I’ve got a pixel 7 pro with GrapheneOS. If you’re a normal phone user, it’s pretty much impossible to be degoogled unless you don’t want to use banking apps. Plenty of apps straight up don’t work unless you have the sandboxed Google play services running.
If in order to achieve security, users have to give up their privacy and freedom, I guess mobile operating systems are behind regular desktop or server oriented operating systems. I mean no matter how secure the operating system is, with bad opsec things can go wrong pretty quickly anyway.
@iliketrains@jackpot@TexMexBazooka@Blake@peter@seliaste@pewgar_seemsimandroid you don’t necessarily have to give up privacy and freedom for security because GrapheneOS does exist, but yeah, it’s an awful, sucky choice if you don’t have a Pixel phone, and the state of mobile operating systems is indeed atrocious from a freedom and privacy standpoint. But I don’t think it’s useful to deny the gigantic gaping easily exploitable security holes in LineageOS and CalyxOS just because we want to support privacy and freedom. People need to be able to make an informed choice about what’s more important to them. And yes with poor operational security you can end up accidentally getting compromised anyway, but with poor device security it’s literally *guaranteed* that nothing you do operational-security wise will protect you from a determined investigation or attack. It’s the difference between authorities having to rely on someone happening to make a mistake in how they use Tor or Signal versus being able to just pull their messages from their phone easily through a number of gaping security holes. Everyone will have different threat models and different things they care about, and I’m not saying nobody should use Lineage or Clayx — for the average person that isn’t doing leftist organizing their threat model is most likely going to be more about corporations hoovering up their data than it is going to be the police or the government, and so even an insecure operating system that is private will be better because insecurity gives the possibility of people getting your data but at least having privacy means that there isn’t a *guaranteed* actor that’s getting your data, so if you don’t have a Pixel they’re fine — but I don’t think we should pretend like lineage OS and calyx Os or even remotely as secure as other mobile operating systems, or that security doesn’t matter lmao
Your phone is almost definitely still using Google services as the backend, MicroG is smoke and mirrors - the front-end libraries are open source, but they still use closed source APIs and send your data to Google unless you have it set up extremely restrictively.
@Blake@peter with grapheneOS at least you can sandbox them like any other app and reroute e.g. location services requests through the OS’s extra secure implementation.
Except in reality nobody really does that. Everyone uses google play services / gapps because they pretty much have to.
Eh, it’s not that hard to get degoogled on android
I’ve got a pixel 7 pro with GrapheneOS. If you’re a normal phone user, it’s pretty much impossible to be degoogled unless you don’t want to use banking apps. Plenty of apps straight up don’t work unless you have the sandboxed Google play services running.
Not the majority, but many people do that.
MicroG is an open source implementation of the services. My phone is google free
@seliaste @Blake my issue with microG is that it’s very insecure
calyx os uses it
@pewgar_seemsimandroid yeah I know. Calyx is focused more on privacy than security though, and overall has a lot of security flaws for a mobile OS. https://madaidans-insecurities.github.io/android.html#unlocking-the-bootloader
it’s not for more security than normal android that’s graphene os
If in order to achieve security, users have to give up their privacy and freedom, I guess mobile operating systems are behind regular desktop or server oriented operating systems. I mean no matter how secure the operating system is, with bad opsec things can go wrong pretty quickly anyway.
@iliketrains @jackpot @TexMexBazooka @Blake @peter @seliaste @pewgar_seemsimandroid you don’t necessarily have to give up privacy and freedom for security because GrapheneOS does exist, but yeah, it’s an awful, sucky choice if you don’t have a Pixel phone, and the state of mobile operating systems is indeed atrocious from a freedom and privacy standpoint. But I don’t think it’s useful to deny the gigantic gaping easily exploitable security holes in LineageOS and CalyxOS just because we want to support privacy and freedom. People need to be able to make an informed choice about what’s more important to them. And yes with poor operational security you can end up accidentally getting compromised anyway, but with poor device security it’s literally *guaranteed* that nothing you do operational-security wise will protect you from a determined investigation or attack. It’s the difference between authorities having to rely on someone happening to make a mistake in how they use Tor or Signal versus being able to just pull their messages from their phone easily through a number of gaping security holes. Everyone will have different threat models and different things they care about, and I’m not saying nobody should use Lineage or Clayx — for the average person that isn’t doing leftist organizing their threat model is most likely going to be more about corporations hoovering up their data than it is going to be the police or the government, and so even an insecure operating system that is private will be better because insecurity gives the possibility of people getting your data but at least having privacy means that there isn’t a *guaranteed* actor that’s getting your data, so if you don’t have a Pixel they’re fine — but I don’t think we should pretend like lineage OS and calyx Os or even remotely as secure as other mobile operating systems, or that security doesn’t matter lmao
Your phone is almost definitely still using Google services as the backend, MicroG is smoke and mirrors - the front-end libraries are open source, but they still use closed source APIs and send your data to Google unless you have it set up extremely restrictively.
@Blake @peter with grapheneOS at least you can sandbox them like any other app and reroute e.g. location services requests through the OS’s extra secure implementation.
Wrong