Switching to GrapheneOS was such a long-term goal; after a point it became less of a “yeah I’ll do this” and more of a running joke. It was one of those things I wanted to do, fully intended to do, and never seemed to. Then, of course, Keir Starmer’s government became the manifest harbinger of The Four Horsemen of the Infocalypse. The UK tech landscape kept shifting — Online Safety Act, chat control, creeping surveillance, the VPN ban threats. Each step adjusts my threat model. At some point the cumulative delta crosses a threshold and fast-tracking changes (like GrapheneOS) stops being “eventually” and becomes “today.”

Two specific triggers caused me to do it.

1. The threat of a “BritCard” app I would be forced to keep on my phone
2. California passing a law forcing “OS level Age Verification”

In my post about Libreboot, I said this:

Any software on my system that has the capability to perform malicious actions, which I have not personally weighed up the pros and cons of it being on my system and have the inability to remove is malware to me.

Needless to say, government-mandated “safety features” fall into this category for me, and to directly quote Cody Wildon “, the only philosophically coherent position is revolt”.

Upon paying off my old phone, I purchased an old Google Pixel 9 XL and installed GrapheneOS. This is the post I wish I had when I was preparing to do so.

What is GrapheneOS?

If you are completely new to this space, GrapheneOS is a privacy and security-focused mobile operating system. It is free, open-source, and fully compatible with Android apps.

At its core, it is built on the Android Open Source Project (AOSP), but stripped of the proprietary Google tracking services, telemetry, and bloatware baked into almost every modern smartphone. However, calling it just a “de-Googled” ROM does it a massive disservice. GrapheneOS is fundamentally a hardened OS. The developers put an immense amount of work into exploit mitigations, memory safety, and aggressive app sandboxing to make the device incredibly difficult to compromise.

If you are trying to escape Google’s surveillance, why on earth did you buy a flagship Google Pixel 9 XL?

It is the great irony of the privacy community. Google’s Pixel hardware is actually the gold standard for secure custom operating systems. Unlike most manufacturers, Google allows you to easily unlock the bootloader, install an alternative OS, and then—crucially—relock the bootloader with your own custom cryptographic keys. This gives you full Android Verified Boot, where every time you turn the phone on, it verifies that the operating system hasn’t been tampered with. Combine that hardware-level security (including the Pixel’s Titan security chip) with GrapheneOS, and you get a fortress of a phone. In many ways, Google phones are what I would want every phone to be - It is fundamentally my device, and I should be able to do all of these things with it. It is truly a bad thing that we are at the point where Google is being congratulated for letting us use our devices how we please.

The Banality of Freedom

One of my biggest pet peeves as a techie is hearing people say “I want to learn Linux”. The thing about it is that Linux is not like something like riding a bike. For the vast majority of distros, you burn the iso to a USB, boot from it, install it, and you are dropped into a working Desktop Environment. You don’t learn Linux; you just use it and slowly learn your way around it. The same can be said for Windows, macOS, and your Smart TV. Most relevant, the same can be said for GrapheneOS. The problem is when you’ve been told for years that switching to this will set you free, and then you’re just using a phone; it can feel like nothing happened.

This is the first thing I need to get across with GrapheneOS: it is still just a phone. Beyond installing GrapheneOS and applying some basic settings and adjusting some workflows, there is no real difference for you as an end user.

Basic Settings and Workflows?

To be clear, this is not going to be a setting-by-setting “go here” and click that wall of text. It is just an idea of where to start, and what I have learned after using GrapheneOS for about six months now.

Profiles matter more than apps

Somewhere along the line your phone became an “everything device”. You listen to music with it, check your work emails, play Clash of Clans, and jack off, all using the same screen. The thing about this is that the single most important thing you can do for your security and privacy is to compartmentalise. Don’t know where to start? Well, I would suggest separating the “Owner” profile from your “General Use” profile. Why? For the same reason you never allow someone to log in as root over SSH.

In GrapheneOS, different user profiles are aggressively sandboxed from one another. They don’t share local storage, they don’t share app data, and an app running in one profile has absolutely zero visibility into what is happening in another. If you install every random app, proprietary banking tool, and social media client directly onto your Owner profile, any malicious code or zero-day exploit that compromises one of those apps has a direct path to the core of your device. By leaving the Owner profile completely bare-bones and doing all your daily driving in a secondary “General Use” profile, you build a cryptographic blast wall. If an app in your daily profile overreaches, tracks too much, or gets compromised, it is trapped inside that specific sandbox. It can’t snoop on your system settings, it can’t grant itself device-wide admin privileges, and it certainly can’t access data from other profiles.

The three profiles I have on my phone right now are “Root”, “General” and “Travel”. I created Travel because I still prefer to use Google Maps, and for that I needed “Google Play Services”. I consider this Malware, and figured if I absolutely need to install it, I would install it on a sandboxed profile. It is about making a choice of what apps you want bundled together with what settings, and as soon as you get your head around that, profiles start to make sense.

fdroid and aurora store

You will notice real quick when you install GrapheneOS that there is no app store; this can be easily remedied. I am going to break the mould slightly here, however. Don’t install F-Droid.

You know those profiles I said to use earlier; well, they do have a slight issue: you cannot install different versions of the same app across multiple profiles. F-Droid has this really annoying quirk that the .apk they publish is not the latest version, opting instead to update to the latest version on install install it. This means you can install it on the first profile fine, but beyond that you wind up in a bit of a shit situation. The solution?

NeoStore

NeoStore is more of a Meta App Store, letting you include multiple repositories, including F-Droid’s. It also has a better UI; not a reason to pick it but it but it is a nice touch.

“I can’t download Clash of Clans on NeoStore though?”

Well, for this you have two choices - Use Google Play, which you can do by installing Google Play services… Or use Aurora Store, which is sort of a privacy front end for Google Play. It lets you download and install apps from an anonymous account, or your own account (although I would recommend a burner account if you use your own). Officially, this breaks Google’s TOS, so I cannot recommend you do this… but.

The OpenSource Market Provides

I actually lost my first GrapheneOS device within 48h of setting it up. Not proud of this; didn’t particularly want to admit this in a blog post, and yet here we are. I had taken for granted Find My Phone, and knew I needed a solution. Well, the open-source market provides.

FMD

You install the app on your phone, set it up, and you are off to the races. If you are a loser like me, you may host your own server. I did mine with the Docker Compose below:

services:
    fmd:
        image: registry.gitlab.com/fmd-foss/fmd-server:latest

        container_name: fmd
        ports:
         - "8080:8080"
        volumes:
            - /srv/fmd-foss/fmddata/db/:/var/lib/fmd-server/db/
        restart: unless-stopped

That is it. It works. I do have a tiny complaint: there are some settings for it which require root access to set. GrapheneOS being GrapheneOS makes that not quite possible. A bit frustrating but swings and roundabouts.

The lesson here is not “take care of your phone”; it is that despite how it seems, you do in fact have options. Another example of this is webauth devices - GrapheneOS does not natively support it, because AOSP only supports it via Google Play Services. This meant that I was unable to use a YubiKey to auth against my IDP on my phone. I did some research and found Passchain, which is an open-source credential provider that enabled me to use USB/NFC keys on my device again. Regardless of your problem, there is probably a solution out there… and if there isn’t, we seem to live in the golden age of vibe coding; fix it yourself.

I just know I’m going to get an email from some anti-AI warrior for recommending vibe coding now.

The Attestation Server

One of the more jarring things you will notice when you first boot up is the “audit” app. At first glance, this will let you audit another person’s grapheneos phone. It does this by using a local device-to-device process where one phone scans a QR code generated by another. It uses the Pixel’s hardware security chip to cryptographically prove that the target phone is running a genuine, untampered version of GrapheneOS.

But unless you have a second Android phone handy, or an equally paranoid friendship group like me, this local device-to-device mode isn’t how you’ll typically use it. This is where the remote Attestation Server comes in. If your phone is successfully compromised by advanced malware, you can no longer trust the phone to tell you it has been compromised. The malware will just lie and say everything is fine. To solve this, you need a trusted third party to check the math. GrapheneOS runs a service at attestation.app that does exactly this.

Here is how it works in practice: The Pixel’s Titan M2 security chip creates hardware-backed proof of the operating system’s integrity every time the device boots. You can set up the Auditor app on your phone to periodically send this cryptographic proof to the remote attestation server. You can then log into that server from your laptop (or set up email alerts) to independently verify that your phone hasn’t been silently rooted or tampered with.

It feels a little bit James Bond for a random Tuesday afternoon, but it is actually an incredibly elegant solution to the “Evil Maid” attack—the threat that someone might physically tamper with your device while you leave it in a hotel room. By turning on scheduled remote attestation, you create an automated dead-man’s switch. If someone alters the OS, the hardware signature changes, the server notices the mismatch, and you get an email warning you that your phone is compromised.

For the average user, you just set up an account, link your device, schedule it to run in the background, and then completely forget about it. It is just another invisible layer of that cryptographic blast wall. You can self-host it… I haven’t… I don’t know if I will; this is one of those things I am okay with trusting another app to do.

Closing thoughts

In a lot of ways this blog has become less of a tech blog, and more of a log of self-improvement and learning via tech anecdotes. This post is not one of those; it is more of a sign of the times, and a marker of what is likely going to be a very difficult few decades for people who love the internet and the freedoms it has brought us. I am not a large fan of phrases like Blackpill or Doomer, but it is immensely difficult for me to approach what is happening with tech legislation with much less than anger and despair. Technology has opened us up to knowledge and information the likes of which have never been seen before, but in many ways sometims i feels like gazing upon a man-made horror the like of which we are not supposed to understand. I’m not naive enough to think installing GrapheneOS stops the Online Safety Act, defeats chat control, or fixes the direction tech legislation is heading. We are undoubtedly entering a grim decade for digital freedom. But doom-scrolling about state surveillance while handing over your telemetry on a platter is a choice. GrapheneOS isn’t a silver bullet that saves the internet - it’s a line in the sand for your own pocket. It turns an expensive slab of glass back into what it should have been all along: a tool that serves you, and only you.