The claims made about GrapheneOS in this interview are extremely inaccurate. It heavily misrepresents the purpose of GrapheneOS and what we've worked on for years. The claim GrapheneOS is a security project rather than a privacy project is misinformation. Contacts are specifically brought up and yet our Contact Scopes feature is ignored. @fla knows GrapheneOS is a privacy project. He replied to a thread with our response to this misinformation only 4 days ago...

https://piaille.fr/@projetslibres_podcast/116379561169492214

/e/ doesn't keep up with providing standard Android privacy patches and protections. It doesn't provide features comparable to the added privacy protections in GrapheneOS including but not at all limited to Storage Scopes, Contact Scopes, Sensors toggle, per-connection Wi-Fi MAC/DHCP privacy and far more. /e/ has a bunch of default connections to Google services and gives highly privileged access to those. It also bundles other invasive services in the OS.

GrapheneOS heavily improves privacy compared to the Android Open Source Project in contrast with /e/ heavily reducing it.

GrapheneOS is far ahead of the standard pace for privacy patches instead of behind and we fix many privacy weaknesses ourselves. We've fixed a bunch of Android VPN leaks and many forms of data leaks to apps.

Since GrapheneOS is a serious privacy project, we have to put substantial work into security too because privacy depends on it.

/e/ tries to provide privacy by bundling a small blocklist of domain names solely used for ads and analytics. This doesn't do anything to address the most privacy invasive behavior by apps which happens via their own services. It doesn't stop apps sending data to arbitrary third parties from their servers or even client side. It can't block anything without the app using a dedicated domain for the unwanted behavior which usually isn't how things are done.

The domains they block are a tiny subset of domains used for those purposes and do not stop the most privacy invasive behavior by apps.

Apps and SDKs have also increasingly bypassed DNS blocklists via DNS-over-HTTPS resolvers, hard-wired IP addresses and most of all moving connecting to third party APIs to their servers where they don't need to leak their API keys.

DNS filtering works fine on GrapheneOS but isn't a viable approach to protecting privacy.

Exodus Privacy uses a very similar approach to label apps as having trackers based on whether they include a library from a small list they've decided as trackers. Many of those decisions are dubious and it misses that the most privacy invasive behavior by apps isn't done that way. It also has extremely inaccurate labelling of permissions misleading users about how that works. Here's a great example of both with Facebook Lite:

https://reports.exodus-privacy.eu.org/en/reports/com.facebook.lite/latest/

Report for com.facebook.lite 505.0.0.8.102

Known trackers, permissions and informations about this specific version of this application

εxodus
According to Exodus Privacy, there's no tracking being done by Facebook Lite. This is the information about trackers which is provided to users within /e/ when they use their Play Store frontend. They're telling users one of Facebook's main apps isn't tracking them. They're also certainly not stopping the tracking via their DNS blocklist. The list of permissions shown there and by /e/ is also extremely inaccurate and misleading. It doesn't work that way.

/e/, Murena and their supporters have spent years misleading people about GrapheneOS. They heavily push the false claims that it isn't a privacy project, isn't usable, isn't broadly compatible with apps and isn't useful to regular people. /e/ and Murena have repeatedly claimed GrapheneOS is only useful to criminals and spies. Here's the leader of both /e/ and Murena stating that as a broader claim about hardening in general:

https://grapheneos.social/@GrapheneOS/116353973732143171

Murena misleads people about GrapheneOS as a core part of their business strategy. They tell people it's not usable by regular people despite requiring far less sacrifice. They say it's not compatible with apps despite it having far broader app compatibility.

They claim the protections we provide aren't useful to regular people and yet both Android and iOS keep adopting features we've created years later including Contact Scopes, locked device auto-reboot, hardware memory tagging and much more.

Authoritarians around the world have been heavily pushing the false narrative that end-to-end encryption and secure devices primarily benefit criminals. GrapheneOS has been a growing target of these attacks on open source privacy technology.

France is the epicenter of this with their national law enforcement engaging in a smear campaign towards GrapheneOS with false claims about our features, distribution and marketing conflating it with non-GrapheneOS devices. Murena has actively participated.

iPhones are very hardened devices with far privacy and security stronger protections than any device with /e/.

Apple is trying to protect their users from privacy and security vulnerabilities. Murena is smearing this hardening as benefiting criminals and claiming it isn't useful to most people.

It's a misconception that exploits of vulnerabilities are only used in targeted attacks. Privacy and security vulnerabilities are very broadly exploited. There are huge botnets of compromised devices.

@GrapheneOS
"Apple is trying to protect their users from privacy and security vulnerabilities" with one major exception: Apple
They do not protect their users privacy against themselves, Apple, a US company which has to share the data with the US government on request. Therefore IMHO there is no privacy with iPhones.

@secid Apple moved towards using on-device models for features like speech-to-text. They use end-to-end encryption for their messaging services and many of their iCloud services. There's an opt-in Advanced Data Protection mode enabling end-to-end encryption for iCloud services other than email, contacts and calendars which can be replaced with an alternative such as Proton:

https://support.apple.com/en-ca/102651

Meanwhile, /e/ implements speech-to-text by sending data to Murena and Murena sends it to OpenAI.

iCloud data security overview - Apple Support (CA)

iCloud uses strong security methods, employs strict policies to protect your information, and leads the industry in using privacy-preserving security technologies like end-to-end encryption for your data.

Apple Support
@GrapheneOS
Although I am neither a spy nor a pedo you won't convince me to change from GrapheneOS to Apple.😉
I will stay with the highest level of protection even against my country Germany and the EU, because I think privacy ist one of the most important pillars of democracy and much more important than the vague possibility to find and catch the three dumbest pedos and terrorists. The clever ones don't need GrapheneOS to protect themselves and their criminal activities. There are other powerful and possibly criminal methods they can use.

@secid We strongly recommend using GrapheneOS rather than an iPhone for people who care about privacy. What we're saying is that iPhones are a much better option than Murena devices. We're not saying that they're a better option than GrapheneOS.

Despite LineageOS being less secure than AOSP and not privacy or security hardened, it's also a much better option than using /e/. /e/ makes it worse in many ways particularly when it comes to privacy and security. People can use the upstream project.