A Blog by Expatriotic

GrapheneOS

If you enjoy the post, throw a few sats to help this dissatisfied employee of the rat race.

Core Philosophy

  1. Privacy ≠ Optional: Prevents mass data collection by design
  2. Security > Convenience: Sacrifices "smart" features for exploit resistance
  3. Transparency: Every line of code auditable
  4. Device Sanity: Removes 2M+ lines of Google telemetry code
  5. Proactive Hardening: Replaces reactive "vulnerability whack-a-mole" with systemic memory safety improvements. 73% of Android CVEs prevented via Scudo++ allocator and Rust integration.
  6. Hardware Paradox: Uses Google Pixels because of their Titan M2 secure enclave (physically separate from main CPU, Verified Boot with user-defined root of trust, Firmware-level MAC randomization (prevents Wi-Fi tracking)).
  7. Support Superiority: GrapheneOS support for Pixel phones is 2 years longer Google's.

"We're eliminating entire vulnerability classes - not just patching holes."

History

"Our Auditor app detects hardware tampering better than Apple's T2 chip."

Installation

Beginners: Web Installer

  1. Enable OEM Unlock:
    Settings → About → Tap Build Number 7x → Developer Options → OEM Unlocking
  2. Visit grapheneos.org/install
  3. Connect phone → Follow prompts (20 minutes)

Advanced: CLI install

"We're proving iPhones aren't the only secure option - just better marketed."

Post-Install Checklist

[ ] Deny all "convenience" permissions
[ ] Enable Sensors Off toggle
[ ] Install Auditor app
[ ] Sensors Killswitch: Quick Settings → Toggle Off
[ ] Network Restrictions:

Settings → Network & Internet → Firewall  
- Enable per-connection MAC randomization  
- Block local network discovery

[ ] Auditor Validation: Daily automated checks against Google's hardware certs

Setting up

Priority Sources

  1. Accrescent (Pre-installed)

    • Molly (Signal fork)
    • Aves Gallery (EXIF stripping)
    • AppVerifier (APK validation)

  2. Obtainium (GitHub)

    1. Search "[App] GitHub releases"  
2. Copy releases page URL  
3. Paste into Obtainium → Auto-updates enabled
    • Example: NewPipe → https://github.com/TeamNewPipe/NewPipe/releases

  3. Google Play (Last Resort)

    • Use separate profile
    • Burner account: Fake name + NO phone number

FOSS Apps

"Your phone is a corporate surveillance device that happens to make calls. GrapheneOS removes the spyware OS while keeping the secure hardware."

No Phone Number Required

Visit Silent.Link → Select data plus eSIM plan (with NO phone number).

I've used this successfully in many countries. It even gives me unfettered and free internet in China. Be sure to pick the telecom company based on what they charge per GB of data. The difference can be 100x!

Support the Project:

"GrapheneOS isn't about becoming a privacy expert overnight. It's about systematically removing corporate surveillance hooks - one app, one permission, one profile at a time."

Moar Halp

I probably had my toddler screaming in the background as I wrote this.

Tip Jar 🫙
Bitcoin⚡️expatriotic@coinos.io
Donations
Bitcoin paynym = +expatriotic
Monero QR