GrapheneOS

Open source privacy and security focused mobile OS with Android app compatibility.

Public Key

npub1235tem4hfn34edqh8hxfja9amty73998f0eagnuu4zm423s9e8ksdg0ht5

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs9g69ua6m5ec6ukstnmnyewj7a4j0gjjn5hu75f7w23d64gczunmgpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43q0uc5de

Publishing to

relay.ditto.pub

Author Public Key

npub1235tem4hfn34edqh8hxfja9amty73998f0eagnuu4zm423s9e8ksdg0ht5

Show more details

Last Notes

2026-05-20 21:37:36 UTC

- reply

@nprofile…5540 @nprofile…dzx4 @nprofile…wlug The best way to get devices for GrapheneOS for a lower price is buying used devices. That depends on there being a large number of devices sold in the past several years. 10th gen Pixels are the first to launch in Mexico so there isn't a good market for used devices there yet. It will take years of Pixels becoming more popular in Mexico before they can get a several year old budget Pixel for a very low price as people can do in the US, Germany, France, etc.

2026-05-11 17:53:00 UTC

- reply

@nprofile…kj8p It's worth noting the Play Integrity API software checks are largely not enforced up front but rather used to detect spoofing and the enforcement comes later. This prevents being able to know exactly how it was caught via GPU fingerprinting, etc. They don't care about small scale spoofing and wait until it's larger scale to take actions to stop it which is often done in a far more naive way than how it was detected. Over time, they're making it stronger and bypasses shorter lived.

2026-05-11 17:51:40 UTC

- reply

@nprofile…kj8p AOSP and GrapheneOS already heavily use sandboxing throughout the OS and are in the process of heavily adopting hardware-based virtualization for isolation. Running an operating system in a container or VM doesn't help with attestation but rather makes it substantially harder to pass from apps doing detection of emulation and virtualization via anti-tampering. A large part of the Play Integrity API software checks are focused on detecting emulation or virtual machines.

2026-05-10 15:10:49 UTC

- reply

@nprofile…amc2 Read the rest of the thread once it's posted.

2026-05-10 00:59:36 UTC

GrapheneOS version 2026050900 released:
https://grapheneos.org/releases#2026050900
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/35409-grapheneos-version-2026050900-released
#GrapheneOS #privacy #security

2026-05-07 23:32:07 UTC

GrapheneOS isn't vulnerable to the 3 recently disclosed Linux kernel vulnerabilities named Copy Fail, Copy Fail 2 and Dirty Frag. Current Android Open Source Project SELinux policies block exploiting all 3 bugs. Standard AOSP GKI kernel configuration also has 2/3 of the vulnerable features disabled.

2026-05-07 22:12:27 UTC

GrapheneOS version 2026050700 released:
https://grapheneos.org/releases#2026050700
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/35349-grapheneos-version-2026050700-released
#GrapheneOS #privacy #security

2026-05-06 15:29:46 UTC

- reply

@nprofile…22e0 https://github.com/IacobIonut01/ReFra is what we're going to be forking and including in GrapheneOS soon. There's also Aves Gallery which is available in Accrescent.

2026-05-06 00:09:13 UTC

- reply

@nprofile…22e0 Use a different Gallery app instead of AOSP Gallery. It's being replaced in the near future.

2026-04-30 18:54:02 UTC

- reply

Standard Android GKI kernels also have the userspace API for Linux kernel crypto disabled including CONFIG_CRYPTO_USER_API_AEAD being unset. Many Android vendors enable a lot more functionality in the kernels but probably haven't had an actual reason to enable this functionality.

2026-04-30 05:26:57 UTC

- reply

AOSP also doesn't permit setuid or setgid binaries which was the chosen attack vector for exploiting it in the proof of concept exploit. It similarly doesn't permit io_uring, user namespaces and a lot of other functionality outside of a few core processes for security reasons.

2026-04-30 03:30:59 UTC

- reply

We'll be moving this kind of content to our forum soon where we can write more about it and use proper formatting including headers and relevant inline images. We haven't moved to the new approach yet but we've also published this thread on our forum too:
https://discuss.grapheneos.org/d/35110-grapheneos-is-protected-against-copy-fail-and-similar-vulnerabilities-by-selinux

2026-04-30 02:34:04 UTC

GrapheneOS is immune to the Copy Fail vulnerability due to the deep integration of SELinux in the Android Open Source Project (AOSP). AOSP only permits using specific types of sockets throughout the OS. It only permits the dumpstate process used to create bug report zips to access AF_ALG sockets.

2026-04-25 20:46:54 UTC

- reply

@nprofile…gyqj @nprofile…37xe It causes substantial harm through spreading harmful misconceptions and misunderstandings. Anyone who supports GrapheneOS should refrain from inaccurately referring to it as a ROM.

2026-04-25 19:10:18 UTC

- reply

@nprofile…gyqj @nprofile…37xe There are an essentially unlimited number of inaccurate claims and outright fabrications people come up with to attack GrapheneOS. They quickly move on to others. There's very little point in collecting attacks on the project and propagating them on their behalf. It isn't going to help with resolving the problem, which is that there are concerted efforts to to mislead people about GrapheneOS. We already have a website and other posts providing accurate information on it.

2026-04-25 01:03:44 UTC

- reply

@nprofile…gyqj @nprofile…37xe Volla OS is a fork of the Android Open Source Project similarly to GrapheneOS. AOSP is a Linux distribution and so are both of these. Unlike GrapheneOS, Volla OS greatly reduces privacy and security compared to AOSP rather than greatly improving them.

2026-04-23 00:57:52 UTC

- reply

We aren't saying we're going to stop posting on these platforms. It means the posts on our timeline will shift towards being links to forum threads with longer form content. We can have proper formatting, edits and a more unified discussion primarily happening on our forum.

2026-04-23 00:17:24 UTC

- reply

We can migrate towards posting longer form content made available via our discussion forum and Info app. It can still be posted to these platforms but without relying on them so much. Our news posts don't reach most of our users this way and it heavily limits how we can post too.

2026-04-22 23:51:28 UTC

Most of our users aren't active on these social media platforms and don't receive news about GrapheneOS beyond our release notes. Hundreds of thousands of people use it as a daily driver without closely following the project. We plan to reduce our dependence on these platforms.

2026-04-22 01:40:35 UTC

GrapheneOS version 2026042100 released:
https://grapheneos.org/releases#2026042100
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/34377-grapheneos-version-2026042100-released
#GrapheneOS #privacy #security

2026-04-21 18:10:34 UTC

- reply

We provided a series of replies with nuanced and well informed takes on email security which go against the beliefs of the dominant posters on Hacker News. As a result, they're relentlessly targeting us with inaccurate claims about our project and team including personal attacks.

2026-04-21 18:07:34 UTC

- reply

Their replies to us started with their incorrect assumption that we don't deploy MTA-STS and are heavily based around a consensus on email security among prolific Hacker News posters who believe Gmail's poor email security practices are a model to follow:
https://x.com/Avamander/status/2025709681012855006

2026-04-21 17:53:10 UTC

- reply

Here's one of the accounts repeatedly posting disingenuous attacks on us in the thread:
https://news.ycombinator.com/threads?id=Avamander
They're attacking GrapheneOS because we disagreed with their advocacy against securing BGP and DNS to protect against real world attacks:
https://x.com/GrapheneOS/status/2025714506261737529

2026-04-21 17:44:14 UTC

- reply

A small number of accounts hostile towards GrapheneOS heavily participate in nearly any thread posted about it. These accounts largely focus on making personal attacks based on completely unsubstantiated libelous claims including fabricated stories. It's rarely heavily countered.

2026-04-21 17:40:24 UTC

Our forum thread addressing the extremely problematic article by WIRED has been posted on Hacker News at https://news.ycombinator.com/item?id=47849854. As expected with Hacker News, a dozen accounts malicious towards us are lying about the project and our team including spreading harassment content.

2026-04-21 12:35:58 UTC

WIRED (@WIRED) has gone ahead with publishing an extraordinarily inaccurate article about GrapheneOS. It presents a highly inaccurate history of the GrapheneOS project heavily based on fabrications from James Donaldson. WIRED failed to incorporate most of our responses to his inaccurate claims.

2026-04-17 16:51:16 UTC

GrapheneOS doesn't persistently store notifications unless users explicitly enable notification history. For users enabling notification history, it's a 24 hour log that's cleared as soon as the feature is disabled again. This is the standard Android Open Source Project approach.

2026-04-15 15:39:16 UTC

Privacy and security on computing devices need to become far stronger to protect people from pervasive violations of their rights. Users have their privacy pervasively violated by corporations, criminals and governments. There are endless privacy and security weaknesses in software with exploits of those happening on a large scale. Operating systems, browsers and other apps need to do a much better job protecting users. Enormous progress is needed on both privacy and security.

2026-04-14 09:54:07 UTC

- reply

@nprofile…7kfx @nprofile…zmac @nprofile…37xe
> If an app has many trackers from different big tech companies, that is enough to tell the app is very likely not going to be privacy friendly.
An app being listed as having 0 trackers on Exodus is not a strong indication that it's a privacy friendly app. It doesn't scan for the vast majority of the most privacy invasive behavior by apps. Very basic analytics or crash reporting is also treated with the same severity as incredibly invasive functionality.

2026-04-14 09:51:16 UTC

- reply

@nprofile…7kfx @nprofile…zmac @nprofile…37xe
> It isn't feasible to manually test every app in the Play Store, as it would require the work @kuketzblog does at an enormous scale.
Scanning for a specific list of libraries being presented the way it is has created major misconceptions for a large number of users. Runtime testing of apps cannot provide much assurance about an app's behavior particularly when only doing limited short term testing, but that isn't what we we're talking about here.

2026-04-14 09:48:26 UTC

- reply

@nprofile…7kfx @nprofile…zmac @nprofile…37xe
> this is a misrepresentation of what people at exodus do.
No, it's not a misrepresentation. Our statements accurately describe our extensive real world experience with how users interpret the information it provide and what it leads them to believe. We've been addressing it for years.
> They don't tell you an app isn't privacy invasive just because it doesn't have any trackers.
The user interface gives many users the impression that it does do that.

2026-04-14 09:33:38 UTC

- reply

@nprofile…7kfx @nprofile…zmac We have a lot of experience with our users asking about this and needing to have their misconceptions addressed. Many people are using this as a major factor in how they choose apps where they believe apps being listed as having 0 trackers means those apps aren't privacy invasive. Similarly, people are interpreting the permission count as meaning something it doesn't. An app which doesn't require granting anything invasive to use it is often shown as very invasive there.

2026-04-14 09:32:13 UTC

- reply

@nprofile…7kfx @nprofile…zmac It's the way it's being presented to users which is a problem. It's a hard-wired list of specific third party libraries without differentiating the severity of what they do where a portion of those are severely privacy invasive and most are far less consequential. Nearly all of the most privacy invasive behavior by apps isn't evaluated at all, because it can't be detected this way. It gives users the impression it's able to determine far more than the approach actually is.

2026-04-14 09:30:36 UTC

- reply

@nprofile…7kfx @nprofile…zmac It's useful to make a list of privacy invasive third party libraries and detect those in apps, but it shouldn't be presented as an overall privacy evaluation of apps. It's unable to detect the vast majority of the most privacy invasive behavior by apps and is primarily detecting far less consequential things. The way that's presented combined with a counter with the number of declared low-level permissions gives users the impression of a meaningful privacy score for apps.

2026-04-14 09:27:05 UTC

- reply

@nprofile…7kfx @nprofile…zmac Ads, analytics, telemetry, crash reporting and similar things done on the client side with connections to dedicated domains are not the most privacy invasive behavior done by apps. There are certain types of client side SDKs which are quite invasive but those things are nowhere close. This definition of trackers and interpretation of what matters is something we've been educating our users about for years. A large portion of people exposed to this are misled by it.

2026-04-14 09:06:18 UTC

- reply

@nprofile…zmac The most privacy invasive behavior by apps is nearly always done with their own code and servers including sharing sensitive data with third parties. Client side ads, analytics and crash reporting code is usually far less invasive. A lot of what's being categorized as trackers is questionable and the most privacy invasive behavior by apps is missed.
Many users have misconceptions about how privacy works and how to evaluate if an app is private because they place too much weight on this.

2026-04-12 14:53:14 UTC

- reply

@nprofile…37xe France's national law enforcement has increasingly gone after apps and devices which are regarded as providing people with privacy and security regardless of the merit to that marketing. In their interviews with the media, about GrapheneOS, they made direct reference to past arrests and server takeovers targeting multiple companies and said they would go after us similarly if they could justify it. This is a serious matter and efforts by /e/ and Murena to help them are a big deal.

2026-04-12 14:49:55 UTC

- reply

@nprofile…37xe Legitimate privacy projects and organizations would not push the narrative that privacy and security are primarily beneficial to criminals or that the userbase of projects like GrapheneOS and Signal primarily consists of criminals. This isn't a one time incident but rather a consistent narrative from /e/.
/e/ and Murena laid the groundwork for France's national law enforcement and corporate/state media using the same talking points to attack the GrapheneOS project alongside them.

2026-04-12 14:46:40 UTC

- reply

@nprofile…37xe /e/ has spent years widely propagating inaccurate claims that GrapheneOS isn't a privacy project, doesn't work on privacy, isn't aimed at regular people, isn't usable, isn't compativle with apps, is difficult to install and much more.
/e/ have repeatedly pushed the false claim that GrapheneOS is primarily useful to criminals and that the userbase largely consists of criminals. They've expanded this to claiming security hardening primarily benefits criminals.
https://grapheneos.social/@GrapheneOS/116353973732143171

2026-04-11 21:54:35 UTC

- reply

/e/ bundles many privacy invasive apps/services. That includes adding a bunch of Google services not present in AOSP with privileged access. They implement speech-to-text by sending user data to OpenAI without informing users about it. We cannot do that.
https://grapheneos.social/@GrapheneOS/114880528716479708

2026-04-11 21:51:26 UTC

- reply

We already shipped our own network-based location and geocoding implementations which we'll be making more discoverable. Our high quality local text-to-speech implementation is shipping soon and we'll also be providing a local speech-to-text implementation. A lot more is coming.

2026-04-11 21:19:33 UTC

/e/ and Murena have been been promoting their products by misleading people about GrapheneOS for years. This has turned into an all out war on GrapheneOS by their company and supporters. We began regularly debunking their inaccurate claims and they try to frame it as aggression.

2026-04-10 17:35:47 UTC

- reply

@nprofile…s4ce @nprofile…zswc We aren't finished responding to it with this thread. We're going to be posting it on our forum and other social media platforms too. We're going to be responding beyond what we're already posted. We've been actively finding and archiving more cases of /e/, Murena and Gaël Duval attacking GrapheneOS by claiming it's only useful to criminals and spies which they've said directly multiple times along with often alluding to it. We have a lot more than that one video clip to use.

2026-04-10 17:30:26 UTC

- reply

@nprofile…s4ce @nprofile…zswc You've likely already read our previous thread where we directly addressed these inaccurate claims. Here's the relevant part of the thread:
https://grapheneos.social/@GrapheneOS/116354014750484314
We're repeatedly published content addressing people inaccurately claiming GrapheneOS is a security project rather than a privacy project. He has read multiple of these threads and knows what we've said. He's saying what he did in the interview despite that. This isn't about getting any technical details wrong.

2026-04-10 17:27:28 UTC

- reply

@nprofile…s4ce @nprofile…zswc He directly responded to the thread we published 4 days ago addressing Murena once again claiming the kind of privacy and security hardening work done by GrapheneOS and iPhones is only useful to criminals and spies. In that thread, we directly addressed these repeated inaccurate claims about the purpose, goals and approach of GrapheneOS which wrongly portray it as a security project rather than a privacy project. His claims in the interview are more than egregiously inaccurate.

2026-04-10 16:12:25 UTC

- reply

Authoritarians around the world have been heavily pushing the false narrative that end-to-end encryption and secure devices primarily benefit criminals. GrapheneOS has been a growing target of these attacks on open source privacy technology.
France is the epicenter of this with their national law enforcement engaging in a smear campaign towards GrapheneOS with false claims about our features, distribution and marketing conflating it with non-GrapheneOS devices. Murena has actively participated.

2026-04-10 16:01:37 UTC

- reply

Murena misleads people about GrapheneOS as a core part of their business strategy. They tell people it's not usable by regular people despite requiring far less sacrifice. They say it's not compatible with apps despite it having far broader app compatibility.
They claim the protections we provide aren't useful to regular people and yet both Android and iOS keep adopting features we've created years later including Contact Scopes, locked device auto-reboot, hardware memory tagging and much more.

2026-04-10 14:28:06 UTC

- reply

/e/, Murena and their supporters have spent years misleading people about GrapheneOS. They heavily push the false claims that it isn't a privacy project, isn't usable, isn't broadly compatible with apps and isn't useful to regular people. /e/ and Murena have repeatedly claimed GrapheneOS is only useful to criminals and spies. Here's the leader of both /e/ and Murena stating that as a broader claim about hardening in general:
https://grapheneos.social/@GrapheneOS/116353973732143171

2026-04-10 14:27:48 UTC

- reply

According to Exodus Privacy, there's no tracking being done by Facebook Lite. This is the information about trackers which is provided to users within /e/ when they use their Play Store frontend. They're telling users one of Facebook's main apps isn't tracking them. They're also certainly not stopping the tracking via their DNS blocklist. The list of permissions shown there and by /e/ is also extremely inaccurate and misleading. It doesn't work that way.

2026-04-10 14:27:42 UTC

- reply

Exodus Privacy uses a very similar approach to label apps as having trackers based on whether they include a library from a small list they've decided as trackers. Many of those decisions are dubious and it misses that the most privacy invasive behavior by apps isn't done that way. It also has extremely inaccurate labelling of permissions misleading users about how that works. Here's a great example of both with Facebook Lite:
https://reports.exodus-privacy.eu.org/en/reports/com.facebook.lite/latest/

2026-04-10 14:27:13 UTC

- reply

The domains they block are a tiny subset of domains used for those purposes and do not stop the most privacy invasive behavior by apps.
Apps and SDKs have also increasingly bypassed DNS blocklists via DNS-over-HTTPS resolvers, hard-wired IP addresses and most of all moving connecting to third party APIs to their servers where they don't need to leak their API keys.
DNS filtering works fine on GrapheneOS but isn't a viable approach to protecting privacy.

2026-04-10 14:26:48 UTC

- reply

/e/ tries to provide privacy by bundling a small blocklist of domain names solely used for ads and analytics. This doesn't do anything to address the most privacy invasive behavior by apps which happens via their own services. It doesn't stop apps sending data to arbitrary third parties from their servers or even client side. It can't block anything without the app using a dedicated domain for the unwanted behavior which usually isn't how things are done.

2026-04-10 14:26:41 UTC

- reply

GrapheneOS heavily improves privacy compared to the Android Open Source Project in contrast with /e/ heavily reducing it.
GrapheneOS is far ahead of the standard pace for privacy patches instead of behind and we fix many privacy weaknesses ourselves. We've fixed a bunch of Android VPN leaks and many forms of data leaks to apps.
Since GrapheneOS is a serious privacy project, we have to put substantial work into security too because privacy depends on it.

2026-04-10 14:26:35 UTC

- reply

/e/ doesn't keep up with providing standard Android privacy patches and protections. It doesn't provide features comparable to the added privacy protections in GrapheneOS including but not at all limited to Storage Scopes, Contact Scopes, Sensors toggle, per-connection Wi-Fi MAC/DHCP privacy and far more. /e/ has a bunch of default connections to Google services and gives highly privileged access to those. It also bundles other invasive services in the OS.

2026-04-10 14:26:20 UTC

The claims made about GrapheneOS in this interview are extremely inaccurate. It heavily misrepresents the purpose of GrapheneOS and what we've worked on for years. The claim GrapheneOS is a security project rather than a privacy project is misinformation. Contacts are specifically brought up and yet our Contact Scopes feature is ignored. @fla knows GrapheneOS is a privacy project. He replied to a thread with our response to this misinformation only 4 days ago...
https://piaille.fr/@projetslibres_podcast/116379561169492214

2026-04-10 13:39:05 UTC

- reply

@nprofile…6tqk @nprofile…zswc The claims made about GrapheneOS in this interview are extremely inaccurate. It heavily misrepresents the purpose of GrapheneOS and what we've worked on for years. The claim GrapheneOS is a security project rather than a privacy project is misinformation. Contacts are specifically brought up and yet our Contact Scopes feature is ignored. @nprofile…f3dp knows GrapheneOS is a privacy project. He replied to a thread with our response to this misinformation only 4 days ago...

2026-04-09 17:09:57 UTC

- reply

@nprofile…jckv @nprofile…40zt GrapheneOS doesn't have a centralized push notification service integrated into the OS. If you install Signal in a profile where you haven't installed sandboxed Google Play, it will only use Signal's own servers for push.
Signal's push implementation isn't power efficient and will drain a lot more power than Google's Firebase Cloud Messaging. However, there's a fork of Signal called Molly supporting using an arbitrary push provider with efficient implementations available.

2026-04-09 17:04:40 UTC

GrapheneOS version 2026040800 released:
https://grapheneos.org/releases#2026040800
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/33971-grapheneos-version-2026040800-released
#GrapheneOS #privacy #security

2026-04-07 17:05:39 UTC

- reply

@nprofile…hkxd It's supposed to show "No command". You need to use the standard hold power + press volume up keybinding to access the recovery menu. It's the standard Android interface for it.

2026-04-07 17:04:19 UTC

- reply

@nprofile…hkxd It's not bricked, you can wipe it from recovery and continue using it.

2026-04-07 16:58:26 UTC

GrapheneOS version 2026040600 released:
https://grapheneos.org/releases#2026040600
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/33898-grapheneos-version-2026040600-released
#GrapheneOS #privacy #security

2026-04-06 17:08:22 UTC

- reply

@nprofile…upuh Android secondary user profiles, work profiles and Private Space profiles are all standard features. Those aren't specific to GrapheneOS. There are major improvements to the privacy, security and usability of secondary users and profiles in general as part of GrapheneOS but they work fine in AOSP and the stock Pixel OS. Certain Android OEMs disable secondary user support but they mostly aren't disabling Private Space and we're not aware of any disabling support for work profiles.

2026-04-06 17:06:55 UTC

- reply

@nprofile…upuh https://silent.link/ exists and takes payment in Monero. In fact, they don't accept fiat payments at all. Data SIMs are a $9 flat fee and it's $98/year for SIMs with inbound SMS support usable for validating phone numbers for use with WhatsApp, Signal and many other apps requiring it. It's a requirement for many apps and therefore it's useful to have a private phone number for activations in general. It's not an obscure service and many GrapheneOS users are actively using it already.

2026-04-06 16:56:52 UTC

- reply

@nprofile…upuh
> it supports multiple identities, none tied to a real world identity or PII
Multiple instances of Signal can be used on the same device at a time. Contact discovery and sharing of the phone number can and should generally be disabled. It's an anti-spam mechanism to still require it despite having usernames. There are non-KYC services for phone numbers available.
> Signal can only be installed from the Google Play Store
No, Signal is available outside the Play Store in multiple ways.

2026-04-06 16:34:59 UTC

- reply

@nprofile…upuh @nprofile…0y33 We listed Signal as an example of another serious privacy project which Duval has repeatedly attacked and misled people about. It wasn't a recommendation of Signal over other options, but we don't agree with your assessment about Olvid.
We've never seen Signal lying about privacy or security. What exactly are you referring to?
We've seen /e/ and Murena doing it relentlessly and we can show many examples of it as we've been doing including here:
https://grapheneos.social/@GrapheneOS/116358370057342525

2026-04-06 14:53:10 UTC

This is an extreme misrepresentation of both what Gaël Duval said in this interview and our response to it. What he clearly said is that /e/ and Murena aren't providing security hardening which he claims is only useful for pedophiles, criminals and spies. Gaël Duval has repeatedly said this in his posts including ones where he directly says GrapheneOS is only useful for pedophiles, criminals and spies. We can show archives of numerous posts with him saying exactly that.
https://tilde.zone/@notthebee/116358115664425978

2026-04-05 22:03:40 UTC

- reply

@nprofile…q9qe GrapheneOS is based in Canada, not France. However, we avoid strongly tying ourselves to Canada and are willing to move elsewhere if there are ever authoritarian laws which prevent us from continuing GrapheneOS in it. Laws which don't impact us directly aren't an issue. We did have multiple public-facing servers in France and had most of our public-facing servers hosted with a French company (OVH). We left those entirely behind.

2026-04-05 21:59:27 UTC

- reply

France is the most anti-encryption, anti-privacy and anti-security country in the EU. They've been doing a gradual crackdown on open source privacy projects including GrapheneOS and Signal with escalating smears and threats. /e/ and Murena are on the side of the police state.

2026-04-05 21:52:18 UTC

- reply

/e/ and Murena have repeatedly claimed GrapheneOS is for drug dealers, pedophiles, terrorists and spies. /e/ and Murena are anti-privacy. They're heavily profiting from marketing products as private but don't believe in it. /e/ is an authoritarian-aligned fake privacy project.

2026-04-05 21:45:59 UTC

- reply

/e/ and Murena have their own privacy invasive behavior in their apps and services. One particularly egregious example is their supposedly private speech-to-text service sending user data to OpenAI without consent instead of doing most locally like Apple:
https://community.e.foundation/t/voice-to-text-feature-using-open-ai/70509

2026-04-05 21:44:51 UTC

- reply

Their marketing heavily focuses on avoiding Google and gives the impression they believe privacy means avoiding one company. Meanwhile, they add a bunch of Google services not present in the Android Open Source Project and give extensive privileged access to Google apps/services.

2026-04-05 21:40:30 UTC

- reply

/e/ and Murena aren't on the same side as GrapheneOS. They're charlatans selling devices with poor privacy and atrocious security to earn money. They've spent years trying to undermine a legitimate privacy project and heavily use the same talking points as police state advocates.

2026-04-05 21:37:14 UTC

- reply

/e/ and Murena are based in France. They've been pushing false narratives about GrapheneOS falsely claiming it isn't usable by regular people and doesn't benefit them for years. Duval has been making the ludicrous claim GrapheneOS is only useful to criminals and spies for years.

2026-04-05 21:33:49 UTC

- reply

Here are several particularly egregious examples:
https://www.leparisien.fr/faits-divers/telephones-proteges-utilises-par-les-narcotrafiquants-rien-nest-inviolable-19-11-2025-3PP34GIBAJGH3EZOVEJVT7OMU4.php
https://www.leparisien.fr/faits-divers/google-pixel-et-grapheneos-la-botte-secrete-des-narcotrafiquants-pour-proteger-leurs-donnees-de-la-police-19-11-2025-NTGPQE4JCNGEHLF7XGIQ3CCA2I.php
https://www.franceinfo.fr/faits-divers/narcotrafic-les-autorites-alertent-sur-l-utilisation-d-un-systeme-d-exploitation-de-telephone-pour-echapper-aux-forces-de-l-ordre_7631510.html
Gaël Duval and Murena participated in these attacks. They even spread harassment content towards our team and shared it with sites attacking us.

2026-04-05 21:13:49 UTC

- reply

Despite being done for profit, /e/ receives millions of euros in funding from the EU on an ongoing basis. /e/ and Murena use extraordinarily inaccurate marketing to not only promote their products/services but also to mislead people about GrapheneOS and scare them away from it.

2026-04-05 21:09:56 UTC

- reply

Murena is a for-profit company owned by shareholders including Gaël Duval. /e/ has a non-profit organization which is also led by Gaël Duval. /e/ includes paid services from Murena. /e/ very clearly exists to build products for Murena to sell in order to enrich the shareholders.

2026-04-05 21:06:56 UTC

- reply

It's common for apps and websites to do everything through their own servers. That's best practice to avoid leaking API keys. It's increasingly common for invasive libraries to use hard-wired IPs and/or DNS-over-HTTPS to evade blocking. DNS filtering is increasingly less useful.

2026-04-05 21:04:12 UTC

- reply

Their DNS blocklist can only block domains not used for useful functionality to avoid ruining usability. Meanwhile, the most privacy invasive behavior by apps is rarely ever split out into separate domains. Even for those, apps and websites can trivially evade DNS blocklists.

2026-04-05 21:02:25 UTC

- reply

/e/ and Murena devices are far worse for privacy and security than an iPhone. It's trivial to break into their devices remotely or extract data from them compared to an iPhone. They have weaker privacy protections from apps too. Their main approach to privacy is a DNS blocklist.

2026-04-05 20:56:03 UTC

- reply

/e/ is far weaker in all of these areas compared to the standard Android Open Source Project on secure hardware. It doesn't keep up with standards updates and protections. It adds tons of low security attack surface and privacy invasive services. It's not in the same space as us.

2026-04-05 20:25:41 UTC

Gaël Duval is the founder and president of the /e/ foundation along with the CEO of Murena. Duval and his organizations have consistently taken a stance against protecting users from exploits. In this video, he once again claims protecting against exploits is for only useful pedophiles and spies.
Translation to English:
> There's the attack surface, on that front we're not security specialists here, so I couldn't answer you precisely, but from the discussions I've had, it seems that everything
https://grapheneos.social/system/media_attachments/files/116/353/970/673/759/638/original/9e06eacbb567eab4.mp4

2026-04-01 23:25:32 UTC

Vanadium version 147.0.7727.49.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/147.0.7727.49.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/33728-vanadium-version-14707727490-released
#GrapheneOS #privacy #security #browser

2026-04-01 21:09:49 UTC

- reply

@nprofile…2hy8 Have you tried the per-app exploit protection compatibility mode toggle?
Does GrapheneOS show a Play Integrity API notification when using it?

2026-04-01 03:58:34 UTC

- reply

Their main threat is to leak personal information including chat logs with the founder of GrapheneOS talking about the attacks coordinated by Copperhead and Techlore. The logs prove what we're saying about all this, so it's mainly a threat of more personal attacks and bullying.

2026-04-01 03:55:25 UTC

- reply

@nprofile…wqvl These aren't politics. For 8 years, people have been engaging in an extreme level of fabrications and harassment towards us. Multiple people have wrongly claimed to have created GrapheneOS. Many charlatans have attacked us. It has been a difficult struggle to continue the project and it remains one because of all this. What would be cool is if these ridiculous attacks towards us stopped. It would be nice to go 1 day without posts across platforms personally harassing our founder.

2026-04-01 03:53:47 UTC

- reply

Our chat logs show them trying to push their way into the project, repeatedly getting caught misrepresenting their involvement and promising to stop repeatedly. People have been spreading fabrications about GrapheneOS and our founder for the past 8 years. It's nothing new.

2026-04-01 03:45:40 UTC

- reply

We've told him he simply needs to stop misrepresenting his involvement and we'll stop talking about it along with taking down our posts. He won't do it and instead he's making threats of harming us, leaking personal information and he's also engaging in horrific personal attacks.

2026-04-01 03:43:35 UTC

- reply

We weren't interested in making a business with him or anyone else. He showed up 4 years into the project, we had just been completely screwed over by a company and he expected us to do it all over again. He's essentially pretending what he wanted happened when it didn't happen.

2026-04-01 03:39:59 UTC

- reply

His actual involvement was that he made a company selling phones with his own builds of GrapheneOS. He gave us a portion of the revenue. Even back then, he believed he was far more involved than he was and we had to keep setting boundaries and getting him to stop overstepping.

2026-04-01 03:38:26 UTC

- reply

Back in 2020, he agreed to stop misrepresenting himself as a co-founder and change the title on his LinkedIn to Business Liaison. It wasn't truly accurate for him to list a role at GrapheneOS but it was close enough and fine with us. He repeatedly promised to do it. He never did.

2026-04-01 03:34:33 UTC

- reply

Back in 2020, we agreed to stop misrepresenting himself as a co-founder and change the title on his LinkedIn to Business Liaison. It wasn't truly accurate for him to list a role at GrapheneOS but it was close enough and fine with us. He repeatedly promised to do it. He never did.

2026-04-01 03:27:38 UTC

- reply

He forced us into publicly addressing by getting media attention for his truly extraordinarily claims about his involvement in data breaches and hacking listed in the data breaches section on https://aquax.nl/#breaches and elsewhere. He's angry we posted about it but won't stop.

2026-04-01 03:25:36 UTC

- reply

He repeatedly promised to stop misrepresenting his involvement in GrapheneOS around 6 years ago. Instead, he's falsely claiming he founded GrapheneOS. He's presenting himself as having a management role from 2018-2025 when he was an external partner from mid-2018 to around 2020.

2026-04-01 03:16:57 UTC

Tweakers.net has corrected their multiple year old article about GrapheneOS. The situation of someone who collaborated with us with their own company misrepresenting themselves as a founder of GrapheneOS for years is an ongoing issue and they refuse to stop doing it.

2026-03-31 20:41:53 UTC

- reply

@nprofile…y3u0 The situation hasn't been resolved. There's a thread on the Tweakers.net which you've locked and you've inaccurately claimed there was an internal dispute. Abdoul Rasnab was never one of our project members but rather he had his own fork of GrapheneOS and his own company. He was supporting GrapheneOS and collaborating with it for around 1.5 years. He was not a GrapheneOS developer and had no role within GrapheneOS. We authorized him to call himself a Business Liaison.

2026-03-31 18:13:56 UTC

- reply

@nprofile…hqtv When those ancient Pixel 3 releases were current, there were much older versions of sandboxed Google Play in our app repository. We didn't keep those around for people to continue using on the end-of-life devices. We changed our approach since then and kept around older versions of sandboxed Google Play for the end-of-life 4th and 5th gen Pixels to keep it working there much longer. However, it's still not supported or intended to work anymore. Updates aren't just for security.

2026-03-31 18:07:35 UTC

- reply

@nprofile…hqtv You were previously using obsolete releases of GrapheneOS which are no longer supported and don't have what's needed to use the current sandboxed Google Play. That's why you had issues and providing you with the ancient releases would only result in you having many issues again trying to use an ancient release of the OS which doesn't work with the current sandboxed Google Play available through our App Store. We don't keep around the ancient releases and you shouldn't use them anyway.

2026-03-31 17:53:05 UTC

- reply

@nprofile…hqtv The reason you previously had issues is because you were using obsolete releases which were no longer supported. We don't provide sandboxed Google Play for anything other than the recent GrapheneOS releases. People are expect to be relatively up-to-date in order to install and use current sandboxed Google Play. It's not going to work on a Pixel 3 since it has been end-of-life since after October 2021 and we stopped providing releases at some point after that since it was insecure.

2026-03-31 17:51:19 UTC

- reply

@nprofile…hqtv GrapheneOS provides much broader app compatibility than iodéOS. Pixel 3 has been end-of-life since after October 2021 and GrapheneOS hasn't supported it for years. We can see that the issue is you were trying to use outdated releases of GrapheneOS for a device we haven't supported for years. It isn't going to work properly and isn't going to have the regular app compatibility of GrapheneOS because it's not supported anymore. We don't provide sandboxed Google Play for ancient releases.

2026-03-31 00:53:29 UTC

Apple and Google regularly tell the media they haven't seen exploits of a specific vulnerability or exploits of devices with a security protection enabled. This is heavily misinterpreted as meaning exploits aren't happening. They don't ever find out about many successful attacks.