-
Notifications
You must be signed in to change notification settings - Fork 11
/
android_comparison.htm
1230 lines (1077 loc) · 54.5 KB
/
android_comparison.htm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html>
<head>
<title>Comparison of Android-based Operating Systems</title>
<meta name="description" content="Comparison of Android-based Operating Systems">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta charset="UTF-8">
<meta name="keywords" content="Technology, Browsers, Firefox, Chrome, Edge, Safari, Brave, Vivaldi, Operating Systems, Desktop Environments, GNOME, KDE, Xfce, Linux, Unix, BSD, Solaris, Windows, macOS, Instant Messengers, Chat, Software, Cloud, Sync, Email, Privacy">
<meta name="author" content="Alphonse Eylenburg">
<link rel="stylesheet" href="style.css">
<style>
:root {
--legendwidth: 280px;
--distrowidth: 230px;
}
table.comparison {
margin-top: 1em;
text-align: center;
border: none;
table-layout: fixed;
font-size: small;
width: calc(var(--legendwidth) + 7 * var(--distrowidth));
height: 100%;
}
table.comparison tr td:nth-child(2) {
border-left: 1px dotted lightgrey;
}
table.appendix {
text-align: center;
table-layout: fixed;
width: 100%;
font-size: small;
}
table.appendix td {
border: 1px solid #ddd;
overflow-wrap: break-word;
width: 25%;
}
table.appendix td:first-child {
text-align: left;
}
table.appendix thead {
position: sticky;
position: -webkit-sticky;
top: 0px;
z-index: 10;
font-size: small;
}
thead {
border: none;
position: sticky;
position: -webkit-sticky;
top: 0px;
z-index: 10;
font-size: large;
}
thead tr td {
background-color: white;
font-weight: bold;
}
@media (prefers-color-scheme: dark) {
thead tr td, .legend {background-color: #222 !important; color: white; }
}
td {
border: none;
padding: 0px;
vertical-align: top;
overflow-wrap: break-word;
hyphens: auto;
}
td img {
padding: 15px 0px;
}
.semititle {
text-decoration: underline;
font-weight: bold;
vertical-align: bottom; }
.legend {
text-align: left;
white-space: nowrap;
padding-right: 5px;
background-color: white;
}
.center {
text-align: center;
}
.tooltip {
text-decoration: underline;
text-decoration-style: dotted;
text-decoration-color: darkred;
z-index: 99999;
}
.tooltip .tooltiptext {
visibility: hidden;
background-color: black;
color: #fff;
text-align: center;
border-radius: 6px;
padding: 5px 5px;
position: absolute;
}
.tooltip:hover .tooltiptext {
visibility: visible;
font-weight: normal;
}
.green {
background-color: #CEE6BB;
}
.lgreen {
background-color: #E7F2DD;
}
.yellow {
background-color: #E7DEB1;
}
.lred {
background-color: #F5E0D6;
}
.red {
background-color: #EBC1AD;
}
img.logo {
max-width: 150px;
max-height: 75px;
}
td.green,
td.lgreen,
td.red,
td.lred,
td.yellow,
td.line {
border-top: 1px solid ivory;
border-bottom: 1px solid ivory;
}
@media (prefers-color-scheme: dark) {
td.green, td.lgreen, td.red, td.lred, td.yellow { color: black; }
}
@media (min-width: 578px){
.legend {
position: -webkit-sticky;
position: sticky;
left: 0;
}
}
sup {
font-size: x-small;
}
</style>
<body>
<script src="top.js"></script>
<header>
<p><a href="index.html">← Sitemap</a></p>
</header>
<h1>Comparison of Android-based Operating Systems</h1>
<p>This is a comparison of popular Android "ROMs" (better term: AOSP distributions or Android-based OS). Please note I'm not affiliated with any of these projects and I am not giving any specific recommendation. If you think anything is factually incorrect, please let me know.</p>
<h2 class="center">Comparison of Android-based Operating Systems</h2>
<p class="center">Source: eylenburg.github.io</p>
<p class="center" style="color: red; font-size: small;">Last updated: 15 November 2024</p>
<table class="comparison">
<colgroup>
<col style="text-align: left; white-space: nowrap; padding-right: 5px; width: var(--legendwidth);"> <!-- legend -->
<col style="border-left: double; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<thead>
<tr>
<td class="legend"></td>
<td>GrapheneOS</td>
<td>DivestOS</td>
<td>CalyxOS</td>
<td>IodéOS</td>
<td>/e/</td>
<td>LineageOS</td>
<td>"Stock" Android</td>
</tr>
</thead>
<tbody>
<tr>
<td class="legend"></td>
<td><img class="logo" src="pics/logos/android/grapheneos.svg" /></td>
<td><img class="logo" src="pics/logos/android/divestos.svg" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/calyxos.jpg" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/iodeos.png" /></td>
<td><img class="logo" src="pics/logos/android/eos.png" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/lineageos.png" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/android.svg" /></td>
</tr>
<tr>
<td class="legend">Based on</td>
<td>AOSP</td>
<td>LineageOS</td>
<td>AOSP</td>
<td>LineageOS</td>
<td>LineageOS</td>
<td>AOSP</td>
<td>AOSP</td>
</tr>
<tr>
<td class="legend semititle"><br />Freedom</td>
<td></td><td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Free and open source (FOSS)?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Deblobbed?</td>
<td class="lgreen">Yes, significantly</td>
<td class="green">Yes, extensively</td>
<td class="lgreen">Yes, significantly</td>
<td class="yellow">Yes, minimal</td>
<td class="yellow">Yes, minimal</td>
<td class="yellow">Yes, minimal</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend semititle"><br />Features</td>
<td></td><td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend tooltip">Network controls for apps<span class="tooltiptext">The controls on LineageOS-based operating systems are leaky as their approach only disabled direct network access (socket) but doesn't disable indirect access via the INTERNET permission, which provides multiple ways of bypassing them not requiring collusion between apps. This functionality is regularly used by apps with no malicious intent. Collusion between apps is an issue for all kinds of granted access, permissions, etc. and not specific to the INTERNET permission. If INTERNET permission is not blocked though, no collusion is required.</span></td>
<td class="green tooltip">Direct and indirect access<span class="tooltiptext">In addition to blocking indirect access via INTERNET APIs, the GrapheneOS Network toggle also emulates the network being down and avoids running scheduled jobs which require the network.</span></td>
<td class="green">Direct and indirect access</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Network-based location (without GNSS)</td>
<td class="green tooltip">Emulated <sup>default</sup>, or Play Services<span class="tooltiptext">Emulated by default (redirect to GNSS-based location), can use sandboxed Google Play via toggles when installed</span></td>
<td class="red">No</td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td class="red">No</td>
<td class="green">Play Services</td>
</tr>
<tr>
<td class="legend">System-wide connection/tracker blocking</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">hosts file, Private DNS, or VPN</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">iode-snort app, Private DNS, or VPN</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">Private DNS setting, or via VPN app</td>
</tr>
<tr>
<td class="legend">E2E-encrypted phone backups</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="yellow">Yes, but requires Google login</td>
</tr>
<tr>
<td class="legend">Notification forwarding from other user profiles</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Duress PIN (to wipe device)</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#duress" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Android Auto compatible</td>
<td class="green tooltip">Yes (<strong>sandboxed</strong>), <a href="https://grapheneos.org/usage#android-auto" target="_blank">see here</a><span class="tooltiptext">GrapheneOS has permission toggles to enable the user to provide the least amount of permissions necessary (e.g. wired Android Auto requires only USB access).</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="green">Yes, <a href="https://blog.iode.tech/use-android-auto-with-iodeos/" target="_blank">see here</a></td>
<td class="green">Yes, <a href="https://doc.e.foundation/support-topics/android-auto" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend">Google Pay compatible</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend semititle"><br />Degoogling (connections to Google)</td>
<td></td><td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">eSIM activation</td>
<td class="green tooltip">Google eUICC w/o data sharing<span class="tooltiptext">Disabled by default. Unlike the regular Google eUICC management app, it doesn't require Google Play and cannot share data with it. It doesn't communicate with Google servers unless the carrier is hosting with them, which would involve using their servers regardless.</span></td>
<td class="green">OpenEUICC</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
</tr>
<tr>
<td class="legend">Provider for network-based location</td>
<td class="green tooltip">Emulated/GNSS <sup>default</sup>, or Google<span class="tooltiptext">Emulated by default (redirect to GNSS-based location), can use sandboxed Google Play via toggles when installed</span></td>
<td>n/a</td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td>n/a</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">SUPL</td>
<td class="green">GrapheneOS <sup>default</sup>, Google or none</td>
<td class="yellow">Google <sup>default</sup>, or none</td>
<td class="yellow">Google <sup>default</sup>, or none</td>
<td class="yellow">Google <sup>default</sup>, or none</td>
<td class="lgreen">None <sup>default</sup>, or Google</td>
<td class="yellow">Google <sup>default</sup>, or none</td>
<td class="red">Google</td>
</tr>
<!--
<tr>
<td class="legend tooltip">PSDS (depends on device)<span class="tooltiptext">Default server depends on GPS chipset, e.g. phones with Qualcomm chips connect to a Qualcomm server and phones with Broadcom GPS connect to a Broadcom server, except Google Pixels with Broadcom chips that connect to a Google server instead. Some ROMs override these settings. <br /><a href="https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">GrapheneOS <sup>default</sup>, Google/Qualcomm, or none</td>
<td class="green">Broadcom/Qualcomm <sup>default</sup>, or none</td>
<td class="green">Broadcom/Qualcomm <sup>default</sup>, or none</td>
<td class="green">Broadcom/Qualcomm <sup>default</sup>, or none</td>
<td class="lred">Google/Broadcom/Qualcomm</td>
<td class="yellow">Google/Broadcom/Qualcomm <sup>default</sup>, or none</td>
<td class="lred">Google/Broadcom/Qualcomm</td>
</tr>
-->
<tr>
<td class="legend tooltip">PSDS - Google Pixel 6 and later<span class="tooltiptext">The default server used depends on the GPS chipset, e.g. phones with Qualcomm chips (e.g. Snapdragon) connect to a Qualcomm server, while newer Google Pixels with Tensor chips connect to a Google server, and other phones with Broadcom GPS (e.g. Exynos) connect to a Broadcom server. Some ROMs override these settings. <br /><a href="https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">GrapheneOS <sup>default</sup>, Google, or none</td>
<td class="green">Broadcom <sup>default</sup>, or none</td>
<td class="green">Broadcom <sup>default</sup>, or none</td>
<td class="green">Broadcom <sup>default</sup>, or none</td>
<td class="lgreen">None <sup>default</sup>, or Google</td>
<td class="yellow">Google <sup>default</sup>, or none</td>
<td class="red">Google</td>
</tr>
<!--
<tr>
<td class="legend ">PSDS - other devices</td>
<td class="green">GrapheneOS <sup>default</sup>, Qualcomm, or none</td>
<td class="green">Broadcom/Qualcomm <sup>default</sup>, or none</td>
<td class="green">Broadcom/Qualcomm <sup>default</sup>, or none</td>
<td class="green">Broadcom/Qualcomm <sup>default</sup>, or none</td>
<td class="green">Broadcom/Qualcomm</td>
<td class="green">Broadcom/Qualcomm, or none</td>
<td class="green">Broadcom/Qualcomm</td>
</tr>
-->
<!--
<tr>
<td class="legend ">PSDS - other devices with Broadcom chips</td>
<td>n/a (no supported devices)</td>
<td class="green">Broadcom <sup>default</sup>, or none</td>
<td class="green">Broadcom <sup>default</sup>, or none</td>
<td class="green">Broadcom <sup>default</sup>, or none</td>
<td class="green">Broadcom</td>
<td class="green">Broadcom <sup>default</sup>, or none</td>
<td class="lred">Broadcom</td>
</tr>
<tr>
<td class="legend">PSDS - devices with Qualcomm chips</td>
<td class="green">GrapheneOS <sup>default</sup>, Qualcomm, or none</td>
<td class="green">Qualcomm <sup>default</sup>, or none</td>
<td class="green">Qualcomm <sup>default</sup>, or none</td>
<td class="green">Qualcomm <sup>default</sup>, or none</td>
<td class="green">Qualcomm</td>
<td class="green">Qualcomm <sup>default</sup>, or none</td>
<td class="green">Qualcomm</td>
</tr>
-->
<tr>
<td class="legend">Connectivity check/captive portal</td>
<td class="green">GrapheneOS <sup>default</sup>, Google, or none</td>
<td class="green">Multiple presets offered</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="green">Kuketz.de</td>
<td class="green">Murena.io</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
</tr>
<tr>
<td class="legend">DNS connectivity check</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">DNS server fallback</td>
<td class="green">Cloudflare</td>
<td class="green">Quad9</td>
<td class="green">Cloudflare</td>
<td class="green">Quad9</td>
<td class="green">Quad9</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">Network time</td>
<td class="green">GrapheneOS <sup>default</sup>, or none</td>
<td class="lgreen"><span class="tooltip">NTP.org (can be changed)<span class="tooltiptext">Server pool with arbitrary providers, which can include Google-hosted servers or even malicious servers. NTP server can be changed with `adb` command.</span></span> & carrier</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> & carrier</td>
<td class="lgreen"><span class="tooltip">NTP.org (can be changed)<span class="tooltiptext">Server pool with arbitrary providers, which can include Google-hosted servers or even malicious servers. NTP server can be changed with `adb` command.</span></span> & carrier</td>
<td class="lgreen"><span class="tooltip">NTP.org (can be changed)<span class="tooltiptext">Server pool with arbitrary providers, which can include Google-hosted servers or even malicious servers. NTP server can be changed with `adb` command.</span></span> & carrier</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> & carrier</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> & carrier</td>
</tr>
<tr>
<td class="legend">Hardware attestation provisioning</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">DRM (Widevine) provisioning</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td>DRM not supported</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend semititle"><br />Google Play Services</td>
<td></td><td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Implementation</td>
<td class="tooltip">GmsCompat (sandboxed Google Play)<span class="tooltiptext">GrapheneOS does not include Google Play as a preinstalled app, but it includes an open source compatibility layer for users who choose to use it. Users can alternatively install microG on GrapheneOS, albeit GrapheneOS does not support signature spoofing. Not all microG functionality requires signature spoofing, for example FCM works with microG without signatures spoofing to the extent it works without special privileges (e.g. microG needs to use a privileged API to wake apps and keep them awake for a short period of time to handle FCM messages).</span></td>
<td>microG</td>
<td>microG</td>
<td>microG</td>
<td>microG</td>
<td rowspan="8">None by default. It's possible to install microG manually (LineageOS <a href="https://review.lineageos.org/c/LineageOS/android_frameworks_base/+/383574" target="_blank">supports signature spoofing for microG</a> since 2024). Alternatively, there are <a href="https://lineage.microg.org/" target="_blank">ROMs with microG preinstalled</a> or one can <a href="https://wiki.lineageos.org/gapps" target="_blank">add Google apps</a> during the installation process, but this is not officially supported by LineageOS. <!--Alternatively, there is the <a href="https://lineage.microg.org/" target="_blank">LineageOS for microG</a> project that integrates microG in LineageOS.</td>-->
<td>Google Play Services</td>
</tr>
<tr>
<td class="legend">Optional?</td>
<td class="green">Yes (not preinstalled)</td>
<td class="green">Yes (not preinstalled)</td>
<td class="green">Yes (preinstalled but opt-out)</td>
<td class="green">Yes (preinstalled but opt-out)</td>
<td class="red">No (preinstalled without opt-out)</td>
<!-- skipped -->
<td class="red">No (preinstalled without opt-out)</td>
</tr>
<!--
<tr>
<td class="legend">FOSS? (see tooltips for details)</td>
<td class="yellow tooltip">Yes, but executes proprietary code<span class="tooltiptext">GrapheneOS's sandboxed Google Play compatibility layer is open source, but the Google binaries themselves are proprietary.</span></td>
<td class="yellow tooltip">Yes, but executes proprietary code<span class="tooltiptext">microG still involves running closed source Google Play code since every app talking to microG does so using the full proprietary Google Play Services library. microG can additionally download and execute proprietary programs from Google for Safetynet support, however, DivestOS blocks the use of Safetynet.</span></td>
<td class="yellow tooltip">Yes, but executes proprietary code<span class="tooltiptext">microG still involves running closed source Google Play code since every app talking to microG does so using the full proprietary Google Play Services library. microG can additionally download and execute proprietary programs from Google for Safetynet support.</span></td>
<td class="yellow tooltip">Yes, but executes proprietary code<span class="tooltiptext">microG still involves running closed source Google Play code since every app talking to microG does so using the full proprietary Google Play Services library. microG can additionally download and execute proprietary programs from Google for Safetynet support.</span></td>
<td class="yellow tooltip">Yes, but executes proprietary code<span class="tooltiptext">microG still involves running closed source Google Play code since every app talking to microG does so using the full proprietary Google Play Services library. microG can additionally download and execute proprietary programs from Google for Safetynet support.</span></td>
<td class="red">No</td>
</tr>
-->
<tr>
<td class="legend">Runs in standard app sandbox?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<!-- skipped -->
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
</tr>
<tr>
<td class="legend">Can be limited to user or work profile?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td>? (TBC)</td>
<td>? (TBC)</td>
<!-- skipped -->
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Signature spoofing needed/allowed?</td>
<td class="green">No</td>
<td class="lgreen">Only for Google signature</td>
<td class="lgreen">Only for Google signature</td>
<td class="red tooltip">Allowed for any app & signature<span class="tooltiptext"><a href="https://divestos.org/misc/mg.txt" target="_blank" style="color: white;">Click here for details</a></span></td>
<td class="red tooltip">Allowed for any app & signature<span class="tooltiptext"><a href="https://divestos.org/misc/mg.txt" target="_blank" style="color: white;">Click here for details</a></span></td>
<!-- skipped -->
<td class="green">No</td>
</tr>
<!--
<tr>
<td class="legend">App compatibility?</td>
<td class="lgreen">Good</td>
<td class="yellow">Decent</td>
<td class="yellow">Decent</td>
<td class="yellow">Decent</td>
<td class="yellow">Decent</td>
<td class="green">Perfect</td>
</tr>
-->
<tr>
<td class="legend">Push notifications via Google FCM?</td>
<td class="green">Yes</td>
<td class="green">Optional</td>
<td class="green">Optional</td>
<td class="green">Optional</td>
<td class="green">Optional</td>
<!-- skipped -->
<td class="green">Yes</td>
</tr>
<!--
<tr>
<td class="legend">Can deny FCM registration for specific apps?</td>
<td class="red">No</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red">No</td>
</tr>
-->
<!-- Note that many apps will avoid using their own push implementation when they detect Play Services installed on the phone, in which case denying them access to FCM will break their push messaging. <a style="color: white;" href="https://github.com/microg/GmsCore/wiki/Implementation-Status target="_blank">Other MicroG features</a> such as Maps API, Safetynet or Fused Locations will still work without FCM registration. -->
<tr>
<td class="legend">Google Play Integrity?</td>
<td class="lgreen tooltip">Passes Basic Integrity only, <a href="https://grapheneos.org/usage#banking-apps" target="_blank">see here</a><span class="tooltiptext">Passes MEETS_BASIC_INTEGRITY but not MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY which require a certification from Google.</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<!-- skipped -->
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend semititle"><br />Privacy</td>
<td></td><td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Storage scopes</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#storage-scopes" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Contact scopes</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#contact-scopes" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Per-app sensor controls</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#sensors-permission-toggle" target="_blank">see here </a></td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Per-connection DHCP state flushing</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">MAC address randomization</td>
<td class="green">Per connection, <a href="https://grapheneos.org/features#wifi-privacy" target="_blank">see here</a></td>
<td class="green">Per connection</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
</tr>
<tr>
<td class="legend">SUPL: IMSI or phone number sent?</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="red">Yes</td>
</tr>
<tr>
<td class="legend tooltip">PSDS: user agent sent?<span class="tooltiptext">May include chipset serial number, device manufacturer and model, carrier, and Android version. <a href="https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">No</td>
<td class="lgreen">No (device-specific), <a href="https://divestos.org/pages/network_connections#psds">see here</a></td>
<td class="yellow tooltip">Partially for Qualcomm chips<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially for Qualcomm chips<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially for Qualcomm chips<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially for Qualcomm chips<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="lred">for Qualcomm GPS chips</td>
</tr>
<tr>
<td class="legend">Closed cross-profile package leaks?</td>
<td class="green">Yes</td>
<td class="lgreen">Partially</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Closed device identifier leaks?</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#closed-device-identifier-leaks" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Metadata stripping for screenshots</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#private-screenshots" target="_blank">see here </a></td>
<td class="green">Yes, <a href="https://divestos.org/pages/news#2023-11" target="_blank">see here</a></td>
<td class="green">Yes, <a href="https://calyxos.org/news/2023/10/04/october-security-update/" target="_blank">see here </a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">EXIF metadata stripping for photos</td>
<td class="green">Yes, <a href="https://grapheneos.org/usage#grapheneos-camera-app" target="_blank">see here </a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow">Available as option</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Tracking through Android Advertising ID?</td>
<td class="green tooltip">Not part of the system<span class="tooltiptext">if Play Services are installed by the user, the Advertising ID can be deleted in settings</span></td>
<td class="green tooltip">Not part of the system<span class="tooltiptext">if microG is installed by the user, it will generate a random Advertising ID for each request</span></td>
<td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td>
<td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td><td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td>
<td class="green tooltip">Not part of the system<span class="tooltiptext">if microG is installed by the user, it will generate a random Advertising ID for each request; if Play Services are installed by the user, the Advertising ID can be deleted in settings</span></td>
<td class="lgreen">Yes, but can be deleted in settings</td>
</tr>
<tr>
<td class="legend semititle"><br />Security</td>
<td></td><td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<!--
<tr>
<td class="legend">Bootloader relocking (if supported by device)?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="lred">If preinstalled</td>
<td class="red">No</td>
<td class="green">Yes</td>
</tr>
-->
<tr>
<td class="legend">Verified boot (if supported by device)?</td>
<td class="green">Yes, incl. system app updates</td>
<td class="yellow">Yes, but excl. system app updates</td>
<td class="yellow">Yes, but excl. system app updates</td>
<td class="yellow">Yes, but excl. system app updates</td>
<td class="lred" style="font-size: 90%;">w/ test keys; excl. system app updates</td>
<td class="red">No</td>
<td class="yellow">Yes, but excl. system app updates</td>
</tr>
<tr>
<td class="legend">Hardware-based security verification</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#auditor" target="_blank"> see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow">Some devices, <a href="https://attestation.app/about" target="_blank">see here</a></td>
</tr>
<tr>
<td class="legend">System app downgrade protection</td>
<td class="green">For updates and boot, with fs-verity</td>
<td class="yellow">For updates and boot</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
</tr>
<tr>
<td class="legend">Secure application spawning?</td>
<td class="green">Yes (exec)</td>
<td class="green">Yes (exec)</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardened memory allocator?</td>
<td class="green">Yes</td>
<td class="green tooltip">Yes<span class="tooltiptext">Patches taken from GrapheneOS</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardware memory tagging?</td>
<td class="green">Yes, if supported by device</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardened kernel?</td>
<td class="green">Yes, highest</td>
<td class="lgreen tooltip">Yes, high (device-specific)<span class="tooltiptext">Patches taken from GrapheneOS</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardened libc?</td>
<td class="green">Yes, highest</td>
<td class="lgreen tooltip">Yes, high<span class="tooltiptext">Patches taken from GrapheneOS</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardened webview?</td>
<td class="green">Yes (Vanadium)</td>
<td class="green tooltip">Yes (Mulch)<span class="tooltiptext">Patches taken from GrapheneOS</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardened SELinux policy?</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Android Runtime <span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> compilation/profiling</td>
<td class="green"><span class="tooltip">AOT<span class="tooltiptext">Ahead-Of-Time</span></span> compilation w/o profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
</tr>
<tr>
<td class="legend tooltip">Dynamic code loading prevention for apps<span class="tooltiptext"><a href="https://github.com/eylenburg/eylenburg.github.io/issues/85" target="_blank" style="color: white;">see here for details</a></span></td>
<td class="green">System, opt-in for non-system apps</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
</tr>
<tr>
<td class="legend">Additional hardening</td>
<td class="green">Highest, <a href="https://grapheneos.org/features" target="_blank">see here</a></td>
<td class="yellow">Medium, <a href="https://divestos.org/pages/technical_details" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Secure TLS for SUPL?</td>
<td class="green">TLSv1.2</td>
<td class="green">TLSv1.2 if supported by device</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
</tr>
<tr>
<td class="legend">Fallback DNS server with DNSSEC?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red tooltip">No<span class="tooltiptext">uses Quad9's unsecured endpoint (9.9.9.10) with provides no security blacklist and no DNSSEC</span></td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend tooltip">Can disable USB-C and pogo pins data?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>
<td class="green">Default (while locked), <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">Can disable USB-C charging?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>
<td class="green">Opt-in (after boot), <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">Can disable USB connections?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>