GrapheneOS

Open source privacy and security focused mobile OS with Android app compatibility.

Website: https://grapheneos.org/
Forum: https://discuss.grapheneos.org/
X: https://x.com/GrapheneOS
GitHub: https://github.com/GrapheneOS

Public Key

npub1kwarc5z9lwhen05uknd2nuwhhthd4ws0cku3t9j3rchm0fcd6luslse0nj

NIP-05 Address

grapheneos_at_grapheneos.social@momostr.pink

Profile Code

nprofile1qqst8w3u2pzlhtueh6wtfk4f78tm4mk6hg8utwg4jeg3utah5uxa07gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dslp5jg4

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1kwarc5z9lwhen05uknd2nuwhhthd4ws0cku3t9j3rchm0fcd6luslse0nj

Show more details

Last Notes

2026-03-24 09:30:04 UTC

Vanadium version 146.0.7680.164.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.164.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/33474-vanadium-version-146076801640-released
#GrapheneOS #privacy #security #browser

2026-03-24 07:00:32 UTC

- reply

It's likely we'll support the 2027 variant of the razr ultra.

2026-03-24 05:56:39 UTC

- reply

Firefox entirely lacks process sandboxing on Android. Firefox rolled out incomplete site isolation providing protection against data being leaked via side channels through not having it in-process. It does not implement sandboxing site isolation required to protect against more than side channels. It doesn't have sandboxing so it can't protect against anything once a remote code execution exploit occurs. It also lacks similar JavaScript VM sandboxing and many other important protections.

2026-03-23 19:12:59 UTC

- reply

No, it's entirely possible to distribute a signed list of trusted roots and verified boot keys from one or more organizations. The proper approach to implementing a third party certification system for devices and operating systems would be directly using the Android hardware attestation API and distributing signed data for use with it. This would enable using multiple sources of that data and not being locked into it. An organization doing certification should still be neutral.

2026-03-22 22:09:40 UTC

- reply

Lenovo is a publicly traded company with 31% of the shares are owned by Legend Holdings.
Legend Holdings is a publicly traded company with 29% of the shares owned by the Chinese Academy of Sciences.
That works out to the Chinese Academy of Sciences owning around 9% of Lenovo. They're far from owning the majority of it.
We're continuing to support Pixels which are the only Android devices from a major OEM based in the US. Smaller brands are white labelled ODM phones.

2026-03-22 20:29:47 UTC

- reply

People can buy the devices without GrapheneOS and install it themselves in any region where that's an issue. Motorola devices with GrapheneOS preinstalled is something we want but it doesn't have to happen right away and doesn't need to happen everywhere for the partnership to be highly successful. Pixels are sold in 33 countries which doesn't include many countries outside North America and Europe.

2026-03-22 13:55:02 UTC

- reply

Revoking Camera, Microphone and Location access automatically is a standard Android feature via granting one-time access instead of persistent access. It revokes it 1 minute after the app isn't in the foreground anymore. The global toggles are problematic to begin with since enabling the functionality globally will allow every app which you've granted the permissions to start using those again, although at least it's only foreground access for Camera, Microphone and by default for Location.

2026-03-21 14:06:37 UTC

- reply

Heavily using Google apps and services doesn't ruin using GrapheneOS. People still get major privacy and security benefits. Migrating away from Google apps and services along with other privacy invasive services can be done over the long term. If migrating away from it is a high priority goal with willingness to be dealing with it, then it's a good idea to start out with it in a dedicated work profile or Private Space.
https://grapheneos.social/@GrapheneOS/116267529664234349
#note1up3…2yn0

2026-03-21 14:03:18 UTC

- reply

It sounds like you do want to minimize usage of Google Play, so set up a dedicated profile for it. Work profile or Private Space is most convenient since they're nested but you could also use a secondary user. Private Space is essentially a nested secondary user. Work profiles are similar but have to be managed by an device policy management app. Shelter is an open source one for local management which many people use. Private Space + work profile gives 2 nested profiles.

2026-03-21 14:01:49 UTC

- reply

You aren't ruining GrapheneOS by using sandboxed Google Play in the Owner user. They're regular sandboxed apps including in the Owner user and you can restore it back to the default of only having the Network permission granted while retaining compatibility with nearly every Play Store app. Network and Unrestricted battery mode are all it needs to provide nearly all functionality apps need. We reroute location requests to Google Play to the OS location service by default.

2026-03-21 14:00:31 UTC

- reply

Their app likely depends on Google Play for push notififications which requires giving it Unrestricted battery mode. If you want to minimize your usage of Google Play, remove it in the Owner user and set up a dedicated work profile or Private Space for it. A work profile is a good option if you want to save Private Space for the main purpose of having private apps/data which remain at rest while using the phone. Google Play is still sandboxed in Owner on GrapheneOS though.

2026-03-21 13:58:16 UTC

- reply

It doesn't matter at all that you did that if they already had your contacts anyway. You have to migrate to avoiding using them for sync if you want to avoid them having those anyway. Just get rid of it if you don't want it and make a dedicated work profile or Private Space for apps depending on Google Play if you want to keep it separate. You'll probably want apps depending on it but you don't need to give it any permissions beyond Network and it can be in another profile.

2026-03-21 13:56:44 UTC

- reply

VCF export/import should work fine. It's possible the app you used for exporting did it in a format incompatible with AOSP Contacts but you can use a different app to export/import on both ends. There are also various apps you can use for end-to-end encryption contacts sync/backup.
You didn't need to give sandboxed Google Play a bunch of permissions to use their contacts sync but it's still far less invasive than regular privileged Google Play services even with those.

2026-03-21 04:21:14 UTC

- reply

Yes, Pixels are going to remain supported and it will be a while before the Motorola devices launch. We launched experimental support for the recently launched Pixel 10a yesterday.
The initial devices with GrapheneOS support from Motorola will be 2027 flagships. We'll add support for new devices each year along with expanding to cheaper devices once those meet the requirements.

2026-03-21 02:01:36 UTC

- reply

That's what this change does.

2026-03-20 21:11:50 UTC

GmsCompatConfig version 168 released:
https://github.com/GrapheneOS/platform_packages_apps_GmsCompat/releases/tag/config-168
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/33369-gmscompatconfig-version-168-released
#GrapheneOS #privacy #security #gmscompat

2026-03-20 20:42:17 UTC

GrapheneOS version 2026032000 released:
https://grapheneos.org/releases#2026032000
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
https://discuss.grapheneos.org/d/33367-grapheneos-version-2026032000-released
#GrapheneOS #privacy #security

2026-03-20 19:26:42 UTC

- reply

Pixel 6a is fully supported and works well. It's part of the oldest generation of supported devices and has an update guarantee from the OEM until at least July 2027.
Some of the laws we're referencing were already passed. It isn't going to result in any changes to GrapheneOS and it will remain available everywhere. Many other projects are making changes due to it or blocking downloads in regions passing these laws but we've determined there's no need for us to do anything.

2026-03-20 18:49:37 UTC

- reply

Pixel stock OS no longer has nearly as many changes in the monthly releases beyond the security patch backports. QPR1 and QPR3 will be smaller releases than previously and stock Pixel OS exclusive. These releases are only relevant to GrapheneOS for Pixel support. We don't need to deal with it for another device.
GrapheneOS has security preview patch access already which we didn't receive from Motorola but rather from another OEM not working on devices supporting GrapheneOS.

2026-03-20 18:47:01 UTC

- reply

That's not how Android updates work. There was previously 1 major yearly release which was changed in 4 major quarterly releases and has been reduced down to 2 major releases per year. Those are made available to OEMs and published to the Android Open Source Project. There are monthly security backports to the major releases from the past around 3 years which are also pushed to the Android Open Source Project. Pixel stock OS is separate from what OEMs use which is the AOSP code.

2026-03-20 16:18:22 UTC

- reply

Fairphone has made it very clear they don't care about providing serious privacy or security. We aren't going to be supporting their devices or working with them. They already chose a different path incompatible with working with us.
https://discuss.grapheneos.org/d/24134-devices-lacking-standard-privacysecurity-patches-and-protections-arent-private

2026-03-20 15:49:21 UTC

- reply

There's a huge audience interested in having private and secure devices. Providing the bare minimum of standard privacy/security patches and important standard hardware-based defenses rules out nearly all Android devices. iPhones have much better security than the vast majority of Android devices. Out of the Android devices supporting installing another OS, the only ones with similar security protections are Pixels. People who want privacy/security mostly buy iPhones.

2026-03-20 15:26:21 UTC

- reply

GrapheneOS is a privacy and security project. It isn't elitist to have a reasonable set of hardware requirements including proper driver/firmware updates and important hardware-based security features we need to protect against widespread real world exploits. Similarly to iPhones, GrapheneOS devices are far more secure than using a traditional desktop OS. The security standards for mobile are much higher than what passes for acceptable for laptops and desktops.

2026-03-20 15:23:48 UTC

- reply

GrapheneOS is a highly usable production quality OS with broad app compatibility. It isn't a niche choice only for people who are highly committed to privacy. It's very usable as a daily driver. The vast majority of Android apps are fully functional on GrapheneOS. In practice, the only apps unavailable on GrapheneOS are a tiny subset banning using any alternate OS with the Play Integrity API or similar methods. 90% of banking apps work and 99.999% of other apps

2026-03-20 15:20:50 UTC

- reply

GrapheneOS is privacy project and privacy depends on security. We have very reasonable hardware security requirements which are listed at https://grapheneos.org/faq#future-devices. We only expect industry standard updates and security features. The only non-Pixel Android devices meeting these requirements don't allow using another OS. We're officially partnered with Motorola and they're making devices meeting these requirements with official GrapheneOS support.
https://grapheneos.social/@GrapheneOS/116159602850585685
#note1eyc…unsd

2026-03-20 14:46:05 UTC

- reply

Pixels are the only currently available devices meeting the security requirements for GrapheneOS.
GrapheneOS has an official long term partnership with Motorola and will support many of their future devices:
https://grapheneos.social/@GrapheneOS/116159602850585685
We aren't lowering our standards but rather their devices are being improved to meet our requirements. Existing devices from every non-Pixel Android OEM lack important security features and don't provide the level of driver/firmware updates we need.
#note1eyc…unsd

2026-03-20 14:41:45 UTC

- reply

GrapheneOS has an official long term partnership with Motorola and will support many of their future devices, not one. It will support multiple new Motorola devices every year. We aren't lowering our security requirements but rather their devices are being improved to meet our requirements. The reason GrapheneOS won't support their currently available devices is because those don't meet our security requirements. Currently, only Pixels meet our requirements.
https://grapheneos.social/@GrapheneOS/116159602850585685
#note1eyc…unsd

2026-03-20 11:38:02 UTC

GrapheneOS will remain usable by anyone around the world without requiring personal information, identification or an account. GrapheneOS and our services will remain available internationally. If GrapheneOS devices can't be sold in a region due to their regulations, so be it.

2026-03-20 11:22:28 UTC

- reply

It will be included in our next regular OS release.

2026-03-20 11:21:50 UTC

- reply

> The fact is Google could also go out to of their way to require a version of this that will block these apps from running on your OS.
Play Integrity API is clearly illegal and substantial progress was being made to dealing with it. Having another anti-competitive system banning using arbitrary hardware and software based in Europe will help to legitimize and spread attestation to more apps.
> Perhaps it’s time to bury the axe?
Volla is welcome to discontinue Unified Attestation.

2026-03-20 11:19:57 UTC

- reply

> Doesn’t that seem a bit farfetched?
Nothing about it is farfetched.
> You don’t want to support it, fine.
No, we don't want these companies further degrading app compatibility with arbitrary options including GrapheneOS which is what their system is going to do.
> You rather trust the whims of Google than these companies, fine.
This is an outrageous misrepresentation of our position. We've been actively fighting and succeeding against the Play Integrity API for years now.

2026-03-19 20:37:12 UTC

- reply

Currently, 90% of European banking apps can be used on GrapheneOS including many supporting tap-to-pay without Google Pay. Unified Attestation will reduce the compatibility of these apps. Each app adopting it would stop working on GrapheneOS and many other systems. It's the opposite of how you're portraying it. It's a system to reduce the compatibility of these apps with arbitrary systems to instead only permit using products from Volla and other participants in the cartel.

2026-03-19 20:35:17 UTC

- reply

Unified Attestation is entirely built on top of the standard Android hardware attestation service. The sole purpose it serves is to centralize control over what's allowed to be use. It exists so that the companies involved can convince apps to adopt their own API for verifying devices where they permit their own products while forbidding everything else. It has no legitimate purpose over using standard Android hardware attestation API which is fully usable outside Android too.

2026-03-19 20:33:31 UTC

- reply

You appear to be confusing Jolla and Volla with each other. Those are completely different companies. Jolla's partnership and ownership by the Russia government from 2015 through 2023 is well documented public information. What do you expect to be proven about something which was very openly acknowledged by them? Their bankruptcy restructing in 2023 got rid of Russia's ownership of Jolla but doesn't change that it's a largely closed source OS which was developed with that regime.

2026-03-19 20:30:49 UTC

- reply

No, GrapheneOS is a privacy project. It's focused on privacy above everything else. Privacy depends on security.
Privacy does not mean specifically avoiding Google services while using more privacy invasive services. Your reasoning for why Curve isn't a private option is extremely wrong. It's not the reliance on Google Play services which makes it bad for privacy.
You're presenting statements from an account not belonging to GrapheneOS or any of our team members as from us...

2026-03-19 20:28:00 UTC

- reply

> It’s obvious to me that GOS is not really about de-googling, but rather to harden the security of Android.
GrapheneOS is a privacy project. It's focused on privacy above everything else. Privacy depends on security.
You're presenting posts from an account which doesn't belong to GrapheneOS or any of our team members as if it's from us...
> Where I find it a bit discomfortable is the constant accusations that others are scammers/lying.
They should stop doing it.

2026-03-18 23:25:07 UTC

Vanadium version 146.0.7680.153.0 released:
https://github.com/GrapheneOS/Vanadium/releases/tag/146.0.7680.153.0
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
https://discuss.grapheneos.org/d/33290-vanadium-version-146076801530-released
#GrapheneOS #privacy #security #browser

2026-03-18 23:24:45 UTC

- reply

It's nearly certain that it's a Volla employee and we have a good idea of exactly who it is too since we've seen their posted on LinkedIn and communicated with them. We know their writing style from LinkedIn. They had non-public information about when they contacted us.
https://mastodon.social/@vollaficationist/116250746129876535
#note1q28…5d0q

2026-03-18 21:55:19 UTC

- reply

That's the same service as archive.ph. They have a bunch of separate proxies with different TLDs.

2026-03-18 20:48:45 UTC

- reply

There's no need for this Unified Attestation API as a layer on top of Android hardware attestation. There's no need for having a single centralized source of what's allowed. Apps can choose which sources of what's allowed they want to use with the Android hardware attestation API already. Each OS can release a signed list of their verified boot keys and multiple orgs can collect those with ongoing checks. Companies selling devices and operating systems shouldn't control it.

2026-03-18 20:47:07 UTC

- reply

Apps insisting on checking the device and OS can already use the hardware attestation API. It doesn't require querying a service about what's allowed, they can decide themselves. It's entirely possible for an actually neutral organization to implement reasonable standards with ongoing checks for those without delaying OS releases where the standard hardware attestation API is used with signed lists of allowed roots and verified boot keys they release. That would enable multiple orgs.

2026-03-18 20:39:35 UTC

- reply

GrapheneOS provides far better app compatibility than they do and that's not going to change. They're not going to be successful at pushing this system. They've already massively shot themselves in the foot with their sockpuppet account posting conspiracy theories that we supposedly aren't actually based in Canada but rather are some branch of the US state.

2026-03-18 20:24:05 UTC

- reply

Why do you accept several European companies making a system which permits using their products but not GrapheneOS? GrapheneOS will not participate or comply with their demands so it won't be allowed. That means they'll be permitting their products with poor security while not permitting a far more secure option. It's not legitimate for a group of companies to come together to make a system permitting the products of the companies participating and not alternatives. That's not legal.

2026-03-18 20:08:08 UTC

- reply

Pinning-based attestation is a useful security feature for protecting users and has little potential for abuse to prevent competition and enforce authoritarian laws. Root-based attestation is what causes those problems. Root-based attestation has poor security since it depends on none of the TEE/SE implementations getting exploited with their keys extracted. Not much of a security feature when any leaked key can be used to bypass it.

2026-03-18 20:06:30 UTC

- reply

Being able to take away compatibility with banking and government apps based on a system imposing arbitrary rules with certification required for each release is authoritarian. Regardless of the motivation for building this kind of system, the end result is a powerful tool for a police state. Root-based attestation is inherently anti-competitive and primarily useful for controlling people rather than protecting people.

2026-03-18 20:05:05 UTC

- reply

Attestation enables them to enforce it. Otherwise, people can import devices not complying with the rules they place on devices sold within Europe. Banning people from using devices from elsewhere is far more extreme and oppressive so that's a lot less likely. It's also far harder to enforce and if things have gotten that bad then many people are going to be unintentionally breaking oppressive laws regardless.

2026-03-18 19:55:13 UTC

- reply

If companies insist on permitting only certain devices and operating to be used then the system should be one that's distributed around the world with multiple neutral organizations not tied to the companies making devices or governments. However, delaying updates for certification is inherently anti-security. It would be impossible to quickly ship security patches without breaking compatibility with many important apps.

2026-03-18 19:53:30 UTC

- reply

It has everything to do with a centralized attestation system. Once this system starts being adopted, the EU can require it for banking/government apps as they began the process of doing with the Play Integrity API. They can then hijack it and begin enforcing their own requirements such including disallowing encryption without backdoors. There should be no organization in charge of which devices and operating systems are allowed.

2026-03-18 19:51:16 UTC

- reply

We made the mistake of using Wayback Machine to keep archives of attacks on the GrapheneOS project and companies engaging in blatant scamming. It backfired when they removed the archives upon request. We've been using archive.today for years to keep archives due to not trusting Wayback Machine to preserve what we archive with it. It's quite bad if that's lost and there isn't an alternative to it.

2026-03-18 19:46:37 UTC

- reply

We're open to suggestions on a better archiving site since there are some complaints about the one we've been using. archive.org has repeatedly removed archives upon request by companies covering up what they've done to GrapheneOS so their service isn't acceptable.

2026-03-18 19:44:04 UTC

- reply

Do you have any alternative to use instead? archive.org will remove content upon request and we'd have archives we created deleted upon request from the companies which then subsequently denied it ever happened and have convinced a lot of their supporters it never did.

2026-03-18 19:35:17 UTC

- reply

Here's an archive preserving all of the posts from this account clearly run Volla:
https://archive.ph/LhddH
It has the whole history of how it was used to promote it pretending to be a supporter with inaccurate marketing to the current outrageous conspiracy theory attacks.

2026-03-18 18:21:32 UTC

- reply

We'll put our support behind a ban on root-based attestation as long as pinning-based attestation is still allowed. Pinning-based attestation doesn't have the same issues with being used to restrict competition and user choice. Our Auditor app is primarily based around pinning-based attestation with little faith put in the initial root-based attestation. A single leaked key from the least secure devices can be used to bypass root-based attestation. It's absolutely not a serious security feature.

2026-03-18 18:19:18 UTC

- reply

GrapheneOS will fight against attempts by the Canadian government to take control over what people are allowed to use on their devices rather than building a system to enable it. Volla is building a system governments will be able to use to control which hardware and software people are allowed to use. The only usage of attestation should be to protect users as our Auditor app does, not to control what they can use as a growing subset of banking and government apps are doing. That should stop.

2026-03-18 18:16:14 UTC

- reply

GrapheneOS exists for the purpose of creating highly private and secure devices which are highly usable and compatible with all of the apps people want to use. GrapheneOS doesn't exist to provide a Canadian smartphone OS and eventually hardware. It's based in Canada because it was a pragmatic decision and we believe it's currently a better location for privacy projects than the US or EU. If that significantly changes, we're open to creating a non-profit elsewhere and moving our operations there.

2026-03-18 18:10:40 UTC

- reply

GrapheneOS is based in Canada but we don't promote it based around it being based in Canada. We're willing to move our non-profit and operations elsewhere in the future if Canada ever passes laws incompatible with our goals. It's based in Canada because it was practical rather than as a core value or approach of GrapheneOS. If Canada goes down the same path as the EU and starts passing laws we cannot accept, then we'll leave Canada rather than ruining GrapheneOS. They won't do that with the EU.

2026-03-18 18:08:44 UTC

- reply

These companies MUST NOT be allowed to successfully seize control over the compatibility of European banking/government apps with mobile devices via Unified Attestation. These companies have a view of privacy based around protecting people from Google and the US government rather than privacy from corporations and governments as a whole. They even market themselves as providing so-called digital sovereignty by giving European governments access and control instead of the American government.

2026-03-18 18:01:32 UTC

- reply

European governments would be able to block certifying GrapheneOS because we won't implement age verification, invasive client side AI scanning and other systems they're trying to impose on devices and operating systems. They can make it into a requirement to integrate these for certification. Volla, Murena and iodé are not privacy/security hardened operating systems. They do not try to protect users against authoritarian surveillance including via exploits. They do not share our goals/values.

2026-03-18 17:59:18 UTC

- reply

For example, any system like this is likely to end up requiring approving each release before it would be compatible with apps checking for certified devices. This means releases would be arbitrarily delayed for certification prior to users being able to receive them without losing compatibility with any apps adopting it. The companies involved can put arbitrary requirements in place which are fine with them but not with us. Governments can also begin to exert control over this system.

2026-03-18 17:58:01 UTC

- reply

Unified Attestation will only permit using the devices and operating systems participating in it. If GrapheneOS participated in it and was initially permitted, we would always be under the threat of the companies involved disallowing it. These companies and their governments could use this to exert pressure on GrapheneOS to do what they want. They can come up with arbitrary requirements for what's needed to obtain and preserve certification including requirements incompatible with our approach.

2026-03-18 17:53:41 UTC

- reply

Volla, Murena and iodé have come together to form the Unified Attestation initiative which will permit using their products while disallowing using alternatives not participating in it. This is fundamentally an anti-competitive system. These companies are consistently not honest about what they provide with users and are playing the same game with Unified Attestation pretending that it's an open system bringing people freedom when in reality it's designed to crush competition and openness.

2026-03-18 17:52:09 UTC

- reply

This is how these companies market their products. They mislead people into buying their products rather than using much more private and secure options.
iodé and Murena have been doing this on a much larger scale than Volla with much more underhanded tactics. They've heavily pushed the false narrative that GrapheneOS isn't usable by regular people, isn't compatible with enough apps and many other inaccurate claims. In reality, it has far broader app compatibility and is much more usable.

2026-03-18 17:50:21 UTC

- reply

RE: https://mastodon.social/@vollaficationist/116250746129876535
In several of these threads, Volla is trying to mislead people about what they can obtain elsewhere including with GrapheneOS to promote their products. This account was originally pretending to be a Volla supporter but recently switched to speaking on behalf of Volla and posting information only known to Volla internally including https://grapheneos.social/@npub1k0s…zs97/116250746180349726. It very clearly belongs to Volla and is an example of how we've seen them doing marketing across platforms including jabs at GrapheneOS.
#note1q28…5d0q

2026-03-18 17:48:20 UTC

- reply

Here are a series of posts from the Volla employee running @npub1k0s…zs97 where they misrepresent their hardware as open source, inaccurately claim it's the most private/secure option with no basis and misrepresent white labelled devices from an ODM as being something far more:
https://mastodon.social/@vollaficationist/114828788734572857
https://mastodon.social/@vollaficationist/114828811907163145
https://mastodon.social/@vollaficationist/114829672784072518
https://mastodon.social/@vollaficationist/114840452085799582
https://mastodon.social/@vollaficationist/114845015249347866
https://mastodon.social/@vollaficationist/114851316858791155
https://mastodon.social/@vollaficationist/114851330429465362
https://mastodon.social/@vollaficationist/114851686998902978
https://mastodon.social/@vollaficationist/114851697197013603

2026-03-18 17:35:54 UTC

- reply

Here they're attacking us for supporting secure devices and working with a major Android OEM towards a serious alternative to Pixels. Volla's devices aren't designed or made by them but rather made for them by an ODM. Their devices are bottom of the barrel MediaTek hardware with atrocious security. Those don't meet our standards. That's why we don't do it.
https://mastodon.social/@vollaficationist/116251167689357464
As an example of what they're doing, Volla is partnered with the hide.me VPN company and bundles their software.
#note1km7…ewvv

2026-03-18 17:31:45 UTC

- reply

Disingenuously misrepresenting our points about the anti-competitive nature of Unified Attestation while pushing their narrative that we're shady forces involved in US intelligence or something similar:
https://mastodon.social/@vollaficationist/116251217622053206
#note1sz4…7erc

2026-03-18 17:30:29 UTC

- reply

Here they are doing the same thing while pushing the idea we aren't who we say we are and weren't actually founded by a Canadian in Canada in 2014:
https://mastodon.social/@vollaficationist/116251229357626550
#note1zcj…zzgz

2026-03-18 17:28:57 UTC

- reply

Here's Volla trying to push the idea that our opposition to Unified Attestation is being funded by shady forces tied to the US government or tech companies:
https://mastodon.social/@vollaficationist/116251250439901603
#note12ge…79sg

2026-03-18 17:27:44 UTC

- reply

Here's another example visible right above that one in the same sub-thread:
https://mastodon.social/@vollaficationist/116250914503700131
#note17cv…86sp

2026-03-18 17:27:19 UTC

- reply

We're opposing Volla's Unified Attestation API because it's fundamentally anti-competitive. They've failed to provide any justification for why there needs to be centralized verification through a new API built entirely on top of the Android hardware attestation API. Instead of engaging with our arguments against in good faith, they're repeatedly posting conspiracy theories about GrapheneOS claiming our project is a honey pot. Here's one of several examples.
https://mastodon.social/@vollaficationist/116251069556427406
#note1twx…gmk0

2026-03-18 17:20:55 UTC

RE: https://mastodon.social/@vollaficationist/116250746129876535
Here's a post where the @npub1k0s…zs97 clearly refers to themselves as being part of Volla and shares internal information which would only be known to someone working at Volla
This account doesn't belong to someone who uses and supports Volla's products but rather belongs to someone working at the company. Take note of how they claim to respect GrapheneOS at the end of that post. It's an extreme contrast with many of the other posts they've made trying to undermine the GrapheneOS project.
#note1q28…5d0q

2026-03-18 17:02:47 UTC

- reply

You've made it clear you work for Volla. Your posts have been repeatedly written as speaking on their behalf and you've posted non-public information which would only be known to people working at Volla. You're repeatedly making disingenuous attacks on GrapheneOS portraying it as a honey pot and a conspiracy. A company which engages in these tactics to harm GrapheneOS is absolutely not a company which should control what's allowed to be used.

2026-03-18 16:50:22 UTC

- reply

Volla sells white labelled devices from an ODM. Your devices don't come close to the security of an iPhone or Pixel. You're making extraordinarily inaccurate attacks on the GrapheneOS project. We're absolutely working on building alternatives to the functionality provided by Google Play and much more. We're actively collaborating with other projects sharing the same goals and approach we have. Volla does not share our goals or approach.

2026-03-18 16:46:52 UTC

- reply

Volla is working on building a future where people can only use devices and software approved by governments. Building a European system for controlling which hardware and operating systems are allowed to be used which they're going to heavily push apps to adopt isn't a good thing. Play Integrity API being controlled by a single US company makes it much easier to fight against in Europe right now. Building a European system for doing the same thing isn't positive.

2026-03-18 16:36:39 UTC

- reply

Very few apps have adopted the Play Integrity API. Convincing a dozen banking apps not to adopt it is very substantial. You're actively sabotaging both our efforts to convince apps not to ban using arbitrary operating systems and also our efforts to convince regulators to stop the Play Integrity API. You're actively working against what we are and yet you think we're going to want to participate. We do not want a group of EU companies in control of this either.

2026-03-18 16:20:06 UTC

- reply

Substantial progress has been made with regulators. Separately from that, we convinced over a dozen apps to stop using the Play Integrity API. You're actively sabotaging all of these efforts.

2026-03-18 16:15:38 UTC

- reply

We've been actively fighting against the Play Integrity API for years. We were making substantial progress in both Europe and India. We've also been coordinating with multiple other companies towards filing a lawsuit against Google. Unified Attestation is an enormous gift to Google helping to legitimize what they're doing with the Play Integrity API. Volla is playing into the hands of authoritarians who want systems disallowing people using arbitrary hardware/software.

2026-03-18 16:08:55 UTC

- reply

We're explaining to people what you're actually doing and how it's going to harm them to have an EU consortium of companies in control of which hardware and software they're allowed to use. It's absolutely going to change things. People aren't yet widely aware of how you're declaring war on their freedom to use alternatives including GrapheneOS. Both Canada and the EU forbid companies getting together to make a system allowing their products but not others.

2026-03-18 16:05:58 UTC

- reply

Yes, we'll file a lawsuit against each company involved in Unified Attestation for the damages done by their anti-competitive cartel to GrapheneOS. It's likely not only going to be us filing this lawsuit. We can work with many other stakeholders interested in stopping creeping authoritarianism in Europe eroding people's right to use whatever hardware and software they want to use. You're working alongside politicians pushing expanded Chat Control. This is perfect for them.

2026-03-18 16:02:21 UTC

- reply

Unified Attestation is working towards eroding people's rights within the European Union and beyond. Play Integrity API is bad enough but at least it can be fought against in Europe by taking advantage of people not wanting a US company in control of which hardware and software they're allowed to use. Unified Attestation is directly undermining our efforts to fight against the Play Integrity API in Europe which were starting to get traction. We now have to focus on UA instead.

2026-03-18 15:43:58 UTC

- reply

It's not an open approach but rather an anti-competitive cartel formed between multiple companies to permit their products while locking out others. GrapheneOS won't participate and we'll file a lawsuit against each company involved for banning GrapheneOS. Unified Attestation is nothing short of a declaration of war on not only GrapheneOS but anyone who wants to be able to choose their hardware and software without needing approval from the EU and EU companies.

2026-03-18 15:41:04 UTC

- reply

Europe passed Chat Control and it's clear many of the countries involved are going to be pushing additional laws to further crack down on end-to-end encryption and secure devices. France has come out as by far the strongest opponent of privacy technology among European countries and is where both iodé and Murena are based. Why would we want to participate in a system where the EU can ban GrapheneOS if we don't comply with authoritarian laws cracking down on secure devices?

2026-03-18 15:37:41 UTC

- reply

In Operation Trojan Shield, a bunch of European states worked with the FBI to sell backdoored devices to organized crime. They marketed these devices as being based on GrapheneOS or as running GrapheneOS. They harmed the reputation of GrapheneOS by marketing it to criminals and put us at high risk of physical harm by violent criminals. More recently, multiple European states are attacking actual GrapheneOS falsely claiming it's mainly used by criminals.
https://darknetdiaries.com/episode/146/

2026-03-18 15:33:19 UTC

- reply

We've been actively fighting against the Play Integrity API for years and now. Unified Attestation is another anti-competitive system very similar to it. We're absolutely going to fight against it as much as we have been against the Play Integrity API. Android hardware attestation is an issue itself due to being primarily designed around root-based attestation. We convinced them to add proper pinning-based verification support to make it a real security feature for our usage.

2026-03-18 15:27:37 UTC

- reply

Android hardware attestation can already be used to permit arbitrary roots of trust and arbitrary operating systems. There's no need for a centralized system based in Europe built on top of it.
It would be better if root-based attestation didn't exist because it's fundamentally insecure for anything serious and primarily useful for anti-competitive and authoritarian purposes. Pinning-based attestation is what's useful for protecting users rather than controlling people.

2026-03-18 15:25:44 UTC

- reply

The EU has been passing laws working towards banning end-to-end encryption and secure devices. It's completely unacceptable to have an EU-based system controlling which hardware and software is allowed to be used. GrapheneOS is not going to participate in bringing about our own downfall through helping to build or legitimize a system which could be used by EU governments to ban GrapheneOS. Play Integrity API should be banned rather than giving it legitimacy making another one.

2026-03-18 15:18:10 UTC

- reply

GrapheneOS won't participate in any system which requires us to delay our releases while waiting for certification. That's inherently anti-security and is completely unacceptable. We also won't give any companies or organizations veto power over app compatibility on GrapheneOS. It's a horrible idea and we're not going to let it happen. We won't participate and we'll file a lawsuit over the fact GrapheneOS is being banned by companies selling products threatened by GrapheneOS.

2026-03-18 15:14:03 UTC

- reply

Murena and iodé are have spent years attacking the GrapheneOS project. They've relentlessly mislead people about what it provides to promote their products. They've misled people about what their own products with atrocious security provide. We began debunking their claims so they began making personal attacks on our team including spreading vile harassment content. We'll never give these companies veto power over app compatibility on GrapheneOS and we won't work with them.

2026-03-18 15:04:02 UTC

- reply

Unified Attestation is illegal throughout Europe too. We'll be filing a lawsuit against each of the companies. It's an illegal anti-competitive cartel and none of these companies has any right to determine whether apps are compatible with GrapheneOS. That's fundamentally illegal and it needs to stop before going any further. Multiple companies which have engaged in years of underhanded attacks on the GrapheneOS project are not going to be in charge of whether apps can be used.

2026-03-18 14:45:56 UTC

- reply

Volla and the other companies involved in Unified Attestation are anything but neutral. They're selling products and are in no position to fairly evaluate devices for security or to come up with those requirements. These companies should not be the ones choosing requirements and determining which devices and operating systems meet those requirements. Forming a cartel with other companies to lock out everyone else isn't legal. We won't be participating and it WILL be stopped.

2026-03-18 14:40:17 UTC

- reply

Unified Attestation is nothing more than an anti-competitive power grab via a centralized service sitting on top of Android hardware attestation. There has yet to be any valid explanation for why this has been created. It would be entirely possible to have neutral organizations certifying devices and publishing those certificates as signed data usable with Android hardware attestation. There's no valid reason to have a centralized service under the control of these companies.

2026-03-18 14:31:47 UTC

- reply

Unified Attestation includes multiple companies hostile towards GrapheneOS. They've spent years misleading people about GrapheneOS and making attacks on our team. Unified Attestation gives them veto power over app compatibility on GrapheneOS. It puts them in a position where they can harm GrapheneOS with unreasonable requirements and disingenuous concerns to reduce app compatibility. It's also clearly an illegal anti-competitive cartel and participating wouldn't be legal.

2026-03-18 13:40:26 UTC

- reply

Unified Attestation is the direct opposite of keeping Android open. It's an anti-competitive centralized system putting Volla and other companies selling devices working with them in control of which devices and operating systems people are allowed to use. It's the direct opposite of open. There's nothing neutral or fair about companies approving using their products while disallowing others. Unified Attestation needs to be stopped.
https://grapheneos.social/@GrapheneOS/116239523775374959
#note1g8c…d3ax

2026-03-18 13:30:41 UTC

- reply

Android already has a standard hardware attestation system usable to permit arbitrary roots of trust and operating systems. Volla hasn't done anything beyond building a centralized system on top of standard hardware attestation. The sole purpose of it is centralizing control over what's allowed so they can permit their own products while disallowing others. Unified Attestation anti-competitive and blatantly illegal regardless of how much Volla falsely markets it.

2026-03-18 13:29:05 UTC

- reply

No, it's an anti-competitive centralized system being run by companies making products with atrocious security. The whole point is permitting their products while disallowing most other options including GrapheneOS. These companies have a history of attacking the GrapheneOS project and would be in a position to veto app compatibility with GrapheneOS. They've been making underhanded attacks on GrapheneOS for years and this would give them the power to hurt us more.

2026-03-18 13:26:57 UTC

- reply

Android already has a standard hardware attestation API which can be used to permit arbitrary roots of trusts and operating systems. Volla's Unified Attestation is only a layer on top of standard Android hardware attestation rather than an alternative to it. Unified Attestation only makes it into a centralized service under the control of these companies where their own devices can be permitted and not others. We'll be filing a lawsuit if it isn't discontinued.

2026-03-17 16:16:21 UTC

- reply

Our Auditor app stopped bothering to support devices not supported by GrapheneOS because it was too much trouble. We plan to eventually add a less secure generic mode working across all non-Pixel devices with working hardware attestation but it's a low priority and we're focused on GrapheneOS. Anyone who can currently use Auditor can use GrapheneOS on their device so nearly everyone using it is a GrapheneOS user and we haven't prioritized non-GrapheneOS usage.

2026-03-17 16:14:46 UTC

- reply

We would still be against a system being run by companies selling devices rather than a neutral system with fair enforcement of security policy which avoids getting in the way of frequent OS updates. However, it would not be nearly as bad if it was designed to have apps use the standard Android hardware attestation API directly where they could easily add other sources of which roots and operating systems are allowed. Why do they want a centralized service?

2026-03-17 16:12:52 UTC

- reply

Android hardware attestation works on all modern Android devices and is the entire basis for Volla's Unified Attestation API. Their system is a centralized service built on top of Android hardware attestation. Android hardware attestation can already be used directly with arbitrary roots of trust and verified boot key fingerprints permitted. Instead of making a centralized attestation service, they could have at least just made signed root CAs and key fingerprints.

2026-03-17 14:26:37 UTC

- reply

GrapheneOS will not participate in an illegal system. It would be a violation of Canadian law. We also won't give these companies veto power over app compatibility in GrapheneOS.
It's an existential issue for GrapheneOS similarly to the Play Integrity API. We're already winning a lawsuit and we can win another against Volla too. They should discontinue this before any app adopts it at which point it becomes a legal matter if that app doesn't permit GrapheneOS.