privacyguides.org/docs/android/grapheneos-vs-calyxos.en.md
d4rklynk 3ab5a28edf
Grammar, punctuation, fixes in Knowledge Base (#1473)
Signed-off-by: Daniel Gray <dng@disroot.org>
2022-06-27 04:00:16 +09:30

9.5 KiB

title icon
GrapheneOS vs CalyxOS material/cellphone-cog

Profiles

CalyxOS includes a device controller app so there is no need to install a third-party app like Shelter.

GrapheneOS extends the user profile feature, allowing you to end a current session. To do this, select End Session which will clear the encryption key from memory. There are plans to add a cross profile notifications system in the future. GrapheneOS plans to introduce nested profile support with better isolation in the future.

Sandboxed Google Play vs Privileged microG

When Google Play services are used on GrapheneOS, they run as a user app and are contained within a user or work profile. Sandboxed Google Play is confined using the highly restrictive, default untrusted_app domain provided by SELinux. Permissions for apps to use Google Play Services can be revoked at any time.

microG is a partially open-source re-implementation of Google Play Services.1 On CalyxOS, it runs in the highly privileged system_app SELinux domain like regular Google Play Services, and it uses signature spoofing to masquerade as Google Play Services. This is less secure than Sandboxed Google Play's approach, which does not need access to sensitive system APIs.

When using Sandboxed Play Services, you have the option to reroute location requests to the Play Services API back to the OS location API, which uses satellite based location services. With microG, you have the option to choose between different backend location providers, including shifting trust to another location backend, like Mozilla; using DejaVu, a location backend that locally collects and saves RF-based location data to an offline database which can be used when GPS is not available; or to simply not use a network location backend at all.

Network location providers like Play Services or Mozilla rely the on the MAC addresses of surrounding WiFi access points and Bluetooth devices being submitted for location approximation. Choosing a network location like Mozilla to use with microG provides little to no privacy benefit over Google because you are still submitting the same data and trusting them to not profile you.

Local RF location backends like DejaVu require that the phone has a working GPS first for the local RF data collected to be useful. This makes them less effective as location providers, as the job of a location provider is to assist location approximation when satellite based services are not working.

If your threat model requires protecting your location or the MAC addresses of nearby devices, rerouting location requests to the OS location API is probably the best option. The benefit brought by microG's custom location backend is minimal at best when compared to Sandboxed Play Services.

In terms of application compatibility, Sandboxed Google Play on GrapheneOS outperforms microG on CalyxOS due to its support for many services which microG has not yet implemented, like Google Play Games and In-app Billing API. Larger apps, especially games, require Play Delivery to be installed, which is currently not implemented in microG. Authentication using FIDO with online services on Android also relies on Play Services, and does not currently work with microG.

Privileged eSIM Activation Application

Currently, eSIM activation is tied to a privileged proprietary application by Google. The app has the READ_PRIVILEGED_PHONE_STATE permission, giving Google access to your hardware identifiers such as the IMEI.

On GrapheneOS, the app comes disabled and can be optionally enabled by the user after they have installed Sandboxed Play Services.

On CalyxOS, the app comes installed by default (regardless of whether you choose to have microG or not) and cannot be opted out. This is particularly problematic, as it means Google still has access to the user's hardware identifiers regardless of whether they even need the eSIM activation or not, and can access them persistently.

Privileged App Extensions

Android 12 comes with special support for seamless app updates with third-party app stores. The popular Free and Open-Source Software (FOSS) repository F-Droid doesn't implement this feature and requires a privileged extension to be included with the Android distribution in order to have unattended app installation.

GrapheneOS does not include F-Droid, because all updates have to be manually installed, which poses a security risk. However, you can use the Neo Store client for F-Droid which does support seamless (background) app updates in Android 12. GrapheneOS officially recommends Sandboxed Google Play instead. Many FOSS Android apps are also in Google Play but sometimes they are not (like NewPipe).

CalyxOS includes the privileged extension, which may lower device security. Seamless app updates should be possible with Aurora Store in Android 12.

Additional Hardening

GrapheneOS improves upon AOSP security with:

Please note that these are just a few examples and are not an extensive list of GrapheneOS's hardening. For a more complete list, please read GrapheneOS' official documentation.


  1. It should be noted that microG still uses proprietary Google binaries for some of its components such as DroidGuard. Push notifications, if enabled, still go through Google's servers just like with Play Services. Outside of default microG setups like on CalyxOS, it is possible to run microG in the unprivileged untrusted app SELinux domain and without the signature spoofing patch. However, microG's functionality and compatibility, which is already not nearly as broad as Sandboxed Play Services, will greatly diminish. ↩︎