I really appreciate the work PrivacyGuides does. That said, I think the mobile recommendations have an extremity that doesn’t match how we approach recommending laptop/desktop hardware/software— and that mismatch deserves a rethink.
On laptops and desktops we make no recommendations at all in terms of hardware, and there are a number of correct answers in terms of software. We don´t expect everyone to use coreboot or TPM or Qubes. But on Android, there’s only one “correct” answer: Google Pixel + GrapheneOS — and everything else is treated as fundamentally flawed. That’s not realistic for many people. There are many valid reasons someone might want something other than a Pixel, even if they care deeply about privacy:
- They don’t want to give Google money but want to buy a new device
- Pixels aren’t sold in their country
- Pixels are out of their price range
- Graphene doesn´t offer parental control options and pixels are a bad choice for a child’s first device if they are likely to get robbed for having one.
- They need an SD card. (Pixels don’t have one.)
- They need two physical SIM slots. (Pixels don’t offer that.)
- They need a headphone jack. (Pixels don’t have one.)
- They need a tablet with 4G/5G. (Pixels don’t offer that either.)
- They need a rugged device
- They need a very small form factor
- They don´t want to shell out 140€ for a screen repair.
- They want to buy hardware that is modular, ecological, fair-trade, or has hardware killswtiches
- They care more about privacy than security
We can’t brush all of these off as fringe needs. These are common, everyday use cases — and yet the Android guidance in PG doesn’t reflect them at all.
But lets reflect for a minute on the last use case: our Android recommendations seem built almost exclusively around high-end threat models: nation-state adversaries, mercenary spyware, and physical device compromise. That matters — but for most people, the actual risk is not Pegasus or Israeli spyware firms, but surveillance capitalism: surveillance, tracking, data aggregation, ads, behavioural profiling, and the long-term social consequences of the destruction of our democracies from silicon valley technofascism. That doesn’t mean security doesn’t matter; it means that security absolutism isn’t a substitute for meaningful privacy improvements people can make on a much wider variety of hardware.
The PG recommendation framework should acknowledge other custom ROMs, GSIs, and UADNG while pointing out the security advantages of pixels.
I fully expect Graphene fanboys to trash me in this thread. I love GOS and use it myself, and work at a weekly lab open to the public where we strongly recommend it for those most vulnerable to mercenary spyware: activists, lawyers, politicians, human rights defenders, antizionists, or a family member of any of these people. But that is not the reality of a huge part of the population affected by the privacy crisis. But this conversation matters — because the real privacy crisis isn’t just about individual digital security, it’s also about collective security and human security: preventing the slow, normalized collapse of democracy due to surveillance capitalism requires addressing not just the most extreme threat model, but also helping people make better, not perfect, choices about privacy in the real world.