Devices lacking standard privacy/security patches and protections aren't private

GrapheneOS · 18 Jul

The article published at https://www.ifixit.com/News/111634/why-the-fairphone-6-should-be-your-next-phone promoting the /e/OS variant of the Fairphone 6 has major misconceptions and inaccuracies. The article promotes a product which is blatantly unsafe due to lack of basic privacy/security patches and protections as being the best option for people who care about privacy. People who listen to it will be significantly worse off on the privacy and security front than if they had bought an iPhone instead.

Fairphone 6 does not keep up with standard Android privacy/security patches and has no secure element to provide working disk encryption for typical users not using a strong password, among other flaws.

/e/OS dramatically reduces privacy and security compared to the Android Open Source Project. It lags far behind on OS and browser patches. It also doesn't keep important standard protections intact.

/e/OS includes numerous non-private apps and services. The Murena voice-to-text service included in /e/OS even sends user speech data to OpenAI with no local option compared to Apple and Google both offering offline speech-to-text support via local models which users can make sure is always used:

https://community.e.foundation/t/voice-to-text-feature-using-open-ai/70509

The article appears to be confusing our sandboxed Google Play compatibility layer with the privileged integration for microG, Android Auto and other Google apps/services in /e/OS:

which is kind of like adding Google Play Services to your phone as a regular user rather than an admin

Our sandboxed Google Play compatibility layer works exactly as the article describes: installing Google Play and other Google apps as regular sandboxed apps. That's not how these things work in /e/OS.

DivestOS, which has been discontinued, had mostly (not fully) unprivileged integration for microG unlike /e/OS and CalyxOS where it's privileged. /e/OS and CalyxOS also have privileged integration for Android Auto and other Google apps/services. If you install Android Auto on /e/OS or CalyxOS, it's a highly privileged app not running in the regular app sandbox and also receives extensive privileged access via special permissions only available to OS components. microG is similar.

GrapheneOS is vastly different from /e/OS. GrapheneOS is a hardened OS preserving the standard privacy and security features and model, then greatly improving both privacy and security on top of that base. /e/OS is not a hardened OS and it greatly reduces both privacy and security compared to the Android Open Source Project. /e/OS doesn't only lag very far behind on OS and browser patches. It also disables or cripples important standard privacy and security protections.

The article implies people can't buy devices with GrapheneOS preinstalled, which isn't right. There are multiple companies including NitroKey selling devices with GrapheneOS installed. This shows where NitroKey sells them:

https://shop.nitrokey.com/shop?&search=nitrophone
https://shop.nitrokey.com/shop?&search=nitrotablet

There are many other companies selling devices with GrapheneOS.

There's a high quality third party comparison between Android-based operating systems at https://eylenburg.github.io/android_comparison.htm with a privacy and security focus.

Android has a new OS release each month. It's a monthly, quarterly or yearly release.

The current release of Android is the July monthly release of Android 16 after the initial yearly Android 16 release last month. Prior to that was the May monthly release of Android 15 QPR2. Android 15 QPR2 came out in March 2025. Android 15 QPR1 came out in December 2024.

Fairphone 6 launched using the initial yearly release of Android 15 from September/October 2024.

Since Android 14 QPR2, quarterly updates are as large as yearly updates. Like many non-Pixel OEMs, Fairphone skips the monthly and quarterly updates. Non-Pixel OEMs are beginning to ship the quarterly updates, but in the past nearly none did.

Providing the latest monthly, quarterly and yearly update is needed to provide full privacy and security patches. Only High and Critical severity patches are backported to older releases in the Android Security Bulletins, often months later. Low and Moderate severity privacy/security patches are almost never backported to older Android releases. Privacy and security improvements not considered bug fixes aren't backported to older releases. Major privacy issues are fixed by newer Android quarterly and yearly releases which will never be backported due to not being considered fixing a bug.

Fixes for important leaks of data to applications, VPN leaks, etc. are rarely backported either due to being considered Moderate severity or a privacy improvement rather than a bug fix. The app sandbox and permission model significantly improves with each new yearly Android release and none of that is backported. Android and iOS provide backports to older releases as a stopgap. Android's quarterly releases go through months of public testing prior to stable release and yearly releases are publicly testing for more than a year. Android's stable releases are not the bleeding edge but rather are the expected baseline unfortunately not provided by most Android OEMs and aftermarket operating systems.

Here are the update notes for the Fairphone 6 stock OS:

https://support.fairphone.com/hc/en-us/articles/24463713641234-The-Fairphone-Gen-6-Release-Notes

Here's for the Fairphone 5:

https://support.fairphone.com/hc/en-us/articles/18682800465169-Fairphone-5-Release-Notes

Here's for the Fairphone 4:

https://support.fairphone.com/hc/en-us/articles/4405858220945-Fairphone-4-Release-Notes

You can see for yourself that it's typical for them to have 1-2 months of delay for the security backports to older releases. The yearly updates typically take a year or more. Monthly and quarterly updates aren't provided.

Fairphone 4 uses the end-of-life Linux 4.19 branch and Fairphone 5 uses the Linux 5.4 branch that's end-of-life in December 2025. As of 2025-10-01, the Fairphone 5 and 6 is still on the initial yearly release of Android 15 (not 15 QPR2) and the Fairphone 4 is still on the initial yearly release of Android 13 (not 13 QPR3).

/e/OS is worse than this and unlike the stock OS, misleads users.

/e/OS changes the UI displaying the patch level to one which masks what's actually being provided. They also set an inaccurate Android security patch level ignoring the non-AOSP portion of the patches and part of the AOSP portion of the patches. /e/OS partially shipping the AOSP portion of the patches as providing the full monthly privacy/security patch backports, which isn't what that is. /e/OS also has major issues providing browser updates. Many apps use the OS WebView.

The article presents this conclusion:

this makes the Fairphone probably the best phone for anyone who values their privacy even slightly.

This is very wrong. Fairphone 6 with stock OS has very lacking security due to delayed patches (1-2 months for partial backports, much longer for full Android patches), no secure element, etc. /e/OS has absolutely atrocious privacy and security, not meeting even basic privacy/security standards. You're guiding people to an unsafe option.

iPhone users get a device with far stronger hardware and software security, far better privacy from apps/services and a bunch of well secured services with most of those supporting proper end-to-end encryption via their opt-in Advanced Protection Program. If people get a device with /e/OS, they're missing the most basic bare minimum privacy and security patches and protections. /e/OS has their own invasive services included, and it does still use various Google services too.

Information from the founder of the Divested Computing projects on /e/OS insecurity:

Issues with /e/OS: https://codeberg.org/divested-mobile/divestos-website/raw/commit/c7447de50bc8fadd20a30d4cbf1dcd8cf14805a0/static/misc/e.txt

ASB update history: https://web.archive.org/web/20241231003546/https://divestos.org/pages/patch_history

Chromium update history: https://web.archive.org/web/20250119212018/https://divestos.org/misc/ch-dates.txt

Chromium update summary: https://infosec.exchange/@divested/112815308307602739

We published this thread as a response to a recent article promoting insecure devices with /e/OS with inaccurate claims, including inaccurate comparisons to GrapheneOS. The founder of /e/OS has responded with misinformation promoting /e/OS and attacking GrapheneOS.

We made a post with accurate info on our forum in response to inaccurate information, that's all. There's a lot more we could have covered. See https://kuketz-blog.de/e-datenschutzfreundlich-bedeutet-nicht-zwangslaeufig-sicher-custom-roms-teil6/ for several examples such as /e/OS having unique user tracking in their update client not communicated to users.

The founder of /e/OS responded to the post we made on our forum here:

https://mastodon.social/@gael/114874688715085353

Gaël Duval has repeatedly personally targeted the founder of GrapheneOS in response to us posting accurate information responding to misinformation from /e/OS and their supporters.

Contrary to what's claimed in this thread, /e/OS does not improve privacy. /e/OS massively reduces privacy compared to the Android Open Source Project in multiple ways. /e/OS is consistently very far behind on shipping important privacy improvements in new major Android releases.

/e/OS regularly lags many weeks, months and even years behind on shipping important privacy and security patches. They roll back various parts of the privacy and security model, add a bunch of privileged Google service integration and their own privacy invasive services too.

The link posted at https://mastodon.social/@gael/114875028964272029 shows /e/OS shipping the previous round of Chromium privacy/security patches a couple weeks late. It regularly takes them months instead of weeks. They take far longer to ship many of the important driver, firmware and AOSP patches.

The link also shows they're using the wrong Chromium tags for Android and frequently results in missing Android-specific privacy/security patches. Chromium 138.0.7204.97 was a June 30th release for Windows, not Android. The Android tag for June 30th was 138.0.7204.63.

https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html
https://chromereleases.googleblog.com/2025/06/chrome-for-android-update_30.html

Patches in Chromium Stable channel updates for Android are often only in the Android tags, not the Windows ones.

The current Android release is 138.0.7204.157, with security patches beyond 138.0.7204.63:

https://chromiumdash.appspot.com/releases?platform=Android

These were minor releases of Chromium. It's trivial to incorporate the changes and ship them on release day within hours. Even major releases of Chromium every ₄ weeks are easy to ship on release day because major releases are open source for weeks in advance, unlike Android.

As can be seen by looking back through https://github.com/GrapheneOS/Vanadium/releases and comparing it to the Android release dashboard linked above, we ship the Chromium Stable and Early Stable releases on release day. This is not impressive. Shipping privacy/security patches is the bare minimum.

Our forum post and this thread were both posted in response to inaccurate info about GrapheneOS posted to promote /e/OS. Once again personally targeting our founder with fabricated stories and harassment from their community is what /e/OS has done before and continues doing.

/e/OS targeted the founder of DivestOS in a similar way and /e/OS supporters directed a massive amount of harassment towards him. It played a significant role in DivestOS being discontinued. /e/OS will not achieve the same thing targeting our founder and should stop doing it.

/e/OS is extraordinarily insecure and non-private due to lagging so far behind on patches and crippling Android Open Source Project privacy/security protections. Selling many devices many months or even years of missing Critical severity patches and hiding it in the UI is wrong.

Murena's services are not nearly as private as claimed and not at all on the same level as serious options such as Proton's software suite. Many of their services recently went down from early October 2024 through March 2025:

https://community.e.foundation/t/update-on-murena-io-service-outage/61781

It's somehow a paid service.

Lack of secure element throttling for disk encryption means users with a typical 6-8 digit PIN or basic password will not have their data protected against extraction. Brute forcing the PIN or password set by the vast majority of users is trivial without secure element throttling. Users are not informed they're not going to have working disk encryption without a strong passphrase on Android devices lacking this feature. Pixels and iPhones provide a high quality secure element providing this and other important functionality. Samsung devices from the past several years at least have a basic secure element providing some of the protections.

TThisOldGuy · 18 Jul

This is excellent and immensely helpful. Thank you for taking the time to write a layman's explanation.

2 part question tho, if you have the time, especially considering the current perceived invasiveness of Gemini.
If someone is Saving up for a pixel, is it better to stay on stock Android or use which of the other OS that claim privacy?
If someone had a light use phone as a backup, without needing Google Services, is it better to stay on stock Android or use which of the other OS that claim privacy?

I love my pixel and GOS but if it ever bit the bucket, it would be about a year before I could replace it. While it seems none of the options are excellent, especially as my older backup phone also likely doesn't have new security updates anymore, which way would be next best?

GrapheneOS · 18 Jul

ThisOldGuy

especially considering the current perceived invasiveness of Gemini

You don't have to use it.

If someone is Saving up for a pixel, is it better to stay on stock Android or use which of the other OS that claim privacy?

Many non-Pixel devices either don't support using another OS or require crippling security to use one. Most of those aftermarket operating systems greatly reduce security compared to a stock OS still receiving updates. If the stock OS isn't receiving updates, aftermarket operating systems will be missing firmware updates and generally at least most of the driver updates too. If the device is end-of-life, using another OS won't fix it. Providing most AOSP security patch backports without the rest has some value, but it greatly diminishes over time.

If someone had a light use phone as a backup, without needing Google Services, is it better to stay on stock Android or use which of the other OS that claim privacy?

An iPhone is the next best choice for a private and secure smartphone. Most Android devices have atrocious security and so do most aftermarket operating systems. If you need a fallback device for apps banning using anything other than iOS or Google Mobile Services Android, then your best choice is iOS.

I love my pixel and GOS but if it ever bit the bucket, it would be about a year before I could replace it. While it seems none of the options are excellent, especially as my older backup phone also likely doesn't have new security updates anymore, which way would be next best?

You can often find a very cheap used device for GrapheneOS by being willing to buy an older generation device with a scratched up screen, etc. We recommend buying 8th/9th gen Pixels for the full set of security features and 7 years of support from launch, but a Pixel 6a still has official support until after July 2027 and the Pixel 7a until after May 2028.

raccoondad · 18 Jul

GrapheneOS If you need a fallback device for apps banning using anything other than iOS or Google Mobile Services Android, then your best choice is iOS.

Question: How would you say factory stock Pixel OS compares to iOS in terms of security?

Ssomeone27281 · 18 Jul

GrapheneOS

I have a question, What is the general situation of Non Pixel but mainstream OEM (the Samsungs, Oneplus etc..) in regards to device security? Would that be acceptable even as a bare minimum?

It'd be nice if you wrote an article diving deep into this situation, since most regular people don't have GrapheneOS right now.

Llinuxaki88 · 18 Jul

someone27281

I like this one for that you asking. It has good points on privacy and security for every OEM (sorry for youtb link, use tor for watch!):

https://www.youtube.com/watch?v=lb1BbT5fpwA

Byteang3l · 18 Jul

GrapheneOS I know the odds of graphene ending up on iphones are probably extremely low but would you consider them officially zero? Or is there some minute possibility?

Oorydeatemi · 18 Jul

someone27281 Would that be acceptable even as a bare minimum?

The answer to your question is that if security matters to you, in that situation, you should get an as recent as possible iPhone.

Oorydeatemi · 18 Jul

Byteang3l I hope that @GrapheneOS will spare me their wrath for answering this one in their stead: the odds of Apple allowing that are about as high as you winning the Powerball, the EuroMillion and Spanish Christmas Lottery, multiple consecutive times in a row.

Byteang3l · 18 Jul

orydeatemi of course apple wouldn't give permission, but it's not needed. There's now unencrypted iphones "thanks" to Europe, so I wasn't sure if there was a vector there. Hence why I said I knew it was minute but asked if it was zero? Only asking because I've seen videos of the herculean task of flashing android on an iphone.

Dde0u · 18 Jul

someone27281 What is the general situation of Non Pixel but mainstream OEM (the Samsungs, Oneplus etc..) in regards to device security? Would that be acceptable even as a bare minimum?

The requirements are here: https://grapheneos.org/faq#future-devices

At present Samsung doesn't meet some of them, OnePlus doesn't meet more of them, etc.

In general some platforms have solid security hardware but don't allow third-party operating systems to use it, and many just don't have solid security hardware.

Solid security hardware doesn't show up in comparison charts or (as triggered this thread) in many phone reviews. Part of the problem is that anybody can say "security", and some journalists will just repeat the claims without fact-checking, so then the claims seem like facts.

Dde0u · 18 Jul

Byteang3l There's now unencrypted iphones "thanks" to Europe [...]?

Can this claim be supported by citing a source?

My understanding is that Apple has been forced to enable third-party app stores to install apps on European-owned iPhones, which is very different from requiring Apple to allow the installation of third-party operating systems to replace iOS. It's just not the same thing.

Byteang3l · 18 Jul

de0u there's tons of sources citing that iphone caved on encryption on European devices and videos of people installing android on iphone. I didn't mean to imply they were related if that's how it came off, just that both occured.

After reading a less misleading article the encryption they stopped supporting was specific to icloud and not for the device. I stand corrected on that one. With Europe being Europe, neither possiblity really surprised me. But this threads been derailed enough so I'll bow out.

Oorydeatemi · 18 Jul

Byteang3l there's tons of sources citing that iphone caved on encryption on European devices

If I'm not mistaken, Apple (not "iphone") caved on iCloud E2E in the UK, which of course has not been part of the EU ever since they voted for Brexit.

One thing that might have gotten your wires mixed up is that Apple is blocking features in Europe because they consider that Euro law would force them to reveal user data to third-parties if they did.

There is, indeed, a bit of a fight over encryption in general over at the European Commission, but it's not settled yet and isn't slated to be implemented before 2030.

Byteang3l videos of people installing android on iphone.

If there are any iPhones more recent than almost 10-years old iPhone 7, I'd be curious to see them.

DDumdum · 18 Jul

raccoondad
https://grapheneos.social/@GrapheneOS/114824836367895978

Stock Pixel OS and AOSP itself aren't far behind iOS but iOS is at least a bit ahead.

LLamaSinge · 18 Jul

I usually find your messages really clear and find it hard to understand how you can so often receive criticism that you've taken care to explain several times. However, I don't find this message very clear; especially on the distinction between privacy and security.

You point out that these devices don't receive security patches quickly, and I agree that a private device should be secure, but in what way have these devices specifically reduced privacy as such? more to the point, I don't find it convincing that the improvements exemplified by the monthly updates, which take 1-2 months to come (not years), allow us to conclude that there has been a significant regression in privacy on these OS compared with AOSP, because I imagine that e/os still offers some interesting features (?)

Thanks again for this great project and your work.

Ssamanthacarter · 18 Jul

so they wrote an article claiming that degoogling a fairphone is good for privacy and then require signing into either Google or facebook to comment? Yeah, they seem like ones to take privacy advice from.

KKilljoy · 18 Jul

GrapheneOS

Non-Pixel OEMs are beginning to ship the quarterly updates, but in the past nearly none did.

Interesting that some are finally going to do this. Which OEMs are you talking about?

GrapheneOS · 19 Jul

We published this thread as a response to a recent article promoting insecure devices with /e/OS with inaccurate claims, including inaccurate comparisons to GrapheneOS. The founder of /e/OS has responded with misinformation promoting /e/OS and attacking GrapheneOS.

We made a post with accurate info on our forum in response to inaccurate information, that's all. There's a lot more we could have covered. See https://kuketz-blog.de/e-datenschutzfreundlich-bedeutet-nicht-zwangslaeufig-sicher-custom-roms-teil6/ for several examples such as /e/OS having unique user tracking in their update client not communicated to users.

The founder of /e/OS responded to the post we made on our forum here:

https://mastodon.social/@gael/114874688715085353

Gaël Duval has repeatedly personally targeted the founder of GrapheneOS in response to us posting accurate information responding to misinformation from /e/OS and their supporters.

Contrary to what's claimed in this thread, /e/OS does not improve privacy. /e/OS massively reduces privacy compared to the Android Open Source Project in multiple ways. /e/OS is consistently very far behind on shipping important privacy improvements in new major Android releases.

/e/OS regularly lags many weeks, months and even years behind on shipping important privacy and security patches. They roll back various parts of the privacy and security model, add a bunch of privileged Google service integration and their own privacy invasive services too.

The link posted at https://mastodon.social/@gael/114875028964272029 shows /e/OS shipping the previous round of Chromium privacy/security patches a couple weeks late. It regularly takes them months instead of weeks. They take far longer to ship many of the important driver, firmware and AOSP patches.

The link also shows they're using the wrong Chromium tags for Android and frequently results in missing Android-specific privacy/security patches. Chromium 138.0.7204.97 was a June 30th release for Windows, not Android. The Android tag for June 30th was 138.0.7204.63.

https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html
https://chromereleases.googleblog.com/2025/06/chrome-for-android-update_30.html

Patches in Chromium Stable channel updates for Android are often only in the Android tags, not the Windows ones.

The current Android release is 138.0.7204.157, with security patches beyond 138.0.7204.63:

https://chromiumdash.appspot.com/releases?platform=Android

These were minor releases of Chromium. It's trivial to incorporate the changes and ship them on release day within hours. Even major releases of Chromium every ₄ weeks are easy to ship on release day because major releases are open source for weeks in advance, unlike Android.

As can be seen by looking back through https://github.com/GrapheneOS/Vanadium/releases and comparing it to the Android release dashboard linked above, we ship the Chromium Stable and Early Stable releases on release day. This is not impressive. Shipping privacy/security patches is the bare minimum.

Our forum post and this thread were both posted in response to inaccurate info about GrapheneOS posted to promote /e/OS. Once again personally targeting our founder with fabricated stories and harassment from their community is what /e/OS has done before and continues doing.

/e/OS targeted the founder of DivestOS in a similar way and /e/OS supporters directed a massive amount of harassment towards him. It played a significant role in DivestOS being discontinued. /e/OS will not achieve the same thing targeting our founder and should stop doing it.

/e/OS is extraordinarily insecure and non-private due to lagging so far behind on patches and crippling Android Open Source Project privacy/security protections. Selling many devices many months or even years of missing Critical severity patches and hiding it in the UI is wrong.

Murena's services are not nearly as private as claimed and not at all on the same level as serious options such as Proton's software suite. Many of their services recently went down from early October 2024 through March 2025:

https://community.e.foundation/t/update-on-murena-io-service-outage/61781

It's somehow a paid service.

Ssomeone27281 · 19 Jul

de0u I was asking about security outside the GrapheneOS scope, from the POV of a regular individual

Imagine a world without GrapheneOS, then how is the security landscape of mobiles?

Dde0u · 19 Jul

someone27281 I was asking about security outside the GrapheneOS scope, from the POV of a regular individual. Imagine a world without GrapheneOS, then how is the security landscape of mobiles?

I believe the GrapheneOS project account, at the top of this thread, described iPhones and Pixels in one class, with other Android devices behind. That matches my (very inexpert) understanding. So, short answer: if you are focused on security, and for some reason you can't run up-to-date GrapheneOS on an in-support Pixel (ideally the 8 series or better), an up-to-date in-support iPhone is probably the next best thing.

After that, I have a vague sense that a recent flagship Samsung device might be next, but I believe I've read that Samsung issues updates more rarely for older devices.

Another way to look at it is that every now and then there is a leak of information about which phones can be exploited by Cellbrite or similar companies. For a while now, an in-support Pixel running GrapheneOS has not been unlockable, and sometimes a recent, up-to-date iPhone is also not unlockable. That's all, in the leaked materials I've seen posted here. According to that, again, there are two kinds of device that are not readily unlockable, and after that everything else is readily unlockable.

I think people hope to hear that there a lot of "actually pretty good security" phones to choose from. That would be nice, but at present I don't think it's true.

What is "acceptable as a bare minimum" depends on who is considering accepting a device.

Pprivacyisconsent · 19 Jul

de0u

I may be misremembering but I think there have been at least two projects aiming to shed some light on hardware security feature support across the Android ecosystem including https://www.android-device-security.org/ but I haven't seen them referenced in many other places so they probably didn't get much visibility. The one linked is also quite out of date. I do wish these projects had more visibility and support.

KKira902 · 19 Jul

Are they running out of developers?

Aanruen · 19 Jul

privacyisconsent looks like a good project, but sadly their scanner app is unable to upload my results because it uses the Play Integrity API. Also it detects "Memory Tagging Extension" as unavailable, which seems wrong to me.

spl4tt · 19 Jul

Can I just say I really adore the GrapheneOS team? The shit they get from others, while just staying true to what their goals are, with their superb knowledge, just wanting to make the best OS and releasing it for free.
The world would truly be a worse place without them.

They sometimes sound like assholes, but you gotta be that way if you're laserfocused on providing the best OS without compromise. I will always stand behind this team.

Ammako · 21 Jul

You know what's actually hilarious? The Fairphone 6 retails at the same price as the iPhone 16e.

Let me rephrase that. For €599 you can get the Fairphone 6, or you can get the significantly more private and secure iPhone 16e.

leafnose · 21 Jul

Ammako
Well, it’s also laughable to see other smartphones sold for that much where exploitation has been a means and not something to fight against!

A hint to understand its price: https://www.fairphone.com/en/2025/06/27/the-fairphone-gen-6-most-sustainable-phone/
And: https://forum.fairphone.com/t/we-ve-scaled-fairtrade-gold/78889

Fairphone’s battle is elsewhere, and it has almost no competitors in that area; many people would like to see a Fairphone meet GOS requirements, or GOS running on a fairer phone…

Dde0u · 21 Jul

leafnose I think it's a fair question whether there is a critical mass of people who are willing to pay more for "fair" and then pay even more for "secure".

Both really do cost money. I can see how "fair" could straightforwardly cost more per device. It might seem that "secure" could be paid for during development instead of per-device, but it's expensive, and if a large cost is divided by a small number of phones then it works out to be a per-device cost.

Apple and Samsung and Google can amortize expensive security over millions of devices. Maybe not Fairphone, OnePlus, etc.

Ttrashaccount · 21 Jul

Maybe if the Fairphone wasn't built like shit, it wouldn't need to be repaired every month. The journalist grifters who don't know anything and the likes of Linus who are either paid off like usual or aim to manipulate the market by glazing the companies who they have shares in think it's some kind of crazy achievement to supply replacement parts to users. Any company can do this. How about they make a good phone first and just supply the parts the same way? They don't believe in their own mission either. They removed the headphone jack just to sell us their earbuds. The market needs to reject this kind of novelty and hold the companies accountable for making e-waste. "eco grifting" and greenwashing is not an excuse for major design flaws, unlike a large portion of the tech community thinks.

leafnose · 21 Jul

de0u
Most Pixel owners did not buy their device because of its security capabilities; I think this is a safe assertion.
Those owners want updates for the bell and whistles, not for security updates. The product pages on the Google store are quite revealing: security features are a secondary selling point, among many others.
In my opinion, the security R&D costs at Google are not entirely reflected on the retail price. This is mostly the case because the Titan M2 is derived from the chip used in Google Cloud data centres; in terms of R&D and costs, this chip in Pixel phones is almost a by-product.
In terms of costs, making phones is more a hobby for Google than anything else, most of R&D having been already amortised elsewhere.

I also think that security is part of its corporate culture, things are well thought out from the start, which makes things cost less down the line. It’s simply efficient.

However, in my previous comment, I had more in mind brands like Xiaomi, Asus, Sony, Nothing and so on. Those brands sell models near or above 1000 bucks. I guess they all have their specificity to justify their prices…
Apple is overpriced, more than the others, it has the biggest profit margin.

Fairphone goals, on the other side, has been to change the various production lines involved in phone manufacturing. For many things, they were the first ones, and often still the only ones, and due to their size, obviously, economy of scale has always been just a dream.
I’m the first one to regret this lack of coherence – because I see security, privacy, fairness and environmental protection as a whole – , but most brands are pretty coherent, just on the opposite side!

Dde0u · 21 Jul

leafnose Most Pixel owners did not buy their device because of its security capabilities; I think this is a safe assertion.

I agree.

leafnose In my opinion, the security R&D costs at Google are not entirely reflected on the retail price. This is mostly the case because the Titan M2 is derived from the chip used in Google Cloud data centres; in terms of R&D and costs, this chip in Pixel phones is almost a by-product.

To some extent. And the same could be said of Apple, where the laptops and phones share a lot of security hardware design. But when it comes time to ship the bootloader and other security firmware for each phone, I'm sure that costs money, especially testing.

leafnose Fairphone goals, on the other side, has been to change the various production lines involved in phone manufacturing. For many things, they were the first ones, and often still the only ones, and due to their size, obviously, economy of scale has always been just a dream.

No disagreement.

My suspicion is that the reason why, so far, no small phone vendor has taken on strong security is that, for a phone vendor without economy of scale, just hiring the necessary staff to deploy strong security hardware if it came "free" on the SoC (plus paying for any kind of external audit) might add a noticeable cost to each individual phone.

If Fairphone is selling 0.1 million devices per year (source) then hoping they will take on strong security might not pan out: it might cost a lot, and meanwhile if hypothetically they captured 100% of GrapheneOS users it would be a modest bump in their sales.

I'm not saying that FaIrphone (or OnePlus, etc.) will never reach the standards of the GrapheneOS project for security -- I hope it happens. But I think some of the questions about why GrapheneOS "doesn't support" various small-vendor phones may have a hidden answer: because small phone vendors ~~would~~ might need to make a big investment, that they ~~would~~ might need to charge each user a noticeable fee for.

GrapheneOS · 22 Jul

leafnose Fairphone makes inaccurate claims about the long term support, privacy, security and updates for their devices. Apple and Google also market the fact that they use a lot of recycled materials and supposedly care about the ethics of their supply chain. Since we can so clearly see they're not telling the truth about privacy, security and updates, why should we believe what they claim about the rest?

leafnose Fairphone's products do not receive proper updates and long term support, despite being heavily marketed as if they do. They're partnered with Murena and promoting /e/OS which is a blatant scam and heavily involved in attacks on the GrapheneOS project. Can you explain how Murena spreading misinformation about GrapheneOS including fabricated stories about our team with the aim of directing harassment towards them is ethical and fits with how Fairphone presents themselves as a company?

leafnose · 22 Jul

GrapheneOS

Apple and Google also market the fact that they use a lot of recycled materials and supposedly care about the ethics of their supply chain.

Since the Foxconn suicides media coverage, they would be pretty ill-advised not to claim having ethics. The roots of this claim, however, are not the same as those of Fairphone.

These two companies have certainly not the same credibility as Fairphone regarding those matters.
It is important to note, however, that Fairphone always said it wanted to be a pioneer and an impetus for these kinds of changes in the electronics industry, starting with smartphones. But real changes, not what we have now, which is the typical sales pitch cashing in on the popularity of eco-conscious velleities. And that it is not to say that Fairphone does not also benefit from it, mostly through the virtue signalling of some consumers.

As I said, I’m the first one to regret the lack of coherence, and I don’t want to debate this point too much, but the claims regarding privacy and security seem to be pretty mild on the Fairphone website (at least on the following pages):
The Fairphone (Gen. 6) now with privacy-first /e/OS
Privacy by design | Fairphone
Security doesn’t even seem to be a subject. Your explanation on this thread has been duly noted, however, when I look at the comparison you linked, I’m more under the impression that GOS is top-notch while /e/ is not really standing out from the crowd. Why not simply say that among all Android-based OS’s, only GOS is being expertly and uncompromisingly crafted and maintained?

I’m under the impression that most Android phones sold around the world are a danger, why not simply invoke Hanlon’s razor? (I’m obviously not talking about smearing campaign and harassment.)

That being said, my subject was Fairphone, not its partner…
Nature protection, fair sourcing, low pollution and humane raw material extraction, and slave free sourcing are serious subjects, as are privacy and IT security.

why should we believe what they claim about the rest?

Because for the last ten years, Fairphone has been put under the spotlight, and as far as I know, no scam whatsoever has been uncovered. In the meantime, it gained recognition, prizes and labels (it’s the only Blauer Engel and TCO certified smartphone) – some environmental prizes and labels may be BS, but that doesn’t seem to be the case here.
I think we can reasonably believe their claims:
Fairphone’s Impact 2024

For the sake of fairness:
Google Environmental Report 2025
Google 2025 Supplier Responsibility Report
Apple 2025 Environmental Progress Report
(Apple) People and Environment in Our Supply Chain 2025

Regarding Foxconn suicides, I’ll let you draw your own conclusions when comparing Apple Progress Reports around 2010 with what actually happened:
See Previous Progress Reports

Casting doubt on Fairphone’s environmental and labour claims, the way you did, was not appropriate. I hope you’ll agree.

Can you explain how Murena spreading misinformation about GrapheneOS including fabricated stories about our team with the aim of directing harassment towards them is ethical and fits with how Fairphone presents themselves as a company?

I do not condone harassment, and it would not fit how most companies present themselves, obviously.
Understand, however, that the fair in Fairphone is related to the concept of fair trade which involves social and environmental standards, like avoiding child labour and mercury poisoning in artisanal and illegal gold mines, not this kind of BS on social networks. But any decent company would condemn swatting…

Now, did you formally present the facts that you’re denouncing to Fairphone?
Have Fairphone been duly informed? Did you get a response?
Did you let Fairphone a chance to comment on their partnership with the Murena and the e Foundation before implying that Fairphone is being dishonest in its commitments?
Are you expecting a positive outcome and good relations with other actors in the industry?

Also, the facts that you’re denouncing are serious, the ones you’re accusing of calumny are under the EU jurisdiction. I’m personally not a fan of never-ending mutual accusations on social networks and forums…

Disclaimer: I am not involved with any of the aforementioned parties; I’ve always been a Fairphone sympathiser, but never bought one of its devices, having determined that only GOS would put my mind at ease regarding security and privacy.

GrapheneOS · 23 Jul

Since the Foxconn suicides media coverage, they would be pretty ill-advised not to claim having ethics. The roots of this claim, however, are not the same as those of Fairphone.

Fairphones are largely designed and manufactured by T2Mobile in China. Do you claim that this company has better ethics than Foxconn? What is the basis for the claim?

These two companies have certainly not the same credibility as Fairphone regarding those matters.

Fairphone doesn't have much credibility as a whole, particularly with their blatantly false claims about updates, privacy and security combined with being partner with a company (Murena) blatantly scamming people. Murena has also been engaging in spreading misinformation about GrapheneOS and personal attacks on our team for years. Their founder has supported harassment content from Kiwi Farms. What's ethical or credible about this behavior? Their response to this thread we published was more misinformation and also more personal targeting of our team members. That's the leader of Fairphone's /e/OS and Murena partners. Fairphone responded by providing a substance free corporate speak statement standing behind Murena and trying to mislead people by talking about Android enterprise requirements which is a Google effort to pretend many Android devices are more secure than they are. Fairphone doesn't even follow those recommendations despite implying they do, only the bare minimum and not even that.

As I said, I’m the first one to regret the lack of coherence, and I don’t want to debate this point too much, but the claims regarding privacy and security seem to be pretty mild on the Fairphone website (at least on the following pages):

Fairphone's site has egregiously inaccurate claims about updates, privacy and security.

Security doesn’t even seem to be a subject. Your explanation on this thread has been duly noted, however, when I look at the comparison you linked, I’m more under the impression that GOS is top-notch while /e/ is not really standing out from the crowd. Why not simply say that among all Android-based OS’s, only GOS is being expertly and uncompromisingly crafted and maintained?

The comparison table we linked primarily compare added privacy and security features along with what's done with the standard Android Open Source Project connections. It mostly doesn't cover rolling back privacy and security features. It doesn't cover the services added beyond the AOSP ones such as how /e/OS is sending user data to OpenAI and other services. It doesn't cover telemetry such as /e/OS generating and sending unique identifiers for update checks. /e/OS is dramatically worse than the other options listed there. The table does have 2 rows about patch delays showing how long ASB patches and further security patches are delayed. However, that only provides a baseline best case for the devices where the operating systems have the least delay.

I’m under the impression that most Android phones sold around the world are a danger, why not simply invoke Hanlon’s razor? (I’m obviously not talking about smearing campaign and harassment.)

Fairphones are worse than typical Samsung and Motorola phones.

That being said, my subject was Fairphone, not its partner…

Fairphone directly responded to this thread with a substance free statement standing behind Murena and trying to mislead people. It's very relevant to them.

Nature protection, fair sourcing, low pollution and humane raw material extraction, and slave free sourcing are serious subjects, as are privacy and IT security.

Things they claim to do, just like they claim to provide a level of privacy, security and updates they do not provide.

Because for the last ten years, Fairphone has been put under the spotlight, and as far as I know, no scam whatsoever has been uncovered. In the meantime, it gained recognition, prizes and labels (it’s the only Blauer Engel and TCO certified smartphone) – some environmental prizes and labels may be BS, but that doesn’t seem to be the case here.

Certifications are very easy to game and are heavily based around self-dealing and money being paid. Fairphone chooses to market their company this way. They also market it providing privacy and updates it doesn't provide. You'll need to provide some actual proof.

I think we can reasonably believe their claims:

We do not and have little reason to believe them.

Regarding Foxconn suicides, I’ll let you draw your own conclusions when comparing Apple Progress Reports around 2010 with what actually happened:

Where's the evidence T2Mobile is so much better than Foxconn today?

Casting doubt on Fairphone’s environmental and labour claims, the way you did, was not appropriate. I hope you’ll agree.

Fairphone spreads misinformation about their products and supports spreading misinformation about GrapheneOS. They support harassment towards our team. They're not ethical or honest. Their claims should not be trusted. Raising doubts about their unsubstantiated marketing claims is entirely appropriate. We just had direct experience with iFixit marketing their products for them with misinformation and that looks very fishy. It draws into question the repair score from iFixit and lots of other accolades Fairphone boasts about when there's so clearly an extreme level of bias perhaps indicating corruption.

Understand, however, that the fair in Fairphone is related to the concept of fair trade which involves social and environmental standards, like avoiding child labour and mercury poisoning in artisanal and illegal gold mines, not this kind of BS on social networks. But any decent company would condemn swatting…

They're supposed to be sustainable but yet lack proper updates and long term support. They're marketing their products as having privacy and security they don't provide. You can see the response they gave to the Android Authority story for yourself.

Now, did you formally present the facts that you’re denouncing to Fairphone?
Have Fairphone been duly informed? Did you get a response?
Did you let Fairphone a chance to comment on their partnership with the Murena and the e Foundation before implying that Fairphone is being dishonest in its commitments?
Are you expecting a positive outcome and good relations with other actors in the industry?

Fairphone is consistently dishonest in their claims about updates and security for their stock OS. It's unsurprising for them to be partnered with blatant scammers and to be peddling false marketing on their behalf. Their partners have been spreading misinformation about GrapheneOS and making personal attacks on our team. It's their responsibility, not ours. Fairphone has repeatedly ignored communications from us and stonewalled people wanting information about things like the Fairphone 4 having an entirely broken implementation of verified boot using publicly available private keys intended only for testing. It looks very much like Fairphone took a shortcut for supporting /e/OS which compromised the security of their devices as a whole. They still appear to be taking similar shortcuts with the current devices. Their response is stonewalling and giving the kind of responses you can see they gave to Android Authority. Not much of an ethical company.

Also, the facts that you’re denouncing are serious, the ones you’re accusing of calumny are under the EU jurisdiction. I’m personally not a fan of never-ending mutual accusations on social networks and forums…

Regulatory and legal action against them within the EU and elsewhere is on the table.

GrapheneOS · 23 Jul

@leafnose Do you think that Fairphone has not seen the founder of /e/OS repeatedly making personal attacks towards our founder and referencing harassment material on his accounts? If they haven't done basic due diligence about their partners and choose not to look into things we've repeatedly brought up, that's on them. Fairphone being partnered with scammers and pushing false marketing for them eventually makes them into scammers too. They're pretty close to that in our eyes even based on their own false marketing.

We will be responding to the responses from both Fairphone and Murena.

GrapheneOS · 23 Jul

/e/OS has made another highly inaccurate response to what we posted, which has at least initially fooled Android Authority. We posted an initial response to Android Authority's coverage, but we'll be making a much more in-depth response and posting a new thread covering everything with more details and references:

https://x.com/GrapheneOS/status/1947794983546695704
https://bsky.app/profile/grapheneos.org/post/3lulmrq4sbs24

GrapheneOS · 23 Jul

Information from the founder of DivestOS on /e/OS insecurity:

Issues with /e/OS: https://codeberg.org/divested-mobile/divestos-website/raw/commit/c7447de50bc8fadd20a30d4cbf1dcd8cf14805a0/static/misc/e.txt

ASB update history: https://web.archive.org/web/20241231003546/https://divestos.org/pages/patch_history

Chromium update history: https://web.archive.org/web/20250119212018/https://divestos.org/misc/ch-dates.txt

Chromium update summary: https://infosec.exchange/@divested/112815308307602739

leafnose · 24 Jul

(No! Why deleting your message?)
@GrapheneOS

Do you claim that this company has better ethics than Foxconn? What is the basis for the claim?
[…]
Where’s the evidence T2Mobile is so much better than Foxconn today?

This is not what I am claiming.
Apple was implicated in these tragedies, as one of the most prestigious customers of Foxconn; it shares a moral responsibility, and probably also shares a legal responsibility under certain jurisdictions.
Although Foxconn was realistically far from being an isolated case at the time – we might say it was pretty close to the norm –, the fact of the matter is that Foxconn employees having worked on Apple products have committed suicide, predominantly at their workplace: a verifiable, documented and undisputed fact.
That was not bad luck, it was the symptom of rationalised awful work conditions; also a verifiable, documented and undisputed fact.
The subsequent shitstorm, and the following damage control for Apple have been a pivotal moment regarding public relations in the industry, not revolutionising working conditions, but hopefully reducing pressure on employees, here and there.
Most documented suicides had happened by the end of the year 2010.

So the pivotal moment was around 2010 – as far as I know, the only explicit reference in Apple reports to what happened is in the Apple Supplier Responsibility 2011 Progress Report (pp. 18–19).

The next part of my answer regarding this point is two-fold.

First, we cannot put in the same basket entities that already existed prior to a pivotal moment with entities that came into existence only after the pivotal moment, as we cannot necessarily do the same with one same entity through time.
To be as clear as possible:

Fairphone was founded in January 2013, and shipped its first smartphones in December 2013;
T2Mobile was founded in 2013;
These two entities started working together in 2021 – Fairphone’s Impact 2021 document (p. 14).

So, yes, if I’m forced to answer, I have no issue with stating that we can reasonably believe that T2Mobile employees who are assembling Fairphone devices have better working conditions than Foxconn employees from 15 years ago.

Secondly:

Fairphones are largely designed and manufactured by T2Mobile in China.

Which one is the problem here? T2Mobile or China?
Do you have information regarding T2Mobile that I do not have (which is possible)?
Or are you working on the assumption that all Chinese factories have the same working conditions?
It is also possible that employees within the same factory do not have the same working conditions, depending on the brand of the devices they assemble – a moral conundrum.

The comparison table we linked primarily compare […]

Thanks for the clarification.

Fairphones are worse than typical Samsung and Motorola phones.

But what about all the other brands? So as the Fairphone OS was being amateurishly developed and maintained, like so many custom ROMs?

Fairphone directly responded to this thread with a substance free statement standing behind Murena and trying to mislead people. It’s very relevant to them.

I missed the response from Fairphone, and I can’t seem to find it.

Certifications are very easy to game and are heavily based around self-dealing and money being paid.

I’ll point out that Google and Apple have a bit more money than Fairphone, yet the latter have certifications that the formers do not have.
As I said in my previous message, I am aware that some labels don’t mean much. In fact, sometimes recycling is not even the good choice, and auditing is a huge business that often ends up being meaningless. However, not all certifications are equal, there’s a hierarchy.

We just had direct experience with iFixit marketing their products for them with misinformation and that looks very fishy.

I totally agree. This advertorial is fishy.
I don’t know if the repairability score has been inflated, but it seems obvious to me why the Fairphone may be the easiest smartphone to repair.

Regarding the distinction between Fairphone and /e/, I don’t know to what extent Fairphone is aware of personal attacks and harassment material – I’m myself not sure to have followed everything – , but it ought to know what’s going on. I agree that it cannot stay silent.

On /e/ privacy concept, the voice to text feature using OpenAI seems to me to be the mother of all red flags. The official response asserting that audio streams are anonymised is appalling – or is their proxy removing names, other confidential information and unique characteristics of the voice from the audio stream?
They should not have set the threshold to ‘very sensitive information’, not nowadays.

spring-onion · 24 Jul

leafnose (No! Why deleting your message?)

Some of the posts were retroactively hidden because they include certain keywords, they're back now.

DDeletedUser370 · 24 Jul

To me, the recent posts seem to make a lot of assumptions regarding the truthfulness of Fairphone's work on sustainability and labour rights. I'm curious if anyone has read and examined Fairphone's latest impact report, which was linked to above. It would be particularly interesting if there was an analysis conducted by a researcher within research fields such as international development or sustainability studies.