Comment by prmoustache
2 days ago
What GrapheneOS is missing is a complete backup and restore solution so that people can preventively wipe their smartphone before crossing the border. It would be nice to have the possibility to backup/restore every app and their data from an ssh/sftp server the way google/apple users do with google cloud / icloud. I'd rather wipe my smartphone, only add a couple of direct contacts, a copy of my passport and the pdf of my plane tickets, take the plane and cross the border with a smartphone with very little but real personal data they already know and be able to provide my PIN/password to law enforcement if they ask for it, abiding with law if such a law exist (which is the case in my home country), than using a duress and risk prosecution.
Sure that doesn't protect your data from any other attack vector but it allows you to travel with less risk of getting detained by law enforcement of a country you are visiting. You get asked your password, you can give it, and they see a phone that is used like a dumbphone. If you get questioned for that a simple "my phone died yesterday, a friend just gave me his old pixel". If you need more stuff/information during your travel you would basically only need to remember the passphrase to access a password manager or a remote ssh server but you can restore only the stuff you need when travelling and and wipe again at any moment.
Having said that maybe it is better to set this up some way but not have it builtin so that law enforcement doesn't expect that any grapheneos user would have his data on an sftp server somewhere by default. Otherwise we are back to point 0 where they would ask to connect to it and restore to a phone they own. Oh and have a dummy google account you only used to purchase a couple of silly stuff on amazon, aliexpress and shein and random subscription of various "non risky subjects" on youtube. The gmail address would quickly be filled with enough spam to look genuine.
I am travelling abroad in 3 weeks for a month and I am seriously considering wiping up my grapheneOS phone before flying. I am wary that I could be targeted at a border just for having a google pixel with grapheneOS. Or maybe I should just leave my main phone at home and only travel with a new empty 150€ phone with only my main family emergency contacts. I don't remember ever being asked to show my smartphone at a border but you never know when it will happen. Thanksfully until you reboot it there is nothing that shows from the lockscreen that it is not running the regular google pixel android.
GrapheneOS includes an encrypted backup system covering far more data than Google cloud backups. It backs up data for apps opting out of cloud backups with allowBackup="false" since it operates in the device-to-device transfer mode. The backup system supports arbitrary sync services with a compatible API. Backups are per-profile so you can test it by restoring to a secondary user.
We plan to entirely overhaul the backup system but it already works fine. It could be a lot simpler and cleaner both in terms of implementation and user experience. We're in the process of overhauling the other apps first but we'll get to it.
One clarification:
> It backs up data for apps opting out of cloud backups with allowBackup="false"
This is untrue for older apps targeting API 30 (Android 11) and earlier. As I understand it, allowBackup is still respected for them, preventing their backup even in D2D mode. https://github.com/GrapheneOS/os-issue-tracker/issues/1112#i...
Those apps are slowly going extinct since the Play Store stopped accepting updates written against the older SDK in 2022, but I gather there are still a few floating around out there (including some niche favorites that have unfortunately abandoned development).
And one wish:
I'd love the ability to maintain a "hotspare" device that's identical to the original in every important way. So if your phone is chucked in the ocean, dropped down a cliff, etc. you can just grab the other one (checkpointed from a few hours or a day ago) and seamlessly keep on going.
I think this is impossible today because of the way the system protects secrets in the Android Keystore and how it's intertwined with the TEE / secure element / Titan M2 / etc. I wish there were a way to truly own my phone including the ability to perform perfect-fidelity backup and restore.
It's great to know this exists! It's one of a few reasons I switched back to iOS after trying grapheneos.
Back then, you were still using Google's backup thing, and it was the year when they intentionally broke it to encourage people to move to unencrypted cloud services for important data.
thanks for chiming in.
A replacement for SeedVault is planned:
https://grapheneos.org/features#encrypted-backups
https://github.com/GrapheneOS/os-issue-tracker/issues/4687#i...
> the project has been taken over by another group of people not sharing our goals or approach
> Seedvault which was originally written for use in GrapheneOS by a GrapheneOS user is a consequence of the 2018 takeover attempt on the project, which the people currently in defacto control of Seedvault were heavily involved in.
Seedvault is currently maintained by the CalyxOS team but I've never heard about this stuff. Does anybody know what happened?
There has been a lot of conflict between Calyx and GrapheneOS a while ago.
1 reply →
Yeah, it's planned for years and years at this point.
Sure I know there are more urgent priorities but at the moment there is no backup for GOS phones. It only works for some people in some situations. For me it never reliably worked, ever.
Neat, I didn't realize it was still included. I thought it had been abandonned.
So basically one needs a webdav server somewhere or an usb flash drive.
The problem is that most apps opt out of backup, so it's effectively useless.
6 replies →
I use Seedvault to create a backup locally on my phone, and then sync it to my backup server with Syncthing
I use local seedvault backup and then sync via round sync daily trigger to my Nextcloud WebDav Server (native seedvault was not able to use this, for some reason).
It also supports the Android Storage Access Framework, so other forms of network "cloud" storage are also supported as long as the client ("cloud storage app") implements the correct api, so not only webdav
It's been planned for years...
TTS has also been planned for a while and they released it recently. Donating or helping out is going to do more than complaining on HN.
2 replies →
I think more useful would be to be able to boot into another data partition with a different password, which, in turn, would hide the other "daily" partition. I believe LUKS is capable of that. The storage dump looks like a random set of data and only a valid password can find and decrypt a matching hidden partition.
Ideally this should also work on lock screen, e.g. if you type in a non-standard PIN, it would boot from the "dummy" partition in the background, with a slight delay perhaps.
This way you don't have backup anything (I mean you should, but for normal purposes) and have a plausible deniability whenever you get randomly inspected, not just at border crossings that you anticipate.
>I believe LUKS is capable of that
Booting into a 30 GB partition on a 128GB phone is going to be mega suspicious, even if the remaining data is random.
A partition based on a sparse disk image might avoid that.
You'd have what appears to be a 128GB image (or some large fraction of that), which in reality is largely holes (typically: repeated blocks of ASCII 00 bytes).
Of course, you'd need to avoid actually trying to fill that filesystem.
There are ways around it AFAIK.
10 replies →
Right, it would have to be 64/64 for everyone.
Not possible to have a robust implementation with the current tech unfortunately.
https://veracrypt.io/en/Wear-Leveling.html
Interesting, did not know that! They do say some hardware, though, is phone's solid state storage definitely affected?
1 reply →
Having different data partition forces you to hide stuff, which can be unlawful in some juridictions.
Not having the data in the first place in some specific contexts (like crossing borders) is easier.
Fair.
That isn't truly hidden and can be detected as a low level from the SSD.
No it can't. The the thing, it's obfuscated.
4 replies →
A complete backup is solution that can be stored on my own encrypted servers and restored with a click of a button is really needed.
I always dread the possibility of my GrapheneOS phone being damaged or stolen and having to spend hours reinstalling and reconfiguring everything that Seedvault missed, as well as losing access to accounts that are locked by the secure element keys.
> I am wary that I could be targeted at a border just for having a google pixel with grapheneOS.
Is that likely to happen at all in a civilized (Western) country?
Yes, see https://www.theguardian.com/us-news/2026/jul/23/cop-city-pro... . The OP is a response to this, as has been pointed out several times here in this discussion.
No. Not even close.
The headline of that article ("US government targets Cop City protester over phone operating system") rests firmly in the lies category of clickbait.
They were targeted for secondary inspection upon their return to the US because they were on a terrorist watchlist, not because they have a phone that runs GrapheneOS.
At least some of what investigators did during that inspection seems likely to be illegal (and the courts will decide if it was, or was not). Meanwhile, the grounds for being on a watchlist to begin with seem dubious at best, as is often the case with such lists.
But none of this was instigated by the presence of GrapheneOS on their phone.
GrapheneOS didn't enter the picture until the person who was already detained and being investigated (and being refused access to a lawyer) provided the phone's duress PIN to nuke the device (by erasing the crypto keys and rebooting) instead of the normal PIN.
2 replies →
Not what the article says at all.
Remind us what happened when you do cross.
"my phone died yesterday, a friend just gave me his old pixel" - please don't do this. That's lying to law enforcement and they can prosecute. Just say it's your travel phone.
Honestly, I feel like I'd be more suspicious of someone who had little to nothing installed on their phone.
A lot of people are still using their smartphone pretty much as a dumbphone with a web browser.
Yeah but if you're a normal guy strolling through every time with a phone that has nothing- no pictures, no signed in email, no history of messages, 4 contacts. That's abnormal, no way of spinning it as "but I just don't use my phone much" will make that seem normal. The average person has their phone glued to their body 24/7 now. Implying that you don't is abnormal.
27 replies →
Like how many ?
Even more of a reason for good and easy backup and restore.
Before travel back up the real contents and restore a dummy travel backup with random games, stock photos etc. Then restore back to real contents.
This is never going to happen for the same reason Apple and Google won’t let you use different backup/restore methods.
1 reply →
Sure but there'd be nothing there.
If the regime is going to just start taking people then nothing will stop that, but the goal is to stop the usefulness of this sort of thing as an intimidation measure - or at least drag it to the forefront and overthrow the regime.
The easiest way to avoid suspicion is to have a phone filled with cat and family pictures, dumb apps and games.
You don't avoid scrutiny by being wierd and hiding things, but by hiding in plain sight by being ultra boring.
The easiest way to avoid suspicion is to have a phone filled with cat and family pictures, dumb apps and games.
Presumably they know quite a lot about you already outside your phone (yay, Palantir). I mean, the guy the recent post was about was an activist. An empty phone vs. a phone with just cat pictures and dumb games wouldn't really make a difference. They went on a fishing expedition, so anything that does not have contact information/messages of other activists or any information that they could use against the phone owner would be a win.
(F-you Palantir for reading this message and adding it to my online record.)
1 reply →
On the other hand, if everything about you is boring, that in itself may begin to seem suspicious. "I borrowed this old phone from my stepson because my own phone got run over by a steamroller at a vintage vehicle show" is the sort of thing an actual spy or criminal would never say.
Add some dickpicks because who doesn't have something on their phone that they don't want others to see.
1 reply →
[flagged]
> So you plan to (1) actively/proactively conceal your data/evidence
I am not concealing data/evidence as it doesn't exists. I don't know of any law in any country that force you to hand out the key of your home to a remote state so that they can enter your country and do a search.
> and then (3) constantly restore from cloud backups?
Why constantly? Only and only if I need to access specific data (that may be available remotely without restore anyway). Full restore only when going back in my own country.
It's been normal operating procedure for many employees that travel to the US. You think they're all criminals?
Border officials don't have the right to search all of your data.
You are also not under any obligation to have it on your phone at all times.
Just like a regular cop, all they need is probable cause.
[flagged]
5 replies →