It requires a positive action from the application developer to include GrapheneOS's keys as well as Google's keys. So this is a deliberate positive step, rather than a default.
Only if they are using hardware key attestation. From what I've read elsewhere it looks like it was never broken so maybe they never went that far before.
Makes sense for them to support this given their scale. I wouldn't be surprised if GrapheneOS secures another big Android OEM vendor (after Motorola Mobility) and the user base of the OS quickly grows from its current 400k+ to millions.
Does anyone know anymore on that front? For months, I've regularly looked up whether there were any news, only to find nothing besides the original announcement. No ETA, no upcoming devices to be supported, heck, on the Graphene side, their own webpages make nary a mention. Would buy a Razr 70 Ultra + Clicks the second that is confirmed, but for something that was so publicly announced months ago, this seems very shaky...
At the time of writing, within ~12 months, in 2027, the 2027 Signature, Razr fold, and Razr flip will meet the hardware security requirements and should have official GrapheneOS support.
Motorola is currently porting GrapheneOS to their devices.
I've been looking into GrapheneOS as a longtime Pixel user who is thinking of becoming a bit more security conscious. But, looking around at its current state RE: RCS and camera apps, I think it makes the most sense to stick with stock Android.
I also have a really niche feature I rely on daily (letting me "wifi call" from one sim over the data line of the other sim), and it's really hard to tell if GrapheneOS supports it.
If I can grab my old pixel that's stored in a box at my parents' house on another continent I might give it a try, but GrapheneOS really doesn't seem ready to be a daily driver.
What's the issue with RCS and camera apps? RCS works (from what i've heard) and you get the same image quality as on stock if you install the pixel camera app.
Not sure about that other feature you mentioned, but you can always revert back to stock if you don't like GOS. Restoring a backup is easier than it's ever been nowadays :-).
RCS is fully functional on GrapheneOS with an app supporting it. Google Messages is the only RCS app for Android available in practice. It fully works on GrapheneOS via the official sandboxed Google Play compatibility layer support for it.
Camera features and quality on GrapheneOS are the same as the stock Pixel OS within the same app. Pixel Camera fully works on GrapheneOS even without sandboxed Google Play in the same profile.
GrapheneOS fully supports dual SIM and cross-SIM calling. It has much better support for it than the stock Pixel OS because cross-SIM calling is one of the features which can be force enabled for carriers not usually supporting it with the GrapheneOS carrier overrides. That also applies to 5G, VoLTE, Vo5G and VoWiFi where those can be used on carriers where those aren't available with the stock Pixel OS.
> but GrapheneOS really doesn't seem ready to be a daily driver
GrapheneOS is a daily driver for many people. The 3 things you've listed as concerns work at least as well in GrapheneOS as the stock OS. You're assuming functionality that's available is missing.
> GrapheneOS really doesn't seem ready to be a daily driver.
As someone who has used it exclusively as their mobile OS for three years, it is absolutely ready. Does that mean it's perfect or bug-free? No, but nothing is.
Been using GrapheneOS as daily driver for 4 years on three pixels. Problems only start when banking apps start actively sabotaging it by pretending the phone is rooted etc. Normal apps work normally and you get way more control over them. I'll never go back to stock or worse than stock (Samsung) as long as GrapheneOS is around even if they get rid of all security aspects (which of course they won't, I'm just saying security is not the only selling point, de-googling is a big one too.. I didn't de-google but I sure like having the option)
Roblox has a long history of not supporting Linux, and the game was rendered unplayable for many years. In 2022 it became possible following some Wine patches, but then they began to implement a kernel-level anticheat. Roblox initially committed to keeping Wine working but suddenly went back on that and blocked it without notice. Today, the last remaining way is through running the Android version of the game through an Android container or emulator. The TFA is about stopping this exact method of running the game though...
They're 60% of the North American game's industry revenue growth. Their rival is negative stock market sentiment. They need to pull out all the stops to prove growth.
Don't get too excited, this still goes against the basic freedom to own the devices you've paid for.
Remote attestation is still there and only official builds of GrapheneOS are supported. While this is marginally better than being tied to a build from an advertising company, you're still out of luck if you want to build the OS yourself.
It's Roblox's responsibility to police their platform and the vast majority of bad actors use mainstream operating systems and mainstream services like Discord or Telegram. Clearly lack of privacy does not prevent crime as we can see on Telegram and Discord which are both not E2EE and yet have far more crime taking place then on encrypted alternatives.
The announcement is very funny in that regard, devices with last update in 2023 like the Galaxy S10 are still ok despite having every root exploit under the sun available but god forbid you want to update it to the last version
LineageOS has no AVB support at all unfortunately and most devices don't allow using verified boot with custom keys anyways. With GrapheneOS they can just add GrapheneOS public keys (https://grapheneos.org/attestation.json).
For LOS Roblox would have to disable hardware attestation completely, which means you can easily just add extra modules such as a setuid binary which makes cheating easy (at least on the client side, you'd have to rely completely on server side anti cheating)
While that is true the bigger issue is that LineageOS doesn't qualify for "They do not break the AOSP security model" as it allows users to get root access without modifying the OS. So even if there was verified boot Roblox would still block it.
For me this means that Roblox's requirements are fundamentally incompatible with any device I would want to use as they want to restrict my access and I want full access.
ROM is to android what distro is to Linux. The term is used correctly here. An android ROM could refer to the stock OS, GrapheneOS, LineageOS, Pixel Experience, etc.
LineageOS disables major parts of verified boot, doesn't preserve the security model it depends on and sets an inaccurate security patch level solely based on the AOSP security backports. Most alternative Android-based operating systems are based on LineageOS and inherit these properties from it.
GrapheneOS didn't create any attestation system and has been a very strong advocate against apps disallowing people from using an arbitrary device or OS. For developers insisting on doing it, we explain how to permit other operating systems beyond Google certified ones using the standard Android hardware attestation system. We provide a signed JSON file with our verified boot key fingerprints for use with it. Other operating systems can do the same as long as they preserve the security model including verified boot. It isn't anything added or created by GrapheneOS but rather is fully functional in a properly done release build of the Android Open Source Project signed with release keys.
They're doing attestation checks to enforce having a Google certified device and OS. They followed our attestation compatibility guide to support GrapheneOS by permitting the verified boot keys for it and have said they're open to permitting other operating systems in the same way. It would be better if apps didn't do this but if they're going to do it then this is much better than only permitting a Google certified OS.
Roblox goes out of the way to explicitly support GrapheneOS. They permit GrapheneOS users to join servers enforcing remote attestation to verify the OS and app as a form of anti-cheat. They need to explicitly add the verified boot keys for each non-Google-certified OS. GrapheneOS is currently the only one they're supporting but they're making it clear that it's not at all exclusively available to it.
It would be accurate to call it official support if it means they have set up their app with the privacy-friendly Android Hardware Attestation API on GrapheneOS.
Unless I'm wrong and they just support Basic Play Integrity or a lower one, I don't know much about that. But those would require play services. I could test to see if it works without play services which would indicate they are using the Hardware Attestation API to check the bootloader lock.
This is a really interesting signal tbh.
While it sounds like it already works on GrapheneOS having a corporation come out and say they won't go out of their way to break it is quite unusual.
It requires a positive action from the application developer to include GrapheneOS's keys as well as Google's keys. So this is a deliberate positive step, rather than a default.
Only if they are using hardware key attestation. From what I've read elsewhere it looks like it was never broken so maybe they never went that far before.
1 reply →
Makes sense for them to support this given their scale. I wouldn't be surprised if GrapheneOS secures another big Android OEM vendor (after Motorola Mobility) and the user base of the OS quickly grows from its current 400k+ to millions.
> after Motorola Mobility
Does anyone know anymore on that front? For months, I've regularly looked up whether there were any news, only to find nothing besides the original announcement. No ETA, no upcoming devices to be supported, heck, on the Graphene side, their own webpages make nary a mention. Would buy a Razr 70 Ultra + Clicks the second that is confirmed, but for something that was so publicly announced months ago, this seems very shaky...
I don't think we'll see it before CES in January.
At the time of writing, within ~12 months, in 2027, the 2027 Signature, Razr fold, and Razr flip will meet the hardware security requirements and should have official GrapheneOS support.
Motorola is currently porting GrapheneOS to their devices.
They're too busy pushing malware on the rest of their lineup in system updates left, right, and center.
silently re-enables com.glance.lockscreenM one more time on you...
I've been looking into GrapheneOS as a longtime Pixel user who is thinking of becoming a bit more security conscious. But, looking around at its current state RE: RCS and camera apps, I think it makes the most sense to stick with stock Android.
I also have a really niche feature I rely on daily (letting me "wifi call" from one sim over the data line of the other sim), and it's really hard to tell if GrapheneOS supports it.
If I can grab my old pixel that's stored in a box at my parents' house on another continent I might give it a try, but GrapheneOS really doesn't seem ready to be a daily driver.
What's the issue with RCS and camera apps? RCS works (from what i've heard) and you get the same image quality as on stock if you install the pixel camera app.
Not sure about that other feature you mentioned, but you can always revert back to stock if you don't like GOS. Restoring a backup is easier than it's ever been nowadays :-).
21 replies →
RCS is fully functional on GrapheneOS with an app supporting it. Google Messages is the only RCS app for Android available in practice. It fully works on GrapheneOS via the official sandboxed Google Play compatibility layer support for it.
Camera features and quality on GrapheneOS are the same as the stock Pixel OS within the same app. Pixel Camera fully works on GrapheneOS even without sandboxed Google Play in the same profile.
GrapheneOS fully supports dual SIM and cross-SIM calling. It has much better support for it than the stock Pixel OS because cross-SIM calling is one of the features which can be force enabled for carriers not usually supporting it with the GrapheneOS carrier overrides. That also applies to 5G, VoLTE, Vo5G and VoWiFi where those can be used on carriers where those aren't available with the stock Pixel OS.
> but GrapheneOS really doesn't seem ready to be a daily driver
GrapheneOS is a daily driver for many people. The 3 things you've listed as concerns work at least as well in GrapheneOS as the stock OS. You're assuming functionality that's available is missing.
I did have RCS issues with GrapheneOS (on T-Mobile in the US) for a while, but at some point that was fixed and it works flawlessly now.
As for camera apps, the stock GrapheneOS camera app is a bit clunky, I just download the stock Android "Camera" off of the Play Store...
4 replies →
> GrapheneOS really doesn't seem ready to be a daily driver.
As someone who has used it exclusively as their mobile OS for three years, it is absolutely ready. Does that mean it's perfect or bug-free? No, but nothing is.
Been using GrapheneOS as daily driver for 4 years on three pixels. Problems only start when banking apps start actively sabotaging it by pretending the phone is rooted etc. Normal apps work normally and you get way more control over them. I'll never go back to stock or worse than stock (Samsung) as long as GrapheneOS is around even if they get rid of all security aspects (which of course they won't, I'm just saying security is not the only selling point, de-googling is a big one too.. I didn't de-google but I sure like having the option)
If it become to big, it will go the same way as CyanogenMod, Google will send some people to pressure the manufacturers to drop them off
Google is the only one supporting them currently.
1 reply →
[flagged]
They've doubled their users in 2 years
Why are you being so aggressive?
Pathetic.
Seems ridiculous, but when their biggest rival can’t be bothered to support Linux… you see why they might announce something like this.
Roblox has a long history of not supporting Linux, and the game was rendered unplayable for many years. In 2022 it became possible following some Wine patches, but then they began to implement a kernel-level anticheat. Roblox initially committed to keeping Wine working but suddenly went back on that and blocked it without notice. Today, the last remaining way is through running the Android version of the game through an Android container or emulator. The TFA is about stopping this exact method of running the game though...
This isn't true. Roblox never had and does not have a kernel anti-cheat.
9 replies →
The TFA explains that it is up to game to decide if they want to use attestation.
Who's their biggest rival? Roblox doesn't support Linux either.
Let me rephrase, it doesn’t actively oppose Linux like Fortnite does. Roblox absolutely can run on Linux, even though it’s not officially supported.
10 replies →
I'd assume Fortnite Creative
They don't officially support Linux, but they allow the community to continue playing using Sober. Honestly it's probably better that way
They're 60% of the North American game's industry revenue growth. Their rival is negative stock market sentiment. They need to pull out all the stops to prove growth.
Fortnite
“You have reached your limits on help.roblox.com”
That is the first time I see something like that!
Great news! I never had problems running Roblox on my GOS, but it's nice to to see the explicit, official support.
Snowball effect (for both sides, software publishers and OS vendors).
Don't get too excited, this still goes against the basic freedom to own the devices you've paid for.
Remote attestation is still there and only official builds of GrapheneOS are supported. While this is marginally better than being tied to a build from an advertising company, you're still out of luck if you want to build the OS yourself.
Please don’t let your kids on this platform…
I guess that makes sense given the type of adults that prowl on Roblox.
It's Roblox's responsibility to police their platform and the vast majority of bad actors use mainstream operating systems and mainstream services like Discord or Telegram. Clearly lack of privacy does not prevent crime as we can see on Telegram and Discord which are both not E2EE and yet have far more crime taking place then on encrypted alternatives.
wow what a nonsensical argument. "not all criminals wear ski masks. so let's let let anyone walk on school premises wearing a sky mask"
That's excellent news!! Hope to see more of this!!
However, if on LineageOS, which mind you is the only way to get updated (and thus safer) android versions in many devices, they simply block you.
Awful.
The announcement is very funny in that regard, devices with last update in 2023 like the Galaxy S10 are still ok despite having every root exploit under the sun available but god forbid you want to update it to the last version
LineageOS has no AVB support at all unfortunately and most devices don't allow using verified boot with custom keys anyways. With GrapheneOS they can just add GrapheneOS public keys (https://grapheneos.org/attestation.json).
For LOS Roblox would have to disable hardware attestation completely, which means you can easily just add extra modules such as a setuid binary which makes cheating easy (at least on the client side, you'd have to rely completely on server side anti cheating)
https://eylenburg.github.io/android_comparison.htm
While that is true the bigger issue is that LineageOS doesn't qualify for "They do not break the AOSP security model" as it allows users to get root access without modifying the OS. So even if there was verified boot Roblox would still block it.
For me this means that Roblox's requirements are fundamentally incompatible with any device I would want to use as they want to restrict my access and I want full access.
Truth be told, GrapheneOS is the only third party ROM that bothers to make app attestation work.
It's not a ROM it's an OS.
ROM is to android what distro is to Linux. The term is used correctly here. An android ROM could refer to the stock OS, GrapheneOS, LineageOS, Pixel Experience, etc.
7 replies →
[flagged]
LineageOS disables major parts of verified boot, doesn't preserve the security model it depends on and sets an inaccurate security patch level solely based on the AOSP security backports. Most alternative Android-based operating systems are based on LineageOS and inherit these properties from it.
[flagged]
GrapheneOS didn't create any attestation system and has been a very strong advocate against apps disallowing people from using an arbitrary device or OS. For developers insisting on doing it, we explain how to permit other operating systems beyond Google certified ones using the standard Android hardware attestation system. We provide a signed JSON file with our verified boot key fingerprints for use with it. Other operating systems can do the same as long as they preserve the security model including verified boot. It isn't anything added or created by GrapheneOS but rather is fully functional in a properly done release build of the Android Open Source Project signed with release keys.
support?
I'm yet to come across an Android app I can't run on GrapheneOS.. what exactly are they doing?
They're doing attestation checks to enforce having a Google certified device and OS. They followed our attestation compatibility guide to support GrapheneOS by permitting the verified boot keys for it and have said they're open to permitting other operating systems in the same way. It would be better if apps didn't do this but if they're going to do it then this is much better than only permitting a Google certified OS.
[flagged]
[dead]
[flagged]
Roblox goes out of the way to explicitly support GrapheneOS. They permit GrapheneOS users to join servers enforcing remote attestation to verify the OS and app as a form of anti-cheat. They need to explicitly add the verified boot keys for each non-Google-certified OS. GrapheneOS is currently the only one they're supporting but they're making it clear that it's not at all exclusively available to it.
It would be accurate to call it official support if it means they have set up their app with the privacy-friendly Android Hardware Attestation API on GrapheneOS.
Unless I'm wrong and they just support Basic Play Integrity or a lower one, I don't know much about that. But those would require play services. I could test to see if it works without play services which would indicate they are using the Hardware Attestation API to check the bootloader lock.