Why GrapheneOS

1. What it is

GrapheneOS is an open-source OS based on Android (AOSP), with strong security hardening and no Google services in the system. It runs only on Pixel phones — for a specific reason (see §7). It keeps Android fully usable, but takes away Google's role as the "owner" of your phone.

2. A harder core (hardening)

• › Hardened memory allocator (hardened_malloc) and extra exploit mitigations — bugs are harder to weaponize.
• › MTE (Memory Tagging) on newer Pixels — hardware protection against memory-safety bugs.
• › Hardened kernel, reduced APIs, unnecessary attack surface disabled.

3. Real privacy control

• › Network permission toggle — you can deny an app internet access (even one that "must have it").
• › Sensors toggle — cut an app off from the accelerometer, gyroscope, compass, etc.
• › Storage Scopes / Contact Scopes — an app sees only the files/contacts you point it to, instead of demanding access to everything.

4. Google without Google

Sandboxed Google Play — if you need apps that require Google services, you install them as a regular app with no system privileges, confined in a sandbox. You get compatibility, but Google gets no privileged access to the system. You can also skip Play entirely.

5. Isolation — many "phones" in one

User profiles (each separately encrypted): e.g. everyday, banking, work, anonymous (Tor-only, no Google). One profile's apps and data are invisible to the others. Plus a guest profile and app-to-app isolation. Practical compartmentalization of your life's spheres.

6. Integrity & anti-forensics

• › Verified boot + remote hardware attestation (Auditor) — detects whether the system has been tampered with.
• › Duress PIN/password — entering an alternate code triggers an irreversible wipe of the device.
• › Auto-reboot after inactivity — the phone returns to the "before-first-unlock" state (data encrypted in memory, keys evicted) → resistance to forensic tools (e.g. Cellebrite).
• › PIN attempt limits, fast and regular security patches.

7. Why Pixel specifically

It's not a whim. Pixels have the Titan M2 secure element, full verified boot with the ability to re-lock the bootloader on your own key (other phones don't allow this), hardware attestation and the longest support (7 years of updates). That's why GrapheneOS supports Pixels only — it's the only place the full security model is achievable.

8. Vs stock Android / iPhone (honestly)

9. Three levels

10. Honest limitations

• › Requires a Pixel phone (you have to buy one).
• › Some banking / DRM apps may not work — though Sandboxed Play + hardware attestation is often enough; some banks still block.
• › A mild learning curve (profiles, scopes).
• › It's not "invisibility" — it protects the device, but not your accounts or metadata while you're signed in.

11. PivLab — setup

We'll prepare a Pixel with GrapheneOS in a multi-profile architecture matched to your threat model: re-lock, Sandboxed Play where needed, Scopes, always-on VPN, private messaging, Duress. You get a ready, hardened phone.