Hacker News new | ask | show | jobs
by mmooss 16 days ago
Is GrapheneOS usable by everyone, including the most non-technical phone users, in a secure way?

They also recommend at least 12 GB RAM. What about domestic abuse survivors requires that?

2 comments

Yes it's usable by everyone. It's secure by default but anyone can make something insecure. For example granting malicious apps accessiblity permissions would not be great for security.

It has 99.99% android app compatibility. Over 90% of banking and government apps work. These apps take extra measures to ban grapheneos, apps must put in work to make their app incompatible, not the other way around.

I wouldn't say anyone can use it, if you can't sign in to a Google account by yourself then you would have trouble setting it up. But that would be similar on iOS. For the average person, definitely. There's no code or anything like that. Works just like stock Pixels.

If I was giving it to my grandma then I would install her apps and she would be fine clicking icons. But similar on iOS.

Yeah that RAM mention is very strange, not the best article.

See my response to the sister comment, if you don't mind.

> anyone can make something insecure

Many consumer products, including iPhones to a significant degree, are designed to prevent this, much to the frustration of hackers. 'What do you mean I can't sideload random apps?' Or other products: It takes a lot of effort to make your car insecure, or to make your stove leak gas. They are carefully designed for safety.

Yes, I find it much easier to set up and use than any other Android phone. There’s less bloatware, and battery life is noticeably better.

Two tips for beginners:

Google Play Store and Google Play Services can be installed from the App Store. They aren’t included by default because GrapheneOS works fine without them.

If a trusted app has trouble running, try enabling Exploit protection compatibility mode on the app’s Info screen (long-press the app icon → Info → Exploit protection).

Check whether your bank is supported: https://privsec.dev/posts/android/banking-applications-compa.... If it isn’t, it likely depends on the Play Integrity API, which means it requires customers to stay under constant surveillance by the world’s largest advertising company, with no real security justification (see https://grapheneos.org/articles/attestation-compatibility-gu...). In that case, you should switch to a more trustworthy bank.

People in IT vastly overestimate what others understand:

> Google Play Store and Google Play Services can be installed from the App Store.

Few will manage this on their own. What is Play Store? And what are Play Services? What does 'services' mean? Do I need both? Can I just use one or the other? When would I use them?

> They aren’t included by default because GrapheneOS works fine without them.

It doesn't, from what I understand. For normal users, 'works fine' means they can download and install any app.

> If a trusted app has trouble running, try enabling Exploit protection compatibility mode on the app’s Info screen (long-press the app icon → Info → Exploit protection).

lol - 'exploit'? 'mode'? 'app’s Info screen'? Even 'long-press' is not usuable by many, especially older people and others with less manual dexterity than 20-something software designers.

> you should switch to a more trustworthy bank

That isn't a serious solution. I love GrapheneOS, but it isn't ready for typical end-users.