Eylenburg

PSA: somebody put together a detailed table[1] comparing security and privacy features of most common Android-based OSes. Yes, GrapheneOS looks amazing but requires a Pixel phone, at least until the new Motorola devices come out. 1 - https://eylenburg.github.io/android_comparison.htm

Why are we degoogling, for what purpose? I couldn't care less about giving them what likely amounts to ~10€ of margin per year on the hardware sale. What I care about is not giving them data which is worth a lot more than that, and to take back control over my device. When you go with an alternative you lose superior privacy and security offered by GrapheneOS and you just end up leaking more data back to Google and other ad-tech companies than you would otherwise, negating any benefits several times over. See: Advanced features, degoogling, privacy, security, and updates sections of https://eylenburg.github.io/android_comparison.htm

CalyxOS was not a hardened OS and is a much different space from GrapheneOS. It hasn't provided the 2025-06-05 or later Android security patches and updates for it have been discontinued. It's strange to recommend people use an insecure and non-private OS without updates. https://calyxos.org/news/2025/08/01/a-letter-to-our-community/ https://eylenburg.github.io/android_comparison.htm has a high quality comparison of the privacy and security between different alternate AOSP-based operating systems.

GrapheneOS community manager here. I would recommend checking out https://eylenburg.github.io/android_comparison.htm for a third-party comparison of these projects. They're not really similar. CalyxOS downgrades security compared to the Android Open Source Project, often falls significantly behind on standard Android privacy and security patches as is the case right now (they still haven't ported to Android 16 which is required to have the latest patches) and doesn't provide similar privacy or security features. Features like Contact Scopes, Storage Scopes and our Sensors permission toggle are some of the privacy features includes in GrapheneOS. Privacy necessitates security. The security provided by GrapheneOS is in order to be able to protect privacy.

It might be worth to switch to GrapheneOS if you have Pixel phones: https://grapheneos.org/ It is a more serious project than LineageOS in the sense that they take security very seriously and they take their development more professionally too. There are no disadvantages to using GrapheneOS compared to LineageOS. You can see a comparison here: https://eylenburg.github.io/android_comparison.htm

Neither of those is a privacy or security hardened OS. AOSP is much more private and secure than the desktop Linux software stack and GrapheneOS greatly improves upon it. GrapheneOS does not promote Google services. /e/ always gives privileged access to Google apps and services and ships with a bunch of Google services active default. GrapheneOS doesn't come with sandboxed Google Play and doesn't connect to Google servers by default. https://eylenburg.github.io/android_comparison.htm https://grapheneos.org/features We have a non-exclusive partnership with Motorola Mobility to bring GrapheneOS to their next generation and later devices. This is necessary because non-Pixel devices don't provide the updates or hardware-based security features we need. GrapheneOS supports the latest available Pixels and plans to add support for future Pixels alongside our partnership with Motorola, which is not exclusive and does not preclude having additional OEM partnerships. /e/ greatly reduces privacy and security compared to the standard Android Open Source Project. /e/ has repeatedly claimed hardened devices mainly benefit criminals and pedophiles and have falsely claimed GrapheneOS is mainly used by criminals on multiple occasions too. That's very relevant to the context leading to someone creating this thread. https://grapheneos.social/@GrapheneOS/116353973732143171

I am not a project member so I cannot speak for GrapheneOS, but maybe I can help clear up some misunderstandings. >insistence on not supporting MicroG leads to poor UX, The problem they are trying to solve is apps not working without the presence of Google Mobile Services or Google Play. They don't want to compromise by having a component with high privileges integrated in their image that involves security issues like signature spoofing. MicroG will send less data to Google partly because it is simply an incomplete implementation of the features offered by GMS (sanboxed-google-play appp compatibility is quite a bit higher), partly because the access is more granular or there are choices offered for services like location (GrapheneOS provides non-Google location services and community support on only installing and enabling the parts you need for specific app features to work). UX is not adversely affected, but if you want to use a privileged app bypassing security checks and sending data to Google anyway then you have the freedom to compile microG with it integrated if you would like. >They also seem to be very opinionated about (not) using a firewall for privacy, like NetGuard, instead recommending some weird alternatives like DNS firewalls GrapheneOS tries to implement or end encourage sustainable approaches to privacy and security, and this partially means approaches that don't break if the adversary knows what you are doing. Egress/outbound traffic filtering is…

GrapheneOS claims to be a lot more secure, having additional hardening. See https://eylenburg.github.io/android_comparison.htm - keep in mind that it is not an independent comparison, the Graphene guys directly feed what this table is supposed to say in the issue tracker, https://github.com/eylenburg/eylenburg.github.io/issues/. But it gives a good representation of the state of the ROMs according to Graphene. In regular use, main difference will be that /e/OS comes with access to the alternative cloud service that project provides. It uses the default FOSS solution microG for google api compatibility, unlike GrapheneOS with their sandbox approach. /e/OS sets on AppLounge to install and upgrade both play store or F-Droid apps. Graphene has a small curated app repo instead. I'd never use GrapheneOS since I don't trust the project. /e/OS is also not my favorite since it feels like it is developing slowly, having issues with outdated software versions - though it does work well in practice. Have a look at iode for an alternative.

Tl;dr: Google needs to fund Mozilla because there are no other internet browsers available; suitable for todays Internet standards. Microsoft gave up, Opera gave up and Webkit is the only other and it's now iOS exclusive. It failed as a desktop browser. Without Firefox, Alphabet would be liable to an anti-trust lawsuit. Apple not so, because they keep it to their iDevice. - Firefox is Mozilla's and Mozilla is a non-profitable organisation. The story as I know it is that in the early days Mozilla became the defacto internet suite as they produced a suite of applications. Email, FTP client and a browser and these were crafted and sustained by volunteers. (This is skipping the predecessor, Netscape). The internet was simple then. HTML and CSS with an lil' bit of Javascript made the internet fine. Everything was open and the rainbow coloured fence of your neighbour was pretty. You could even implement your own renderer and know it would work. In the dozens: https://eylenburg.github.io/browser_engines.htm Introducing Google: they started out just as search engine and that it was. Pretty great at it what it was and their was no other. It's boasted feature was one of that you could rank pages with PageRank although in the long run became unprofitable. The popped dotCom boom had made VC's scared to invest and Silicon Valley was still recovering from the aftermath. Unlike Yahoo, Lycos and other service providers, who all had offered services like email and entertainment…

The company that imports Fairphone 4 to the US (Murena) runs e/OS which is OK. There's a bit of FUD that pops up on HN about e/OS from time to time, but the reality is that it's a mostly de-Google'd but still usable LineageOS clone. Their emphasis is on de-Googling, and usability, not security. It's probably worth a look. I'd say that their privacy/de-Googling is the best of all the LineageOS flavors. You can see comparisons between all the flavors here: https://eylenburg.github.io/android_comparison.htm That said, you can flash any Android Os that supports Fairphone, or PostmarketOS to it. The phone itself is responsive/quite good despite being a bit old at this point. I can do all normal phone tasks (email, web, music, navigation, etc) with no lag or any issues. I have not attempted to game on it. The Fairphone 4 is modular, parts are available for repairs, and it works great in the US with T-Mobile or T-Mobile MVNOs. https://murena.com/america/shop/smartphones/brand-new/murena-fairphone…

LineageOS has no AVB support at all unfortunately and most devices don't allow using verified boot with custom keys anyways. With GrapheneOS they can just add GrapheneOS public keys (https://grapheneos.org/attestation.json). For LOS Roblox would have to disable hardware attestation completely, which means you can easily just add extra modules such as a setuid binary which makes cheating easy. https://eylenburg.github.io/android_comparison.htm

TIL Briar is text-only, per https://eylenburg.github.io/im_comparison.htm

This German security researcher maintains a comparison table showing the differences between mobile OSes. https://eylenburg.github.io/android_comparison.htm

This is certainly bad news, but at least an escape hatch exists (the "advanced flow") and it appears to be a one-time pain in the ass. If that changes, I hope GrapheneOS and friends[1] can get Google Pay or some alternative working so I can comfortably jump ship, as I rely pretty heavily on the ability to pay with my phone. [1] https://eylenburg.github.io/android_comparison.htm

> I wonder how this compares to GrapheneOS in practice. https://eylenburg.github.io/android_comparison.htm is a fairly complete comparison. One of GrapheneOS' biggest features is that they sandbox Google services (if you choose to install them), whereas e/OS gives them privileged access by default (via microG). Calling it a "degoogled" OS while microG uses Google's proprietary blobs is... a choice. The GrapheneOS developers are very sceptical of e/OS (https://xcancel.com/GrapheneOS/search?f=tweets&q=e/os), but you should obviously take biases into account here. Murena's CEO occasionally participates too: https://xcancel.com/gael_duval/search?f=tweets&q=grapheneos

There's absolutely no reason to use /e/ when GrapheneOS exists. https://eylenburg.github.io/android_comparison.htm

This site claims to list them out: https://eylenburg.github.io/countries.htm I cannot vouch for its accuracy but I thought it was interesting.

In what ways does LineageOS trail behind AOSP in terms of security? I looked at the comparison chart you linked elsewhere and the privacy/security sections only seem to list advantages over OEM Android (not AOSP), with the exception of secure boot [1], but AOSP (not OEM Android) doesn't have that out-of-the-box either. Unless you are comparing Lineage with OEM Android? [1] https://eylenburg.github.io/android_comparison.htm

Read this: https://eylenburg.github.io/android_comparison.htm In short, GrapheneOS is vastly superior.

With microG, your apps still connect to the Google servers, so you're not "breaking free". Moreover, some OSes (e.g. /e/OS) give certain Google apps higher privileges than other apps even with microG, install Android Auto and it's still game over. GrapheneOS does not have this issue because as you say, Google apps/services get sandboxed. Obligatory link: https://eylenburg.github.io/android_comparison.htm

Consider this (by Graphene OS): https://discuss.grapheneos.org/d/24134-devices-lacking-standard-privac… /e/OS community talking about it: https://community.e.foundation/t/article-from-grapheneos-about-e-os/72… And then maybe this: https://eylenburg.github.io/android_comparison.htm Hope that helps.

You really don't want /e/ on Fairphone. That's frankly worst of both worlds. Insecure hardware with limited patches and updates, running insecure software with much patches skipped or delayed. Most recent fairphone is based on Android 15, while 16 is available from mid-2025. Yes, that matters, releases is not only eyecandy, but also some security patches (ie: not many patches are back ported from 16). https://support.fairphone.com/hc/en-us/articles/24463713641234-The-Fai… Features: https://eylenburg.github.io/android_comparison.htm Historic security updates : https://web.archive.org/web/20241231003546/https://divestos.org/pages/… So, I'd rather have second hand debloated midrange Motorola thank /e/, even less so on Fairphone.

How can LOS's security be somewhat close to GOS if it's worse than OEM? LOS lacks verified boot, hardware security features, it's often behind is security patches.. With "advanced protection" enabled stock OEMs are even more secure, but GOS is even more secure still. When it comes to EOL devices, LOS may be more secure than OEM depending on your threat model. https://eylenburg.github.io/android_comparison.htm

Always impressed by GrapheneOS social media painstakingly dealing with these trolls. For those without time the link they post to a 3rd party comparison of Android based OSes is very enlightening: https://eylenburg.github.io/android_comparison.htm

That's untrue. The main focus of GrapheneOS has always been privacy. This level of privacy is enabled through good security. GrapheneOS goes above and beyond in regards to privacy. No other custom Android OS hosts its own time server, proxies for PSDS and SUPL, captive portal, Wi-Fi positioning proxy, Widevine provisioning proxy, etc. GrapheneOS doesn't make any connections to Google or Qualcomm by default, unlike all the other other Android-based systems. https://grapheneos.org/faq#default-connections See https://eylenburg.github.io/android_comparison.htm As previously mentioned, GrapheneOS hosts a proxy for the Qualcomm SUPL service. In addition, it removes unique device identifiers from the requests, that would normally be present. GrapheneOS supports the Pixel tool for provisioning eSIMs, but it's fully sandboxed and doesn't share any data with Google.

Even if you run LineageOS without Google, LineageOS still phones home to Google for DNS and captive portal checks. https://eylenburg.github.io/android_comparison.htm

there's already a comparison mentioned in the article https://eylenburg.github.io/android_comparison.htm

/e/OS ranks poorly and is consistently months behind security updates: https://eylenburg.github.io/android_comparison.htm Also visual voicemail should actually work just fine on select carriers.

There's a comparison table of messengers here: https://eylenburg.github.io/im_comparison.htm Note the list of "messengers that are relevant but did not make it on the list" in case none of the messengers in the comparison meets your requirements. Even that isn't exhaustive, but there are lots of options.

sadly you can only install grapheneos on pixels due to the strong security requirement grapheneos requires on devices for them to support it (like relocking the bootloader with a third party os installed) seems like xperia is supported by divestos though which is still a good alternative https://eylenburg.github.io/android_comparison.htm https://divestos.org/pages/devices