about my current smartphone Samsung Galaxy S21Ultra on a Verizon plan is the mandatory software updates in which they install WITHOUT MY PERMISSION stupid apps like Netflix and addictive gambling games and stacking block games and Candy crush. God knows what else they install without my permission. I don’t want any of it!
Next phone I buy I want to start with a clean slate, I’m not going to affiliate with any conglomerate like Verizon or AT&T or Sprint or T-Mobile etc, I prefer to go rogue somehow,
which smartphone do you recommend that has no bloatware and it’s customizable?
The only recommendation I can provide is a Google Pixel device with GrapheneOS. Graphene is only designed to work on Pixels because they are (allegedly) the most secure mobile phone hardware-wise. Once you flash Graphene, it’s up to you to install any apps beyond the basic browser (Vanadium), gallery, camera, caller, SMS, PDF viewer, contacts, file manager, and security/system apps. No Google involved without your permission, though you will have to install Google services, available via a Graphene mirror and sandboxed for privacy, IF you want to install an eSIM after flashing Graphene. If you’re interested in further information, please let me know. I use it, love it, and am happy to provide any information you may need to decide if it’s a good fit for you or not.
Not OP but interested in both privacy and high-tech features. My current (stock) pixel 4a device has a worse camera than many other phones, but the software compensates a lot, netting better picture quality overall very often. I’m wondering how much of that is lost when using graphene instead of stock android, do you know?
Similarly with the latest gen pixels having AI features built in, I’m assuming much of that is software that’s not as easily installed somewhere else…
I’m not sure what the GrapheneOS stock camera app does under the hood, but if it’s not enough for you, you have the option of installing Google’s Pixel Camera app from the Play/Aurora store if you want to compare. I don’t imagine it would require Google Play Services to run on devices older than 8 since they don’t have the AI integration, but I could be wrong. You can easily deny the app network permissions to ensure that the app isn’t sending your photos to Google. As far as the AI features go on newer devices, I could see those requiring Google Services installed to work, but again, they’re available through a Graphene mirror, run sandboxed for privacy, and can be denied network permissions. I’m satisfied with how my pictures turn out (7 Pro), but I may try Pixel Camera out just to see what the difference is.
If you do that I’d be very interested to see the results! Especially things like night sight, my gf’s camera is as night blind as she is 😅
It’s been a couple years since I tried the graphene camera, but (at the time) it’s essentially trash in comparison to the Google camera. I just use the gCam without internet permissions and call it a day.
But I’m not hardcore tin-foil ‘the NSA will use your office mirrors reflection to precisely heat up a 2mm space on the side of your phone that somehow enables Bluetooth and with that the G + glowy bois will exfiltrate your data at 10Kb/s’. I want additional security hardening and some privacy additions, but I also use the play services and store, like a typical user. Yada yada threat model yada yada - I just want my phone to simply function at the end of the day. Middle of the road, if you will, between stock os users and the guy that’s now boarding up all his windows because of the 2mm Bluetooth mystery vulnerability.
Unknown about the claimed AI features - my 8 pro is in transit. But I can check in a few days, if interested.
What is the root scene on Graphene? I know the dev is pretty against it but I like having root access after being used to it. Is it possible to easily root it without any integrity issues later on?
It’s not supported. According to the devs rooting defeats the purpose of Graphene OS.
Yeah I have read that. And couldn’t find any reason why. When I ask about root people only say "if you want root, graphene isn’t for you"😅
Rooting defeats androids security model and allows for further exploitation. Graphene most likely does support it because any AOSP OS that is geared towards security isn’t going to leave a big hole in their security allowing malware or bad actors to modify system files (or install a rootkit).
Desktop Linux allows root access and is still secure. Allowing root access doesn’t make it insecure.
Desktop linux isn’t the same as Android, which is why I said the “Android security model”. Android is a mobile operating system and must protect against the fact that it will be in unknown environments all the time. It must protect against physical attacks, software attacks, and partially sandbox apps. Root breaks app sandboxing and allows for modifying system files and reading internal app storage. The system image is immutable and modifications/settings are made on top.
Linux desktop isn’t more secure out of the box. The general user account shouldnt be a sudoer. Immutable OSes are more secure and help pervent rootkits and other attacks. PCs are most often stationary and stored in a private location. Laptops are weak against attacks because you can boot to a different OS from usb without passworded BIOS. Desktop OSes are the geared for the same kinds of protections.
There is good reason why Android is far more secure than Linux mobile.
Oh okay thanks!
GrapheneOS significantly increases security, rooting does the exact opposite
It looks like the verified boot security feature of Graphene effectively prevents rooting the OS. I understand wanting root access, it does provide some nice features, but I don’t have any need for it. I don’t have any bloatware embedded to remove, and I don’t need to mod any system apps, so I haven’t looked into it much. I know the dev says it isn’t planned because it massively increases attack surface, which I personally agree with, but it would be nice to have the option via a separate version of the OS or something. If you need root access, I would suggest looking into LineageOS. It’s similar in privacy to Graphene and last I knew could be rooted. Graphene is very focused on security as well as privacy, and for me is a best of both worlds, but if you want to modify the system for various power-user type features, it might not be for you.
Yeah I’m currently running LineageOS. I wanted root mainly for adblock (modifying
/etc/hosts) and AppOps. Does Graphene have those features built in?Check out DivestOS. It’s a fork of lineage with a focus on better security and privacy. Not restrictive like Graphene. Rootable via magisk.
So far I’m liking it. Great battery life (lowest I’ve ever seen) even on my 5 year old phone.
I’ll try that thanks!
No, it doesn’t. I use 95% FOSS software, so anything that might have ads just gets denied network permission entirely. As for AppOps, I just looked it up, and that would be something I’d like to see developed as a feature of Graphene. It seems like a genuinely useful, and at the very least privacy-protecting, app. I don’t use copy/paste via keyboard, and despite it not having network permissions, I’d still deny it clipboard access simply because it doesn’t need it.
Okay. Thanks a lot! :)
For security reasons GrapheneOS doesn’t allow the modification of system files. You can achieve the same thing with DNS though. Either self-host a Pi-Hole or AdGuard Home, or use something like NextDNS.
You can root on GrapheneOS. You do it exactly the same way you’d do it for the stock Google ROM:
- Have an unlocked bootloader. Yes, this means that it “”“defeats the purpose of GrapheneOS”“”, if the purpose of GrapheneOS isn’t for you to avoid Google’s privacy nightmare. I use GrapheneOS for privacy moreso than security, and not being able to block ads properly is irritating.
- Install the Magisk app.
- Extract the
boot.imgfrom the GrapheneOS image and patch within Magisk. - Flash the patched boot image in the bootloader.
The main annoyance with this is that you’ll have to do that dance every month when a security patch gets released, but for me, it’s better than vomiting from exposure to ads on mobile.
What is the patching process when running with Majisk, without OTA? It looked like quite a PITA to me, but I’m using Graphene for the same reason you are.
Edit: I found this
After sideloading an update I’d probably have to do what Trevor posted.
Oh okay. Thanks! Does it pass the integrity checks?
Get a used pixel for $100. Factory reset on arrival, and install Graphene OS. Do not install gapps.
Ignoring the gapps part is… Tricky.
Why? By default gapps doesn’t come with ROMs. Its usually more work to install gapps.
Well yeah…but eventually you end up needing some banking app or some other crap that might need G-Services.
Nope. Never needed it. Just dont use that crap.
I wouldn’t put anything financial on a phone, anyway. Use a secure laptop for that.
Except, in my country, the banking website will NEED a token generated on the banking app. Internet banking assumes a smartphone with their app…or it’s completely blocked what you’re allowed to do.
Which country? All countries I know about like this allow hardware tokens as an alternative to a smartphone with a TPM
I wouldn’t recommend a Pixel older than the Pixel 6 as these will soon be EOL.
No reason not to install them on Graphene if people want a fully functional phone. You can’t compare gapps on other custom ROMs to Graphene’s implementation.
+1 for pixel. I just ordered a 7a for grapheneos.
everyone’s recommending Pixel. That’s good to know.
ok but we’re all here because we’re interested in privacy, so please tell me what does Google Pixel have anything to do with privacy??
“Google” & “Privacy” are contradictions.
GrapheneOS, a privacy/security focused operating system is compatible with a limited amount of devices. The pixel series is part of those compatible devices.
They use Graphene. That’s the point. Pixels are unfortunately the only supported devices. That’s why I won’t use Graphene as I would never support google. A pity, many do
I personally think this might be a “vote with your vallet” situation. Signaling to Google (and to other manufacturers) that people appreciate openness in their smartphones. Knowing Google though, it’s unlikely they will get it.
People or rather I didn’t buy pixel as its more privacy friendly but its the only one available here that let’s me install another ROM on day 1 without voiding warranty. And grapheneos being one of the best privacy focused ROM only available for pixel and that pretty much every ROM is available on pixel is another reason. I was basically forced into buying a google product as everyone else void warranty on unlocking boot loader or they don’t have much of a custom ROM scene.
r o m?
range of motion
Read only material
That’s all I’ve got
Read-Only Memory
thank you
Read Only Memory
I can’t tell if you’re being sarcastic or not but look it up yourself if you actually don’t know
Another vote for fairphone here, but for reasons others failed to mention: replaceable battery, so even after 2 years, it can feel like new and keep most of its value (to resell if wanted); 5 years of updates + warranty; support for after market roms. Then there’s also the fair ethics part of it
How are you killing your battery after two years?
Even my cheapshit Honor 9 lasted six before it started getting random shutoffs.
old phones have batteries that are meant to last
Not killing, but degrades in performance because batteries have a limited amount of charge cycles. The more intensive you use your phone, the faster the battery degrades
Google Pixel with GrapheneOS
Heads up, the bootloader cannot be unlocked if you buy a pixel through Verizon. You have to buy it straight from Google if you want to install anything custom.
Source: I have a pixel 6 pro from Verizon that I got originally thinking to try out grapheneOS.
And if your bootloader is unlocked, VZ is likely to lock you out of VoLTE/HD Voice/WiFi calling/etc.
I mean, you could go to T-Mobile who don’t currently play these specific games with devices, but then you’re trading coverage for features/freedom.
All carriers, wired and wireless, need to be regulated as DUMB PIPES. Title 2 for everyone. That’s what we’re paying for: Not “the Verizon experience” or “the pride and accomplishment of being an AT&T customer.” Let me buy a phone, and do with it whatever it is technologically capable of doing on your network. The network provider doesn’t need to provide any Android/iOS tech support if they keep it simple and stay out of the customer-fuckery business.
You dont have to buy straight from Google, just literally from anywhere else than Verizon.
For best privacy AND security, Pixel 8 or 8 Pro with GrapheneOS. Nothing else compares. The Pixel 8 series are also the first that support hardware memory tagging, basically making them immune against 70% of all exploits.
Removed by mod
I have a Xperia 1.
It has a flagship SoC, but it also has a SD card slot, a headphone jack, no notch or cutout, front firing stereo speakers and a nice blocky look without a massive camera bump.
The downside is software support can be a bit spotty and the cameras are made for manual use, as opposed to being AI-driven point-and-shoot things. That last one could be a positive depending on your preference, though.
But overall? I’m very satisfied, and I went there specifically because I was tired of the ongoing Apple-ification of Samsung in the first place. You may want to consider coming to the dark side and incentivizing Sony to keep making a phone with a feature set, instead of copy-pasting Apple’s or Samsung’s playbook.
Same boat here, I have the 5 II and I absolutely love it. Great size, the camera is OK on auto but can do wonders in manual mode (depending on your skill).
The lack of software support is a bummer though. I was surprised it’s not in LineageOS’ official support anymore…Do you use any custom ROM on your Xperia?
Nope. Honestly, I stopped tinkering with that stuff altogether ages ago. It’s a candybar that gives me text messages and takes photos, I don’t need to make it my own.
Maybe a fair phone? https://shop.fairphone.com/fairphone-5
Short summary:
- no bloatware
- 5y waranty
- easily Repairable
- Planned to receive 5 android major version upgrades
Addition:
- several unsolved (hardware) issues in the past
- security patches are far too late
- 8 years support
- Using the promoted /e/ results in loss of support (you habe to flash back FairphoneOS). Maybe this has changed as they are sellig phones with preinstalled /e/ by themselves
- Screws in the FP4 where very low in quality
- above-average batterie drain
I have the fp5 and flashed e/os myself. Im very happy with it. You need to flash it back when you want to sent it in (they have the instructions on there own page). Build Quality is nice. Repairs are simple. The price for spareparts is reasonable. And they really try to make a difference here and that is why i support them. Are they perfect? No? But who is? And you need to start from somewhere i think.
- no bloatware
Does it come without GApps? Most people don’t need half of those
It is google Android but they do not pay for the name so they call it ‘FairphoneOS’. It comes with all the standard GApps.
Now for the important question though:
Do they allow the user to uninstall those apps like any other app?
It is google Android but they do not pay for the name so they call it ‘FairphoneOS’.
That’s not how that works, they call it FairphoneOS because they added their own customizations. Default Android is pretty barebones nowadays so nobody uses that. You dont have to pay Google to use the Android name
They really need to sponsor graphene to get it officially supported on fairphone. Cant recommend fairphone when you are stuck with google tracking everything you do on stock android.
No bloat? Stay away from Samsung then.
Google Pixel with GrapheneOS.
I keep seeing this idea everywhere. Buy a Google phone and install another OS.
It is completely absurd to fund the exact adversaries you are running away from, while consuming, without contributing a dime, merely a piece of free software. (It is only a small piece of freedom because none of the hardware is free, and some binary blobs [incl. potential backdoors] will still be present in the alternative OS no matter which one it is.)
This is unsustainable, terrible, damaging advice. Stop giving it.
Well, the only viable alternative then seems to be some sort of Linux phone, then.
Fairphone, Librem, PinePhone, f(x)tec, etc. are available alternatives, yes.
Even a OnePlus is better than directly funding and supporting the adversary organisation that is one of the biggest surveillance capitalism corporations on earth.
Fair point, I suppose the only thing preventing me from going for Linux phone are banking apps which want to run on unrooted android. 🤷🏼♂️
deleted by creator
The bottom line is that GrapheneOS is the most security-focused mobile operating system available, and the Google Pixel is pretty well the only mainstream phone with an unlockable bootloader.
If Alphabet were to ever lock down the Pixel’s bootloader, the GOS devs would undoubtedly jump ship to a lesser available platform in order to continue the project. But until then, no other hardware comes close with respect to embedded security.
Buy a pixel off marketplace then. You can brag about saving e-waste.
Google isn’t a bad company, just a product of poor regulation. They have amazing engineers and produce valuable hardware and that should be praised.
Its the business side of things which needs massive regulation and an ethics check.
It is not about “bragging” or whatever. Nor is it about “bad” or “good”.
By funding or promoting the use of Google products, you would be funding litigation and influence such as lobbying to keep poor regulation as it is, if not worse. You would be funding their acquisitions of great tech and startups that might offer a more ethical and/or free technology. You would be funding their poaching of said engineers and valuable hardware intellectual property.
Simply put, it is a counterproductive and an unsustainable practice.
That being said, their amazing engineers, and technical value of their hardware are irrelevant to this community, post and comment. That simply doesn’t excuse their entire business model being built on breaches of privacy and other forms of curbing user freedoms.
Im going to do this and leave every social media except some federated instances.
Already went with Linux and FOSS years ago. Finally time to say good riddance to everything that doesnt align for what I stand for. I like it better anyway
Pixel with GrapheneOS. Only one that will give you the complete control, as well as the privacy (and) security done right. Also the only one that will let you have a fully functional phone, have things like working bank apps, and let you beat the Goog out of the benefits of the play services, while at the same time not allowing them to have privileged access on your phone. They’re just normal apps that you are in control of.
I’m not going to affiliate with any conglomerate like Verizon or AT&T or Sprint or T-Mobile etc, I prefer to go rogue somehow,
Yes, you will. Because that’s who has the mobile networks. There is no such thing as going rogue. Going with an MVNO isn’t avoiding them, that’s a mind game. If you can save money going with one cool, but don’t kid yourself that you’re not on one of the 3 carriers, because you will be.
I’m just trying to avoid getting bloatware installed on my phone every time they run a mandatory software update. that was probably a Samsung thing and had nothing to do with Verizon but whatever the case,
It’s time to upgrade.
I’mma get starlink.
As cool as the technology is, I wouldn’t trust Starlink to handle my breakfast order. It’s leadership is corrupt, arrogant, and evil. You can find all sorts of news stories about it online.
I have never heard of phone updates installing bloatware. The only time bloatware is present is when you first use the phone
Yup, I’m telling you, when I first got this phone, first thing I noticed was fucking candy crush et al, and immediately uninstalled all that junk. And every time it runs a software update, i kid you not, within a couple days I’m looking through my phone and I notice more shit they installed. Monopoly, Candy crush, block stacking games, I didn’t ask for any of this! delete delete delete.
A Google Pixel running GrapheneOS is your best option. Graphene doesn’t have any Google services by default, no bloatware at all, maximum privacy and security. It’s super easy to install, you can check out this video guide or just read their official documentation.
Another video about GrapheneOS that I totally recommend: https://youtube.com/watch?v=yTeAFoQnQPo
I recommend this after the install: https://youtube.com/watch?v=BymH90zFe30
Here is an alternative Piped link(s):
https://piped.video/watch?v=yTeAFoQnQPo
https://piped.video/watch?v=BymH90zFe30
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
How well does apps that require locked bootloaders, non-rooted device etc. work on grapheneOS? We have an official 2FA app in my country that’s used for digital identification for everything from banking to social security services. Right now it isn’t working on my oneplus 9p with lineage, despite using magisk and passing safetynet check, because it still detects that my phone is rooted.
GrapheneOS is built to work with a locked bootloader, in fact, relocking the bootloader is a step in the installation guide. It’s not rooted by default and the GOS team highly recommends against rooting, all apps should work as long as they only require SafetyNet basic integrity. If they require full integrity, they won’t work on GrapheneOS because the OS has to be manually whitelisted by Google in order to pass the full integrity check. Most apps (including banking or government apps) only mandate basic integrity though, full integrity is rarely required. It should definitely work better than LineageOS.
Hmm, my lineage OS phone passes basic integrity check, and my banking apps all work as intended, as do other government apps. But this damn 2FA app is still complaining and refuses to work, saying the phone is insecure.
Yeah, that’s because your phone is rooted. By default you can’t get root on GrapheneOS so it should work there.
Lots of good advice here, but many might be too extreme. I find such all-or-nothing approach intimidating for people who just started to think about improving their privacy situation.
Let’s see… you are angry about bloatware. It can come from two sources - mobile service carrier and phone manufacturer. How to get rid of it?
- Buy only “unlocked” phones. Then the carrier will not be able to push anything to your phone. You will also be free to change the carrier as you wish.
- Buy phones from manufacturers that don’t install too much bloatware. Google Pixel has only Google apps, Motorola also is almost vanilla Google. Fairphone is more exotic, but an interesting option. iPhone is OK too if you want Apple ecosystem, but customization is not a thing there.
Now, we are in a privacy focused community and I saw your later comments about Google being an opposite of privacy. I would argue that vanilla Pixel is much better than bloated and locked Samsung already. I see you get recommendations to replace the OS that your new phone might run, and these are valid, but come with significant downsides. There are other ways to improve your privacy stance by changing the way how you use your phone without changing what phone or what OS you run on it.
Warning about bringing an unlocked phone to Verizon (even if it’s a current flagship Apple/Samsung/Google device): 50/50 they’ll lock you out of WiFi calling/HD voice, etc. Because they’re dicks.
Removed by mod
Just a tip, you can debloat your galaxy without rooting it with adb tools. You can remove any apps you want this way fairly easily.
Not a long term solution, and all the other comments are great options for replacement. Until then, you can remove almost anything you want until you’re ready to switch.
The none root method that you mentioned is just removing the application from your profile. It’s still present in the OS.
I don’t think that’s true. From XDA forums, you can choose to disable the app or completely remove it. I have completely destroyed the system from uninstalling critical apps. I have had to do a complete factory reset due to uninstalling core apps. No root whatsoever.
I’ve read it a few times over the years. Maybe I keep reading people say the same misinformation. I suppose without root we’ll never know.
Your anecdotal evidence could just be that you’ve ruined your profile; although of course, you could be entirely correct.
I’ve only used it to remove annoying apps, e.g. Facebook. I’ve never gone crazy with it as I don’t care about the manufacturer’s pre-installed apps as they’ve remained silent for me.
