[theandrewbailey]

When I got a new phone last year, I purposely got a Pixel (open box 9a) to put GrapheneOS on it immediately. Been happy living the de-Googled Android life since.

I was sad that I had to go through the OOBE setup on the stock image to unlock the bootloader. At least it doesn't force an internet connection and login, unlike Windows.

[sowbug]

If it's any consolation, the wipe* requirement before unlocking the bootloader is generally a good thing, even if it's inconvenient. Someone who is targeting your personal data gets access to your encrypted phone, either by stealing it or in an evil maid situation. They unlock the bootloader and install privileged code that helps them recover the symmetric encryption key or intercept your PIN. Then they either have your data or wait for you to enter the PIN. In theory recovery shouldn't be possible (access to the key depends on a secure element that rate limits brute-force attacks), but security bugs do happen. Wiping* your data before removing the bootloader's signing requirement is an extra layer of protection.

*It doesn't actually wipe your data; it just destroys the symmetric key, making the data permanently unreadable.

[Markoff]

AFAIK you can't unlock bootloader without wiping the data, that's my experience from last 15 years unlocking bootloaders on various phones

so it's kinda pointless to wipe data prior wiping them again during the bootloader unlocking process

[sowbug]

We're saying the same thing. The bootloader unlocking process includes a step that destroys the FDE key.

[Sophira]

While the OOBE of the stock image doesn't force an Internet connection, the ability to unlock the bootloader does - whether you can do it or not depends on the phone manufacturer's desire, and Android for some reason uses an Internet connection to check that.

My understanding is that it is impossible to unlock the bootloader on a new recent (Android 7+ at least; possiblt earlier) Android phone until it has connected to the Internet. After that, the ability to unlock the bootloader is permanent.

[dlenski]

Yep, on older phones it was certainly possible without an Internet connection.

On the Nexus 5, you could just `fastboot oem unlock` right out of the box, install TWRP (custom "recovery") and install CyanogenMod/LienageOS, without ever booting the stock ROM.

On my Moto G4 Play and Moto X4, you had to get an unlock code from the Motorola website (based on the phone serial number I think) and waive some warranty terms, but once retrieved at least the phone didn't need to be online to unlock the bootloader.

The process on the newer Pixels is disappointingly intrusive, like basically everything Google has done for the last decade.

[Markoff]

If it is any consolation it became intrusive on pretty much every single brand nowadays, if they at least offer bootloader unlocking option.

[Sophira]

I misspoke when I said Android 7+, my apologies; I was thinking of my Pixel 7, which runs Android 13.

[Markoff]

it should be possible on Sony and OnePlus phones and maybe other brands, though it can require obtaining code from internet on other device, but the device being unlocked itself doesn't need to have internet connection

[a96]

I think LG had a system for getting unlock codes as well, but they closed it a long time ago.

Any other manufacturer may alter the deal any time. In case you have such a phone, dear reader, consider getting your code if you still can even if you won't use them yet.

[Sophira]

...I feel a bit silly. When I said "Android 7+", I was thinking of my Pixel 7, which runs Android 13, so "Android 13+" is what I actually meant to say. Oops.

[qurren]

Is it possible to install basic Google apps like Gmail, Calendar, Maps, Drive without googlifying the whole phone?

I'm not looking to fully de-Google but I want Google as apps and not my OS.

[handedness]

I run a litany of Google (and other corporate/business apps) apps in Private Space under the owner's profile, which is only unlocked when I need it for something. That space's connection can go out over a WireGuard tunnel if I need those apps to be on any specific networks, while the rest of the phone's traffic is unaffected. The file systems stay functionally separate (although that's not a major concern given how file encryption is handled, plus the dream that is Storage Scopes), and that space has its own camera app and such.

The Owner profile itself doesn't run Google Play Services, so when that Private Space is locked and dormant it's effectively a degoogled stack.

Some will invariably argue that an old pocket-sized Linux PC with a cellular modem is a superior experience, and for some specific things it may well be, but GrapheneOS is the only viable option for someone looking for a user-respecting modern phone with very few limitations.

[hiitsmyaccount]

Yes, you install the Google Play store via the GrapheneOS App Store. The OS comes with like 5 apps out of the box. The rest is up to you.

Biggest caveats that I've encountered: tap to pay via Google Wallet is a no go, Android Auto can be flaky, MDM managed work profiles don't work at the moment, and some apps that use the Google Play integrity API fail to validate and refuse to work (I've only encountered one app that fails, and plenty others that work.)

In general, I'm moving towards a de-Googled life and GrapheneOS is a great entrypoint towards that.

[strcat]

Android Auto is fully supported and shouldn't be any more flaky than it is on the stock OS. It's often flaky due to a bad USB connection or problematic implementation in the car. That's just how it is everywhere.

Google Wallet bans using anything other than an unmodified Google Mobile Services stock OS but there are alternatives in certain regions. In Europe, there are a lot of banking apps with tap-to-pay compatible with GrapheneOS and also Curve Pay. PayPal also has a limited tap-to-pay launch in Germany.

[handedness]

My end-run around Google's absurd unwillingness to certify GOS for Google Pay has been Garmin Pay, which has worked virtually everywhere I've ever tried it.

I'm hopeful that an OEM Motorola device will get certified for Google Pay.

[microtonal]

Depends as bit on the country and bank. I also use Garmin Pay, but my bank only supports adding their credit card (not debit card) and a substantial portion of shops here only supports contactless payment through debit cards (credit cards have historically not been popular here).

So I get to use contactless payment at maybe 50% of the stores, which is annoying, because it's sometimes hard tot tell ahead of time.

[qurren]

> MDM managed work profiles

Do you mean actual employer-spyware MDM work profiles? I suppose I never expected those to work.

Or do you mean things like Shelter, which uses work profiles and which I use to quarantine certain less-trusted apps?

[hiitsmyaccount]

Yes, I mean MDM work profiles. I play an IT guy at work and am a Google Workspace admin. We have it running in BYOD mode and it's actually not intrusive at all. The most sensitive data you can see as an admin is what apps are installed in the work profile, the phone's make + model, and the version of Android. Nothing like location, charge level, or anything outside of the work profile. I'm fine with running it on my personal device (I actually really like the way it functions), but it's borked on current versions of GOS.

[nekusar]

How to say "I work for a company too cheapass to provide work devices".

Its all fun and games until the company gets hit with a lawsuit and discovery hits your phone and ALL your accounts, corporate and personal.

[Uvix]

Some people don’t want to carry two devices and prefer BYOD, even if the company offers a work phone.

[y2244]

Tap to pay is mostly NFC? So is there an alternative app?

[cyberax]

I extracted a chip (by dissolving the plastic in acetone) from my card and glued it to the wriststrap of my Pebble watch :)

[distances]

When using contactless payment with my card, about 10% of the time the payment terminal tells me to insert the card to the reader slot instead and enter my PIN. I assumed this is a general security feature, but I guess it depends on the issuing bank then. This in Europe.

[cyberax]

Well, I still have a backup physical card. It just is annoying to get it out of my wallet.

[pezgrande]

Nice hack but sounds quite unsafe, I like having to unblock de phone in order to use it.

[subscribed]

Garmin Pay, Samsung pay if you have a compatible bank and card, PayPal in Germany and sometimes banks' own systems.

I had a very weird (bad) experience with Curve support so I couldn't recommend it.

NFC payments work, it's only Google who claims a phone not patched for 8 years is safe and secure, but phone with working hardware attestation and patched 6 months ahead of everyone else is insecure.

[jordand]

Curve Pay has worked well for me. Only good alternative as it doesn't depend on Google Play Services too

[wolvoleo]

Yes you can use Curve pay.

Edit: Apparently that's Europe only? I'm in Europe so yeah. I didn't know that.

[dgrabla]

Paypay works as well (at least in Germany)

[vrganj]

There's Curve Pay in Europe. In the US, I'm not sure.

[hxorr]

I believe one of Graphene OS's main features is that they allow you to run google play services in a sandboxed environment, so you can run your standard google apps but without the standard android deal where google play services has unfetteted access to all your phone's location/data/etc info

[drnick1]

> I'm not looking to fully de-Google but I want Google as apps and not my OS.

This is entirely possible as other posters have explained. But I think it kind of defeats the point of Graphene, at least somewhat. Google is already profiling every aspect of your life by reading your emails, files, calendar, location, etc? In that case, OS access becomes moot.

I think that GrapheneOS makes most sense as part of a broader move towards privacy-respecting alternatives. I see the sandboxed Play Services as something useful perhaps in a secondary user profile, for the odd commercial app required and only available from the Play Store.

[qurren]

> In that case, OS access becomes moot.

Not really.

1. A non-Google OS can shut off background running access to Google apps, as well as supply Google apps with mock location data and other data

2. Google does other things to the OS that drive me nuts. Like allowing apps to restrict screenshots. I own the phone. If I want a screenshot, it should screenshot. This is not something for apps or Google to determine, and if the OS listens to me (not the app) it should allow screenshotting the display 100% of the time regardless of what the app cries about.

[Scrounger]

> Like allowing apps to restrict screenshots. I own the phone. If I want a screenshot, it should screenshot. This is not something for apps or Google to determine, and if the OS listens to me (not the app) it should allow screenshotting the display 100% of the time regardless of what the app cries about.

PREACH!

I hate this.

[fooqux]

I agree and have moved mostly away from everything Google. But it's hard to replace maps. I know open street maps exists but it's hard to beat Google's data gathering.

[wolvoleo]

I think OSM is way way better. It has every little path in the hills I walk. On Google Maps I'm just walking in a featureless green blob. OSM even has unofficial trails that are no more than a worn-down line in the brush.

Maybe for cars Google is better but I don't use those. But even there I see really detailed stats.

OSMAnd is a really great full featured mapping app. A real tool that you can configure in detail. And Organic maps is more simple and quick like Google maps.

There's just two things I still need Google for: most businesses don't bother keeping their opening hours etc updated on other mapping services, and in my city they have live data on the public transport network. This should really be mandated to be offered to open street map too.

[flaburgan]

Don't forget to update the business hours in OSM when you see they are missing / wrong

[wolvoleo]

Yes but I mean special holiday opening hours etc. Most places do keep these up to date in google.

[eblanshey]

I use Google Maps on Graphene. It works perfectly. You still get the benefits of the rest of the phone being degoogled. Just allow it to access your location only when you're actively using the app. When it's closed, it's closed.

[donalhunt]

There are players in the OpenStreetMap ecosystem attempting to change that. I know the team behind Organic Maps are actively working to make their app as viable as possible by sourcing appropriate data for example.

[DarkUranium]

Organic Maps is amazing.

I actually find that it blows Google Maps out of the water for cycling (which is why/how I discovered it). I haven't really used it for driving much because my own car has a builtin nav, so can't really comment on that.

YMMV of course.

[flaburgan]

Organic Maps has been forked to CoMaps as a community managed project btw

[theandrewbailey]

I've been using HERE WeGo for almost a year. I had to install a text to speech engine in order to get voice directions. (I installed the GlaDOS one, now the evil computer tells me where to go.)

https://www.here.com/products/wego

https://here-wego.en.aptoide.com/app

https://k2-fsa.github.io/sherpa/onnx/tts/all/index.html

[handedness]

I've settled on running CoMaps in the Owner profile, with Google Maps/Waze/etc. in the Owner profile's Private Space for when they're necessary.

[fooqux]

Can that setup work with android auto? If so, I'll need to try that.

[NoGravitas]

I use CoMaps in the owner profile with Android Auto. Only caveat is that even with Android Auto developer mode enabled, I still had to install CoMaps from Play Store to get it to show up in Android Auto.

[thefz]

Different scopes and purposes. Google Maps is made to find commercial activities and addresses, OSM is there to map the territory around.

[fph]

I recommend Magic Earth. Free with traffic and navigation, and strong privacy promises (unlike Here Maps).

[Scrounger]

> I recommend Magic Earth.

LOL Bruh... this has a 1.7 rating on Android based on 42k reviews

https://play.google.com/store/apps/details?id=com.generalmag...

[NoGravitas]

It used to be really good, and then it went to a subscription model, with a lot of back-and-forth uncertainty about the change. I suspect the rating reflects that.

[strcat]

Using Sandboxed Google Play doesn't defeat the purpose of using GrapheneOS and neither does using Google apps. It does not exist specifically to avoid Google apps or services. It exists to provide a highly private and secure OS retaining high usability and app compatibility. Being able to use sandboxed Google Play is an important part of what it provides. Many GrapheneOS users don't use it and many who do use it are only using it in a dedicated profile for a small subset of apps but that's not at all required to heavily benefit from GrapheneOS. Moving to more private apps/services over time does make sense but it isn't mandatory and users can choose what kind of compromises they wan to make.

[jzer0cool]

What are some good alternatives

[drnick1]

The best alternatives are self-hosted, e.g. your own email, CalDAV, CardDAV, and file servers, with e.g. K9 as email client.

[strcat]

Yes, those are all compatible and the only way to use them is as regular sandboxed apps without any special access. Sandboxed Google Play can be installed in the profiles of your choice. Installing it in the main Owner user is a valid choice and doesn't at all ruin what GrapheneOS provides but you can make a dedicated work profile or Private Space for it to keep it separate. Only apps in the same profile can see it and use it, so you can control which apps will use their functionality depending on it that way.

[notRobot]

Yes, you can have sandboxed Google apps: https://grapheneos.org/usage#sandboxed-google-play

[upboundspiral]

Yes absolutely.

You can install nonprivileged google stuff on the main account.

Alternatively you can setup a private space (accessible to the main user but mostly separate from the main system) with a few clicks in the settings.

If you prefer more friction / isolation you can setup a separate user where you can install the google stuff.