43 KiB
| title | icon |
|---|---|
| Android | fontawesome/brands/android |
Android is a secure operating system that has strong app sandboxing, Verified Boot, and a robust permission control system.
The main privacy concern with most Android devices is that they usually include Google Play Services. This component is proprietary, closed source, has a privileged role on your phone, and may collect private user information. It is neither a part of the Android Open Source Project (AOSP) nor is it included with the below derivatives.
AOSP Derivatives
GrapheneOS
!!! recommendation
{ align=right }
{ align=right }
**GrapheneOS** is the best choice when it comes to privacy and security.
GrapheneOS provides additional [security hardening](https://en.wikipedia.org/wiki/Hardening_(computing)) and privacy improvements. It has a [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), network and sensor permissions, and various other [security features](https://grapheneos.org/features). GrapheneOS also comes with full firmware updates and signed builds, so [verified boot](https://source.android.com/security/verifiedboot) is fully supported.
[Visit grapheneos.org](https://grapheneos.org/){ .md-button .md-button--primary } [Privacy Policy](https://grapheneos.org/faq#privacy-policy){ .md-button }
Notably, GrapheneOS supports Sandboxed Google Play. Google Play Services can be run fully sandboxed like a regular user app and contained in a work profile or user profile of your choice. This means that you can run apps dependant on Play Services, such as those that require push notifications using Google's Firebase Cloud Messaging service. GrapheneOS allows you to take advantage of most Google Play Services whilst having full user control over their permissions and access.
Currently, only Pixel phones meet its hardware security requirement and are supported.
!!! attention
GrapheneOS's "extended support" devices do not have full security patches (firmware updates) due to the original equipment manufacturer (OEM) discontinuing support. These devices cannot be considered completely secure.
CalyxOS
!!! recommendation
{ align=right }
**CalyxOS** is a decent alternative to GrapheneOS.
It has some privacy features on top of AOSP, including [Datura firewall](https://calyxos.org/docs/tech/datura-details), [Signal](https://signal.org) integration in the dialer app, and a built in panic button. CalyxOS also comes with firmware updates and signed builds, so [verified boot](https://source.android.com/security/verifiedboot) is fully supported.
[Visit calyxos.org](https://calyxos.org/){ .md-button .md-button--primary } [Privacy Policy](https://calyxinstitute.org/legal/privacy-policy){ .md-button }
To accomodate users who need Google Play Services, CalyxOS optionally includes MicroG. With MicroG, CalyxOS also bundles in the Mozilla and DejaVu location services.
Currently, CalyxOS only supports Pixel phones.
!!! attention
CalyxOS's "extended support" does not have full security patches due to the original equipment manufacturer (OEM) discontinuing support; therefore, they cannot be considered completely secure.
DivestOS
!!! recommendation
{ align=right }
**DivestOS** is a [soft-fork](https://en.wikipedia.org/wiki/Fork_(software_development)#Forking_of_free_and_open-source_software) of [LineageOS](https://lineageos.org/).
DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](https://source.android.com/security/verifiedboot) on some non-Pixel devices.
[Visit divestos.org](https://divestos.org){ .md-button .md-button--primary } [Privacy Policy](https://divestos.org/index.php?page=privacy_policy){ .md-button }
DivestOS has automated kernel vulnerability (CVE) patching, fewer proprietary blobs, a custom hosts file, and F-Droid as the app store. It includes UnifiedNlp for network location. Its hardened WebView, Mulch, enables CFI for all architectures and includes network state partitioning.
DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via defconfig hardening. All kernels newer than version 3.4 include full page sanitization and all ~22 Clang-compiled kernels have -ftrivial-auto-var-init=zero enabled.
DivestOS 16.0, 17.1, and 18.1 implements GrapheneOS's INTERNET permission toggle, hardened memory allocator, exec-spawning, JNI constification, and partial bionic hardening patchsets. 17.1 and 18.1 feature GrapheneOS's per-network full MAC randomization option, and ptrace_scope control, and automatic reboot/Wi-Fi/Bluetooth timeout options. All branches additionally have various miscellaneous patches courtesy of GrapheneOS.
!!! attention
DivestOS firmware update [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) varies across the devices it supports. For Pixel phones, we still recommend using GrapheneOS or CalyxOS. For other supported devices, DivestOS is a good alternative.
Not all of the supported devices have [verified boot](https://source.android.com/security/verifiedboot), and some perform it better than others.
Android security and privacy features
User Profiles
Multiple user profiles (Settings → System → Multiple users) are the simplest way to isolate in Android. With user profiles you can limit a user from making calls, SMS or installing apps on the device. Each profile is encrypted using its own encryption key and cannot access the data of any other profiles. Even the device owner cannot view the data of other profiles without knowing their password. Multiple user profiles is a more secure method of isolation.
Work Profile
Work Profiles are another way to isolate individual apps and may be more convenient than separate user profiles.
A device controller such as Shelter is required, unless you're using CalyxOS which includes one.
The work profile is dependent on a device controller to function. Features such as File Shuttle and contact search blocking or any kind of isolation features must be implemented by the controller. The user must also fully trust the device controller app, as it has full access to the data inside of the work profile.
This method is generally less secure than a secondary user profile; however, it does allow you the convenience of running apps in both the work and personal profiles simultaneously.
Verified Boot
Verified Boot is an important part of the Android security model. It provides protection against evil maid attacks, malware persistence, and ensures security updates cannot be downgraded with rollback protection.
Android 10 and above has moved away from full-disk encryption (FDE) to more flexible file-based encryption.
Each user's data is encrypted using their own unique encryption key, and the operating system files are left unencrypted. Verified Boot ensures the integrity of the operating system files preventing an adversary with physical access from tampering or installing malware on the device. In the unlikely case that malware is able to exploit other parts of the system and gain higher privileged access, Verified Boot will prevent and revert changes to the system partition upon reboot of the device.
Unfortunately, original equipment manufacturers (OEMs) are only obliged to support Verified Boot on their stock Android distribution. Only a few OEMs such as Google support custom Android Verified Boot (AVB) key enrollment on their devices. Some AOSP derivatives such as LineageOS or /e/ OS do not support Verified Boot even on hardware with Verified Boot support for third party operating systems. We recommend that you check for support before purchasing a new device. AOSP derivatives which do not support Verified Boot are not recommended.
VPN Killswitch
Android 7 and above supports a VPN killswitch and it is available without the need to install third party apps. This feature can prevent leaks if the VPN is disconnected. It can be found in ⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN.
Global Toggles
Modern Android devices have global toggles for disabling Bluetooth and location services. Android 12 introduced toggles for the camera and microphone. When not in use, we recommend disabling these features. Apps cannot use disabled features (even if granted individual permission) until re-enabled.
Recommended Apps
Orbot
!!! recommendation
{ align=right }
**Orbot** is a free proxy app that routes your connections through the Tor Network.
[Visit orbot.app](https://orbot.app/){ .md-button .md-button--primary }
**Downloads**
- [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=org.torproject.android)
- [:pg-f-droid: F-Droid](https://guardianproject.info/fdroid)
- [:fontawesome-brands-github: GitHub](https://github.com/guardianproject/orbot)
- [:fontawesome-brands-gitlab: GitLab](https://gitlab.com/guardianproject/orbot)
Orbot can proxy individual apps if they support SOCKS or HTTP proxying. It can also proxy all your network connections using VpnService and can be used with the VPN killswitch (⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN).
For resistance against traffic analysis attacks, consider enabling Isolate Destination Address ( ⁝ →Settings → Connectivity). This will use a completely different Tor Circuit (different middle relay and exit nodes) for every domain you connect to.
!!! attention
Orbot is often outdated on the Guardian Project's [F-Droid repository](https://guardianproject.info/fdroid) and [Google Play](https://play.google.com/store/apps/details?id=org.torproject.android) so consider downloading directly from the [GitHub repository](https://github.com/guardianproject/orbot) instead.
All versions are signed using the same signature so they should be compatible with each other.
Shelter
!!! recommendation
{ align=right }
**Shelter** is an app that helps you leverage the Android work profile to isolate other apps.
Shelter supports blocking contact search cross profiles and sharing files across profiles via the default file manager ([DocumentsUI](https://source.android.com/devices/architecture/modular-system/documentsui)).
[Visit gitea.angry.im](https://gitea.angry.im/PeterCxy/Shelter){ .md-button .md-button--primary }
**Downloads:**
- [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=net.typeblog.shelter)
- [:pg-f-droid: F-Droid](https://f-droid.org/en/packages/net.typeblog.shelter)
- [:fontawesome-brands-github: GitHub](https://github.com/PeterCxy/Shelter)
- [:fontawesome-brands-git-alt: Source](https://gitea.angry.im/PeterCxy/Shelter)
!!! attention
As CalyxOS includes a device controller, we recommend using their built in work profile instead.
Shelter is recommended over [Insular](https://secure-system.gitlab.io/Insular/) and [Island](https://github.com/oasisfeng/island) as it supports [contact search blocking](https://secure-system.gitlab.io/Insular/faq.html).
When using Shelter, you are placing complete trust in its developer as Shelter would be acting as a [Device Admin](https://developer.android.com/guide/topics/admin/device-admin) for the work profile and has extensive access to the data stored within it.
Auditor
!!! recommendation
{ align=right }
{ align=right }
**Auditor** is an app which leverages hardware security features to provide device integrity monitoring for [supported devices](https://attestation.app/about#device-support). Currently it works with GrapheneOS and the device's stock operating system.
[Visit attestation.app](https://attestation.app){ .md-button .md-button--primary }
**Downloads:**
- [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=app.attestation.auditor)
- [:fontawesome-brands-github: GitHub](https://github.com/GrapheneOS/Auditor)
Auditor performs attestation and intrusion detection by:
- Using a Trust On First Use (TOFU) model between an auditor and auditee, the pair establish a private key in the hardware-backed keystore of the Auditor.
- The auditor can either be another instance of the Auditor app or the Remote Attestation Service.
- The auditor records the current state and configuration of the auditee.
- Should tampering with the operating system of the auditee after the pairing is complete, the auditor will be aware of the change in the device state and configurations.
- The user will be alerted to the change.
No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring.
If your threat model requires privacy you could consider using Orbot or a VPN to hide your IP address from the attestation service. To make sure that your hardware and operating system is genuine, perform local attestation immediately after the device has been installed and prior to any internet connection.
Secure Camera
!!! recommendation
{ align=right }
{ align=right }
**Secure Camera** is an camera app focused on privacy and security which can capture images, videos, and QR codes. CameraX vendor extensions (Portrait, HDR, Night Sight, Face Retouch, and Auto) are also supported on available devices.
[Visit github.com](https://github.com/GrapheneOS/Camera){ .md-button .md-button--primary }
**Downloads:**
- [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.camera.play)
- [:fontawesome-brands-github: GitHub](https://github.com/GrapheneOS/Camera/releases)
Main privacy features include:
- Auto removal of Exif metadata (enabled by default)
- Use of the new Media API, therefore storage permissions are not required
- Microphone permission not required unless you want to record sound
!!! note
Metadata is not currently deleted from video files but that is planned.
The image orientation metadata is not deleted. If you enable location (in Secure Camera) that **won't** be deleted either. If you want to delete that later you will need to use an external app such as [Scrambled Exif](https://gitlab.com/juanitobananas/scrambled-exif/).
Secure PDF Viewer
!!! recommendation
{ align=right }
{ align=right }
**Secure PDF Viewer** is a PDF viewer based on [pdf.js](https://en.wikipedia.org/wiki/PDF.js) that doesn't require any permissions. The PDF is fed into a [sandboxed](https://en.wikipedia.org/wiki/Sandbox_(software_development)) [webview](https://developer.android.com/guide/webapps/webview). This means that it doesn't require permission directly to access content or files.
[Content-Security-Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) is used to enforce that the JavaScript and styling properties within the WebView are entirely static content.
[Visit github.com](https://github.com/GrapheneOS/PdfViewer){ .md-button .md-button--primary }
**Downloads:**
- [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.pdfviewer.play)
- [:fontawesome-brands-github: GitHub](https://github.com/GrapheneOS/PdfViewer/releases)
PrivacyBlur
!!! recommendation
{ align=right }
**PrivacyBlur** is a free app which can blur sensitive portions of pictures before sharing them online.
[Visit privacyblur.app](https://privacyblur.app/){ .md-button .md-button--primary }
**Downloads:**
- [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=de.mathema.privacyblur)
- [:pg-f-droid: F-Droid](https://f-droid.org/en/packages/de.mathema.privacyblur/)
- [:fontawesome-brands-github: GitHub](https://github.com/MATHEMA-GmbH/privacyblur)
!!! warning
You should **never** use blur to redact [text in images](https://bishopfox.com/blog/unredacter-tool-never-pixelation). If you want to redact text in an image, draw a box over the text. For this we suggest [Pocket Paint](https://github.com/Catrobat/Paintroid) or [Imagepipe](https://codeberg.org/Starfish/Imagepipe).
General Recommendations
Avoid Root
Rooting Android phones can decrease security significantly as it weakens the complete Android security model. This can decrease privacy should there be an exploit that is assisted by the decreased security. Common rooting methods involve directly tampering with the boot partition, making it impossible to perform successful Verified Boot. Apps that require root will also modify the system partition meaning that Verified Boot would have to remain disabled. Having root exposed directly in the user interface also increases the attack surface of your device and may assist in privilege escalation vulnerabilities and SELinux policy bypasses.
Adblockers (AdAway) which modify the hosts file and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For Adblocking we suggest encrypted DNS or VPN server blocking solutions instead. RethinkDNS, TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN) preventing you from using privacy enhancing services such as Orbot or a real VPN server.
AFWall+ works based on the packet filtering approach and may be bypassable in some situations.
We do not believe that the security sacrifices made by rooting a phone are worth the questionable privacy benefits of those apps.
Firmware Updates
Firmware updates are critical for maintaining security and without them your device cannot be secure. Original equipment manufacturers (OEMs)—in other words, phone manufacturers—have support agreements with their partners to provide the closed source components for a limited support period. These are detailed in the monthly Android Security Bulletins.
As the components of the phone such as the processor and radio technologies rely on closed source components, the updates must be provided by the respective manufacturers. Therefore it is important that you purchase a device within an active support cycle. Qualcomm and Samsung support their devices for 4 years while cheaper products often have shorter support. With the introduction of the Pixel 6, Google now makes their own system on chip (SoC) and they will provide 5 years of support.
Devices that have reached their end-of-life (EoL) and are no longer supported by the SoC manufacturer, cannot receive firmware updates from OEM vendors or after market Android distributors. This means that security issues with those devices will remain unfixed.
Android Versions
It's important to not use an end-of-life version of Android. Newer versions of Android not only receive security updates for the operating system but also important privacy enhancing updates too. For example, prior to Android 10, any user apps with the READ_PHONE_STATE permission could access sensitive and unique serial numbers of your phone such as IMEI, MEID, your SIM card's IMSI, whereas now they must be system apps to do so. System apps are only provided by the OEM or Android distribution.
Android Permissions
Permissions on Android grant users control over what apps are allowed to access. Google regularly makes improvements on the permission system in each successive version. All user installed apps are strictly sandboxed, therefore there is no need to install any antivirus apps. The savings you make from not purchasing or subscribing to security apps is better spent on paying for a supported device in the future.
Should you want to run an app that you're unsure about, consider using a user or work profile.
Advanced Protection Program
If you have a Google account we suggest enrolling in the Advanced Protection Program. It is available at no cost to anyone with two or more hardware security keys with U2F support.
The Advanced Protection Program provides enhanced threat monitoring and enables:
- Stricter two factor authentication; e.g. that U2F or FIDO2 must be used and disallows the use of SMS OTPs, TOTP, and OAuth
- Only Google and verified third party apps can access account data
- Scanning of incoming emails on Gmail accounts for phishing attempts
- Stricter safe browser scanning with Google Chrome
- Stricter recovery process for accounts with lost credentials
For users that are using the privileged Google Play Services (common on stock operating systems), the Advanced Protection Program also comes with additional benefits such as:
- Not allowing app installation outside of the Google Play Store, the OS vendor's app store, or via
adb - Mandatory automatic device scanning with Play Protect
- Warning the user about unverified applications
SafetyNet and Play Integrity API
SafetyNet and the Play Integrity APIs are generally used for banking apps. Many banking apps will work fine in GrapheneOS with sandboxed Play services, however some non-financal apps have their own crude anti-tampering mechanisms which might fail. GrapheneOS passes the basicIntegrity check, but not the certification check ctsProfileMatch. Devices with Android 8 or later have hardware attestation support which cannot be bypassed without leaked keys or serious vulnerabilities.
As for Google Wallet, we don't recommend this due to their privacy policy, which states you must opt-out if you don't want your credit rating and personal information shared with affiliate marketing services.
Advertising ID
All devices with Google Play Services installed automatically generate an advertising ID used for targeted advertising. Disable this feature to limit the data collected about you.
On Android distributions with Sandboxed Google Play, go to ⚙️ Settings → Apps → Sandboxed Google Play → Google Settings → Ads and select Delete advertising ID.
On Android distributions with privileged Google Play Services (such as stock OSes), the setting may be in one of several locations. Check
- ⚙️ Settings → Google → Ads
- ⚙️ Settings → Privacy → Ads
Depending on your system, you will either be given the option to delete your advertising ID or to "Opt out of interest-based ads". You should delete the advertising ID if you are given the option to, and if you are not, we recommend that you opt out of interested-based ads and then reset your advertising ID.
Android Device Shopping
Google Pixels are known to have good security and properly support Verified Boot. Some other phones such as the Fairphone and OnePlus devices also support custom Android Verified Boot (AVB) key enrollment. However, there have been issues with their older models. In the past they were using test keys or not doing proper verification, making Verified Boot on those devices useless.
Avoid buying phones from mobile network operators. These often have a locked bootloader and do not support OEM unlocking. These phone variants will prevent you from installing any kind of alternative Android distribution. Phones that cannot be unlocked will often have an IMEI starting with "35", that includes phones from purchased from Verizon, Telus, Rogers, EE, etc.
Be very careful about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen there's a possibility of IMEI blacklisting. There is also a risk involved with you being associated with the activity of the previous owner.
We have these general tips:
- If you're after a bargain on a Pixel device, we suggest buying an "a" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
- Consider price beating options and specials offered at brick and mortar stores.
- Look at online community bargain sites in your country. These can alert you to good sales.
- The price per day for a device can be calculated as
\text {EoL Date}-\text{Current Date} \over \text{Cost}. Google provides a list of their supported devices. - Do not buy devices that have reached or are near their end-of-life, additional firmware updates must be provided by the manufacturer.
- Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper Verified Boot support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
- In short, if a device or Android distribution is not listed here, there is probably a good reason, so check our discussions page.
The installation of GrapheneOS on a Pixel phone is easy with their web installer. If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the NitroPhone as they come preloaded with GrapheneOS from the reputable Nitrokey company. The GrapheneOS project is not currently affiliated with any vendor and cannot ensure the quality or security of their products.
A CalyxOS membership also entitles you to a device preloaded with CalyxOS.
Where to get your applications
GrapheneOS's App Store
GrapheneOS's app store is available on GitHub. It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the Auditor, Camera, and PDF Viewer. If you are looking for these applications, we highly recommend that you get them from GrapheneOS's app store instead of the Play Store, as the apps on their store are signed by the GrapheneOS's project own signature that Google does not have access to.
Aurora Store
The Google Play Store requires a Google account to login which is not great for privacy. The Aurora Store (a Google Play Store proxy) does not, and works most of the time.
F-Droid
F-Droid is often recommended as an alternative to Google Play, particularly in the privacy community. The option to add third party repositories and not be confined to Google's walled garden has led to its popularity. F-Droid additionally has reproducible builds for some applications, and is dedicated to free and open source software. However, there are problems with the official F-Droid client, their quality control, and how they build, sign and deliver packages, outlined in this post.
Sometimes the official F-Droid repository may fall behind on updates. F-Droid maintainers reuse package IDs while signing apps with their own keys, which is not ideal as it does give the F-Droid team ultimate trust. The Google Play version of some apps may contain unwanted telemetry or lack features that are available in the F-Droid version. We have these general tips:
- Check if the app developers have their own F-Droid repository first, e.g. Bitwarden, Samourai Wallet, or Newpipe, which have their own repositories with less telemetry, additional features or faster updates. This is the ideal situation and you should be using these repositories if possible.
- Check if an app is available on the IzzyOnDroid repository. The IzzyOnDroid repository pulls builds directly from GitHub and is the next best thing to the developers' own repositories. We recommend that you download the GitHub builds and install them manually first, then use IzzyOnDroid for any subsequent updates. This will ensure that the signature of the applications you get from IzzyOnDroid matches that of the developer and the packages have not been tampered with.
- Check if there are any differences between the F-Droid version and the Google Play Store version. Some applications like IVPN do not include certain features (eg AntiTracker) in their Google Play Store build out of fear of censorship by Google.
Evaluate whether the additional features in the F-Droid build are worth the slower updates. Also think about whether faster updates from the Google Play Store are worth the potential privacy isues in your threat model.
Droid-ify
The official F-Droid client targets a low API level and does not utilize the seamless updates feature introduced in Android 12. Targeting lower API levels means that the F-Droid client cannot take advantage of the new improvements in the application sandboxes that comes with higher API levels. For automatic updates to work, the F-Droid client requires that the Privileged Extension be included in the operating system, granting it more privileges than what a normal app would have, which is not great for security.
To mitigate these problems, we recommend Droid-ify as it supports seamless updates on Android 12 and above without needing any special privileges and targets a higher API level.
!!! recommendation
{ align=right }
**Droid-ify** is a modern F-Droid client made with MaterialUI, forked from [Foxy Droid](https://github.com/kitsunyan/foxy-droid).
Unlike the official F-Droid client, Droid-ify supports seamless updates on Android 12 and above without the need for a privileged extension. If your Android distribution is on Android 12 or above and does not include the [F-Droid privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged/), it is highly recommended that you use Droid-ify instead of the official client.
**Downloads:**
- [:fontawesome-brands-android: APK Download](https://android.izzysoft.de/repo/apk/com.looker.droidify)
- [:fontawesome-brands-github: GitHub](https://github.com/Iamlooker/Droid-ify)
Security comparison of GrapheneOS and CalyxOS
Profiles
CalyxOS includes a device controller app so there is no need to install a third party app like Shelter. GrapheneOS plans to introduce nested profile support with better isolation in the future.
GrapheneOS extends the user profile feature allowing a user to press an "End Session" button. This button clears the encryption key from memory. There are plans to add a cross profile notifications system in the future.
Sandboxed Google Play vs Privileged MicroG
When Google Play services are used on GrapheneOS, they run as a user app and are contained within a user or work profile.
Sandboxed Google Play is confined using the highly restrictive, default untrusted_app domain provided by SELinux. Permissions for apps to use Google Play Services can be revoked at any time by the user.
MicroG is a reimplementation of Google Play Services. This means it needs to be updated every time Android has a major version update (or the Android API changes). It also needs to run in the highly privileged system_app SELinux domain like normal Google Play Services and requires access to signature spoofing so this is less secure than the Sandboxed Google Play approach. We do not believe MicroG provides any privacy advantages over Sandboxed Google Play except for the option to shift trust of the location backend from Google to another provider such as Mozilla or DejaVu.
From a usability point of view, Sandboxed Google Play also works well with far more applications than MicroG, thanks to its support for services like Google Play Games and In-app Billing API.
Privileged App Extensions
Android 12 comes with special support for seamless app updates with third party app stores. The popular Free and Open Source Software (FOSS) repository F-Droid doesn't implement this feature and requires a privileged extension to be included with the Android distribution in order to have unattended app installation.
GrapheneOS doesn't compromise on security; therefore, they do not include the F-Droid extension. Users have to confirm all updates manually if they want to use F-Droid. Alternatively, they can use the Droid-ify client which does support seamless app updates in Android 12. GrapheneOS officially recommends Sandboxed Google Play instead. Many FOSS Android apps are also in Google Play but sometimes they are not (like NewPipe).
CalyxOS includes the privileged extension, which may lower device security. Seamless app updates should be possible with Aurora Store in Android 12.
Additional hardening
GrapheneOS improves upon AOSP security with:
- Hardened WebView: Vanadium WebView requires 64-bit processes on the WebView process and disables legacy 32-bit processes. It uses hardened compiler options such as
-fwrapvand-fstack-protector-strong, which can help protect against stack buffer overflows. APIs such as the battery status API are disabled for privacy reasons. All system apps on GrapheneOS use the Vanadium WebView which means user installed apps that use WebView will also benefit from Vanadium's hardening. The Vanadium patch set is a lot more comprehensive than CalyxOS's Chromium patch set which is derived from it. - Hardened Kernel: GrapheneOS kernel includes some hardening from the linux-hardened project and the Kernel Self Protection Project (KSPP). CalyxOS uses the same kernel as regular Android with some minor modifications.
- Hardened Memory Allocator: GrapheneOS uses the hardened malloc subproject as its memory allocator. This focuses on hardening against memory heap corruption. CalyxOS uses the default AOSP Scudo Malloc, which is generally less effective. Hardened Malloc has uncovered vulnerabilities in AOSP which have been fixed by GrapheneOS such as CVE-2021-0703.
- Secure Exec Spawning: GrapheneOS spawns fresh processes as opposed to using the Zygote model used by AOSP and CalyxOS. The Zygote model weakens Address Space Layout Randomization (ASLR) and is considered less secure. Creating fresh processes is safer but will have some performance penalty when launching a new application. These penalties are not really noticeable unless you have an old device with slow storage such as the Pixel 3a/3a XL as it has eMMC.
Please note that these are just a few examples and are not an extensive list of GrapheneOS's hardening. For a more complete list, please read GrapheneOS' official documentation.