I never implied it was, however if someone is using graphene as a way to achieve mobile security, it can generally be assumed they want said security if they switch to a different OS. Iodé and CalyxOS both support more than just pixels, and don’t do data collection, nor do they sacrifice physical security. Mobile Linux on the other hand, has very little physical security, and very poor application sandboxing compared to the aforementioned android forks. It wouldn’t make sense from a security perspective to skip over android forks directly to {postmarketos, Ubuntu touch, armbian/mobian, manjaro mobile…} unless your goal is to use a Linux phone without caring about physical security and app sandboxing (which would not make sense if you are using Graphene, and don’t want to change your threat model too much while not supporting Google.)

I require my banking app to work.

Everyone does run proprietary hardware with its own hardware vulnerabilities that could very easily be exploited and escalated without proper security. Unlocked bootloader leaves you open to very easy physical attacks. Phones batter is low and you need to charge it in a public space? You better hope no one had modified the charger with something like an RPI to silently exploit your phone. Crossing a border into a country and they suspect you’re some sort of threat? There goes all your personal information directly to their government. Not running software that updates the hardware’s proprietary software drivers? One text message and you’ve got a rootkit.

You are more than welcome to run less secure and/or insecure software. No one is telling you you can’t. If someone is on GrapheneOS however, they’re probably not using it to be on a less secure os. Most people don’t want a less secure os. I’m glad you currently have the option to do what you want, but this response to someone using a secure OS about how to stay secure didn’t really need an “um ackshually” about people who don’t want a secure os.

As someone who only uses fedora on all my PCs and iodé on my phone, I’m not sure why you think I’d say this just to stir up drama. I’ve done the research into what would be available on mobile relative to my current threat model and found its not ready, and will most likely not be ready for a long time unless were somehow blessed with another Steam deck like moment for phones.

Also, can we stop the stupid spongebob chicken mocking text? It makes your response seem a lot more negative than it needed to be.

Just get a flip phone for calls/SMS. Then pinephone for cool stuff.

I can’t imagine someone who wants to use their phone wants to spend that time using it setting up sandboxing by hand.

Degoogled android has way more potential from what I can tell. Android has a solid ecosystem of apps while protecting security and privacy. Google is the core problem. Why throw away years of work on AOSP and F-droid.

Since the original user doesn’t actually know the answer to the question asked, its because

Mobile Linux doesn’t support any sort of verified boot like android does, leaving it open to evil maid attacks

Mobile Linux doesn’t sandbox applications as well as android, leaving it open to spyware (Think Facebook intercepting Snapchat DMs, not old school steal your credit card spyware)

and I feel like there’s a third major big thing but I can’t recall it at the moment. Android’s security model is genuinely one of the most secure out of any modern operating system. I’m all for Linux phones, but they need to prioritize parity with Android security before I daily drive one.

One thing Google seems to be able to do right is security. Android has a strong security architecture that is highly robust. You can straight up download malware or lose your phone and everything stays safe.

I’m not saying it would be impossible to create a OS that is as secure as Android. However, it would take some very serious work and would likely mean building something from scratch with APIs for permission requests.

Do you have examples where that isn’t the case?

Linux phones tend to just be the desktop versions of desktops adapted for a smaller screen.

Android has well built ecosystem with strong privacy and security features not really found anywhere else. The entire system focuses on least privilege with strong security isolation so even if you do download something bad it will have a hard time doing real damage.

Android has very strong security sandboxing and tight permission control. It also tracks the integrity of the system so it is very hard to tamper with the boot process. Everything is encrypted and the entire system is very hard to break into even with physical access.

Android is really impressive if you dig into the bolts. While I would love to see something on Linux do something similar I haven’t seen any OS come close.

This is a frankly a bad take. Just because something is foss doesn’t mean that it can’t poss a risk. Software tends to have security vulnerabilities and supply chain attacks. From a security perspective you want to follow best practices such as least privilege and defense in depth. Blinding trusting software is not a good idea regardless of the source.

The problem is the economics of what you want.

It is going to cost money to buy phones, unpack them, upload the OS, test the product, then repack them and ship them. I would expect that to cost at least $20, probably more.

Then, after that, you have to maintain the phone software for several years. That includes testing the builds, which will likely be at least tens of thousands of dollars for each update.

So, you’re adding all this cost to a phone and for what? A phone that will be less capable than what is currently sold? And, likely, those who would be more likely to purchase this service can do it themselves.