Short version: if I get a used google pixel from eBay that already has GrapheneOS on it, is there a serious danger of malware also being added (by the seller, not graphene)?
My iPhone is at the end of its life and I decided a while ago that I’m not getting another iPhone. I was gonna get just a normal android phone (probably a Samsung thought I did check out the Motorolas) but when I was trying them out they all shove that stupid Gemini ai shit down your throat. I was already aware of GrapheneOS but initially I was thinking I’d get an android, wait for that Motorola GrapheneOS phone to come out, and see if it looks worth switching to that since I’d prefer to not give google my money. Now though, I think I’ll just switch to graphene immediately for my own sanity
Since I don’t want to give google money by buying a new pixel tho, I was considering getting a pre-owned one on eBay that already has graphene installed on it. My question is if that’s dangerous. Like, can the person that puts graphene on it also add other dangerous stuff? Or is that not really a concern? Or should I just get a new pixel bc realistically me buying one phone, while not perfect to my values, is still not the end of the world? And that way I know it should last me for a good 4-5 years at least before I need a new phone. Also realistically, I will be running the sandboxed google play services for at least some apps so I’ll still sort of be “supporting” google in that sense
Also, if anyone has any advice/tips about graphene, I’d love to hear them! I’ve been watching videos about it and reading through the website’s documentation but hearing from actual users is always helpful!
Side note: I like how my brief lemmy post history is just me getting advice/support on my journey of switching to Linux/open source/user centric alternatives since I don’t know anyone irl that knows about this kind of stuff. Y’all have really helped so much in improving my life so thank you <3
You don’t need to reinstall as many people have suggested. There are instructions on the website for this https://grapheneos.org/faq#preinstalled-devices. Basically, verify the installation and do a factory reset from Recovery.
Thank you!
It is absolutely simple to install. Change a few settings, plug into a laptop and press install
Yes there is a possibility the seller has tampered with the phone, but it is small. I would just reflash it though just to be sure. It’s absolutely fine buying a used device!
Thank you!
If you buy a phone that doesn’t come with the stock OS with a locked bootloader, just reflash as a precaution.
Identity theft is not worth saving yourself a half hour of messing about
Good point! Thank you!
a half hour
You overestimate my power…
I was honestly surprised how user friendly the install process is, they’ve got a web installer that basically does everything, you just follow a small number of extremely simple instructions
Alternatively, grab any pixel off eBay and flash grapheneos yourself. They make it very very simple, all through your browser. I was genuinely surprised how simple they made it having never put custom ROMs on any device before.
Nvm
Or get a Nitro phone if you want something off the shelf.
Short answer: yes.
Long answer: You can use the attestation app bundled with graphene to check the integrity of the system. The catch is, you need another phone with graphene os to do it properly. There is also an online attestation check, but IF the OS is purpusfully infected, you can’t rely on what the app itself says.
If I were you, I’d try to reinstall it. The whole procedure can be done by following the instructions in any chromium based web browser. https://grapheneos.org/install/web
Thank you!
I would opt to install myself but “dangerous” is a relative term. Its definitely more dangerous than installing yourself since you can’t verify their install source or process. You can factory reset when you get it but again can’t validate the Rom used as the reset image.
If risk is a concern of yours, I’d buy used and install yourself. Not only will you save money, you’ll know you installed from a legitimate source.
The install is so easy for graphene, Theres so little risk of messing up. It takes less than 10 minutes.
Thank you!
Probably fine, just reflash it first to be safe®.
Technically, possible, but realistically, not much of a concern. You probably know better than anyone else as to whether you are that much of a person of interest that it warrants an attacker who is motivated enough to:
- Figure out that you are interested in a GrapheneOS phone
- Put up an offer and somehow ensure you buy that
- Rebuild GrapheneOS and load a malicious one into it and hope you don’t reinstall one, or use a really fancy trick that it persists across wipes
If it still bothers you, you can install it yourself. GrapheneOS has a web installer through which you can install GrapheneOS. It’s really weird how your browser can access all that, but yeah, you can install it within a website and a phone plugged into that computer. Once you do it yourself, I really doubt there’s anything malicious left.
I figured it’d be that kind of situation, but I don’t know much about phone security so I wasn’t sure if there were added vulnerabilities. Thank you!
I moved from an iPhone to Graphene about a year ago. I miss the quality hardware that Apple makes, metal and glass feel nicer than plastic. The pictures the Pixel 8 Pro takes are crap compared to my old iPhone too. However… I bought the Pixel used to test the software primarily and will stick with Graphene for the forseable future. It runs great and instead of buying a better quality Pixel, I am waiting for what Motorola will offer next year.
Some advice regarding the switch. Apple will make it annoying to leave their ecosystem. I recommend to move gradually, get your Graphene set up and keep your iPhone as a daily driver until you’re confident everything works on Graphene. I did this for about a week. I moved my pictures off of iCloud with Proton Drive and for NFC payments I switched to a bank that supports it from their own App. (Although I also switched to using 95% cash, it’s good to have a backup on the phone.) Using a Mac or going to icloud.com will make exporting your contacts and calendar a lot easier than trying it on iOS.
Two profiles is my setup. The main without Google for Threema, Signal, OrganicMaps, Voyager for Lemmy and all the other dailies. The secondary profile has the GooglePlay services running for my two banks. I use OLauncher for a clean home screen and HeliBoard as a keyboard, neither of these two have network access.
Chat me if you have specific questions, I enjoy tinkering with this stuff and chatting about it :)
Thanks for the advice! I wasn’t gonna trade in my phone anyways bc I only get like $50 for it, so I was thinking I’d keep it to make the transition easier, like you said. I’ll probably shoot you some questions once I get the phone and get graphene on it. Thank you!
Buying a pixel is by itself risky because the hardware is mediocre from both an engineering and quality pov: cases of screens with stripes or green tinted, the usb is soldered on the motherboard so if it’s busted you are f***d (samsung and apple are much much more modular), on top of that to remove the battery you have to remove the screen and a wierd carbon insulator that looks like a last minute patch. oh and of course battery is shit, guess you cannot expect anything good from an exynos right? Yes I, have one, yes it has graphene and yes I am waiting for Motorola to put out something decent. If i were you i would wait.
My pixel 8 w graphene is the best phone Ive ever had. Battery life is phenomenal without google services and build quality seems fine. The smaller size from most androids on the market is great.
You must have had a bad experience or are cherry picking issues - which can be true of any device.
I would wait if I could but my phone is in “so old it’s no longer working for basic functionality” at this point. So I need to get something for now, even if I end up reselling/trading in in a year or two. This gives me good stuff to think on tho! Thank you!
