this post was submitted on 07 Jun 2026
30 points (94.1% liked)

Privacy

4630 readers
535 users here now

Icon base by Lorc under CC BY 3.0 with modifications to add a gradient

founded 3 years ago
MODERATORS
Ategon@programming.dev
danielintempesta@programming.dev
30
Switching from iPhone to GrapheneOS (suppo.fi)
submitted 1 day ago by cm0002@suppo.fi to c/privacy@programming.dev
16 comments fedilink hide all child comments
 

Hey everyone! I'm making this post just to share my experience switching from iPhone to grapheneos. My experience may be a little different than others, because I was already using all open source apps if possible, so moving apps wasn't horrible.(only took me like 2 days.) Moving my imsg contacts to signal fucking sucks though. Especially when they say no, and you gotta coax them ugh.

To be honest apple's iOS 26 HORRENDOUS FUCKING DESIGN LANGUAGE in conjunction with a recent exploit that forced me to update or I would get malware was the primary reason for updating. I can't even express how badly iOS 26 fucked up my phone. Along with that i was tired of dealing with issues from side loading. It felt so delicate, and it broke at any minor change. The amount of issues I had with sidestore were absurd.

The general iPhone to android switch wasn't too bad. I prefer material ui over ios 26 and maybe a little more than iOS 18's. Back on my iPhone I had icloud, so deleting apps wouldn't wipe its data and it pissed me off so much sometimes. Being able to press clear data or cache was such insane peace of mind. The large app selection(even considering FOSS only) is also super nice.

The one thing that annoys me a lot about grapheme is alarms. All my profiles can't run in background, so I have to switch to owner so I can set an alarm before sleeping. (I have auto restart, so it always goes to owner in the morning.) Oh wait actually I think of more. Lower battery life than my iphone, notifications being used for persistence, file transfer troubles over cable, and having to use 3 Mullvad VPN devices, 1 for each of my profiles. If anyone knows how to use one Mullvad device across all my profiles, please let me know. Also I'm not used to the keyboard at all.

As said earlier, me not being apple pilled or being anymore than one layer into their ecosystem made switching easy as pie. Man I remember the first time I saw that graphene boot screen on a fresh pixel I felt so cool; the first boot home screen is genuinely so clean. Just staring at that black wallpaper with 4 apps is just so calming i don't know. Although I switched to kiss launcher(its fucking perfect), I still like going to that original homescreen to look sometimes.

I would say in general the greatest boon of switching was peace of mind. My phone did what was documented and what the apps I chose did. On my old phone I couldn't trust anything. Gosh, its so nice! If anyone was interested in purchasing a device I hope my experience was interesting to you. Attached is a photo of my homescreen, if anyone is interested.

Sorry about messy grammar or ordering of information. I kinda rushed to make this post

By author @guymontag@lemmy.ml

top 16 comments
sorted by: hot top controversial new old
[–] valar@lemmy.ca 6 points 1 day ago (1 children)

When I started out with Graphene, I had a non-owner profile as my primary day to day profile and had trouble with receiving text notifications, but also having to switch around profiles often eg. to change various settings. Later I switched to using the main owner profile as my primary profile and it fixed my issues and simplified things greatly. I still use alternate profiles for a few things like my banking app, and anything requiring Play Services.

If sounds like you also not using the owner profile as your daily use profile. Perhaps this approach could help with your alarm issue.

[–] db_null@lemmy.dbzer0.com 5 points 1 day ago (2 children)

More than two profiles might be a bot overkill, I did it for a while but with the sandboxing being so effective I merged two. Now I just have the owner with FOSS only and another for Apps that require Play services.

Not allowing the second profile to run in the background is a big win for battery life.

Graphene states in their documentation that the VPN profiles are separate on purpose, so there is likely no immediate solution but it the option to route user traffic through the owner ('s VPN) would be a nice addition in the future.

Remember to unregister your phone number from iMessage with Apple. Either deactivate it on the iPhone or do it through their website. Anyone you couldn't convince to move to Signal can then just text you with a green bubble on their iPhones.

I recommend Heliboard, much prefer it to the stock one on Graphene and it's very customisable.

[–] 01189998819991197253@infosec.pub 2 points 1 day ago (1 children)

I've been using FUTO keyboard for a couple days, and I like it more than Helis. Just adding another option, and not at all saying one is better than the other. It has pretty good swipe and stt out of the box. But it's not, strictly speaking, OSS (it's source-available).

[–] db_null@lemmy.dbzer0.com 2 points 23 hours ago (3 children)

I'll have a look, I added transcribo for stt but having everything in one would be even better. I just disable network access and then any app can be trusted to stay local.

[–] IceFoxX@lemmy.world 1 points 11 hours ago* (last edited 11 hours ago)

Btw It would be better to prove that it is secure. If you think about last year, for example (That applies to Qualcomm, so you'd have to check what hardware is installed. ) —CVE-2026-25262(But it's only now making headlines)—the question remains: what hasn't been discovered yet?

Oh look, grapheneOS was vulnerable... but it's been fixed now https://discuss.grapheneos.org/d/35355-details-on-the-may-2026-android-security-bulletin (not same CVE)

https://forum.torproject.org/t/enabling-grapheneos-protections-causes-tor-browser-for-android-to-break/21535 lol

The focus is still on what has been discovered; the question remains: what has not yet been discovered?

And you still need firmware you can trust. You can't trust Qualcomm.

Dont forget the whole infrastructure. https://youtu.be/fM5w7bFNvWI

[–] 01189998819991197253@infosec.pub 1 points 13 hours ago

I've been using SayBoard, but it was like transcribo where it was it's own thing. A bit annoying flipping back and forth, but I did it for privacy.

And be careful trusting an app on stock android versions, Samsung, or another android with Google play services. They can share the data they were going to send directly (but now can't due to firewall rules) with GPS, which will relay that for them.

[–] IceFoxX@lemmy.world 0 points 12 hours ago* (last edited 12 hours ago)

Stop spread bullshit... There are methods like uXDT etc. 🤣🤣🤣 (Then there's the hardware... Qualcomm... undocumented instructions etc) You cant trust a cell phone...

[–] boomzilla@programming.dev 1 points 1 day ago* (last edited 1 day ago) (1 children)

Futo Keyboard is exceptional too. With local models, dictionary for speech-to-text, swipe and spell check.

Not allowing the second profile to run in the background is a big win for battery life.

Wait what? I assumed it wouldn't run by default. I just checked and you're correct. There's a switch for that. Battery drain is ok but not as good as other more bloated Androids I owned. I know Pixels are not the best in that regard but I hope this will give it a good boost. Thanks for the heads up.

[–] db_null@lemmy.dbzer0.com 1 points 23 hours ago* (last edited 23 hours ago)

The speech to text built-in is interesting. Will have a look at Futo next time I'm in the mood for fiddling around with things.

With light usage I get through a day with my 2nd hand 8 Pro, it has just under 80% battery health. I'm looking forward to the Motorola release next year.

[–] eleijeep@piefed.social 2 points 1 day ago (1 children)

Why don't you use the cross-post feature instead of making a new post such that it appears twice in our feeds?

[–] cm0002@suppo.fi 4 points 1 day ago (2 children)

I do in most cases, text only posts though do require a slightly different approach that avoids direct linking to a .ml comm, hence the user tag.

Context

Why am I cross-posting .ml content?

I cross-post from .ml to the nearest relevant non-.ml comm to reduce the influence of .ml comms and indirectly, the instance as a whole, to help vitilize non-.ml comms and make it an easier decision for other instance admins to defederate because one key reason I identified that admins don't want to defederate is because .ml still has some very large comms and some active niche comms.

Megathread on the issue

Some highlights from the link:

Dessalines, head .ml admin, lead Lemmy dev actively spreading genocide denialism https://sh.itjust.works/post/61371958

.ml admin, Nutomics continued transphobia https://lemmy.world/post/29222558 The original transphobic Comment from Nutomic: https://lemmy.world/post/18236068

"If you don't support Russia then you just don't understand geopolitics" ~dessalines, .ml admin, dev https://lemmy.world/post/27352415

"Don't worry guys, the Uyghur Genocide was REALLY just birth control! ~dessalines, .ml admin, dev https://lemmy.world/post/30580167

"See! nobody died IN Tiananmen Square, just AROUND it, so it doesn't count!!" ~ Davel, .ml admin https://lemmy.world/post/30673342

"NK is actually good and anything counter to that is Western propaganda!" ~dessalines, .ml admin, dev https://lemmy.world/post/31595035

General negative sentiment to other instances who haven't "seen the way" yet ~davel, .ml admin https://lemmy.world/post/27426510

And so so much documentation on clear heavy handed censorship and bias also on the link. So much I can't even put them all here because this comment would be really long.

I believe the behavior of its admins (the main admins are Lemmy devs) does harm to the overall growth of the Lemmy-verse and maybe even the Thrediverse (since Lemmy kinda kicked off the Thrediverse) because of its association with the devs of Lemmy and their insistence to use .ml as their personal political platform to spread harmful propaganda

On the outside, bringing up Lemmy frequently leads to comments like "Lemmy? Isn't that the place with a bunch of tankies?" Or "Tried Lemmy, but found it full of pro Russia crap so I left". The best way forward from that I see is to either widely defederate from .ml like the rest of the Triad, or pressure them to put a fair and unbiased as possible admin team.

[–] toor@lemmy.world 2 points 1 day ago (1 children)

Ah, one of those names is familiar. I never paid much attention to instances, only focusing on communities. Until I helpfully reported an obviously misinformation filled post to community on lemmy.ml. An admin copied the contents of the report into a message in that post, making fun of me. Then banned me from all lemmy.ml communities I was subscribed to (for "abusing the report system"). I've since blocked lemmy.ml and am on the lookout for the other similar instances to block, and/or yet another alternative to Reddit/Lemmy.

[–] cm0002@suppo.fi 2 points 1 day ago* (last edited 1 day ago)

Oh it's you lol yea I saw you in the modlog when I was perusing, that was davel pretty, much the #2 enforcer of .ml

I thought it was probably something along what you described and I wanted to make a post on !meanwhileongrad@sh.itjust.works on it, but there was really no way for me to tie it back in an evidentiary-way like I do for all my other posts

similar instances to block, and/or yet another alternative to Reddit/Lemmy.

Hexbear and grad are way worse than .ml, but also means .world defederates from them already (and a lot of the Threadiverse network)

As far as right-wing instances go, the most prominent one I think currently is HilariousChaos (HC is like ExplodingHeads reborn. They basically did a .ml and try to keep it more subtle (EH is to grad/hex as HC is to .ml)) that is also still federated with world last I checked

ETA: oh and also that was a site ban you got (the whole getting banned from every comm thing is actually a workaround for a federation bug)

So you win an award!

[–] eleijeep@piefed.social 1 points 1 day ago (1 children)

It's nice of you to provide such a detailed explanation but did you really need to downvote my question?

[–] cm0002@suppo.fi 1 points 1 day ago

I had just assumed since I myself got downvoted shortly after replying to you it was you and was reciprocal, but after actually checking I see that it wasn't. So I'll revert it