Heard some people saying that pixel phones (ironically from google) can be flashed with grapheneOS and the phone can be very secure and is very good with some small hitches when trying to use some apps. Am I tripping balls or can a phone from google be secure or is there some blob that secretly destroys the whole security of the phone?
The Pixel 3 and 4 have a Titan M chip which does improve the security, but the big security problem in Android is the use of the Google Play Store which is filled with malware.
I can’t comment on GrapheneOS since I’ve never used it, but installing an AOSP-derivative (eg, LineageOS, /e/ and GrapheneOS) will get rid of the Google spyware installed by default and then only using apps downloaded from F-Droid or the /e/ Store will get rid of most of the security and privacy problems in Android.
What about spooky hidden spying firmware?
GrapheneOS needs proprietary blobs just like Android preinstalled by the vendors. The only blob free Android is Replicant but it does only work on some devices and usually you need an external WIFI stick. Unfortunately the SIM card has its own proprietary OS.
The firmware is protected against writing by Android’s Secure Boot and the keys are held by the Titan M chip on the Pixel 3 & 4. It would be really hard to change the firmware after fabrication without authorization by the user.
I think @user1 meant “spooky hidden spying firmware” ex-factory i.e. inability to change the firmware is a bad thing, not a good thing.
The bottom line is that your typical Android or spiPhone was not engineered to be private, does not have released schematics, does not intentionally try to avoid blobs, is not 100% open source.
So if there’s some kind of bootloader that runs first - it is a question of trust. There is no verify.
For me the equation is: how much are you willing to pay for privacy? Conversely, how much are you willing to compromise?
1 Like
GrapheneOS seems a lot more secure than purism, but a bit problem with GrapheneOS is how difficult it is to backup, or potentially recover if it has a problem. You can’t just pop the SSD into a new Pixel to recover it because of the Titan M. The options available are pretty far below flying cars 
You can use Seedvault (a backup app integrated into GrapheneOS) and it’s working pretty well.
1 Like