The thing that annoys me about GrapheneOS is that it is not possible to install a sudo binary or to root the phone. I get that this is a Good Thing from a security perspective, but I don't like the fact that I can't install AdAway for resource-less adblocking with an edited hosts file, the ability to SSH into my phone with a certificate, or the ability to make good "nandroid" backups. I also philosophically like the fact that I'm in control, ultimately, of my device and if I want to send an app fake data, I can do so. The GrapheneOS developers have quite sternly said that they won't ever develop a rootable version of the OS, and that makes me sad.

There's also ProtonAOSP, which allows you to choose between no Google services, microG, sandboxed Google Play Services, and bundled Google Play Services:

https://protonaosp.org/gapps

ProtonAOSP works with root, and the documentation explains how to use it with Magisk:

https://protonaosp.org/root

ProtonAOSP also passes SafetyNet by default, as of right now.

The developer of ProtonAOSP (kdrag0n) is also the GrapheneOS contributor who implemented the Google Play Services sandbox for that OS.

ProtonAOSP supports the Pixel 4/XL, 4a/5G, 5, and 6/Pro. It does not currently support the Pixel 5a.

This looks fantastic – thank you. A pity I don't think it's compatible with my OnePlus 5, although there is a fork on Github.

You can always compile it with any such changes baked in.

> Why LineageOS and not GrapheneOS?

One problem with GrapheneOS is that it only supports a tiny handful of devices, and only for few years (at best) per device. A lot of people can't afford to keep buying Pixel phones on that schedule, and some who can afford it find the e-waste unappealing.

This isn't exactly the project's fault. It's more a side effect of an industry that prevents customers from securely installing an OS on their own hardware, and/or refuses to provide firmware security updates beyond a rather short time frame.

I hope that changes. I love what GrapheneOS attempts to do, but at the moment, I think using it is unreasonably hard on the budget and the environment.

Starting from the current Google Pixel, Google will support them for at least 5 years.

Five years from when? The purchase date, or the product introduction date? If the latter, the effective support lifetime will be (on average) much shorter.

Product release date of course.

Other devices compromise on security.

Indeed. Which brings us back to my original comment.

The choice is between GrapheneOS + Sandboxed Google play vs LineageOS + MicroG.

If you care too much about privacy, GrapheneOS is the way to go. If you want a balance between privacy and usability, LineageOS is the way to go. Also, GrapheneOS only supports Pixel phones.

I have tried CalyxOS but there are too many issues.

> If you care too much about privacy, GrapheneOS is the way to go

Not so sure about that. If you care about SECURITY than GrapheneOS is pretty much the best choice on the market, comparable only to iOS or bare Android on Pixel Phones. Everyone else isn't even reasonable to compare against it.

But wether it's more private with sandboxed Google Play Services vs Lineage OS and MicroG or iOS is not such an obvious choice to me.

If you want privacy, don't install anything Google or microG. Surprisingly many apps from Play store (via Aurora or sideloaded) still work (not all features though) - but if you want privacy, don't even use Play store via Aurora.

Not using Aurora and micro made banking impossible in my case... Well, I almost completely de-googled so I don't complain too much. Maybe keeping my old phone for banking only and using a pinephone for everything else would work, I have to investigate that!

I just use the web version of internet banking. One of my banks doesn't have responsive website, but for sending money and setting card limits it's still more than enough.

Lots of banks require their particular 2FA Apps

Yeah, I went to the local branch, pulled out my old Nokia 3310 and asked them to install the app. They promptly switched me back to SMS auth.

By "sandboxed Google Play" do you mean using the Aurora app?

Coming from iPhone, something I keep forgetting is the full support for PWA apps on Graphene OS. I wish there were PWA versions of apps like Signal, Wire, ProtonMail, and more; so much cleaner to update the app through a deliberate refresh than going through a middle-man service like F-Droid.

They support actual Google Play Services in a sandbox: https://grapheneos.org/faq#google-services

Word! PWAs are awesome (for a lot of usecases), and I don't quite get how they are not becoming a center pillar of mobile development.

Sanboxed Play Services nets more app compatibility than LineageOS+MicroG, I don't understand your usability argument.

What issues have you experienced with CalyxOS? Asking as a daily user of CalyxOS. I have not had any real issues, but I also don't install many apps on my phone.

For one, they recently were unable to give monthly security updates for 3 months or so.

The "usability" thing is quite frankly, bullshit.

Sandboxed play services is quite literally play services you're allowed to deny permissions to, it offers way more compatibility than microg which replaces play services with it's own thing

Seems like GrapheneOS officially supports a very small subset of devices, aka only Pixel phones right now https://grapheneos.org/faq#supported-devices

Because GrapheneOS supports a handful of devices (https://grapheneos.org/faq#supported-devices), where LineageOS supports hundreds of devices (https://wiki.lineageos.org/devices/).

I wish GrapheneOS was available on OnePlus.

Take a look at my DivestOS project, I support OnePlus 1-7 devices.