ELI60 How would you know that Google doesn't have something "odd" in their Pixel phone?

I’m trying to convince an elderly member of my family to get a Pixel with GrapheneOS. He’s been using Samsung for as long he owns a phone. Although it’s a tad too late now since he was getting an S24 in the end, he has a question that I couldn’t answer in a way that is easy to understand for him.

The question was in the topic title. I could have flipped the question back to him, “How would you know Samsung didn’t do the same?” but I don’t think that would support the case in getting a Pixel.

Tbh, I also don’t know the answer, but I trust GrapheneOS and open source community more than corporations, especially when their business model is around personal data. I understand this line of reasoning may not work for people who in the end, prefers convenience vs privacy anyway.

So out of curiosity, could someone enlighten me how I should approach this kind of question next time it may happen?

By trusting security researchers who haven’t found anything malicious and the large open-source community around Android.

Which sometimes works, unless someone is so far gone with the crazies that they go full anti-intellectual conspiracy bs mode.

There’s a point where you will have to make assumptions and trust entities. It would be extremely hard to insert nefarious code/behaviour to AOSP. They might be able to put nefarious code in driver binaries, and chip firmwares like the Titan M2, but I think the negatives of them doing that vastly out weight the benefits. Nothing has been found so far, and if it were to be found, they would lose a lot of the trust of many corporate customers, they would open themselves for massive lawsuits in many countries, all the intelligence agencies will start to coerce Google into giving them access to all that backdoored hardware… And for what? They surveil everyone using Google services already, so the only extra people they would be able to surveil would be that 0.001% of people with a degoogled Pixel.

I’m not sure if this is a good idea.
At the very least the person should themself be interested in privacy/security and how to improve it. Otherwise they end up with a device that they don’t understand and probably don’t even want.

I would have suggested a stock Pixel to that family member though.

Everyone gave great replies here, but i really agree with Valynor

You shouldn’t try to change someone’s current lifestyle choice (device here) if they have no interest/desire in doing so, it ends up being a losing battle from the start, or at least one positioned at a disadvantage

I think what you could do is show something more concrete, like show Samsung’s data-collection and privacy policies and compare them with Graphene (which strips Google tracking), and go from there

I don’t think it’s crazy to remain skeptical, even if it leans to extreme degrees. Everyone considered the levels of surveillance Snowden exposed to be “crazy” and “absurd”, and guess how things turned out…so it’s not far from the impossible

Thanks all, these all make sense.

@quitet.gear your explanation shed a new light to me on how hardware couldn’t work without conjunction with software (code, driver binaries, etc). I think in his mind, the “backdoor” could also be a hardware piece that we may not know, but I think the possibility of that without being discovered is close to impossible compared to a piece of code I’d say. Because his line of reasoning was around “a phone made by Google”.

@Valynor Yep totally agree with you. When I asked him why you chose S24 in the end, was as simple as, “because it’s an easy one click to transfer data from my old phone”. He backs up all his apps and data to his google account for this one convenience. Idk if there’s an alternative to this because data transfer is not an issue for me personally. But more because I’m fine with sacrificing that one click ease with data compartmentalization.

Thanks a lot for this! A definite eye opener :slight_smile:

This Techlore video also speaks about this subject.

And this website has some comments criticising the video, but I didn’t verify their accuracy.

Tldr- dont worry about it. Take care of yourself.

Dont push him or anyone. I put my fam on Samsung’s so i dont have to deal w their BS. They can go to samsung store if they want to and or if im unavailable for their questioning.
I run GOS and deal w my own shit/issues.

I read this whole thread, and this is a takeaway that I got from it:

Don’t help or educate your family members, and let their data be collected and sold by Google, Samsung, and probably their carrier too if they get their phone from the carrier.

Also, just let your family members get fucked by Samsung’s customer support, who treats their customers like this:

@Grunge164 if you have the time, then show your family members the advantages of a Pixel device with GrapheneOS and the disadvantages of bloated spyware like Samsung phones, etc. Also, if you have time, then help them if they encounter any issues; after all, they’re your family.

You read what you want to read from it, I guess.

Thanks @anon48875053 @Viper @8pen-s8urce. I see all fair assesment and balance re: how much a push is a push. At the end of the day, you can only do so much to point out the ups and downs, and they will need to make the decision for themselves.

I think for older gens, the line of thinking goes like this: does this have a visible impact for me? If not, then why bother. So far, samsung has been working well for him so good for him. At least I didy part to educate.

It was just that one question that I couldn’t answer and I would like to prep myself in case it happens again :slight_smile:

I actually know something about this and have done this with my father who is in their 80s. He only uses a few standard google apps, like contacts, calendars, mail and Vanadium with Adguard DoH provider. It’s a very good way to have a no-nonsense handset with basically the things a person might expect. This person isn’t interested in social media or any of that nonsense. We have a private element room that we use for family chatter and that’s it.

Over time we added Quillpad to it so he can make some notes, mostly because he used to write things on pieces of paper and then lose them.

Of course with any recommendation you will have to support it. At that age it really depends on the cognitive ability of the person too.

This has been a painless experience for me too to support.

I feel like a great way to get someone older/someone who doesn’t really care about their privacy to sort of “care” about their privacy is to make it as straightforward and familiar as possible. Like sure maybe we won’t explain to them threat modelling and “nerdy” stuff like that, better to just provide them something with everything without Google spying on hem. Like I was thinking it would be a good idea to just give them a pixel with grapheneos on it and then pretend it’s the new cool Samsung phone that’s the most updated and slightly different and that doesn’t have bad stuff in it, and then let them get used to it by explaining them how to do what they want. I think you did a great job :+1:

It’s not a bad approach, to evaluate what that person is going to do and provide suitable options. I do think the starting from less, and adding as you need it has some merit, as modern smart phones bombard older users with a lot of things.

Exactly, in my case we have an E2EE room in Matrix, sufficiently we can post pictures, and messages to everyone in the group without outsiders being able to read them. I like element because there are suitable desktop apps that aren’t a pain to use. Multi device support is good.

I didn’t really have to pretend. One thing to remember about older people is they come from a generation where these things didn’t exist. New and packed with features isn’t necessarily something they find exciting.

They are going to care far more that they can do what they need to do. In this case my dad usually wants to:

  • Search for a phone number or something in search engine with Vanadium
  • Read an email Gmail, Proton Mail is a good alternative here though and have done that with some family members in their 70s. Due to the minimal usage it gets we didn’t bother
  • Calendar
  • Send a message to me and my family or post a picture with Camera
  • Aves
  • Alarm clock timer (he uses the AOSP one)
  • Read PDF
  • Quillpad
  • Phone
  • Messages
  • Maps
  • Bitwarden

What frustrates him is “changes” so, sticking between his mail app, vanadium and element has been a very constant experience. We use the official google messages/phone app in order to avoid annoying spam, which works pretty well.

I made sure to log into his google account and disable YouTube history / maps timeline.

When I made that post I was referring to like the original post not really yours, though I did respond to yours in some parts, sorry if I wasn’t really clear

That’s very spot on. To expand a little bit on this, it’s very hard to spy with hardware alone, you probably do need some software to help with that. That’s where that whole Intel ME discussion comes to mind. IME is a whole computer inside your computer, like the aliens in Men in Black. It has full access to your main computer’s memory, network, everything. And it has it’s own…OS and who knows what. Yaiks.
As for other systems, we basically have to rely on people who know more than us. Asahi Linux folks say the individual hardware components in Apple silicon Macs are isolated and don’t have the same level of access of IME, so you should feel assured if you trust them.
Same for the Pixel. The GrapheneOS people say all the dedicated hardware components are completely isolated not only in Pixels, but in virtually all modern Android phones.

I just tend to think of it as a risk/reward for Google. With all the very legal ways Google can spy on you to get the information they need, where is the benefit to using some form of illegal hardware monitoring? Logically it just doesn’t make much sense for them to attempt.

Would you mind saying what happened, I am not understanding what you are trying to infer here?

@Grunge164 - If you can take your man’s phone and remove unnecessary permissions for certain Google Apps and Google Play services and also to samsung services. They run privileged anyway but removing them is still a good idea.