A case for /e/OS as a first step away from Google Android for beginners

[Poecilia]

I may have missed a discussion here about /e/OS but couldn't find anything, either browser or searching. I saw the post about Android from Privacy Guides on Reddit and brief mention of /e/OS.

While I understand it is good to only recommend the most secure setups, I would argue that /e/OS works very well as a first step away from a Google environment for people who are unfamiliar with unlocking bootloaders, flashing roms, etc. I speak from personal experience. I was most concerned about accidentally 'bricking' my phone.

The recommendations in the guide focus on Pixel and Xiaomi. The higher price/risk would have prevented me from trying back then.

With /e/OS's supportive community (forum, Telegram), I was able to set up a Google-free phone on a cheap 60 euro Moto device; that felt low risk, and I learned a lot in the process. /e/OS is also doing work to lower the barrier even further, by having their OS pre-installed on the Fairphone, or shipping other refurbished phones (Samsung) with the OS pre-installed.

While I understand these /e/OS setups may not fully meet your high standards for privacy, I think it deserves a recommendation on your Android page in this context: it a good first step for absolute beginners to experiment with alternatives to Android, without too high a risk. You can download F-droid and have a good working smartphone that way. I have used it, for example, to show my kids about alternative options.

[TommyTran732]

I think this has already been answered on Reddit:

https://www.reddit.com/r/PrivacyGuides/comments/rkajh4/comment/hp9nhlg/?utm_source=share&utm_medium=web2x&context=3
https://www.reddit.com/r/PrivacyGuides/comments/rkajh4/comment/hp9opzr/?utm_source=share&utm_medium=web2x&context=3

In short, /e/OS will not be recommended until they at least:

1. Support verified boot for devices that do support verified boot with third party OSes.
2. Ship firmware updates for devices that have not reached EOL.
3. Not have any major security regression over the stock OS.

While there is no "anti recommendation" against /e/OS, it is not recommended either because it does not meet basic security requirements. It is okay as an after market OS to salvage old EOL devices, but if you are spending money on a new phone, you should get a Pixel and flash GrapheneOS instead. There is no point in spending $600 for a Fairphone with /e/OS whatsoever, as explained in the Reddit thread.

Even for a test device (which I don't think you should be spending money on because it is quite hard to brick your phone with GrapheneOS's web installer), a $100 OnePlus 6T with DivestOS would make a lot more sense. It at least can do verified boot.

[ph00lt0]

If you don't want/cannot go the recommended way you could always disable/uninstall google apps from your system, that is still a good option compared to running an insecure rom.
Not sure if I would consider Calyx and GrapheneOS hardcore. They are really easy to use, ans calyx also can ship you a preloaded phone.

[Poecilia]

I am starting to see the differences between privacy and security. I know the argument here on this platform is that you can't have privacy without security.

For me, as an EU citizen, having the experience of using apps without always adding to the databases of the big corporations (Google, Amazon, Facebook, is what I was and am after. I don't take my smartphone out of the house. I get the feeling that the intended target audience of Privacy Guides is more towards people that might be worried about government intervention.

What I have clearly failed to do here is convince you of what things look like from the perspective of someone new to all of this (i.e., someone just used to buying the latest Android device and installing apps from the Google store) who has become interested in keeping their data off corporate servers. Your response "not sure if I would consider ...hardcore" may be true for you, but is certainly not true at all for regular smartphone user with a beginning interest in privacy. That is where I also feel something like /e/ has played an important role for me, which is, a couple of years down the line, I can now follow and understand this discussion and consider your points and maybe try them. I would not have been in a position to do that at the start of my journey.

[ph00lt0]

@Poecilia i think you misunderstand, security is important not only for government interference but also of big tech, ISPs and malware. This is a huge issue in the current smartphone world and shouldn't be underestimated. With a malicious device there is no privacy and even advertising industry takes advantage of security weaknesses. i think you misunderstand, security is important not only for government interference but also of big tech, ISPs and malware. This is a huge issue in the current smartphone world and shouldn't be underestimated. With a malicious device there is no privacy and even advertising industry takes advantage of security weaknesses.

[TommyTran732]

I want to clarify a few things:

1. These guides are not written for people who are targeted by the government. The state is an adversary with unlimited time and unlimited resources. If you are targeted by them, you have to take a completely different approach - not using a phone at all, putting a blanket over your head whenever you type in your password, stay on QubeOS and Tor 24/7, etc and etc. And even with that, the state is most likely to win anyways.
2. These guides are meant for people who are interested in privacy and security. We do not want to recommend bad security practices (rooting your phone to install adblockers, breaking system integrity protection to replace Play Services with MicroG, etc). Sometimes, there is a trade off to be made between privacy and security, but that is not the care with which Android derivative to use.
3. You don't have to read anything below the Recommended Applications if you don't want to. It is not expected that you read through and understand it fully if you are an average Joe who just wants to get your hands on a private phone. It is there for people who are interested In finding out things like "Why is rooting bad? How badly does rooting hurt my security" or "Why exactly is GrapheneOS better than CalyxOS security wise? How much better is it?".

[Positron832]

@ph00lt0 I think you pinged the wrong person?

[SkewedZeppelin]

Some more reading if you want to be really sure that /e/OS is not great:

• https://community.e.foundation/t/divestos-vs-e-os-security-and-privacy-easy/33717/8
• https://community.e.foundation/t/divestos-vs-e-os-security-and-privacy-easy/33717/67 < me fwiw
• https://community.e.foundation/t/divestos-vs-e-os-security-and-privacy-easy/33717/73 < the /e/ founder

  • "So I want to be clear that /e/OS is currently NOT a security-hardened system"

• https://gitlab.e.foundation/e/backlog/-/issues/3650
• https://gitlab.e.foundation/e/backlog/-/issues/3651
• cleanapk is also extremely sketchy imo, and /e/ constantly pretends they both are and aren't related to it
• https://forum.f-droid.org/t/an-analysis-of-the-e-os-app-installer/15700
• they are also consistently behind even basic security patching. most builds right now are 2-3 months behind. And many of their devices are very old versions when Lineage itself supports newer.
• they are consistently evasive in answering questions, recently they started selling the OnePlus Nord a device with 6 different models under the same name and all are very different, yet they refused to state which model it was specifically: https://community.e.foundation/t/murena-nord-announcing-a-new-device-from-the-esolutions-shop/36186/11
• also https://gitlab.e.foundation/e/backlog/-/issues/948, my summary: "verified boot and bootloader locking and encryption aren't basic security" 🤣