Recommendations needed for switching to privacy-friendly mobile OS

[BlackHatCoiner]

I hate Reddit, and because this community is very sensitive with privacy, I want some help regarding which mobile OS best fits my needs.

So, I recently stumbled across this paper, which describes how a deep-learning attack can be executed to de-anonymize you if smartphone is near the keyboard: https://arxiv.org/pdf/2308.01074.pdf. Their research shows that with the acoustic side channel attacks they've executed, there is 95% accuracy on phone-recorded laptop keystrokes. This means that even if you're running some super privacy-respecting software like Tails, if you're carrying a smartphone around you, there is chance that the closed-source Android OS can use VoIP and de-anonymize that little privacy square left.

As the icing on the cake, I'm interested in running a transparent, privacy-focused mobile OS to sleep easy. It has to fulfill the following criteria:

• It has to be Android-based.
• Has to have serious development (not a project that can be abandoned the other month).
• I will be able to have apps like Instagram, Messenger, Discord, and anything that uses micro-G. (and support notifications without problems)
• It needs to be open-source and privacy-focused.

I have concluded GrapheneOS, LineageOS and CalyxOS are what govern the space, but I'm quite lost to be honest. I want to read your thoughts on this.


Edit: I tried GrapheneOS. Read: https://bitcointalk.org/index.php?topic=5463809.msg63022282#msg63022282

[1714269698]

1714269698

[1714269698]

1714269698

[1714269698]

1714269698

[_act_]

I know of Calyx OS. It is open source but only working mostly on Google devices, but probably on few other devices. If you can use it, it would be better than google. This OS was created for privacy reasons. LineageOS support more devices but very few too. GrapheneOSis only working on Google devices.

My advise is that if you have computer, use it for privacy things like wallet instead. I have not seen developers that say these mobile phone OS are good, but Linux on computer is highly recommended.

Those apps or sites like Instagram and Facebook messenger have nothing to do with privacy, they are privacy invading.

[Findingnemo]

You can also consider /e/OS, It is an open-sourced version of Android with No Google apps so you can have the privacy you wanted.

Importantly, Google Services have been replaced by microG, it means you can install your favorite apps too.

Github: https://github.com/e-foundation
Website: https://e.foundation/e-os/?ref=itsfoss.com
Supported device: https://doc.e.foundation/devices

And really, do You want to install Instagram on a private device? I think you should avoid installing any apps from Google and Facebook because you never know how much deeper they are into tracking our data.

Those apps or sites like Instagram and Facebook messenger have nothing to do with privacy.

Really? Both these apps have access to your device's camera, file manager, and microphone so it's like a spy app that is monitoring all the users 24/7.

[_act_]

Those apps or sites like Instagram and Facebook messenger have nothing to do with privacy.

Really? Both these apps have access to your device's camera, file manager, and microphone so it's like a spy app that is monitoring all the users 24/7.

I mean if you are using Instagram, Facebook messenger and other social media, that they privacy invading. I have eidted it for people not to get confused of what I am trying to communicate.

[BlackHatCoiner]

Those apps or sites like Instagram and Facebook messenger have nothing to do with privacy, they are privacy invading.

I know, but nonetheless, necessary to communicate with my people.

You can also consider /e/OS

I had never heard of that before. Seems like they're running this since 2018, as they say they were the first to release a deGoogled mobile OS. I don't know, from what I can tell, it doesn't differ much from the OSes that I have already mentioned.

And really, do You want to install Instagram on a private device? I think you should avoid installing any apps from Google and Facebook because you never know how much deeper they are into tracking our data.

I'm comfortable with knowing when and where they're spying. That's why I'm looking for a privacy-focused OS; so I can limit privacy permissions. What I'm not comfortable with is not knowing that my phone might be recording me when I have no application in the background, and when it's closed.

[Faisal2202]

So, I recently stumbled across this paper, which describes how a deep-learning attack can be executed to de-anonymize you if smartphone is near the keyboard: https://arxiv.org/pdf/2308.01074.pdf. Their research shows that with the acoustic side channel attacks they've executed,

I did not quite understand you need a OS which should be based on Android and at the same time it must not be an Android? Because you said:

there is chance that the closed-source Android OS can use VoIP and de-anonymize that little privacy square left.

Well, the problem you are discussing here is, if my smartphone is near the keyboard then the strikes on the keyboard could be recorded as when we hit any key a sound is created and then by using DL attackers could synchronize those keystrokes to make useful meanings such as while we are types our phones numbers, or email or Pin codes etc.

The things which i do not understand here is:
First
If attackers could use your phone to get the audio of your keystrokes then your phone is already compromised so don't you worry about that instead of worrying about keystrokes audio leaking.
Second
If you think it is a risk then why taking such risk. Put your phone away from the keyboard matter solved.
Third
If you still thing that you can not resist to keep your phone away by your keyboard side then use a touch keyboard where no sound will be created or buy a laptop like the new Lenovo Yoga laptop which have touch screen key board. If not then buy only a touch screen keyboard and you would be good to go.

Talking about Lenovo Yoga Book 9i --------- https://mashable.com/archive/cool-leaf-keyboard

[BlackHatCoiner]

I did not quite understand you need a OS which should be based on Android and at the same time it must not be an Android?

No, I said that I don't want a closed-source Android, such as the one Pixels, Samsungs, Xiaomis, etc., have pre-installed. I very much like Android as an OS however, and there exist open-source alternatives like LineageOS and CalyxOS, which are Android-based.

If attackers could use your phone to get the audio of your keystrokes then your phone is already compromised so don't you worry about that instead of worrying about keystrokes audio leaking.

Or be worried about both. Recording me without my permission is the worst, but recording what I type is another level of creepiness.

If you think it is a risk then why taking such risk. Put your phone away from the keyboard matter solved.

The keyboard isn't the sole problem. It's the lack of transparency that makes me think I carry a surveillance device everywhere. I can't put my phone away on everywhere I go.

[BitMaxz]

I have a list of Android OS on my bookmarks most of them have open-source code and some of them don't have an open-source or dead GitHub link.

If you want to check you can find it here "Awesome Android OS List"

I never tested other customs Android OS yet listed above except for LineAge, Cyanogenmod, and Clockworkmod this is a known custom ROM before when I have a Galaxy Y phone that can easily flash through Odin.

Right now it's not easy to flash a unit(Newer phones) with modded/custom ROMs if you flash the wrong firmware there is a possibility your phone may become bricked or dead boot which is not easy to fix.

[Faisal2202]

No, I said that I don't want a closed-source Android, such as the one Pixels, Samsungs, Xiaomis, etc., have pre-installed. I very much like Android as an OS however, and there exist open-source alternatives like LineageOS and CalyxOS, which are Android-based.

Hmm Ok got your point. LineageOS is discontinued so there will be update problems like you wanted to use all types of social media platforms. But CalyxOS seems to be a good option here why don't you try that. But I visited the CalyXOS they have less visitors means the users of this OS must be lower too. I have found some other options for you which are following:

• https://grapheneos.org/
• https://resurrectionremix.com/
• https://paranoidandroid.co/ ---> It seems it has some limitations like it might not be run on Samsung phones as by visiting the website you can see on which smartphones you could install it.

IMHO I can say Grapheneos is a better option here but just to clarify I did not tried any of these before instead did some researched as this really excited me after knowing that we can also install OS on our phones other than some Android OS. Why I never thought of it because I never thought or being to careful to find that it's a problem or it might become one just like you pointed out that these issues might provide opportunity to hacker to compromise your device.

The keyboard isn't the sole problem. It's the lack of transparency that makes me think I carry a surveillance device everywhere. I can't put my phone away on everywhere I go.

What about the third option but I think you are also looking at a cheap option too instead of spending more money on such devices I think downloading and installing a new OS is better option.

[BlackHatCoiner]

LineageOS is discontinued so there will be update problems like you wanted to use all types of social media platforms.

Where did you get that information from? Their Github repo is updated recently.

Why I never thought of it because I never thought or being to careful to find that it's a problem or it might become one just like you pointed out that these issues might provide opportunity to hacker to compromise your device.

As a LineageOS user, I have to tell you that it's a lot better, even if you don't have privacy concerns as I do. The OS runs smoothly, there are no advertisements (as with Samsung and Xiaomi) in default apps, it runs faster etc.

If you're that paranoid, you could just move your smartphone away from your keyboard or cover your smartphone microphone.

I don't understand why I'm being called a paranoid here. I don't find neither Xiaomi nor Google trustworthy with my privacy. Both are data sharks, and both rely on personal data to survive. It makes no sense to trust their word that they don't spy the device, even if I haven't given the permission. They have quite an awful history with securing privacy.

LineageOS definitely doesn't match your requirement since their website/wiki doesn't state anything about privacy-focused feature.

They aren't privacy focused, but that's enough:

Your data, your rules. Along with monthly security updates to every supported device, we enhance existing privacy touchpoints around the OS and keep you informed of how the system shares your data.

[dkbit98]

This means that even if you're running some super privacy-respecting software like Tails, if you're carrying a smartphone around you, there is chance that the closed-source Android OS can use VoIP and de-anonymize that little privacy square left.

Realistic chances of this scenario happening in real world is minimal, but smartphones are generally a privacy nightmare so it's best not to use them when you want to maintain privacy.
Good old mobile phones still work fine if you want to call someone, receive calls and send/receive sms messages.
If you want more than you can use some of the mobile OS options you mentioned.

I have concluded GrapheneOS, LineageOS and CalyxOS are what govern the space, but I'm quite lost to be honest. I want to read your thoughts on this.

GrapheneOS is best you can get for privacy & security if you want OpenSource software on your smartphone that is updated frequently and it follows Android updates.
Note that GrapheneOS works only with Pixel phones, they can be found very cheap and they have several years for receiving updates.

PS
Don't expect to find perfect working solution.
There is pros and cons with everything.

[BlackHatCoiner]

Update: I got myself a Pixel and installed GrapheneOS. One of the best mobile purchases, and the best mobile OS by far. Here are some key differences comparably to LineageOS:

- Allows you to give network permission whenever you install an app. That means if an app is malicious and doesn't get network and storage permission, it can't harm you. Not sure if Lineage lacked that feature, but it definitely didn't prompt me for network permission during installation.
- Sandboxed Google services. Let's be honest, we all need Google services. That sandbox solution is these services without the tradeoff of allowing Google messing with your phone as it gets limited permission. More info: https://grapheneos.org/features#sandboxed-google-play
- Comes with a privacy-focused, lightweight browser called "Vanadium": https://grapheneos.org/features#vanadium
- It signals when a hardware component is used. For example, if an app uses microphone, it will signal that microphone is used, which is useful if you want to know what closed-source apps are doing in the background. I recently noticed Instagram uses the camera at random times while browsing. That's creepy.
- Zero ads guys. None. Got rid of Xiaomi's annoying ad-based OS, replaced YouTube with Vanced, and now I'm basically ad free.

OP edited.

[dkbit98]

Update: I got myself a Pixel and installed GrapheneOS. One of the best mobile purchases, and the best mobile OS by far. Here are some key differences comparably to LineageOS

Good choice!
If it's not a secret, what model you purchased exactly?
Pixels are good devices, but some of the models can be bigger and heavier than other smartphones (especially for people who use iPhones),
and they have few more stupid little stuff, for example you can't connect pixel with external monitor using usb type-c connection.

- Sandboxed Google services. Let's be honest, we all need Google services. That sandbox solution is these services without the tradeoff of allowing Google messing with your phone as it gets limited permission.

You can even create two profies.
One only for g00gle services, and other totally clean of that.
Many google services have decent alternatives that wor fine most of the time, aurora store works good now, and there is also F-droid or similar stores.
Note that pixel camera app is inferior to google cam app, especially when recording videos.

Zero ads guys. None. Got rid of Xiaomi's annoying ad-based OS, replaced YouTube with Vanced, and now I'm basically ad free.

You can still use your old Xiaomi device as offline bitcoin wallet, or in some multisig setup.

- Zero ads guys. None. Got rid of Xiaomi's annoying ad-based OS, replaced YouTube with Vanced, and now I'm basically ad free.

True, unless you install apps with ads  

Do you have any idea how good is it compared with Firefox (in terms of privacy and security)?

It's much better than Firefox, because Mozilla development for mobile devices is way inferior, both in terms of privacy and security.

[BlackHatCoiner]

Do you have any idea how good is it compared with Firefox (in terms of privacy and security)?

I couldn't be so arrogant to make a fair comparison as they're way out of my field, but I know Firefox is pretty much having the most development along with Chrome. However, none of these are privacy focused. Graphene team aims to provide both sufficient privacy and security with Vanadium: https://grapheneos.org/usage#web-browsing. It is also a fork of Chromium, so I presume it inherits serious development.

Just wondering, which Vanced you use? Since the original/first one forced to be shutdown by google, it's hard to track which fork is legit or works.

I recently stumbled across Revanced: https://revanced.app/, which is pretty much the same thing (except that this one works). From desktop, if you haven't already noticed, YouTube requests you to disable ad blocker after you watch three videos, so I had to figure out an alternative client-side for that too. The best ones I've found are piped.video and invidious.

If it's not a secret, what model you purchased exactly?

6A. Best Pixel.

Note that pixel camera app is inferior to google cam app, especially when recording videos.

I really haven't paid much attention, but it seems better and simpler. 

[dkbit98]

6A. Best Pixel.

I wouldn't say it's the best pixel, but certainly one of the lighter options with only 178 g (6.28 oz), and it can be found very cheap.
Let me make few comparisons with pixel 6 with 207 g (7.30 oz) or pixel 6 pro with 210 g (7.41 oz), trust me this is a big difference for wrists.
Pixel 5 was even lighter than 6a, but problem is that updates wont be available for much longer on that device, EOL is October 2023.
Pixel 7 = 197 g, pixel 7a =  193.5 g, Pixel 8 = 187 g, Pixel 8 Pro = 213 g.
 

I really haven't paid much attention, but it seems better and simpler.  

It makes very shaky videos because video stabilization is not yet on the level with Gcam.
Easy to install Gcam now and use both versions as needed.

[BlackHatCoiner]

I wouldn't say it's the best pixel, but certainly one of the lighter options with only 178 g (6.28 oz), and it can be found very cheap.

I'm not into smartphones (as you might have already acknowledged from the context), but I had read that 6A was particularly chosen to be the best in terms of price : camera. I think someone had conducted an anonymous poll where the same picture was taken by lots of phones, and it let you vote for the best picture; people unknowingly chose the 6A one. It is also pretty light and comfy. I had read Pixel 7 faced some issues with Graphene, so there's where my conclusion originates.

Easy to install Gcam now and use both versions as needed.

No problem. As said, as long as the app requires no network permission to work, and gains limited permission as to which files it can access, then it is harmless.

[libert19]

Allows you to give network permission whenever you install an app. That means if an app is malicious and doesn't get network and storage permission, it can't harm you. Not sure if Lineage lacked that feature, but it definitely didn't prompt me for network permission during installation.

Those looking for similar functionality on non-graphene android can use Netguard [1], set default setting as block mobile/wi-fi and no installed or to be installed app will have Internet access by default, works on all system/user apps.

Regarding storage permission, all recent android versions are coded to ask for user permission before app can access storage, Lineage would have been no exception.


[1] https://play.google.com/store/apps/details?id=eu.faircode.netguard

[Outhue]

@Blackhatcoiner I got your back

I am currently running LineageOS on my android smartphone right now coming from a MIUI OS, and so far I believe this OS got what you want, if you need me to carry out any testing you are free to ask and I will reply you Asap.

Here are few advantages of Lineage OS after using for months now.

1. Almost every week you get constant updates, and do not worry, your OS isn't going to get old, they are very active and always throw me the latest Android Version and patches.

2. It's very stable, I am so much liking this OS, I mean everything works out of the box and I wished this was how I purchased my phone in the first place.

3. Unlimited customization options are available, and this includes privacy control via app permissions, unlike the old OS I was using before.

4. It's fully open-source and it comes with De-Google, Google apps isn't included and if you need you will have to flash Gapps minis or other Gapps package, Bank apps work and no single app had any hiccups.

I've not tested Graphene OS but it's for the Google Pixel phones, if you have google phones it could be the best choice but on other android phones Lineage OS rocks. Switch to Lineage OS if you are concerned about your Privacy.

Feel free to ask me anything about LineageOS.