This was a very needed intermediate level GrapheneOS tutorial. IT's easy to install GrapheneOS and blindly trust all of the defaults and not take full advantage of the privacy and security features. I learned a few things and changed my phone settings in a couple of places to tighten security. The video seemed to show how to have the most private and secure phone-centric life with many apps installed and a lot of phone activity. I have a different approach. I have very few apps on my phone to reduce the threat surface. I don't do any banking or payment using my phone. I use the phone for calls, texts, Signal secure texting, and the occasional web browsing or video watching.
Thanks for your feedback! Very interesting! I work in the internet space and use lots of tools. So this is geared towards being able to use various apps in an as secure way as possible. Not using the apps in the first place is the better way to go, but not everybody can. Cheers for your feedback! The next video will be about making your own private VPN.
This was extremely comprehensive and VERY easy to follow. Your pace was a good balance between speed and clarity. I followed everything except I opted to download .apk files direct from source.
I am slowly getting up my courage to install GrapheneOS on my phone. This video is a great resource and has added to my confidence. I haven't actually watched the install video yet, but I will now.
I just got my new phone and installed Graphene on it and it's thanks to videos like yours that it's been smooth sailing up to now. Thank you very much!
Very much agree on your choices and like the way you present and explain, thanks! Yet, one thing I'd love to better understand is under which profile you install apps; do you tend to do this as owner and remove the ability to install apps in all other profiles? And have you come across a reliable and pricacy firendly profile switcher that you like?
You can switch profiles by simply pulling from the top twice: once to see the controls and again for the extended version of the controls. Bottom right is your profile Switcher. I have one profile for everything that absolutely need google, one for private surfing, one for kids and one for work. All with their own apps.
@@DigitalIndependent Thanks for pointing that out. I am aware of the regular method to switch profiles, not too complex but yet I thought there might be some kind of shortcut. For the second part, this was clear to me from your video. Yet I wondered if you you install them from within the individual profile OR if you remove the ability to install apps for the less priviledges profiles and use the Owner profile for installation and then make them available to the respective profiles. Maybe in the end this would be the same from a security perspective, I don't (but would love to) know.
Nice interesting video, I'm totally new to GrapheneOS and this has been a very good introduction. Do you know if Graphene lets you run alternative launchers? I quite like the Trebuchet launcher used in LineageOS.
Awesome video. New to graphene and this has opened my eyes to the possiblities. Can I still use music apps like Spotify and Apple Music and should I add them into its own profile? Thank you for the help - new guy 😂
What happens if I have a messenger app on a separate profile and receive a notification there? Will I be notified while I am logged in with another user profile? If yes, clicking on the notification will open the chat on the other profile where the messenger app is installed?
how do you logically separate between profiles? do you keep the Admin profile empty & use another profile like your "me" profile as your main use profile? Do you install neostore & aurora store in each profile separately? or conversely do u keep neostore & aurora only in your main or Admin profile , download required apps there & then copy the apps to other profiles? how does this work if the app needs Google play services but the downloading profile doesnt have google play services?
@DigitalIndependent I'd be also interested in what @acespade987 mentioned. And by they way, as @mistawinta asked below, any idea why Neostore hasn't been updated in a year? Is it still the way to go for apps? Thanks a lot in advance. Best regards
You are asking the right questions :) I install aurora and neo afterwards on the various profiles and add apps per user later on. This was just a shortcut to get the first set of local users up and running without having to duplicate steps. Should have mentioned that though :)) For apps requiring google play services: they are sandboxed and have reduced privileges in graphene. So I try to group apps into two additional users: one profile that really requires Google stuff (navigation mainly, but also meet and others) and one profile for specific apps that need Google play services (that’s a few banking and business apps). If you play games, then that would be a separate user, because I inherently don’t trust game developers security practices.
You are asking the right questions :) I still use neo store, it just pulls the f-droid stuff and presents it in a nicer way. Since I do updates and maintenance only once or twice a week I usually switch off the „install apps“ permission for these when I am not using them. Not sure, if you get a notification for my other comment, so here’s my answer: I install aurora and neo afterwards on the various profiles and add apps per user later on. This was just a shortcut to get the first set of local users up and running without having to duplicate steps. Should have mentioned that though :)) For apps requiring google play services: they are sandboxed and have reduced privileges in graphene. So I try to group apps into two additional users: one profile that really requires Google stuff (navigation mainly, but also meet and others) and one profile for specific apps that need Google play services (that’s a few banking and business apps). If you play games, then that would be a separate user, because I inherently don’t trust game developers security practices
You can have completely different apps on each profile. Some apps even create problems, if you install them later on a different profile. F-Droid is an example for that. Better use the alternative I described.
@@DigitalIndependent I followed your neostore advice but couldn't locate Aurora store within it, using the search function or filtering alphabetically. Has it been removed from the neostore?
SMS: no idea. Probably some app that allows you to export them. Have a look in the neostore. Contacts: those can be exported and imported. But I host my contacts in a nextcloud and sync them via CardDAV. That’s one of my planned videos
the elephant in the room is what to do for a navigation app on a privacy fork of Android, such as GrapheneOS (great video, BTW - a nice follow on would be a video highlighting various apps that are likely to be needed by most users - I have a fav note taker app, 2 factor authentication app, bar code scanner app, the whole subject of VPN, perhaps email clients - use Proton Mail myself, secure chat clients as alternatives to just using SMS, etc., etc., etc.)
@@JohnDoe-iv5ns I use Standard Notes, which recently got acquired by ProtonMail guys, which I also use. I use it on my personal Linux PC and laptop and my Windows work laptop and can, of course, keep notes synced across all devices.
Very interesting ideas! Personal VPN is coming up next. Casual navigation is doable, but for professional travellers it’s very lacking. App recommendations is great, I have started the script on that.
I don’t think there’s much difference because carriers are usually some kind of „critical infrastructure“ and thus fall under special legislation. That usually hits all of the carriers. So choosing wisely isn’t going to help that much. A much larger impact would be using a good VPN for surfing. That’s why my latest video was about securing a simple and cheap VPS (virtual private server). As soon as you have that, you can configure a VPN on it (that’s one of the next three videos coming up). Do stay tuned :)
Thanks so much for stretching what to do after the installation. So many helpful hints and tips. Any insights or thoughts on DNS services? I have heard to better use a secure protocol and connet with one which refuses censorship. Kind greetings from Düsseldorf.
Thanks! That is the topic of the next video: your own (self hosted) VPN for private surfing. Ich hoffe die Zahlen in deinem Profil sind nicht politisch gemeint.
Its so amazing how well graphene os works. Does anyone have a tip how I can improve GPS? It just takes many minutes until I find my location, because there is no WiFi location turned on. But even if I turn it on and set location services to Google, it does not get faster.
Maybe I missed it, but how do you split the app install across the profiles. Do you have anything installed on the "admin" profile? Do you install apps with the "me" profile primarilly? Where do you use the app services, only in the "googleshit" profile or in all of them? Thanks for the great tutorial.
I install the most common apps across all profiles in the admin/owner profile. Then I can transfer these app installs to all other profiles under „manage users“. Then I delete them from the owner profile. In every single profile I separately install apps. Googlesh*t is a profile where the few apps run that insist on Google play services. They are sandboxed there. Usually navigation and all E.V. related apps
Thank you for this video! I'm confused about the difference between installing and using google play store with a throwaway account and permissions locked down, versus installing the Aurora store and using that with a throwaway account. Why is the Aurora store the preferred approach?
Lots of little benefits, but I wouldn’t call them big: 1. purity: the play store app never even touches your phone 2. obscurity: who know what security issues might come up in the future. Not having the play store App might just mitigate in some imaginary scenarios. 3. showing Google that we want more freedom. The EU is forcing side loading soon anyway, but it’s still a statement. 4. supporting Aurora by using it. 5. my main reason: I don’t have to rely on GrapheneOS or me having locked down the Play Store App properly, because it’s not there :)
The neo store just does not work on mine, it just shows Battery Optimization and Permission to post notifications only and no way to get rid of them, any idea how to solve this?
Is there any analysis video of this operation system? It's nice that everyone repeats the same buzz words privacy and open source but i was wondering if anyone actually read the code and checked if there's nothing suspicious there. And also how can you make sure the web installer install the same open source code and not something else?
Half and half. Apps really don’t read each others files and data. Since the apps are one of the greatest potential vectors for snooping and siphoning data I’d say that’s a very good baseline. There are occasional holes in the separation, which are mostly upstream bugs in Android. The media player card currently bleeds out into other profiles‘ notification centres. But that’s mostly it. Do you have a link to the thread?
@@DigitalIndependent my comments are not being posted - weird. Here is someone from Graphene forum: Unlike Qubes where VMs provide the security boundary, in Android user profiles are separated via SELinux MLS (multi level security). Apps with a targetSDK of 28 (Android 9) or later also have their sandbox enforced by SELinux MLS. Any exploit that could cross the boundary between apps would likely be capable of crossing between user profiles
@@abexman yes. But SELinux exploits are rather rare. And that’s more like the persistent advanced threat actor that gets to use those. Separation is more against the abuse of permissions and being able to selectively delete a partner your digital life
Not much. Random MAC addresses in the setting for that specific WiFi and set your own dns, maybe Quad9 or another public dns server. But the traffic is going through that WiFi, not protected by a vpn. So that’s inherently un-private.
Yes. Your own VPN is coming up. Had to re-do the whole video because the maintainer of the easiest but also safe way noped out and nobody has taken the reigns. So the original video got useless.
What if you still need Google apps for work purposes? Does it defeat the purpose even if we run it on different user profiles? Is it still better to use graphene even with a work user profile with outlook, slack, whatsapp etc. or does it defeat the purpose and should I stay with iphone?
I isolate all Apps that need Google in a seperate profile and this doesn't run in the background. And I have started phasing out many apps that rely on Google. You'd be surprised about the quantity and quality of Apps on neostore/F-Droid
The first 16 mins is this intended for the primary/admin user account or done on all user accounts? If set on admin user will it carry over to secondary user accounts?
I usually install the apps on the admin user, then transfer them to the other users and delete them from the admin. This saves time, but only if you intend to have some apps in multiple local users. Otherwise just run through this on a per user basis
I guess I would make a good criminal because every time I register a fingerprint on any device it works for a few weeks and then doesn't work anymore. I have tried different fingers in case forefinger gets more callused or something. No joy.
Didn't work for me. Even re-flashed back to droid and tried again. Tried cables too. Giving up or trying to find someone who can help me near where i live.
Damn all I want is for google and Samsung to not collect mountains of data on me 😭 Still fire video, very informative + i now feel like Edward Snowden LMAO
I JUST LOST A YEAR OF IMPORTANT PHOTOS!!! BACKUP FIRST!!! I guess I only have myself to blame really; but I watched 5+ long videos about GrapheneOS and installation walkthroughs, and I guess I still somehow just missed the memo to make sure your phone is COMPLETELY BACKED UP (PHOTOS, files, anything that you would lose if you could push one “wipe phone” button on your phone). Do not do a single step of installing GrapheneOS, before making sure you haven’t forgotten to backup EVERYTHING. RIP Dad, RIP Lily, RIP Patches; a year of saving things through pictures and screenshots gone, a year of a lot of photos of myself that now, I just won’t have a year of my life to be able to reference or look back at; just a year that I’ll pretend I was blackout drunk literally every day, because I literally have no other way of verifying that that year even happened tbh. Poof. RIP me
@@DigitalIndependent It never worked for me as it doesn't find any devices. E.g. I was trying to Screen cast to my Samsung QLED TV. Works with every other Android Phone, just not with the Pixel running GrapheneOS 😥
Is there something like a false PIN login? Like if you type in a different pin code it logs you into another sandboxed account, can be good if you’re in a situation like journalists and less privacy respecting country, or criminals, or an exceedingly overbearing parent. All the data saved and stored in one account and one seemingly innocent false account no one bats an eye at.
Good question. The pixel has acceptable global sales numbers and it’s a vanilla version of Android, without additional vendor changes like in Samsung. It just seems to be the obvious choice…
Thanks for pointing that out! I would suggest isolating the private stuff in one user account that doesn’t unlock with a fingerprint. Maybe call it something harmless like „kids“ or „drug trade“.
I had to laugh when I saw your user profiles because I toss all my Google apps into a folder called Google shit also lol I have been using a zte blade I've moved back to an older device because I pretty much stipped everything off it you might say it's a smart phone that's been rendered dumb its for texting and calls only so far if I brick the zte I don't really care it's basically a shitbox but will be fun to play with a custom ROM
Too many things to consider when trying to secure phones, laptops, desktops, browsers, and so on. And you have to review security implementations on a regular basis because some apps can become rogue or there are better ways to secure everything or there is some new exploit. I think we're fooling ourselves into a false sense of security. That said, I have bought a Pixel 6 Pro and installed graphene on it. Too bad that a lot of phones can't be rooted so that an alternate OS can be put on it.
Can I install graphene OS en this device? Device Information App Version 7.1-rc1-release Version Code 96 Device Manufacturer realme Device Name RMX1931L1 Device Model RMX1931 Device Brand realme Android Version 11 CPU Arch aarch64 Storage Total 108.19GB Storage Free 90.24GB RAM Total 7.32GB Is Device Rooted false
