Kuketz IT-Security Blog

Here‘s an in-depth review from 03/2025 where Kagi and Metager are compared by german IT-Sec expert Mike Kuketz and his team. No privacy-related concerns were raised back then. It is a german blog (sorry, couldn’t find an EN-version), and a very trustworthy source for me. https://www.kuketz-blog.de/besser-als-google-bezahlsuchmaschinen-im-te…

I would never recommend this article for anyone looking for comparison. It's wrong in so many ways. Your opinions are highly biased and it's an extremely poor attempt to make GrapheneOS look bad. For a factual and technical comparison, I would suggest this blog post series: https://www.kuketz-blog.de/android-grapheneos-calyxos-und-co-unter-der… It's well written and focuses on facts rather than poorly made assumptions

GrapheneOS leaks less data to Google by default and otherwise than /e/OS and is also a privacy-focused project. I believe places like https://www.kuketz-blog.de/ and https://eylenburg.github.io/android_comparison.htm will attest to that. App compatibility should also be better with sanboxed-play-services compared to microG since almost all apps/features that don't require meeting certification requirements (e.g. Google Pay and certain banking apps) or privileged integration (Android Auto) should work just like on another Android family OS. Something you might run into is the hardened memory allocator exposing memory corruption issues in apps whereyou might not see the same crashing elsewhere.

If you understand German, then I recommend the review by Mike Kuketz (https://www.kuketz-blog.de/briar-anonymitaet-und-sicherheit-gehen-vor-… Maybe you get a decent translation with Deepl, though I stay wary. There is also a comparison to other messenger systems on https://www.freie-messenger.de/systemvergleich/. They have a PDF in English available, but it doesn't really tell much.

There is a German article, that goes in depth on how to disable pretty much all of them and explains what they do: https://www.kuketz-blog.de/mozilla-firefox-datensendeverhalten-desktop… A few of them actually do make sense for a normal user (i.e. the Wifi portal stuff). But you can disable it if you spend some effort on it or you can also use an alternative build of Firefox without it. Not great, but also not terrible imo. Sorry, that I have no English source.

It's not, it starts sending all kinds of information to Google from the very first time you unlock the phone: https://www.kuketz-blog.de/e-datenschutzfreundlich-bedeutet-nicht-zwan… They also run proprietary Google blobs in a privileged process to pass basic Play Integrity and give certain Google apps higher privileges than the normal Android sandbox. Aside from Google, Fairphone 6 (both the stock OS and /e/OS) ship with proprietary, Chinese TCL blobs for image processing (most likely also privileged). Besides that, /e/OS often uses way outdated Linux kernel versions and firmware bundles with many known CVEs and old major Android versions, having many unfixed vulnerabilities that are not marked high/critical (ASBs only give you high/critical fixes). Fairphone does not have a secure enclave, only TrustZone. So, secrets can be extracted using frequently-found side-channel accounts. The lack of a secure enclave + the many available CVEs, it will probably fail within seconds when using data extraction tools like Cellebrite, even when the phone is locked. So better not bring your phone to demonstrations or border crossings. But hey, it doesn't matter, because Murena's CEO says security hardening is only for spies and pedophiles. (Friends don't recommend friends Fairphone or /e/OS.)

See for example https://www.kuketz-blog.de/opera-datensendeverhalten-desktop-version-b… (In German, but Kagi translate or Google translate work fine here)

Definitely wouldn't be unheard of in the Fintech industry. But I don't know, because I don't use the service. My bank thankfully offers their own implementation of NFC payments within their own app, so I don't need to rely on any third-party services. Many banks in Europe actually do this. Here's a German article about Google-free mobile payments on GrapheneOS: https://www.kuketz-blog.de/nfc-datenschutzfreundlich-bezahlen-mit-dem-…

GOS developers have said on multiple occasions that they think LineageOS is worse for security than the stock OS on multiple devices, as it doesn't keep up with current privacy/security patches or provide all of the standard protections. The comparison also does bring up these faults. See also https://www.kuketz-blog.de/lineageos-weder-sicher-noch-datenschutzfreu…

/e/OS falls significantly behind the other alternative Android systems with regards to privacy and security. Please see this independent comparison table: https://eylenburg.github.io/android_comparison.htm And additionally the reviews by Kuketz: https://www.kuketz-blog.de/android-grapheneos-calyxos-und-co-unter-der… See also my table that shows historical release dates for monthly Android Security Bulletins: https://divestos.org/misc/a-dates.txt and the Chromium (WebView): https://divestos.org/misc/ch-dates.txt

Original blog: https://www.kuketz-blog.de/lastpass-android-drittanbieter-ueberwachen-…

As far as I know, Signal is hosted on a mix of Amazon, Google, Microsoft and Cloudflare. https://www.kuketz-blog.de/signal-jegliche-kommunikation-erfolgt-ueber… Threema is hosted on bare-metal servers in Switzerland. https://threema.ch/en/faq/server_location

Here is the blog entry of the Journalist Mike Kuketz, explaining in detail how he uncovered the fraud, unfortunately only in German. This includes samples of the questionable GET and POST Requests, as well as a link to a commit to the WOT sources on GitHub, which introduced the necessary changes ... https://www.kuketz-blog.de/wot-addon-wie-ein-browser-addon-seine-nutze… The commit referenced in the blog: https://github.com/mywot/firefox-xul/commit/0df107cae8ac18901bd665acac…

GrapheneOS provides much better privacy, stability and app compatibility than /e/ rather than only security. GrapheneOS entirely exists as a privacy project and focuses on security too in order to protect privacy. GrapheneOS is a privacy project aimed at being highly usability. There's a good third party comparison between them here: https://eylenburg.github.io/android_comparison.htm /e/ regularly lags many weeks and months behind on essentially privacy and security patches for Android, the browser engine used by many apps, the Linux kernel, drivers and firmware. It doesn't preserve the standard Android privacy and security model either. It isn't safe from a privacy or security perspective for those reasons. It doesn't take a nation state attacker to exploit not having patches for many known browser/OS privacy and security vulnerabilities. Despite the misleading marketing, /e/ always uses multiple Google services and integrates them into the OS with privileged access unavailable to other services. They automatically download and run Google code with privileged access along with giving privileged access to certain Google apps when they're installed including Android Auto. Article from Mike Kuketz about /e/ including covering user tracking in their update client, still using Google services with privileged integration into the OS and major delays for important privacy/security…

Edge shares literally every single website you visit with Microsoft, even in InPrivate (= Incognito) mode. [1] The worst part is that you have to disable a genuine security feature (i.e., SmartScreen) to prevent this. No other browser makes you choose between security and privacy in this manner. Even Chrome attempts to protect your privacy by doing hash prefix computations for their Safe Browsing feature. Also, at least Chrome lets you set a custom encryption passphrase. Microsoft managed to import every other feature from Chrome, except this one, apparently. Microsoft has somehow done the impossible and beat Google in its own game. Edge is a complete privacy nightmare, only rivaled by the likes of Opera and Yandex browsers. If Chrome is the fire, Edge is a nuclear reactor in meltdown. [1]: https://www.kuketz-blog.de/microsoft-edge-datensendeverhalten-desktop-… (English version: https://www-kuketz--blog-de.translate.goog/microsoft-edge-datensendeve…

> open-source means auditable privacy This is what that auditing actually reveals: * /e/OS sends user speech data to OpenAI without consent [1], and thought this was ok until they got caught [2]. * /e/OS massively delays security patches, and calls this a "standard industry practice" [3]. Meanwhile, GrapheneOS' opt-in security preview releases provide early access to security updates prior to official disclosure [4]. Also see [0] (Security update speed) and [7] (WebView being 40 security updates behind). * microG downloads and executes proprietary Google binaries in a privileged environment [5] [6]. You can obviously not audit these, nor should this count as "degoogled". * microG still phones home to Google by default (android.clients.google.com for device registration check-in, mtalk.google.com for FCM push, firebaseinstallations.googleapis.com for SIM activations) [7]. [0] has a comparison of popular privacy and security-focused Android-based OS, which paints the whole picture. Privacy-friendly does not necessarily mean secure, but in this case "privacy-friendly" is quite a stretch already. [0] https://eylenburg.github.io/android_comparison.htm [1] https://grapheneos.social/@GrapheneOS/114880528716479708 [2] https://community.e.foundation/t/clarification-about-voice-to-text-stt… [3] https://community.e.foundation/t/e-os-and-security-updates/72384 [4] https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-rel… [5]…