GrapheneOS

Last week, I wrote about installing GrapheneOS, an open-source, Android-based privacy operating system, on a Pixel 3. I shared some initial impressions, but now I’m back after using the GrapheneOS Pixel 3 as my daily driver for a week.

As I said in my initial impressions, GrapheneOS offers a low bar for entry from a technical perspective thanks to a straightforward install process (if you follow the guide on their website).

Using GrapheneOS once it’s installed, however, isn’t quite at the “it just works” level. I think that’s something important to keep in mind for anyone interested in trying out GrapheneOS. To be clear, GrapheneOS works, and works quite well (more on that below). But it’s often not a seamless experience like using an unmodified Pixel or an iPhone.

I don’t blame GrapheneOS for this — it’s entirely Google’s fault. Android, in its current form, is a hodgepodge of open-source software and proprietary Google-made software. Often, the Google software forms the backbone of the modern Android experience most people are familiar with.

GrapheneOS is an excellent way to reveal how much of the Android experience is reliant on Google because it takes Google out of the equation entirely. That’s what surprised me the most in my week using GrapheneOS — there are so many things, both big and small, obvious and not so obvious, where Android relies in part (or whole) on Google software.

Google, apps, and sandboxes

In my first impressions post, I mentioned running into an issue with my contacts not syncing. My solution was to manually export my contacts from another phone, upload them to Google Drive, then download that file on my Pixel 3 and import the contacts into the default Contacts app on GrapheneOS.

That small, but significant hurdle became something of a pattern for my week using GrapheneOS. Throughout the week, I kept stumbling across small issues. Many could be resolved by downloading an app or tweaking the way I used the phone. Others were more challenging.

There are no Google apps installed on GrapheneOS when you first boot it up. If you want Google apps, you need to install the Play Store, Play services and the Google Services Framework from an ‘Apps’ app that comes with GrapheneOS. It’s worth noting you don’t need to install these things if you don’t want to use the Play Store, and you can use other sources for apps (for example, F-Droid or Aurora, two open-source app stores). However, some apps need the Play Store and its requisite services to power things like notifications.

The beauty of GrapheneOS is it lets you run these apps with a compatibility layer that sandboxes them (i.e. isolates them from other parts of the system) and makes the Google apps run like normal Android apps with permissions and other restrictions. In other words, those who want to run Google apps can do so while maintaining some privacy (although you are still running Google apps). Plus, you can also use GrapheneOS’ built-in profiles to, for example, divide your apps between ‘Personal’ and ‘Work’ use, adding extra layers of separation between your data.

One of the more interesting consequences of this was I had to give the Play Store permission to install apps on my phone by toggling the option to let it ‘Install unknown apps.’ I also noted seemingly improved standby battery life on the Pixel 3 with GrapheneOS. There was one day where I took the phone off the charger at 100 percent at 8am and after a day of light use, it still had 80 percent left in the tank at 4pm. Using the phone still drains the battery quickly, but the standby time impressed me.

All of this worked without a hitch in my experience, and I had no problem installing and using apps from the Play Store.

Filling a G-shaped hole

With the Play Store set up, you can also download the various Google apps, although it isn’t entirely necessary unless you expect certain things from your Android experience. For example, there’s no voice assistant on GrapheneOS. Instead, I had to download the Google Assistant and Google apps from the Play Store and change a few settings (such as setting Google as the default assistant app) before I could use Assistant like I would on an unmodified phone.

Once I made it through the hurdles, Assistant worked as well as it would on any other Android phone. It’s worth noting that fans of the ‘Hey Google’ wake word can’t use it on GrapheneOS — the feature is flat-out disabled and I couldn’t see a way to enable it. But, if you care about privacy, disabling the wake word is for the best.

Other Google apps worked fine as well once I installed them. That includes Gmail, Google Photos, Drive, Keep, and Google’s Phone and Messages app (Messages did give me some issues until I enabled some permissions for it, then it worked fine). Google Pay also appeared to be present and functional, but since I don’t use Google Pay normally I didn’t test it. On that note, banking apps might be a pain point for some (I was able to install mine, but since GrapheneOS isn’t an official Android release, it may cause problems).

Still, some of the “smart” features I’ve grown used to were still missing. For example, Google’s Phone app didn’t have Call Screen, a feature I’ve come to rely on. The keyboard also threw me for a loop — GrapheneOS includes a default keyboard that looks just like Google’s Gboard, but with worse autocorrect and missing features like swipe typing and surprisingly no emoji.

Likewise, the default camera app is functional, but it felt less intelligent than Google’s Pixel camera app.

Private OS, not so private apps

Of course, if any of these things are deal-breakers, you can work around them by installing the Google versions from the Play Store. But I found myself wondering if my privacy was actually better off for using GrapheneOS if I still frequently used Google software.

Again, you don’t have to use any of these apps or features. Gmail and Keep were the only Google apps I downloaded out of need — the others I grabbed because I wanted to test if they worked.

However, there’s a difference between getting by and flourishing — and I was just getting by with GrapheneOS. I attribute that to my over-reliance on Google apps.

Ultimately, those considering giving GrapheneOS a try need a few things to really make it work. First is a willingness to trade convenience for privacy. Like I wrote in my initial impressions, GrapheneOS works great, but I often found it lacked features I’ve come to rely on, features that make using my smartphone easier and more convenient. These are almost always tied to one Google service or another. Those who don’t care about Google’s apps or who are happy with a more basic smartphone experience will find a lot to like in GrapheneOS.

Basic troubleshooting skills are also a must to make the most out of the mobile OS. It’s not a matter of if, but when you’ll run into a problem. It could be a small hiccup like not having emojis or something more drastic like an app not working because you’re missing some integral Google software it relies on.

I never had to get technical to solve these problems, but I did have to think outside the box. The issue with my contacts is a prime example — instead of relying on Google’s broken sync software, I manually transferred my contacts through Google Drive. It wasn’t difficult, but not everyone would think to try something like that.

Overall, I really liked GrapheneOS, but it was generally incompatible with how I use my phone (and with my job, which generally revolves around writing about the latest tech features). I think I could run GrapheneOS as my daily driver and be perfectly happy in a world where my smartphone wasn’t such an integral part of both my career and my life. I’ll be keeping an eye on GrapheneOS going forward, but my SIM is going back to the Pixel 6 for now.

Some of the more privacy-conscious people out there may be tired of the lack of actually private mobile phones available on the market. There’s the iPhone, which Apple champions as private but isn’t entirely, while Android relies on Google-made software to work well. Ever tried using a pure Android Open Source Project (AOSP) build without Google’s invasive apps?

Yea, it’s not great.

There are, however, options out there. That said, it comes down to a balance of convenience versus privacy. I’ve started trying GrapheneOS, an open-source, free, Android-based mobile operating system focusing on privacy. This will likely be the first of two stories I write about GrapheneOS, focusing on the initial set-up plus some first impressions.

One of the main things that drew me to using GrapheneOS was its built-in compatibility layer that allows users to run Google Play Services, Services Framework, and the Play Store. GrapheneOS has a more in-depth explanation here, but the short version is that unlike many other privacy-focused Android builds, GrapheneOS enables users to install and run apps through the Play Store while also avoiding some of the more invasive behaviours of Google’s software. The compatibility layer effectively coerces Google’s services to run like normal apps that require permissions, preventing them from accessing data in other apps without express user consent.

Installing GrapheneOS on a Pixel 3

You probably shouldn’t do this.

Not because there’s anything wrong with the GrapheneOS installation process — in fact, as long as you follow the step-by-step guide available on the GrapheneOS website, it’s actually effortless. No, the reason you shouldn’t install GrapheneOS on the Pixel 3 is that it’s on the GrapheneOS extended support list now (you can view a complete list of supported devices here). That means Pixel 3 devices will “no longer receive full security updates” and instead get extended support releases “as a stopgap” while users transition to newer devices.

Unfortunately, I didn’t realize this until after I finished the installation. However, I decided to stick with it since the current version of GrapheneOS is based on Android 12 and I wanted to get a feel for whether I liked it before I attempted installing it on another Pixel.

Plus, although I may have written my final farewell to the Google Pixel 3, I wasn’t entirely ready to let it go.

Anyway, the installation process was relatively simple. GrapheneOS put together an excellent guide, and if you use the web-based installation tool, you can effectively do the whole thing by only clicking a few buttons and tweaking a couple settings on your phone. As someone who spent a lot of time rooting Android phones and installing ROMs back in the day, this was a breeze. If you’re not familiar with that process, then installing GrapheneOS might be more challenging. I’d rank it as more difficult than installing an Android beta on a Pixel phone through Google’s Android Beta Program website but easier than manually installing an Android Developer Preview.

All told, the process took maybe 10 minutes total, and I did it while writing some other stories.

First impressions

Once the installation was finished, setting up GrapheneOS was similar to setting up any Android phone. You turn it on, connect to Wi-Fi, etc. One issue I encountered here was that I couldn’t copy data over from another phone (GrapheneOS does let you bring data over from another phone with GrapheneOS, but this was my first time trying it).

Following set-up, GrapheneOS greets users with a basic, Pixel-like Android experience, minus all the Google apps. GrapheneOS includes the staples, like apps for phone, messages, files and the camera. These defaults get the job done, but they feel (and look) like they’re from a past era of Android. Thankfully, with Play Store access, I was able to download whatever apps I wanted to use instead, although not without issue.

So far, I’ve had no issues downloading and using my password manager app, Twitter, Infinity for Reddit, Gmail, and Discord. I’m well aware that most of these apps aren’t privacy-friendly, but I do feel better using them on GrapheneOS, knowing that the omnipresent Google Play Services is sandboxed away. I had a few issues with Google’s Messages app until I enabled some permissions for the restricted Play Services.

I also ran into issues importing my contacts from the Google account (eventually, I worked around this by exporting them from another phone to my Drive storage then downloading that file to import them back into the contacts app on GrapheneOS).

Ultimately, I haven’t encountered any real deal-breakers so far with GrapheneOS. Most of my hiccups in the first few hours came from little conveniences I’ve grown used to. For example, having my contacts sync automatically or using my security key to authenticate myself when signing into accounts (this worked inconsistently and seems like something GrapheneOS is working to improve). I’ve been able to work around these little hiccups so far, but some people may not be able to.

Suffice it to say that GrapheneOS may not need much technical know-how to install, but so far, using it like I would a regular Android phone has required thinking outside the box. Anyone looking for a straightforward experience may want to avoid GrapheneOS or other privacy-oriented Android experiences since the privacy gains often come at the expense of convenience and ease of use. I wish that weren’t the case. However, GrapheneOS has so far been one of the easiest privacy experiences I’ve tried, so maybe it won’t be much longer until people don’t need to make that sacrifice.

I’ll have more thoughts on GrapheneOS soon after spending more time with it.