GrapheneOS: Full Setup Guide, maximise Privacy, Security & Battery after Installation

Maximise your Privacy, Security and Battery life with this post-install checklist für your #GrapheneOS #android phone. If you are using #graphene with out of the box settings, you are missing out on some of the greatest features.
I'm covering:
00:00 Introduction
00:28 Multiple Android User profiles and GrapheneOS specials, isolating apps and digital life, best practices
04:00 Quick tipp: Migrating/copying apps to other profiles
04:34 Deleting user profiles
06:37 Settings: Network
08:55 Settings: Connected devices/Bluetooth
09:55 Settings: Notifications & Battery
10:32 Settings: Storage Scopes (!)
12:50 Settings: Privacy
13:46 Settings: Security, PIN vs Biometrics/Fingerprints
16:05 Customise quick settings
17:46 Installing Apps, but not the F-Droid Store
18:50 Neostore as F-Droid alternative
21:36 Aurora Store, Rate limiting, best practices
23:56 Google Play services
24:45 Additional tweaks

[@Liberty4Ever]

This was a very needed intermediate level GrapheneOS tutorial. IT's easy to install GrapheneOS and blindly trust all of the defaults and not take full advantage of the privacy and security features. I learned a few things and changed my phone settings in a couple of places to tighten security. The video seemed to show how to have the most private and secure phone-centric life with many apps installed and a lot of phone activity. I have a different approach. I have very few apps on my phone to reduce the threat surface. I don't do any banking or payment using my phone. I use the phone for calls, texts, Signal secure texting, and the occasional web browsing or video watching.

[@DigitalIndependent]

Thanks for your feedback! Very interesting! I work in the internet space and use lots of tools. So this is geared towards being able to use various apps in an as secure way as possible. Not using the apps in the first place is the better way to go, but not everybody can. Cheers for your feedback! The next video will be about making your own private VPN.

[@rasix86]

Just don't allow any browser to install apps. Instead allow your Files app to install apks.

[@DigitalIndependent]

Very good point! That’s even better than having a separate browser for maintenance

[@notme3945]

I don't seen an option for this, whenever I open an APK from the files app it wants me to give Vanadium permission

[@cryptotech4401]

How do we do that? @rasix86

[@celiskurtis]

@@notme3945 install shizuku and SAI. Give Shizuku the permissions it needs with ADB. Then give SAI the Shizuku permission.

[@em.b.5231]

26:53

[@ozzemie]

I just got my new phone and installed Graphene on it and it's thanks to videos like yours that it's been smooth sailing up to now. Thank you very much!

[@roseforeuropa]

This was extremely comprehensive and VERY easy to follow. Your pace was a good balance between speed and clarity. I followed everything except I opted to download .apk files direct from source.

[@DigitalIndependent]

Thanks for the feedback! Very much appreciated :)

[@YuKonSama]

Though about that as well. How does this work with updates? Do you have to maintain everything manually?

[@emerald_mtn]

This is incredibly helpful. Thank you SO much for creating this. I am just being my graphene transition.

[@DigitalIndependent]

Glad it was helpful! :)

[@tiREV55]

Just installed Graphene and went through your steps, thanks for this guide!

[@DigitalIndependent]

Glad it helped!

[@digisol492]

awesome tutorial; thanks for the time putting all this together!

[@DigitalIndependent]

Thanks for watching and your feedback! Your own private VPN is coming soon…

[@YETIPUNK]

Just installed this OS and followed your suggestions...thanks man👍

[@DigitalIndependent]

Enjoy :)

[@louishurr393]

This was really great. Thank you!

[@DigitalIndependent]

Glad it helped :)

[@android-pixel4070]

Awesome tutorial! There are plenty of tutorials on how to install GrapheneOS, but very few follow-on guides to optimize or harden settings after that.

[@android-pixel4070]

Also good that the 'why' of each setting/optimization is explained, rather than just 'do this, trust me it's secure!'.

[@AuroraPixel6]

Great video, it helped me to optimise my GrapheneOS

[@DigitalIndependent]

Glad it helped :)

[@goodcitizen4587]

Thanks a ton! Tricking out my Pixel 4a. Sub'd!

[@DigitalIndependent]

Thanks! Pixel 4a is a great value phone and gets new life from graphene.

[@user-gd7yw7pk8m]

Hey man! I loved this tutorial, as well as the first GrapheneOS setup video; great job. With privacy in mind, how "bad" is using the standard messenger and calling apps from GrapheneOS? Is an app like Signal necessary in order to preserve my privacy?

[@DigitalIndependent]

Thanks! What’s a standard messenger to you :)? I think privacy is a trade-off. It’s difficult to get everything right. For me: Signal all the way.

[@wildone1480]

Awesome video. New to graphene and this has opened my eyes to the possiblities. Can I still use music apps like Spotify and Apple Music and should I add them into its own profile? Thank you for the help - new guy 😂

[@ThomasBMXFreestyler]

Keep uploading about Privacy , security and stuff :)

[@ricko_1965]

This Video was so helpful - Thank You, just picked up my Pixel 7 this morning and installed GrapheneOS with your help. Well Done....

[@DigitalIndependent]

Great to here! Have lots of fun!

[@Bond2025]

excellent, i will be installing after watching the Naomi Brockwell videos.

[@DigitalIndependent]

I’ve got a full install video here, too: kzbin.info/www/bejne/h4DUh4KZq8yUnsU

[@Tapsnapper]

Nice interesting video, I'm totally new to GrapheneOS and this has been a very good introduction. Do you know if Graphene lets you run alternative launchers? I quite like the Trebuchet launcher used in LineageOS.

[@DigitalIndependent]

Yes, you can use any launchers. But beware, many are very aggressive at tracking you

[@MrKevinours]

Big thank you !

[@DigitalIndependent]

You're welcome! Thanks for watching and have lots of fun with your Graphene phone! Quick plug: your own self-hosted VPN is coming up next

[@drosskills]

Thanks for the video! How do you approach selecting the right carrier and/or SIM card from a privacy standpoint?

[@DigitalIndependent]

I don’t think there’s much difference because carriers are usually some kind of „critical infrastructure“ and thus fall under special legislation. That usually hits all of the carriers. So choosing wisely isn’t going to help that much. A much larger impact would be using a good VPN for surfing. That’s why my latest video was about securing a simple and cheap VPS (virtual private server). As soon as you have that, you can configure a VPN on it (that’s one of the next three videos coming up). Do stay tuned :)

[@Akira_Rei]

Really informative, did not know this was a feature. I have a different alternative OS and it works for it as well.

[@DigitalIndependent]

What do you run?

[@otisobl]

I'd be intereded as well. Looking for a good option for a Fairpone.

[@luisqp66]

Thanks. Could you explain how you use your owner profile? Do you take and receive calls from there ? Do you have any repos installed ?

[@DigitalIndependent]

The owner profile is a normal android user. So just install and use whatever you want on it…

[@luckychukiye8743]

Thanks!

[@DigitalIndependent]

You’re welcome :) more coming…

[@galapogosisland]

Great tutorial. With multiple profiles, is the same app required to be installed per profile or are there ways to optimize it?

[@DigitalIndependent]

You can have completely different apps on each profile. Some apps even create problems, if you install them later on a different profile. F-Droid is an example for that. Better use the alternative I described.

[@tclearytcleary]

@@DigitalIndependent I followed your neostore advice but couldn't locate Aurora store within it, using the search function or filtering alphabetically. Has it been removed from the neostore?

[@davidg369]

Thank you for this video! I'm confused about the difference between installing and using google play store with a throwaway account and permissions locked down, versus installing the Aurora store and using that with a throwaway account. Why is the Aurora store the preferred approach?

[@DigitalIndependent]

Lots of little benefits, but I wouldn’t call them big: 1. purity: the play store app never even touches your phone 2. obscurity: who know what security issues might come up in the future. Not having the play store App might just mitigate in some imaginary scenarios. 3. showing Google that we want more freedom. The EU is forcing side loading soon anyway, but it’s still a statement. 4. supporting Aurora by using it. 5. my main reason: I don’t have to rely on GrapheneOS or me having locked down the Play Store App properly, because it’s not there :)

[@davidg369]

@@DigitalIndependent That makes a lot of sense, thank you!

[@ntplx9975]

Very much agree on your choices and like the way you present and explain, thanks! Yet, one thing I'd love to better understand is under which profile you install apps; do you tend to do this as owner and remove the ability to install apps in all other profiles? And have you come across a reliable and pricacy firendly profile switcher that you like?

[@DigitalIndependent]

You can switch profiles by simply pulling from the top twice: once to see the controls and again for the extended version of the controls. Bottom right is your profile Switcher. I have one profile for everything that absolutely need google, one for private surfing, one for kids and one for work. All with their own apps.

[@ntplx9975]

@@DigitalIndependent Thanks for pointing that out. I am aware of the regular method to switch profiles, not too complex but yet I thought there might be some kind of shortcut. For the second part, this was clear to me from your video. Yet I wondered if you you install them from within the individual profile OR if you remove the ability to install apps for the less priviledges profiles and use the Owner profile for installation and then make them available to the respective profiles. Maybe in the end this would be the same from a security perspective, I don't (but would love to) know.

[@grunnenpi]

This is what I'm interested also.

[@grunnenpi]

For example are all Google apps installed under the googleshit profile or under the primary profile?

[@grunnenpi]

And apps that I once bought, under what profile do I install them?

[@paarker]

Cheers buddy

[@DigitalIndependent]

Any time!

[@YuKonSama]

Maybe I missed it, but how do you split the app install across the profiles. Do you have anything installed on the "admin" profile? Do you install apps with the "me" profile primarilly? Where do you use the app services, only in the "googleshit" profile or in all of them? Thanks for the great tutorial.

[@DigitalIndependent]

I install the most common apps across all profiles in the admin/owner profile. Then I can transfer these app installs to all other profiles under „manage users“. Then I delete them from the owner profile. In every single profile I separately install apps. Googlesh*t is a profile where the few apps run that insist on Google play services. They are sandboxed there. Usually navigation and all E.V. related apps

[@nayibmc5437]

How does theming work on GrapheneOS? Is it the same as stock's Material You, or is there no theming by default?

[@DigitalIndependent]

Sorry, haven’t tried that :(

[@1q3er5]

what is vanadium - is it a spoofed google chrome browser? is it compatible with add-ons like say an metamask wallet?

[@genieur8188]

Thanks so much for stretching what to do after the installation. So many helpful hints and tips. Any insights or thoughts on DNS services? I have heard to better use a secure protocol and connet with one which refuses censorship. Kind greetings from Düsseldorf.

[@DigitalIndependent]

Thanks! That is the topic of the next video: your own (self hosted) VPN for private surfing. Ich hoffe die Zahlen in deinem Profil sind nicht politisch gemeint.

[@genieur8188]

@@DigitalIndependent Da bin ich mir keiner Schuld bewusst. YT hat irgendwann an alle Profilnamen ein paar Zahlen angehängt.

[@SpookyLurker]

Where do you import your past SMS mesaages to (profile) and how? What about contacts?

[@DigitalIndependent]

SMS: no idea. Probably some app that allows you to export them. Have a look in the neostore. Contacts: those can be exported and imported. But I host my contacts in a nextcloud and sync them via CardDAV. That’s one of my planned videos

[@GainingDespair]

The first 16 mins is this intended for the primary/admin user account or done on all user accounts? If set on admin user will it carry over to secondary user accounts?

[@DigitalIndependent]

I usually install the apps on the admin user, then transfer them to the other users and delete them from the admin. This saves time, but only if you intend to have some apps in multiple local users. Otherwise just run through this on a per user basis

[@tuxforce]

What happens if I have a messenger app on a separate profile and receive a notification there? Will I be notified while I am logged in with another user profile? If yes, clicking on the notification will open the chat on the other profile where the messenger app is installed?

[@DigitalIndependent]

Yes. Every profile can be set to „receive notifications from other profiles“. Then you see a notification „signal“ from profile „private“.

[@TheSulross]

the elephant in the room is what to do for a navigation app on a privacy fork of Android, such as GrapheneOS (great video, BTW - a nice follow on would be a video highlighting various apps that are likely to be needed by most users - I have a fav note taker app, 2 factor authentication app, bar code scanner app, the whole subject of VPN, perhaps email clients - use Proton Mail myself, secure chat clients as alternatives to just using SMS, etc., etc., etc.)

[@JohnDoe-iv5ns]

What note taker app do you use? I'm thinking of trying Joplin or Obsidian.

[@TheSulross]

@@JohnDoe-iv5ns I use Standard Notes, which recently got acquired by ProtonMail guys, which I also use. I use it on my personal Linux PC and laptop and my Windows work laptop and can, of course, keep notes synced across all devices.

[@DigitalIndependent]

Very interesting ideas! Personal VPN is coming up next. Casual navigation is doable, but for professional travellers it’s very lacking. App recommendations is great, I have started the script on that.

[@DigitalIndependent]

Obsidian with Syncthing. Have two syncthing nodes at locations I control.

[@acespade987]

how do you logically separate between profiles? do you keep the Admin profile empty & use another profile like your "me" profile as your main use profile? Do you install neostore & aurora store in each profile separately? or conversely do u keep neostore & aurora only in your main or Admin profile , download required apps there & then copy the apps to other profiles? how does this work if the app needs Google play services but the downloading profile doesnt have google play services?

[@MrThommsan]

@DigitalIndependent I'd be also interested in what @acespade987 mentioned. And by they way, as @mistawinta asked below, any idea why Neostore hasn't been updated in a year? Is it still the way to go for apps? Thanks a lot in advance. Best regards

[@DigitalIndependent]

You are asking the right questions :) I install aurora and neo afterwards on the various profiles and add apps per user later on. This was just a shortcut to get the first set of local users up and running without having to duplicate steps. Should have mentioned that though :)) For apps requiring google play services: they are sandboxed and have reduced privileges in graphene. So I try to group apps into two additional users: one profile that really requires Google stuff (navigation mainly, but also meet and others) and one profile for specific apps that need Google play services (that’s a few banking and business apps). If you play games, then that would be a separate user, because I inherently don’t trust game developers security practices.

[@DigitalIndependent]

You are asking the right questions :) I still use neo store, it just pulls the f-droid stuff and presents it in a nicer way. Since I do updates and maintenance only once or twice a week I usually switch off the „install apps“ permission for these when I am not using them. Not sure, if you get a notification for my other comment, so here’s my answer: I install aurora and neo afterwards on the various profiles and add apps per user later on. This was just a shortcut to get the first set of local users up and running without having to duplicate steps. Should have mentioned that though :)) For apps requiring google play services: they are sandboxed and have reduced privileges in graphene. So I try to group apps into two additional users: one profile that really requires Google stuff (navigation mainly, but also meet and others) and one profile for specific apps that need Google play services (that’s a few banking and business apps). If you play games, then that would be a separate user, because I inherently don’t trust game developers security practices

[@julio2854]

What if you still need Google apps for work purposes? Does it defeat the purpose even if we run it on different user profiles? Is it still better to use graphene even with a work user profile with outlook, slack, whatsapp etc. or does it defeat the purpose and should I stay with iphone?

[@DigitalIndependent]

I isolate all Apps that need Google in a seperate profile and this doesn't run in the background. And I have started phasing out many apps that rely on Google. You'd be surprised about the quantity and quality of Apps on neostore/F-Droid

[@luckychukiye8743]

Getting my new pixel soon

[@DigitalIndependent]

Enjoy !

[@MrMosoani]

I'm still juggling between this and lineage OS 21 another issue is our fin tech app in our country don't support rooted phones

[@reclee8333]

If you have no VPN and have to connect to untrusted wi-fi, are there settings/features on grapheneos that can protect you?

[@DigitalIndependent]

Not much. Random MAC addresses in the setting for that specific WiFi and set your own dns, maybe Quad9 or another public dns server. But the traffic is going through that WiFi, not protected by a vpn. So that’s inherently un-private.

[@mistawinta]

I'm hesistant to download the neostore as it hasn't been updated in a year. Any idea why? Do you still use it?

[@GuillaumeCoste]

Same here, what did you end up doing ?

[@iFunktion]

The neo store just does not work on mine, it just shows Battery Optimization and Permission to post notifications only and no way to get rid of them, any idea how to solve this?

[@DigitalIndependent]

You have to deactivate batter optimisation and give permissions for notifications for this message to go away

[@philrose7716]

I have GrapheneOs on a pixel 6. My question i want to make a forward calling. But the to use is not available to use what can i do?

[@DigitalIndependent]

I am not sure what you mean, sorry :/

[@dudi2200]

Is there any analysis video of this operation system? It's nice that everyone repeats the same buzz words privacy and open source but i was wondering if anyone actually read the code and checked if there's nothing suspicious there. And also how can you make sure the web installer install the same open source code and not something else?

[@DigitalIndependent]

Good question. There was some talk on Reddit on audits. But I can’t find the link. Try the privacy subreddit for that…

[@gsftom]

👍

[@DigitalIndependent]

Cheers :)

[@michaelmana1335]

Are you able to enable Mobile Data and Hotspot from non-admin users?

[@DigitalIndependent]

Nope. One of the downsides. Hotspot is only for the main user. But you can activate mobile data per user

[@abexman]

Someone on Reddit said that putting things in separate profiles doesn't provide true 'sandboxing' - is this correct?

[@DigitalIndependent]

Half and half. Apps really don’t read each others files and data. Since the apps are one of the greatest potential vectors for snooping and siphoning data I’d say that’s a very good baseline. There are occasional holes in the separation, which are mostly upstream bugs in Android. The media player card currently bleeds out into other profiles‘ notification centres. But that’s mostly it. Do you have a link to the thread?

[@abexman]

@@DigitalIndependent my comments are not being posted - weird. Here is someone from Graphene forum: Unlike Qubes where VMs provide the security boundary, in Android user profiles are separated via SELinux MLS (multi level security). Apps with a targetSDK of 28 (Android 9) or later also have their sandbox enforced by SELinux MLS. Any exploit that could cross the boundary between apps would likely be capable of crossing between user profiles

[@DigitalIndependent]

@@abexman yes. But SELinux exploits are rather rare. And that’s more like the persistent advanced threat actor that gets to use those. Separation is more against the abuse of permissions and being able to selectively delete a partner your digital life

[@sticksnstones5407]

When I created a second profile I'm unable to use messages it says "This app isn't allowed by the device owner" Is there a way to fix this

[@DigitalIndependent]

You have to go to the profile settings of that specific profile and ensure you have activated „make calls and send messages“ (or something similar

[@user-me9ru1rk5x]

Is there an possibily to reset the Phone automatically when its connected to an pc?

[@DigitalIndependent]

Not that I know of. Maybe with Tasker and running command line scripts. The Tasker ecosystem might have something. Please report back :)

[@acehoodman]

How did u manage to get ur screen cast working?

[@DigitalIndependent]

Built-in. Just started it and it worked. Why?

[@acehoodman]

@@DigitalIndependent It never worked for me as it doesn't find any devices. E.g. I was trying to Screen cast to my Samsung QLED TV. Works with every other Android Phone, just not with the Pixel running GrapheneOS 😥

[@DigitalIndependent]

@@acehoodman I misunderstood, sorry! I thought you meant the screen recording. Haven’t tried casting to a tv yet.

[@acehoodman]

@@DigitalIndependent Screen recording works fine but Screen Casting seems to be a general issue with AOSP and Pixel devices.

[@invictant_media]

whats the max amount of user profiles?

[@DigitalIndependent]

I have 6, no maximum found until now

[@_Sepherial]

Can GrapheneOS be installed on a Samsung Note II?

[@DigitalIndependent]

Nope. Sorry

[@subsystemvids]

Any plans for more videos?

[@DigitalIndependent]

Yes. Your own VPN is coming up. Had to re-do the whole video because the maintainer of the easiest but also safe way noped out and nobody has taken the reigns. So the original video got useless.

[@sjatkins]

I guess I would make a good criminal because every time I register a fingerprint on any device it works for a few weeks and then doesn't work anymore. I have tried different fingers in case forefinger gets more callused or something. No joy.

[@DigitalIndependent]

Uhoh! Please never buy a fingerprint lock to your flat or house :)

[@hogster5935]

Didn't work for me. Even re-flashed back to droid and tried again. Tried cables too. Giving up or trying to find someone who can help me near where i live.

[@fdsknjlsfnubk3e7hi8sx]

you cannot reflash after gos installed. its bricked afer gos

[@Sirshort123]

I JUST LOST A YEAR OF IMPORTANT PHOTOS!!! BACKUP FIRST!!! I guess I only have myself to blame really; but I watched 5+ long videos about GrapheneOS and installation walkthroughs, and I guess I still somehow just missed the memo to make sure your phone is COMPLETELY BACKED UP (PHOTOS, files, anything that you would lose if you could push one “wipe phone” button on your phone). Do not do a single step of installing GrapheneOS, before making sure you haven’t forgotten to backup EVERYTHING. RIP Dad, RIP Lily, RIP Patches; a year of saving things through pictures and screenshots gone, a year of a lot of photos of myself that now, I just won’t have a year of my life to be able to reference or look back at; just a year that I’ll pretend I was blackout drunk literally every day, because I literally have no other way of verifying that that year even happened tbh. Poof. RIP me

[@Sorin68]

Me pregunto si cuesta algo poner subtitulos en tus videos...Un saludo desde España

[@DigitalIndependent]

There are some AI and translation services out there. Maybe that’s a perk when I have 5.000 subscribers :)?

[@sandrosandro6430]

Why only pixel? Is there any secret deal with Google? Becsuse this forces one to buy a pixel phone

[@DigitalIndependent]

Good question. The pixel has acceptable global sales numbers and it’s a vanilla version of Android, without additional vendor changes like in Samsung. It just seems to be the obvious choice…

[@biotechy2k]

I had to laugh when I saw your user profiles because I toss all my Google apps into a folder called Google shit also lol I have been using a zte blade I've moved back to an older device because I pretty much stipped everything off it you might say it's a smart phone that's been rendered dumb its for texting and calls only so far if I brick the zte I don't really care it's basically a shitbox but will be fun to play with a custom ROM

[@fusion9619]

American police and officials are now legally allowed to use your fingerprint to open your phone - by force. So... I guess that debate is settled.

[@DigitalIndependent]

Thanks for pointing that out! I would suggest isolating the private stuff in one user account that doesn’t unlock with a fingerprint. Maybe call it something harmless like „kids“ or „drug trade“.

[@npc-drew]

My only fear is Google stopping to make phones, lol, 😅🤣the irony on that?!

[@genericdude6551]

Too many things to consider when trying to secure phones, laptops, desktops, browsers, and so on. And you have to review security implementations on a regular basis because some apps can become rogue or there are better ways to secure everything or there is some new exploit. I think we're fooling ourselves into a false sense of security. That said, I have bought a Pixel 6 Pro and installed graphene on it. Too bad that a lot of phones can't be rooted so that an alternate OS can be put on it.

[@alisius5640]

Can I install graphene OS en this device? Device Information App Version 7.1-rc1-release Version Code 96 Device Manufacturer realme Device Name RMX1931L1 Device Model RMX1931 Device Brand realme Android Version 11 CPU Arch aarch64 Storage Total 108.19GB Storage Free 90.24GB RAM Total 7.32GB Is Device Rooted false

[@DigitalIndependent]

Nope. Pixel or pass