[prmoustache]

What GrapheneOS is missing is a complete backup and restore solution so that people can preventively wipe their smartphone before crossing the border. It would be nice to have the possibility to backup/restore every app and their data from an ssh/sftp server the way google/apple users do with google cloud / icloud. I'd rather wipe my smartphone, only add a couple of direct contacts, a copy of my passport and the pdf of my plane tickets, take the plane and cross the border with a smartphone with very little but real personal data they already know and be able to provide my PIN/password to law enforcement if they ask for it, abiding with law if such a law exist (which is the case in my home country), than using a duress and risk prosecution.

Sure that doesn't protect your data from any other attack vector but it allows you to travel with less risk of getting detained by law enforcement of a country you are visiting. You get asked your password, you can give it, and they see a phone that is used like a dumbphone. If you get questioned for that a simple "my phone died yesterday, a friend just gave me his old pixel". If you need more stuff/information during your travel you would basically only need to remember the passphrase to access a password manager or a remote ssh server but you can restore only the stuff you need when travelling and and wipe again at any moment.

Having said that maybe it is better to set this up some way but not have it builtin so that law enforcement doesn't expect that any grapheneos user would have his data on an sftp server somewhere by default. Otherwise we are back to point 0 where they would ask to connect to it and restore to a phone they own. Oh and have a dummy google account you only used to purchase a couple of silly stuff on amazon, aliexpress and shein and random subscription of various "non risky subjects" on youtube. The gmail address would quickly be filled with enough spam to look genuine.

I am travelling abroad in 3 weeks for a month and I am seriously considering wiping up my grapheneOS phone before flying. I am wary that I could be targeted at a border just for having a google pixel with grapheneOS. Or maybe I should just leave my main phone at home and only travel with a new empty 150€ phone with only my main family emergency contacts. I don't remember ever being asked to show my smartphone at a border but you never know when it will happen. Thanksfully until you reboot it there is nothing that shows from the lockscreen that it is not running the regular google pixel android.

[grapheneos]

GrapheneOS includes an encrypted backup system covering far more data than Google cloud backups. It backs up data for apps opting out of cloud backups with allowBackup="false" since it operates in the device-to-device transfer mode. The backup system supports arbitrary sync services with a compatible API. Backups are per-profile so you can test it by restoring to a secondary user.

We plan to entirely overhaul the backup system but it already works fine. It could be a lot simpler and cleaner both in terms of implementation and user experience. We're in the process of overhauling the other apps first but we'll get to it.

[rkagerer]

One clarification:

> It backs up data for apps opting out of cloud backups with allowBackup="false"

This is untrue for older apps targeting API 30 (Android 11) and earlier. As I understand it, allowBackup is still respected for them, preventing their backup even in D2D mode. https://github.com/GrapheneOS/os-issue-tracker/issues/1112#i...

Those apps are slowly going extinct since the Play Store stopped accepting updates written against the older SDK in 2022, but I gather there are still a few floating around out there (including some niche favorites that have unfortunately abandoned development).

And one wish:

I'd love the ability to maintain a "hotspare" device that's identical to the original in every important way. So if your phone is chucked in the ocean, dropped down a cliff, etc. you can just grab the other one (checkpointed from a few hours or a day ago) and seamlessly keep on going.

I think this is impossible today because of the way the system protects secrets in the Android Keystore and how it's intertwined with the TEE / secure element / Titan M2 / etc. I wish there were a way to truly own my phone including the ability to perform perfect-fidelity backup and restore.

[grapheneos]

In general, it's a very bad sign if an app isn't targeting a recent API level. It's largely not because apps are abandoned but rather to abuse weaker privacy and security protections for older target API levels. We'll likely move the standard warning when launching an app for the first time to the install process and will make it more prominent with an actual explanation of the risks.

[hedora]

It's great to know this exists! It's one of a few reasons I switched back to iOS after trying grapheneos.

Back then, you were still using Google's backup thing, and it was the year when they intentionally broke it to encourage people to move to unencrypted cloud services for important data.

[prmoustache]

thanks for chiming in.

[microtonal]

A replacement for SeedVault is planned:

https://grapheneos.org/features#encrypted-backups

https://github.com/GrapheneOS/os-issue-tracker/issues/4687#i...

[Voklen]

> the project has been taken over by another group of people not sharing our goals or approach

> Seedvault which was originally written for use in GrapheneOS by a GrapheneOS user is a consequence of the 2018 takeover attempt on the project, which the people currently in defacto control of Seedvault were heavily involved in.

Seedvault is currently maintained by the CalyxOS team but I've never heard about this stuff. Does anybody know what happened?

[flexagoon]

There has been a lot of conflict between Calyx and GrapheneOS a while ago.

[subscribed]

Yeah, it's planned for years and years at this point.

Sure I know there are more urgent priorities but at the moment there is no backup for GOS phones. It only works for some people in some situations. For me it never reliably worked, ever.

[prmoustache]

Neat, I didn't realize it was still included. I thought it had been abandonned.

So basically one needs a webdav server somewhere or an usb flash drive.

[gruez]

The problem is that most apps opt out of backup, so it's effectively useless.

[prmoustache]

Yeah I don't even understand why this is even a thing. It should be user's choice, not app vendor/developer's choice.

[grapheneos]

Android 12 changed the meaning of allowBackup="false" to opting out of cloud backups. GrapheneOS encrypted backups use the device-to-device transfer mode which includes apps opted out of cloud backups. It's similar to the Google Play data transfer feature, not Google's backup system.

[grapheneos]

Android 12 changed the meaning of allowBackup="false" to opting out of cloud backups. GrapheneOS encrypted backups use the device-to-device transfer mode which includes apps opted out of cloud backups. It's similar to the Google Play data transfer feature, not Google's backup system.

[gruez]

That still doesn't prevent other means that developers have to thwart backups. Chrome and vanadium has a custom backup agent that only dumps out settings, so browsing history and bookmarks aren't backed up at all. I believe firefox is similar unless they changed something recently. Same goes for other apps like signal. Browsers, messengers, and camera are the top 3 categories of apps I use on my phone, and the built-in backup gets 1/3 of them (camera actually works because it's just regular internal storage). That's not very good coverage.

[grapheneos]

Vanadium will add more data to the device-to-device backups but we haven't gotten to it yet.

For Signal, you can set up their own backups locally and they'll be included with backed up home directory data if that's enabled. Signal encrypts their database and encrypts the key used for it with the hardware keystore. A generic backup system can't back that up directly. The encrypted database is useless outside of the current app install since the hardware keystore key can't be exported.

[flexagoon]

I use Seedvault to create a backup locally on my phone, and then sync it to my backup server with Syncthing

[preisschild]

It also supports the Android Storage Access Framework, so other forms of network "cloud" storage are also supported as long as the client ("cloud storage app") implements the correct api, so not only webdav

[Helmut10001]

I use local seedvault backup and then sync via round sync daily trigger to my Nextcloud WebDav Server (native seedvault was not able to use this, for some reason).

[SuperShibe]

It's been planned for years...

[microtonal]

TTS has also been planned for a while and they released it recently. Donating or helping out is going to do more than complaining on HN.

[grapheneos]

TTS is also in the process of being massively improved. What we've included is only an initial bare minimum implementation. We also plan to add speech-to-text but we may only support using existing models for it since it's harder and a model doesn't need to be bundled with the OS for accessibility.

[cromka]

I think more useful would be to be able to boot into another data partition with a different password, which, in turn, would hide the other "daily" partition. I believe LUKS is capable of that. The storage dump looks like a random set of data and only a valid password can find and decrypt a matching hidden partition.

Ideally this should also work on lock screen, e.g. if you type in a non-standard PIN, it would boot from the "dummy" partition in the background, with a slight delay perhaps.

This way you don't have backup anything (I mean you should, but for normal purposes) and have a plausible deniability whenever you get randomly inspected, not just at border crossings that you anticipate.

[gruez]

>I believe LUKS is capable of that

Booting into a 30 GB partition on a 128GB phone is going to be mega suspicious, even if the remaining data is random.

[dredmorbius]

A partition based on a sparse disk image might avoid that.

You'd have what appears to be a 128GB image (or some large fraction of that), which in reality is largely holes (typically: repeated blocks of ASCII 00 bytes).

Of course, you'd need to avoid actually trying to fill that filesystem.

[cromka]

There are ways around it AFAIK.

[gruez]

There really isn't. You can try avoid the "30GB volume on 128GB phone" problem by putting the hidden volume inside the free space of another volume, but since the outer volume doesn't know about the hidden, you have to be very careful not to overwrite the inner volume contents. The safest way would just be to not use the outer volume, but that's also suspicious. Who carriers around a phone that doesn't have any activity for months/years? Not to mention trim/discard means that free space will get wiped by default, and disabling it also makes you stick out like a sore thumb.

You're better off traveling with a wiped phone, and restoring from backup after you've crossed.

[dredmorbius]

Who carriers around a phone that doesn't have any activity for months/years?

An activity-generator might help address that.

[gruez]

Well the activity generator is going to have to be very careful to not accidentally overwrite data on the hidden volume, and somehow able to hide itself from adb or forensic tools that it's enabled.

[inigyou]

Right, it would have to be 64/64 for everyone.

[Cider9986]

Not possible to have a robust implementation with the current tech unfortunately.

https://veracrypt.io/en/Wear-Leveling.html

[cromka]

Interesting, did not know that! They do say some hardware, though, is phone's solid state storage definitely affected?

[Cider9986]

Based on what I read it seems it's the same whether an SSD or UFS (what Pixels use) because they both use Nand flash as the underlying storage technique which is where the metadata issues occur.

https://search.brave.com/ask?q=ssd+vs+pixel%27s+storage%3F&c...

[prmoustache]

Having different data partition forces you to hide stuff, which can be unlawful in some juridictions.

Not having the data in the first place in some specific contexts (like crossing borders) is easier.

[cromka]

Fair.

[grapheneos]

That isn't truly hidden and can be detected as a low level from the SSD.

[cromka]

No it can't. The the thing, it's obfuscated.

[hangrybear666]

I'm gonna trust the grapheneos HN account on this one.

[cromka]

An unmounted, hidden veracrypt volume is pretty much undetectable with the typical forensics, if the OS hasn't leaked anything that would expose it. I don't know what their official account was alluding to with that wildcard statement.

[Cider9986]

That's on HDDs, phones don't use HDDs. We already did this [1]?

[1] https://news.ycombinator.com/threads?id=Cider9986#49058421

https://veracrypt.io/en/Trim%20Operation.html

https://veracrypt.io/en/Wear-Leveling.html

[sfdlkj3jk342a]

A complete backup is solution that can be stored on my own encrypted servers and restored with a click of a button is really needed.

I always dread the possibility of my GrapheneOS phone being damaged or stolen and having to spend hours reinstalling and reconfiguring everything that Seedvault missed, as well as losing access to accounts that are locked by the secure element keys.

[drnick1]

> I am wary that I could be targeted at a border just for having a google pixel with grapheneOS.

Is that likely to happen at all in a civilized (Western) country?

[codethief]

Yes, see https://www.theguardian.com/us-news/2026/jul/23/cop-city-pro... . The OP is a response to this, as has been pointed out several times here in this discussion.

[ssl-3]

No. Not even close.

The headline of that article ("US government targets Cop City protester over phone operating system") rests firmly in the lies category of clickbait.

They were targeted for secondary inspection upon their return to the US because they were on a terrorist watchlist, not because they have a phone that runs GrapheneOS.

At least some of what investigators did during that inspection seems likely to be illegal (and the courts will decide if it was, or was not). Meanwhile, the grounds for being on a watchlist to begin with seem dubious at best, as is often the case with such lists.

But none of this was instigated by the presence of GrapheneOS on their phone.

GrapheneOS didn't enter the picture until the person who was already detained and being investigated (and being refused access to a lawyer) provided the phone's duress PIN to nuke the device (by erasing the crypto keys and rebooting) instead of the normal PIN.

[inigyou]

You're re-stating what the headline says.

[ssl-3]

> You're re-stating what the headline says.

I've done no such thing.

[tt24]

Not what the article says at all.

[DeluluDon]

Remind us what happened when you do cross.

[ryoshu]

"my phone died yesterday, a friend just gave me his old pixel" - please don't do this. That's lying to law enforcement and they can prosecute. Just say it's your travel phone.

[hahn-kev]

Honestly, I feel like I'd be more suspicious of someone who had little to nothing installed on their phone.

[prmoustache]

A lot of people are still using their smartphone pretty much as a dumbphone with a web browser.

[skitsofrandom]

Yeah but if you're a normal guy strolling through every time with a phone that has nothing- no pictures, no signed in email, no history of messages, 4 contacts. That's abnormal, no way of spinning it as "but I just don't use my phone much" will make that seem normal. The average person has their phone glued to their body 24/7 now. Implying that you don't is abnormal.

[hamper653]

"I only ever cross borders with a blank phone because I don’t want you invading my privacy" is a perfectly valid answer. You can also add that it is your employer’s policy and/or your government official recommendation.

[Terr_]

You can also point out that other countries want to search phones too.

"I have to do this because of country X, you know that they're like, amirite?"

[stef25]

> a perfectly valid answer

Makes no difference at all in the real world. You don't have to give valid answers, you need to get the guy across from you to not find you suspicious. That phrase is going to put a red flag on you, valid or not.

[hamper653]

> you need to get the guy across from you to not find you suspicious.

What? No, who cares about that? Let him find you suspicious, what matters is that he doesn’t access your data. And it is not suspicious to cross borders (esp. US borders) with burner phones. As others have said, it is standard practice.

[inigyou]

It's one that will get you denied entry, or detained indefinitely.

[microtonal]

I have worked for employers that required taking a burner phone to certain countries without any accounts logged in, etc. (so mostly for calls, maps, and web browsing) and nobody has ever been detained or denied entry. Some countries know that this is just standard procedure when they are visited for business trips. Probably different for the US though.

(Not legal advise of course, just observation. Always check with the legal department of your employer, etc.)

[hamper653]

Denied entry, why not. But detained?

[Dusseldorf]

"I got on pickpocketed on my last vacation, so now I travel with an old backup phone instead"

[skitsofrandom]

This may feel like a good idea as a “gotcha” justification but it just doesn’t matter. It’s still extremely abnormal and you will stick out. The only way to protect yourself is by blending in, not sticking out.

[rolph]

i am familiar with a number of the security team personnel, so i can give you the inside perspective.

the reaction you provoke at a border crossing, or an LEO encounter is almost entirely based on what profile you fit.

the vehicle, the state/contents of the vehicle, what you say, even how you move, are being evaluated for consistency with a profile.

[inigyou]

I think it would work. It's plausible enough. It doesn't have to be the most common answer to be accepted.

[stef25]

Like how many ?

[XorNot]

Sure but there'd be nothing there.

If the regime is going to just start taking people then nothing will stop that, but the goal is to stop the usefulness of this sort of thing as an intimidation measure - or at least drag it to the forefront and overthrow the regime.

[izacus]

The easiest way to avoid suspicion is to have a phone filled with cat and family pictures, dumb apps and games.

You don't avoid scrutiny by being wierd and hiding things, but by hiding in plain sight by being ultra boring.

[microtonal]

The easiest way to avoid suspicion is to have a phone filled with cat and family pictures, dumb apps and games.

Presumably they know quite a lot about you already outside your phone (yay, Palantir). I mean, the guy the recent post was about was an activist. An empty phone vs. a phone with just cat pictures and dumb games wouldn't really make a difference. They went on a fishing expedition, so anything that does not have contact information/messages of other activists or any information that they could use against the phone owner would be a win.

(F-you Palantir for reading this message and adding it to my online record.)

[inigyou]

> (F-you Palantir for reading this message and adding it to my online record.)

Hello Palantir. I orchestrated 9/11. Please come and arrest me.

[bloak]

On the other hand, if everything about you is boring, that in itself may begin to seem suspicious. "I borrowed this old phone from my stepson because my own phone got run over by a steamroller at a vintage vehicle show" is the sort of thing an actual spy or criminal would never say.

[stef25]

Add some dickpicks because who doesn't have something on their phone that they don't want others to see.

[inigyou]

Multiple decoy accounts, heh. First one: cat pics. Second one: dick pics. Third one: conversations with an imaginary mistress. Fourth one: porn that's illegal in Korea. Fifth one: ....

completely impractical obviously

[progbits]

Even more of a reason for good and easy backup and restore.

Before travel back up the real contents and restore a dummy travel backup with random games, stock photos etc. Then restore back to real contents.

[K3V1N_FLYNN]

This is never going to happen for the same reason Apple and Google won’t let you use different backup/restore methods.

[prmoustache]

I looked at snapseed a few hours ago and backup must be done per profile.

So you can totally have different profiles with different backup servers/credentials and decide to nuke one before flying or crossing a border.

Obviously you can't expect having 2 whatsapp or signal accounts on same number but you can always have several SIMs.

The good thing is with profiles you can totally seed a profile for a few weeks before travelling.