Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. So today I’ll be covering how to install stock Android OS on a Google Pixel currently running GrapheneOS. This process should still work if you’re running a different operating system than GrapheneOS looking to install the stock OS on your device, but for the purpose of this demo, it’ll be a Google Pixel 7 running GrapheneOS. So to get started, we’re going to head on over to grapheneos.org. Select install GrapheneOS. Select web USB-based installer. Scroll down in the table of contents to replacing GrapheneOS with the stock OS. This is the one part that’s specific to GrapheneOS, and that is GrapheneOS factory images. Flash a non-stock Android verified boot key, which needs to be erased to fully revert back to the stock device state. Before flashing the stock factory images, you should boot the device into fast boot mode and make sure the boot loader is unlocked. Then erase the custom Android verified boot key to untrust it. And then regardless of which OS you’re using, we’ll be using the Google web flashing tool. So we’ll get to that shortly. But the first step in this process is to enable OEM unlocking and USB debugging. So to do that, swipe up on your device, go to settings, scroll down to about phone, tap on that, scroll down to the bottom, tap on build number, I think four or five times. You’ll be prompted for your PIN code. Enter that. We can now swipe back. Go to system right above about phone. You should now see developer options. Tap on that. We’re going to scroll down. The first one is OEM unlocking. Toggle that on. Enter your device PIN again. Allow OEM unlocking. Enable. Scroll down some more till you get to USB debugging. Enable that. Allow USB debugging. Okay. So now the next step is to boot into fast boot mode and make sure the boot loader is unlocked. So for that, we need to connect a USB cable to our device. This USB cable should be plugged into whatever device you’re using to perform the installation. I’m using my laptop with Brave Browser. Now that we have that plugged in, we need to boot into fast boot mode. And to do that, we’re going to press the power button. And as soon as we press restart, hold the volume down button down. So, press restart, hold volume down while it’s rebooting. If that worked correctly, you should be presented with the fast boot mode. And if we look here, we see device state locked, but it is unlockable since OEM unlocking is enabled. And on the GrapheneOS page, we’re going to scroll up to unlock bootloader. It should be the first step at the top. Press unlock bootloader. Your screen should change to this if everything’s working successfully. But before we unlock the bootloader, I do want to say this process will erase all data on your device. So if there’s something you want to save, stop now. Transfer that data off. Otherwise, it’ll be gone, and you cannot recover it. So now on this screen, we have do not unlock the bootloader. To change that, press the volume up or down. And when it says unlock the bootloader, press the power button to execute it. And if that was successful, you should see device state unlocked. Now at this point, we can proceed with the GrapheneOS-specific step, which again, scroll back down to the bottom, press the remove non-stock key. Key erased. We are good to proceed. Once that’s completed, you can then right-click on the Google web flashing tool, open link in new tab. Let’s go to the new tab. You can click get started. You’ll see a popup like this. Grant access to ADB keys. Allow ADB access. Press the button. Now at this point, if everything was successful, you should see one available device that you can select. So click on that now because we used the GrapheneOS page to remove the stock key. You might see an error like this: connection error. Just try reconnecting your device cable and plug it back in again. So once I did that, I now see that my device is available to connect to. It says connected slow because I’m using a crappy cable, but that doesn’t make a difference. It just makes the process take longer. So once you see this, you can then go ahead and select your device. We’re going back to default. Once you do that, press the install build button again. Here’s another warning. Factory reset will result in all data on the Android device being erased. It’s already erased because we unlocked the bootloader. Do not unplug your device. Do not interact with your device unless instructed. Once you give that a quick read, select continue or confirm. You must agree to the license. I accept. Preparing your device in progress. Now, this step will take different amounts of time depending on your internet connection. So, I’m going to give this a minute to download, and I’ll be back in a moment. So this is about done. So we should see our device flash in a moment once this finishes. Now that that has finished, the next step is to lock the device. Your bootloader must be locked to complete the process. So select start. And now on our phone, we see do not lock the bootloader. We want to lock the bootloader. So, press volume up or volume down. Lock the bootloader. Press the power button to execute that. Once that finishes, we saw device state locked. Your device will now reboot. You can press done on the page. We are finished here. Give our device a minute to start up. So, at this point, we are back on stock Android OS. The device is ready to be sold, traded in, use it, whatever. The web user interface makes the process pretty straightforward, but if you have any questions or comments, feel free to leave those down below, and I’ll see you next time.đź“ť Transcript
Transcript
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
We you ever sitting there, wondering: how do I get these files from my phone to my computer, and vice versa? You could use a USB drive or cable to plug it directly into your computer, or you could use some sketchy third-party website to temporarily upload the file—but that’s all pretty inconvenient. What if you want to transfer something between an iPhone and an Android phone or between two Android devices? What do you do then?
If you have an iPhone and the other person has an iPhone, you can use something like AirDrop to transfer files. But if you want to transfer files to a computer, you need to make sure it’s a Mac; otherwise, AirDrop doesn’t work. That’s pretty inconvenient too. And you know what? Sometimes, there are just some files you don’t want to put in the cloud. That’s where LocalSend comes in.
LocalSend is an open-source, cross-platform local network transfer app. No internet connection is required, except to download the app. For this demo, I’ll be using my desktop computer along with my Android device running GrapheneOS.
Step 1: Download and Install On the desktop computer, head over to LocalSend.org, click download, and select the appropriate installer for your platform. I’m on macOS, so I downloaded the DMG. Once installed, you can open the app. The interface is super clean—I’m a big fan of nice interfaces!
On the other device, which in my case is my Android phone, go to LocalSend.org again. For Android, you can get it from Google Play, F-Droid, or download the APK directly. Use whatever method you prefer to install apps. For iOS, it’s on the App Store. LocalSend is available on Linux, Windows, macOS, and Android—pretty much all platforms.
Step 2: Setup and Transfer Once installed, open LocalSend on both devices. On my phone, the default screen shows a friendly, randomly generated device name. In my case, my phone is named “Patient Coconut,” and my desktop is “Fantastic Tomato.” It’s fun how they name the devices like that.
For transferring files, on my Android device, I’m going to be receiving files, so I’m on the “Receive” tab. From the desktop, I’m going to be sending files. I go to the “Send” tab, where “Patient Coconut” appears, matching my Android device.
I have some test files here. The first one is an image, which is the cover art for my new podcast. If you want to check that out, head over to InTheHellPodcast.com. Dragging the file to the “Send” section, it shows a preview: one image, file size 2.5 MB. I select the receiving device (Patient Coconut), and now on my phone, it shows that “Fantastic Tomato” wants to send a file. I can either accept or decline. I accept, and boom—the file is transferred!
If we check the gallery, we can see the file is there. It’s really that simple.
Other Features LocalSend also allows you to easily send folders. If you’ve ever used Signal to send files to yourself, you’ll know you can’t send folders unless you zip them. With LocalSend, it’s as simple as dragging the folder. I tested this with a folder containing four images. Just drag, select the receiving device, and accept. The transfer is done, and when I check my files, there’s the folder with all four images inside.
Another cool feature is the ability to send text to yourself. There have been times when I needed to send a URL to my phone while setting up a new device. Instead of emailing it to myself, you can just copy the text, go to the “Text” option in LocalSend, paste it, select the device, and send it. You’ll get a notification saying “Fantastic Tomato sent you a link,” and you can copy or open it. It’s as easy as that.
For Android users, there’s also an app option where you can send APKs of your installed apps. This is super useful if you have another Android device without internet access and want to transfer apps.
Comparison to AirDrop One feature I missed from my iPhone days was the ability to send multiple photos to someone using AirDrop. With LocalSend, it’s very similar. You can select photos, select the receiving device, and send them over. It’s seamless and well-integrated into the system.
One Caveat The main caveat with LocalSend is that both devices need to be on the same Wi-Fi network to find each other and transfer files. If there’s no Wi-Fi around, a workaround is to create a hotspot on your device and let the other person connect to it. Once connected, you can launch LocalSend and start transferring files. It’s not as convenient as AirDrop, which uses Bluetooth and Wi-Fi, but it works.
How It Works If you’re curious about the technical side of LocalSend, the receiving device sets up a web server, and the sending device sends files to it. The files are transferred over HTTPS, so they’re encrypted during transit. It’s a really elegant and simple solution, especially when dealing with different platforms and devices.
If you have any questions or comments, feel free to leave them down below. I’ll see you next time!
]]>Response from SMSPool on what they do with used phone numbers
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
Before we begin, I want to make a quick disclaimer. If you’re just starting out using GrapheneOS, I highly recommend not using the setup I’m about to discuss in this video. This setup will create friction, and friction is the enemy of adapting to something new, especially if you’re hesitant to begin with. When you install GrapheneOS, just install the Play Store, sign in, download apps as you normally would, and get used to things. You can always switch to a different setup later. For everyone else, here’s how I install apps on my Google Pixel running GrapheneOS.
So, this idea was suggested to me around two years ago, but I finally set it up about one year ago. This isn’t something that was just shared with me recently and now I’m sharing it—I’ve tested it, and it’s been working well for me. This also won’t be a step-by-step guide. I’ll demonstrate installing three different apps from three different sources and give you details of my setup. When I upgrade my device in the future (still TBD), I plan to make a step-by-step video.
Before we begin, I want to mention that I just published the second episode of my podcast, which is called In the Hell. If you want to find out how you can listen to it, head over to inthehellpodcast.com, which I’ll link below. It’s also worth noting that it’s hosted on Yellowball, the no-BS podcast hosting platform I recently launched, in case you’re looking to start your own podcast.
When you first install GrapheneOS, you have one user profile, the owner profile, which is there by default, and you cannot delete it. From there, you can create additional user profiles depending on how you want to separate your apps. In my setup, all apps are installed from the owner profile, and I use the “Install Available Apps” feature to push those apps to my daily user profile. I like this setup because it lets me install apps from the Google Play Store without actually having the Play Store installed on my daily user profile. It’s kind of like having a command center for app installations.
The recording on the screen right now is my owner profile. The first thing I did when I set this up was install Orbot, which is a free proxy that lets you send all your device traffic over the Tor network. That means that all of our traffic when accessing the Play Store will go over the Tor network, along with any downloads of system updates from GrapheneOS, since those are all done from the owner profile. You can install Orbot by downloading the APK from GitHub, which I’ll also link down below.
Once we open Orbot, we can click “Start VPN” and give it a minute to connect. Now we have a full-device VPN, which means all of our owner profile traffic is going over the Tor network. It’s important to note that VPNs are profile-specific, so while our owner profile traffic is using Orbot, any secondary user profiles (which we’ll discuss later) will not use Orbot by default—it’s only for the profile that it’s installed on.
You might notice where it says “Change Exit.” I currently have it set to the United States, and the reason for that is that sometimes when you go into Google Play, it might say “App not available” if the exit node is in a different country. This is common with banking apps or social media apps. If you run into that issue, you can change the exit node to match your country and see if you can access the app.
One other quick tip about Orbot: if you switch networks (for example, from Wi-Fi to cellular) or the Wi-Fi disconnects, Orbot might say it’s connected, but it’s really not. You’ll notice that because your browser won’t be able to load anything. What I found helpful is to long-press on the Orbot app, select “App Info,” force stop it, then clear the cache (but don’t clear the storage). After that, restart Orbot, click “Start VPN,” and nine times out of ten, it fixes the issue.
Now, let’s talk about the first app store I use. The first store I search for apps is the default GrapheneOS app store. In this case, I installed Accrescent from here, which is actually the second app store I use. If an app isn’t available in the first store, I move on to the second. The GrapheneOS app store mostly has system apps, but Accrescent is available there, so I installed it from there.
The second app store I use is Accrescent. There aren’t a ton of apps here, but it’s actively developed, and they’re constantly adding new apps and working with developers to get more. I plan to make a video just about Accrescent in the future because they’re doing great work, especially from a security perspective. For this demonstration, I’ll be installing Xf Eraser. I just click “Install,” and it’s done.
The third app store I use is Obtainium. If you’ve never used it before, it can be confusing, but I have a video dedicated to it, which I’ll link below. I use Obtainium for all my open-source apps or any apps that publish APKs directly on their site or on GitHub. For this example, I’ll install NewPipe. I’ll copy the GitHub link, add the app to Obtainium, and let it download. Then I’ll install it.
With this owner profile setup, I always make sure to uncheck “Allow Network Permission” when installing apps because I don’t use these apps in the owner profile. If you forget to uncheck it, you can always change it later. Now we can see that NewPipe is installed.
So far, we’ve seen the GrapheneOS app store, Accrescent, and Obtainium. The last store I use is the Google Play Store, which I installed using the GrapheneOS app store. You’ll notice that there’s no “Install” button for Google Play Services because I already have it installed. The issue with the Play Store is that you need an account to access it, which sucks. Unlike Aurora Store, which lets you use anonymous accounts, I’m not a fan of shared anonymous accounts, so I prefer this setup.
Creating an anonymous Google account without getting it blocked or locked is somewhat difficult but not impossible. If you try to create it over a VPN or Tor, you’ll likely run into issues. What I do is drive to a parking lot with free Wi-Fi—like at a grocery store or coffee shop—connect with my laptop, and create the account using a fake name generator for the required information.
The tricky part is when they ask for a phone number for SMS verification. You don’t want to use your real number here because it would ruin the anonymity. Instead, you can temporarily rent a phone number just for receiving the SMS code. There are free services, but I wouldn’t recommend them because they’re public and often blocked. You’ll have to pay, but it’s usually 50 cents to a dollar. I’ll link the site I use in the blog post for this video, but I won’t mention it here on YouTube. Once you receive the SMS code, you can validate your account.
I’ve done this for about ten different Google accounts without any issues. The key is to practice compartmentalization—don’t use this account for anything else. Just use it for the Play Store. If you get a new device, create a new account rather than using the same one. It sounds like a hassle, but it’s how you keep things separate and private. And since Orbot is running, all of your Play Store traffic is going over the Tor network, which helps maintain your anonymity.
Some people might critique using a shared phone number for account validation. While there’s a small risk someone else could gain control of that number, from what I can tell, it’s only used for initial validation, and Google doesn’t tie it to your account. If you’re concerned, you could use a prepaid SIM instead, but personally, I think the risk is low.
At this point, you can now sign into the Play Store with an anonymous Google account and start installing apps. For this demo, I’ll install WhatsApp. You might notice slower downloads when using Tor, but that’s normal. After installation, I’ll uncheck “Allow Network Permission” like I did with NewPipe.
Now, to avoid accidentally using the apps in the owner profile, I’ll disable them. Long-press on the app, go to “App Info,” and click “Disable.” I’ll do this for NewPipe, WhatsApp, and Xf Eraser.
The next step is to use the “Install Available Apps” feature to push these apps to my secondary user profile. In the demo, I created a profile called “YouTube Demo,” but you can call it whatever you like. This is the profile you’ll use daily instead of the owner profile. Once you select the secondary user profile, you can go to “Install Available Apps,” check the apps you want to install, and they’ll be available in the secondary user.
To switch profiles, swipe down from the top of the screen, tap the user icon, and select the profile. Screen recordings don’t work across profiles, so I’ll be back in a moment.
Now we’re in the secondary user profile. If I swipe up, you’ll see the apps we installed—Xf Eraser, NewPipe, and WhatsApp—all from different sources.
So this is how I install apps on my device running GrapheneOS. If you have apps that require Play Store Services, you can install them in the secondary profile. In my setup, I only have Play Store Services running in a specific profile for calls, not in my daily profile.
The benefit of separating profiles like this is that you can end a session for a profile where Play Store Services are running. This essentially puts that profile to rest, so Play Store Services are no longer running in the background. You can’t do this with the owner profile unless you power off the device. This method allows you to shut down Play Store Services without turning off your device.
One more thing to note: there’s only one instance of an app installed on the device at a time, so when you update an app in the owner profile, it’s updated across all profiles. You don’t need to worry about updating it in each profile.
After recording this, I realized it’s a lot of information, and it might seem overwhelming. But once you set it up, it’s pretty much “set it and forget it.” When you need to install a new app, install it in the owner profile, disable it, use “Install Available Apps” for the secondary user, and you’re good to go.
If you have any questions or comments, feel free to leave them down below, and I’ll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So after a year, I figured it was finally time to put out an update on my Pixel Tablet experience running GrapheneOS. Spoiler alert: my original video had some high ambitions of replacing my laptop and taking this with me when I travel, along with a keyboard and things like that. None of that happened—it didn’t work out. But if you’re curious as to why, keep watching. If all you wanted was that quick answer, there you go, and I’ll see you next time.
Before I get into the apps that I’m using and things like that, I first want to talk about the physical aspects of the tablet that I really like. To begin, let’s start with the case. This is the official case from Google, and if you end up buying the tablet after watching this video, or have bought the tablet, I highly suggest you buy this case. It’s probably one of the best-designed cases I’ve ever used—not that I’ve used many cases, but to start off, it’s a nice rubbery, grippy texture that helps with holding onto it. Besides that, you have this circle thing on the back—or oval, I should say—and that’s great for a kickstand, holding it up in the landscape position. It also works in the portrait position, so it can lean back like that. When you’re just kind of walking around or laying on your couch, it works great for holding it just like this.
You might be wondering why it’s that shape. You see those four pins on the bottom? Those correspond to the dock. When this goes on the dock, the handhold—or whatever that metal thing is—helps align the dock so that it locks into those pins, giving you a good connection. It’s all magnetic, so the dock just snaps on. This is the only way I charge it—I’ve never actually plugged a USB cable into this, except for during installation. So, the case—I highly recommend it.
Now, back to the dock. The dock is included in the box. I’m not going to say that the dock is free because, of course, I’m sure that’s baked into the price somewhere, but the dock has exceeded my expectations, mostly from an audio standpoint. When you set the tablet on the dock, this then turns into the main speaker; the internal speakers on the tablet are disabled, and the audio comes out of this. For listening to music or podcasts, things like that, you’re not getting room-filling booming audio, but it is pretty impressive for the form factor. I like using this when I’m listening to podcasts or audiobooks on the tablet. It just works really great for that.
Speaking of podcasts, I wanted to let you know that I just published the first episode of my podcast, which is called In the Shell. You can check that out at intheshellpodcast.com to find out where you can listen to it, and I will also leave a link down below in the description if you want to check it out.
So now, let’s get back to the reason why you clicked on this video. One more thing to mention about the physical appearance: I don’t use a screen protector on the tablet. They do make them for it; I just never found a need for one. It’s not like a cell phone where I’m carrying it around, constantly taking it out of my pocket—this wouldn’t fit in my pocket. So, I didn’t really see a need to have a screen protector. So far, after a year, it looks good—no chips, cracks, or scrapes. Hope I didn’t jinx myself, but so far, so good.
On the actual tablet, I have two user profiles set up. I have my main owner/admin user profile that you can see here, and I have my daily “Josh” user profile. On my main owner profile, I have the Google Play Store installed along with Obum. On that profile, I do all the installation of apps, and then I use the “install available apps” feature from the main owner profile to push the apps to my daily profile. It was suggested to me a while ago to test out that method, and I’ve been using it ever since on my phone and tablet. I’m not going to cover it in this video, but I will make a dedicated video specifically for that topic because I think it’s a really useful way to configure your GrapheneOS device.
As I mentioned, I have two user profiles set up. We’re currently in my daily profile that I use, named “Josh.” You can see that in the top right-hand corner up there. On the main home screen, I have two Progressive Web Apps (PWAs) installed: one is for Miniflux, a self-hosted RSS reader that I use, and the other is Wallabag, which is kind of a bookmarking tool—another self-hosted app that I use.
So let’s now swipe up and get to the app drawer. I’m not going to explain the default apps installed, like the camera, gallery, etc. If you have GrapheneOS, you’re already familiar with those.
To start off, I have AntennaPod, which I use for listening to podcasts. Like I said, that goes really well with the dock—you get really good audio quality, and it works well for listening to those. The next app is Audiobookshelf, a self-hosted app I use to listen to my audiobooks. Then there’s Bitwarden, a password manager. I also have a calendar app and EteSync, which is a contacts, calendar, and task sync app—another self-hosted app that I use. They also offer a cloud service, so if you’re looking for an encrypted way to store your calendar, contacts, and tasks, I would suggest checking out EteSync. You don’t have to self-host it; you can just sign up and use their service.
Following that, I have Jellyfin. I run a Jellyfin server at my house for my movies and TV shows that I want to watch. The Jellyfin app lets me access and watch those on the tablet, which, with the 11-inch screen, works perfectly—much nicer than trying to watch on my phone. Material Files is a third-party file explorer I use to connect to some network shares I have in my house. I don’t have it installed on my phone because I don’t access my network shares on my phone, but on the tablet with a larger screen, it works great for that.
Mullvad is my VPN of choice—it’s running on here all the time. NewPipe is the next app, which is a third-party client for YouTube that helps you avoid the ads, which is nice. Notify is an app that provides push notifications to my device when it receives a webhook notification from the uptime services that monitor my site and different services. It works without Google Play Services, which is why I have it installed on here, since I don’t have Google Play installed on this user profile.
ProtonMail is my email provider. I have their paid plan, so I use it for my sideofburritos.com domain. If you’re looking for a decent email provider that’s privacy- and security-focused, I would recommend them. The next app is Standard Notes, which I use for all my note-taking. I have a couple of files stored in there, but primarily just text files. I self-host the Standard Notes server at my house, so it syncs locally to a Raspberry Pi where I have that running. They do have a cloud offering, so if you’re looking for an encrypted notes service, I would suggest checking them out.
Next is Tasks, which syncs with EteSync, as I mentioned earlier, for contacts, calendar, and tasks. Tutanota is another privacy-focused email provider that supports end-to-end encryption, just like Proton does, which means they have no access to your emails or the content of them. I’ve always wanted to test them out, so when I set up the email for (https://yellowball.fm), the podcast hosting provider that I recently launched, I decided to go with them. So far, so good—I like their product and interface. As a company, I kind of prefer them over Proton. Proton’s kind of turning into a commodity; it seems like they’re just launching more products and everyone’s using them. While I appreciate that because it means they’re more accessible to the masses, at the same time, it’s kind of nice to support companies that are more niche in privacy and security, and Tutanota seems to be that.
The last app is VLC, which I use to play any files that the default gallery app can’t play. VLC basically plays any file you throw at it—sometimes I think it’ll even play a text file. It’s just one of those solid apps to have.
As I mentioned in the intro, I had high ambitions for this—plugging it into an external monitor, plugging it into a keyboard, possibly using it as my full-time device. But it’s just not going to replace a laptop, especially for someone like me doing programming, editing, recording videos, and things like that. The interface just isn’t meant—at least at this point—for a mouse and keyboard to be as productive, or even close to it, as a laptop, at least from my perspective. Again, your results may vary.
But that being said, would I recommend this to someone? If you want to use it like me, where 99% of the time I use it as an entertainment device—watching YouTube videos, watching Jellyfin, checking my email, or browsing the web—then absolutely, I think this is a great device to purchase. But other than that, I don’t really use it for much else.
So I hope I didn’t disappoint you too much, and if you have any questions about the tablet, feel free to leave those down below, and I will see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
I finally found my battery, so I can start recording videos again. The feature I want to talk about today is the duress PIN/password feature that GrapheneOS released a few months ago. First, we’ll start by looking at the documentation, and then I’ll show you how to set it up on a device and what the actual wipe process looks like once you enter the duress PIN/password.
Looking at the official documentation, which is always the best place to go first, I will link that down below. GrapheneOS provides users with the ability to set a duress PIN/password that will irreversibly wipe the device along with any installed eSIMs. Once entered, anywhere the device credentials are requested, such as the lock screen or any other prompt that the OS shows you asking for your PIN or password, the wipe does not require a reboot and cannot be interrupted. So once it’s entered, all data on your device is completely inaccessible, and you will never have access to it again. Take that as a warning—be careful with this. Once you set it, do not enter it just to test for any reason whatsoever, because all your data will be gone.
Both a duress PIN and password are needed to account for the different unlock methods that user profiles may use. You might have one user profile with a PIN and another with a password, which is why you need to set both. It’s important to note that if your duress PIN is the same as your actual unlock PIN, the actual unlock PIN will take precedence. So, let’s say your duress PIN is 1234 and your unlock PIN is also 1234—once you enter 1234 into your device, it will be unlocked, and you will not wipe the device.
One more thing I want to mention before I get into the live demo: make sure you check into any local laws or regulations regarding this feature. If you’re at the airport and they ask you for your PIN, and instead, you enter this and your device is wiped, who knows what could happen. Destruction of evidence could be one of many legal implications. So, make sure you understand the ramifications of using this feature, wherever you are in the world, before actually using it.
With that out of the way, let’s check out what this actually looks like. Here, I have a Google Pixel with GrapheneOS installed. The only thing I’ve done is set a PIN code, which is 12345. In order to set a duress PIN/password according to the documentation, we go into Settings, scroll down to Security, and then we go to Duress Password. We need to enter our device PIN to authenticate that it’s us. Once you finish reading the text on the page, you can select the duress PIN. I’m going to set the PIN to 1111 and the password to qqqq. Once we select “Add,” again, you’ll see a warning about what will happen if you enter this. Select “Proceed,” and now on this screen, you can either update your duress PIN or password or delete it.
So now, let’s see what the actual wipe looks like. We’re all pretty familiar with the lock screen—if you enter it there, the phone will be erased. To show you a little more non-standard scenario, if we go into Settings and back to Security, in order to set a fingerprint, you have to enter your device PIN. We’re going to select the fingerprint unlock, and now this is an example of the OS prompting us for our PIN. Instead of entering my actual PIN, I’m going to enter my duress PIN. You’ll see it says “Wrong PIN,” the device powers off, and the irreversible wipe has occurred along with wiping all installed eSIMs. At this point, you can power the device back on. Just give it a minute to power up. This is the screen you’ll see after the wipe occurs. You can go down to the factory reset. It’s important to note that this feature does not brick the device in any way; it just makes the data completely inaccessible. So, we select the option for factory reset, confirm that, and now we have a fresh installation of GrapheneOS.
Whether or not this feature is applicable to you and your threat model is a personal decision and something you need to decide. I would caution against setting it to something simple like 1234. If someone has your device and, as a joke, they enter that PIN, now your device is wiped, and that would not be good. I do want to point out one other site that I think someone posted on the GrapheneOS forum. Someone did some duress password QA testing—they just went through a bunch of different scenarios to test it out. I thought it was something cool to check out, so I’ll link that down below. One other use I saw someone mention for this feature is: you take a piece of paper, write your duress PIN code on it, and put it in your phone case. If someone finds your phone and they think you just left your PIN code in there because you’re forgetful, they’ll enter it, and your device is wiped. That’s one option I like—that’s something to consider.
So, for the last year, I wanted to start a podcast, and when I started looking at where I could host it, I couldn’t really find an option that had everything I was looking for from a privacy perspective. So instead, I decided to build that, and it’s called Yellowball. You can check it out at yellowball.fm. I would appreciate it if you could sign up and test it out. Let me know if you find any bugs—all you need to sign up is a username and a password. I know many of you are not looking to start a podcast, but if you’re like me, then in your friends and family, you’re likely the go-to person when someone has a tech question. So, if someone comes to you and asks about starting a podcast, if you could suggest they check out Yellowball, I would really appreciate it. Keep an eye out because in the next one to two weeks, I’ll be publishing the first episode of my podcast, which is going to be called In the Shell. It’s going to feature different stories from tech, different events that have happened in the past, and things I find interesting. So, if you’re watching this video a week or two after it’s been published, check down below—I’ll link it in the description. If you have any questions or comments, feel free to leave those down below, and I’ll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
In today’s video, I’m going to cover step by step how to install Graphene OS on the newly released Google Pixel tablet. I’m going to be using the web installer, which makes it nearly impossible to break your device. There are some hiccups you might run into during the installation, and I’ll cover those at the relevant points in the video.
So, to begin the installation, we’re going to head on over to grapheneos.org. Once you get there, select “Install Graphene OS.” Like I said, I’ll be using the web installer, so go ahead and click the “Web USB-based installer.”
Once we get here, go ahead and read through the prerequisites. You must be using a supported OS, which they do list here. I’ll be using macOS for the installation today. It’s also worth noting that if you have an existing Graphene OS device, you can use that for the installation, along with another Android device running stock Pixel OS or another certified Android variant. Make sure your operating system is up to date before proceeding, and then lastly, you must make sure you’re using a supported browser. In this video, I’ll be using Brave, but make sure that you are using one of the browsers listed above.
There are a couple of other notes below that I want to mention. If you are using Linux, avoid flat pack and snap versions of the browser as they’re known to cause issues during the installation process. Do not use incognito mode or other private browsing modes. The reasons why are listed here. There’s also an important note here; I don’t really think this applies to the tablet, but to make sure that the device can be unlocked to install Graphene OS, avoid carrier variants of the devices. So with the phones, they’ll have a Sprint or Verizon version, and those will usually have issues and you can’t unlock them. So if you do buy a device, make sure it’s OEM unlockable. I also suggest reading the rest of the information here, but I’m not going to read that to you.
The first step in the process is to enable OEM unlocking. One thing I want to mention is always go to the source for documentation and guides. Be hesitant to follow some random YouTuber or blog post that claims they have their own method or knows the process better. That’s why I’m following the official guide in this video. You’ll always get the most up-to-date instructions and information.
So, I just took this tablet out of the box and turned it on, which means we’re going to have to walk through the initial setup before we can actually enable OEM unlocking. If you’ve already gone through the setup on your device, feel free to skip this part in the video.
So, I’m going to select “Get started.” I’m going to set up offline, continue. I’m going to leave that set to the default. I’m going to uncheck these options, accept the limited warranty. Next, you should always set a secure PIN on your device, but since I’m going to be erasing the OS in five minutes, I’m just going to set “12345” for mine. I’m going to skip fingerprint unlock because we’re erasing the OS, so select “No thanks.” Swipe navigation, skip. That’s just a guide on how to use it, so if you need to follow that, otherwise skip it. We’ll swipe up to go home.
So, we are now at the home screen. Let’s go back to the instructions. Enable the developer options menu by going to Settings > About phone and pressing the “Build number” menu entry until developer mode is enabled. So, to do that, we’re going to swipe up, we’re going to scroll down and go to Settings, scroll down again, go to About tablet. Scroll down to the bottom, and you’ll see this labeled “Build number.” That’s what you want to tap until you see “Developer options” show up. You’re going to have to enter your PIN code to enable this. And then you’ll see the pop-up that says, “You are now a developer” on the bottom.
So, the next step is to go to Settings > System > Developer options and toggle the OEM unlock settings. So, we’ll go to System, we can see Developer options, select that, scroll down to OEM unlocking, which we can see is grayed out here. So, I did purchase this device brand new from Google, and it is unlocked. But, in order to enable OEM unlocking, you need to connect the device to the internet for the first time. If you bought your device used and someone has previously enabled OEM unlocking, you don’t need to worry about this step. But if you did buy this brand new, like me, you’re going to have to connect to the internet for this to be available. So, go ahead and connect to Wi-Fi. So, you can scroll up, tap “Network and internet,” select “Internet,” to your Wi-Fi network.
So, once your device is successfully connected to the internet, let’s go back to the Developer options, System > Developer options, and we can now see OEM unlocking is no longer grayed out, and we can now enable it. So, we’ll go ahead and tap the toggle. You’ll have to enter your PIN code again. You’ll see a pop-up for “Allow OEM unlocking,” select “Enable,” and OEM unlocking is now enabled.
So now, back to the instructions. The next step is flashing is non-root (this is for Linux, so if you’re on Linux, follow these instructions; if you’re not, skip ahead). The next step is booting into the bootloader interface. You need to boot your phone into the bootloader interface. To do this, you need to hold the volume down button while the phone boots (or, in this case, a tablet). It’s also worth mentioning that I’m making this video about 12 hours after the initial release of Graphene OS for the Pixel tablet, so some things on some wording may change in the future, but the overall general process will be the same.
So, to boot into the bootloader interface, if you’ve never done this before, it can take you a few tries. But what you need to do is swipe down, swipe down again, tap the power icon in the bottom right-hand corner, and then select “Restart.” And now, immediately hold the volume down, which is on the left side of the device on the bottom, then keep holding that. And if you are successful in booting into the bootloader interface, you’ll reach a screen that looks like this. This is going to be a little bit difficult for the camera since this is so tiny (that’s what she said). So here, you’ll see this output, it’ll have some information about your device, and also say “Device state is locked,” we’ll be changing that shortly. And for now, I’m going to set this down, and we’ll proceed onto the next step.
So, the next step is connecting the phone, or in this case, our tablet. Again, the Pixel tablet was just released, so they haven’t updated the wording yet, but this is referring to your tablet. So in the note here, if you are on Windows, you need to install a driver for Fastboot if you don’t already have it. No driver is needed on other operating systems. There’s a couple of ways you can install the Fastboot driver on Windows. The first and easiest way, you can obtain the driver from Windows update, which will detect it as an optional update when the device is booted into the bootloader interface, which is what we see on the screen now and connected to the computer. So that’s the easiest way. So if you are on Windows, just follow the instructions here. The second way is you can manually install it with Device Manager. So if you feel up to that, you can also go ahead and do that, but I would recommend the first method as that’s easier and more straightforward.
At this point, we can now connect our tablet to our computer. The typical recommendation is to use the USB cable that came with the device. The tablet does not come with one, so you’re going to need to use one that you have lying around or purchase one. Your best option will be to use the stock cable that came with a Pixel phone if you purchased one in the past, or you can just use whatever cable you have lying around that you know is in good working condition. That’s what I’m using. I just have a third-party cable here. As I mentioned in the beginning, there are a few things that could go wrong with the installation, and the USB cable is a big one that a lot of people have issues with. If you have any strange behavior during the installation, it’s likely due to a faulty USB cable. It might work for powering a device, but data and power use different pins on a USB cable, so it’s possible that the data pins are damaged, and it’s not working so good. First troubleshooting step is to try a different cable, purchase a new one, and again, use that if you have any strange issues during the installation process.
So I’m going to go ahead and connect this to my tablet on the bottom. There’s a USB-C port, plug in the cable there. So once you plug it in, we’re going to move on to the next step, which is “Unlock Bootloader.” So, one warning before unlocking the bootloader. This step will completely erase the device, so if you have any photos you took or maybe you have some contacts you saved, make sure you save those somewhere else first before moving on to this step. Again, this will completely erase the device and anything on there. So, we’re going to select “Unlock Bootloader.” We can see up here, “Pixel tablet” shows up on the screen, select that, press “Connect.” We’re going to see our screen change. We have a warning here, “If you unlock the bootloader, you will be able to install custom operating system software on this phone.” That’s why we’re here. So in order to do this, we can see up at the top right, it says the current option is “Do not unlock the bootloader.” We’re going to press either volume up or down to change the selection. So when I press that, it now says “Unlock the bootloader,” and then to select that, we need to press the power button. So I’m going to press the power button. Now that it says “Unlock the bootloader,” the screen goes blank for a minute, and as I mentioned earlier, down here, we had “Device state,” and it was green, and it said “Locked.” At this point, since we unlocked the bootloader, our device is now unlocked, and it’s red. You will also see the output on the screen that says “Bootloader unlocked.”
So the next step is obtaining factory images. In order to do that, press “Download release.” So depending on your internet speed, this can take a few minutes, but at this point, it’s just downloading the factory image. It’s not actually flashing it to our device yet. And while that’s downloading, I want to mention that if you get any value from Graphene OS or after you install it, you really like it and use it on a regular basis, consider donating to the project. And like I said earlier, they had this tablet release initial release out within 12 hours of me actually receiving the device in the mail, so they do incredible work. They’re a great resource for the privacy and security community. So any monetary contribution you can offer, I’m sure the project would appreciate.
So once the download has finished, you’ll see this has changed to “Downloaded,” doesn’t say “Download” anymore. So the next step is flashing factory images. The initial install will be performed by flashing the factory images. This will replace the existing OS installation and wipe all the existing data. I do suggest you give this paragraph a read before clicking the button above. The most important part down here is avoid interacting with the device until the flashing script is finished and the device is back at the bootloader interface. So once you’re ready, select “Flash release.” You’re going to see your screen flash and change. So just give it a few minutes for this process to complete.
So once the flashing has completed, the text on the screen will change to “Flashed,” and we can now proceed onto the next step, which is “Locking the bootloader.” Locking the bootloader is important as it enables full verified boot. It also prevents using fastboot to flash, format, or erase partitions. There’s also some other interesting information here, so I suggest you give that a read, but similar to how we unlocked the bootloader, in order to lock it, we’re going to select “Lock bootloader” in the corner. We now see “Do not unlock the bootloader.” We’re going to press the volume rocker either up or down, and it now has changed to “Lock the bootloader,” and then to select that option, we’re going to press the power button.
So I’m going to press the power button. Give it a second. And we can confirm the bootloader is locked as “Device state” is now green and “Locked.” So at this point, we are ready to boot up the OS. There’s a couple more steps we need to complete underneath the “Post-installation.” You’ve now successfully installed Graphene OS and can boot it. Nice job! Pressing the power button with the default start option selected in the bootloader interface will boot the OS. We can see the default option right now is “Start,” so select the power button, and our device will now start up.
So, this is the first screen you’re going to see. I’m going to press the power button quick to pause the display or to pause the boot process. So, this is normal to see if you have a different operating system other than stock Android OS installed on your device. We can see here, “Your device is loading a different operating system.” And on these post-installation instructions, there’s one step you can do here, which is “Verified Boot Key Hash.” So, we pause the screen by pressing the power button, and we can now see the hash listed out down there below. And what you want to do is look at that hash that’s listed next to “ID” and make sure that matches the, in this case, Pixel tablet. I’m going to read that quick, and it does match. So it’s just one other way to verify the integrity of the installation we just performed. If that matches, we can proceed. You don’t need to do this every time; this is just after the initial installation. I think it’s good practice. So once you’ve verified that, we can now press the power button to resume. So I’m going to select that. The next screen you’re going to see is the Google splash screen. That’s normal. Don’t be worried. And then we will see the Graphene OS screen. I’m going to let this complete the first boot, but we are now successfully booting Graphene OS. Once that finishes, we’re going to walk through the initial setup. I’m going to press “Start” next.
Change to your time zone.
Enable Wi-Fi if you want. I’m going to skip that for now.
I’m going to uncheck location services.
I’m going to skip the fingerprint setup.
I’m going to set up a PIN code, though. Don’t make your PIN code “12345.” I’m going to be wiping this device shortly.
Once you confirm that, I’m going to skip restore apps and data, and then we can press “Start.”
So I’m pretty excited. This is the first time I’ve ever booted Graphene OS on a tablet. I’ve been waiting for the larger display for a long time, so this is pretty awesome.
So if we go back to the post-installation instructions, we can see “Disabling OEM unlocking.” So we want to complete that step, so we’re going to go into Settings, scroll down to “About phone,” we’re going to tap “Build number.” Once we see this screen, enter your PIN code.
We are now developers. We can see on the bottom. Go to System, and then back to Developer options, and then disable OEM unlocking. Please restart the device to enable the device protection feature. So I’m going to hold down the power button and then select “Restart.”
So my camera is saying it’s going to overheat. Let’s hope it doesn’t overheat.
There’s more information under “Verifying installation” and some other details down below regarding hardware-based attestation. I would suggest you give that a read-through. I’m not going to cover that in this tutorial.
And so once your device boots up, we can swipe up, enter our PIN code.
And you are now ready to start using Graphene OS on your Pixel tablet. So if you’re looking for an easy way to get started and to start downloading apps, Graphene OS offers sandbox Google Play services. They are very easy to install. I’m going to run through that quick. First step is we need to connect to Wi-Fi, so I’m going to go into Settings > Network and internet, select my Wi-Fi network.
So once you’re connected to Wi-Fi, we can swipe up again, go back into the app drawer. We’re going to go into the Apps app. You can then go to Google Play services, tap “Install.” This will take a few minutes depending on your internet connection. You’ll see a few pop-ups. Tap “Install.”
So once that finishes, you can swipe up to go to your home screen. Going to swipe up again, we can now see Play Store is installed. If you’ve ever used Android OS before, this is going to be very similar to the Google Play Store. There’s a lot more information on the sandboxed Google Play services on grapheneos.org, which I’ll link down below. But I’m not going to cover that in this video.
So again, this is just a basic setup if you’re just getting started, want to experiment, and mess around. You can make a fake Google account and sign in with that just on your tablet to use. And if you don’t like having Google Play services on your device, you can always erase your device and set it up however you prefer.
So, if you made it this far and are not tired of hearing me talk yet, I do have a monthly newsletter that I send out. You can sign up for that at sideofburritos.com. I send out random text stuff and non-text stuff. You might like it or you might not, but you can always unsubscribe.
So, my camera just shut off that was recording the tablet, but we’ve reached the end of the installation process. If you’re looking for a good resource on Graphene OS-related information, check out the forum that they host. You can go to that at discuss.grapheneos.org. And if you enjoyed this video, I think you might like the top one listed here, and the YouTube algorithm thinks you might like the bottom one.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So in today’s video, I’ll be demonstrating how to install graphene iOS on the Google Pixel seven specifically, but if you have a different Google Pixel, this process will be relatively similar, I’m going to be using the web installer. And if you use that, it’s nearly impossible to mess up your phone. So don’t be afraid to attempt this. Now with that being said, there are a few hiccups you may run into during the install process. And I’ll cover those at the relevant points in the video. The computer I’m demonstrating this from is running Mac OS, and I’m using the brave browser. So to get started, we’re going to head on over to Griffin os.org. All websites that I mentioned in the video will be linked down below in the description box. So once you get here, click on Install Griffin OS. As I mentioned, we’re going to be using the web based installer. So once you get to this page, we’re going to scroll down to the prerequisites, give this a read through make sure that you have all of these requirements met. Make sure you’re using one of the supported OSS, like I said, I’ll be installing from macOS. So besides a supported operating system, make sure you are using a supported browser. There is an important note here, if you are using chromium on Ubuntu, it’s broken and will not work. So use a different browser, such as Google Chrome. Another important note here do not use incognito or private browsing mode. And so once you give that a read through, I’m not going to waste your time by reading it to you, and you make sure that all the prerequisites are met, we can then proceed on to the first step, which is enabling OEM unlocking in the screen we’re currently on is the screen that you’ll see if you just bought it brand new and just took it out of the box. So first, I’m going to walk through the initial setup. If you’re already past this part, you can skip it, I’ll leave the timestamps down below in the play bar. So we’re going to go ahead and select to get started. I’m not going to connect to a mobile network, I don’t have a SIM card in my phone. Skip. I’m going to skip connecting to Wi Fi select Setup offline, continue. Date and time, you can leave that set to default. You don’t need to uncheck these but I like to anyways click Accept limited warranty. Next additional legal terms except we are going to be erasing the phone so you don’t really need to set a pin but I think it’s good practice anyways
confirm the pin fingerprint unlock I’m going to skip this because like I said, we’re just gonna be erasing the phone momentarily. No banks face on luck, no thanks. This is just a quick tutorial on swipe navigation. If you want, you can go through it. Otherwise skip. So we have finished the initial setup offline and go ahead and swipe up. And we’re now at the home screen. So I’m recording this part while editing the video because I forgot to mention it initially, this step is not required. But it is suggested that you update your device before installing graphene allow us to check for updates, first connect to Wi Fi, then swipe up, go into settings, scroll down, tap on system. And then tap system update. If you see your system is up to date, then you’re good to go. Otherwise, install any pending updates and then continue with the video. So to enable OEM unlocking we first need to enable developer options, which you can do by going to settings about and repeatedly pressing the build number menu entry. And just one note before we actually start following the instructions, make sure you always go to the source when you’re looking for information. Don’t just follow some random YouTuber or some blog post, always go to the official documentation in this case graphene os.org get your information from the source first and then go from there. Select the instruction said we’re going to swipe up, go into settings, scroll down to the bottom, we’re going to tap about phone, scroll to the bottom. And down here we have build number. Go ahead and tap that until you are prompted for your PIN. If you set one, enter your PIN. And we can now see you are now a developer. So another developer options are enabled. Next go into Settings System developer options and toggle the OEM unlocking setting. So we’re going to go back, scroll down, go to system. At the bottom, we have developer options, tap that. If we scroll down, we can see here OEM unlocking so there is one caveat about OEM unlocking that I want to mention. So if you purchased your phone brand new from Google or from a store, you will need to connect to the internet first so that your phone can check if the serial number was sold carrier locked or if you’re able to enable OEM unlocking devices that are typically locked by the carrier or Verizon based devices, those ones even if you connect to the internet, you won’t be able to unlock. Your only option at that point is to either return the device or sell it and buy a factory unlocked device. For me personally, I usually buy my devices directly from Google, I select the unlocked version option. And every time I’ve had no issues, so if you’re watching this video and haven’t purchased a device yet, and you’re looking to buy a used mobile phone, I suggest asking the seller to send you a screenshot or a photo showing that OEM unlocking is available. That’s the only way to truly guarantee it. I’ve purchased a device used in the past, and it was carrier unlocked, which means I could connect to different carriers, but it didn’t actually support OEM unlocking so reach out to the seller to confirm that if they’re not willing to send you a photo showing that I would suggest not buying that device. So again, if you bought a new phone, you connected the internet OEM unlocking should be available at that point. And once it is, go ahead and enable OEM unlocking, you’ll be prompted for your pin again. Allow OEM unlocking, enable, and we can now see OEM unlocking is enabled. So on to the next step flashing as non root. This is for anyone who’s on Linux, I’m not on Linux. So I’m not going to cover this. But if you are give this a read over following that is booting into the bootloader interface, you need to boot your phone into the bootloader interface. To do this, you need to hold the Volume Down button while the phone boots, the easiest way is to reboot your phone and begin holding the Volume Down button until it boots up into the bootloader interface. So this part can be a little bit tricky for some people. So we’re going to swipe down, swipe down again, you’ll see down here the power button, select that, and then select Restart. Once restarting disappears from the screen, hold the Volume Down button.
This will take a minute. And if you were successful on booting into the bootloader interface, you will see this screen. If you were not successful, your phone will just boot up as normal. At that point restarted again, hold the Volume Down button until you get into this interface. So the next step is connecting the phone. If you’re on Linux, here’s a note about that. If you’re on Windows, you need to install the driver for fast boot if you don’t already have it, there’s a couple options for actually obtaining the drivers. So pause the video and Give this a read over if you’re on Windows. And for everyone else, we can just go ahead and connect our USB cable to our device. So this is where a lot of people run into an issue. They plug their phone into the computer with a USB cable, and their computer doesn’t actually see the phone and they don’t understand what’s going on. Typically that’s due to a faulty USB cable. The best option in this scenario is to use the stock cable that came with your device. If you don’t have that use a third party cable. But if you plug in your phone to the computer with a USB cable, and it doesn’t see it, try a different cable. Typically it’s a faulty cable causing you issues. One other thing to mention, make sure you’re plugging your USB cable directly into your computer, don’t plug it into a dongle first. That can also be the cause of issues. So again, use the cable that came with your device, plug it directly into your computer, and you should have the best chance of not having an issue. So plugging the cable to your device. So before we unlock the bootloader it’s important to note that once you do, all data on your device will be wiped. So if you were using your phone and you took some photos, or maybe this was your primary device and now you want to test out graphene iOS, make sure you make a backup of everything on there, your contacts, calendar events, text messages, everything will be erased and there’s no way to recover it. So once you confirm you have everything’s backed up or saved that you want, you can then proceed to unlock the bootloader select unlock bootloader and if your cables not faulty and your computer sees your device, you will see a prompt like this graphene os.org wants to connect, you should see your device listed here. Select Connect, we can see the screen changed, we have a quick disclaimer down here about unlocking the bootloader. And up here we can see it do not unlock the bootloader we want to unlock the bootloader. So to change the selection, we’re going to press the volume down or up. You’ll now see it says unlock the bootloader once you see that to select that option, press the Power button. And if you were successful at unlocking the bootloader you’ll see device state has now changed to red unlocked. So now that the bootloader is unlocked, we can proceed on to the next step which is obtaining factory images. We’re going to select Download release. And the actual amount of time this takes to download will vary depending on your internet speed. It’s gonna take a minute, two minutes or an hour. And so while that’s downloading, I just want to mention to consider donating to the project if you’re getting any sort of value from it, the developers putting in a lot of work to updates and Supporting new phones as they come out. My favorite way to contribute is using GitHub sponsors, it lets me schedule a monthly recurring donation to them. So again, consider donating to the project donations are used for paying developers purchasing hardware paying for infrastructure. So once the download has finished, it’ll say downloaded and the progress bar will be full. So now that the download has completed, we can proceed on with flashing our device, the initial install will be performed by flashing the factory images. This will replace the existing OS installation and wipe all the existing data, give this paragraph or read over. But the most important part is avoid interacting with the device until the flashing script is finished. So once we click flash release, just leave your device alone, don’t touch it, wait for it to complete. Once you’re ready, select flash release, you’ll see the screen changes. And again, just let the device do its thing. Don’t interact with it at all.
And so while that’s flashing I just want to mention that I have a somewhat monthly newsletter that I send out, you can sign up for that at site of burritos.com. If you’re new to privacy and security on your mobile device, I have a page on my website that has an index of all my videos I have. It’s a good starting point if you want to get familiar with what options are out there.
And then while we wait for this to complete, one of my friends came to me the other day upset about something they did, I told them some solid life advice, and that was that they needed to embrace their mistakes. So they gave me a hug
so once the flashing has completed, you’ll see the text on the screen has changed to flashed, and our phone is back at the bootloader interface. The next step and this is extremely important is to actually lock the bootloader give this a read over it explains why it’s so important. But again, to do that, we’re going to select Lock bootloader we see the prompt on our screen again, we see it says do not lock the bootloader same as earlier we’re going to press the volume up or down until it says lock the bootloader at that point, press the Power button
and if that completes successfully, we’ll see device state now says locked and it is green. Congratulations. You’ve now successfully installed graphene OS and can boot it. pressing the power button with the default start option selected in the bootloader interface will boot the OS. So if you have the default option selected, it should say start press the power button
you’re going to see the screen here devices loading a different operating system. Since we have a nonstock operating system installed, the screen is normal so expect to see that it’s also normal to see the Google splash screen. And at this point you’ll now see the graphene OS boot animation we’ll take a minute for the initial boot we can now walk through the initial setup. Select Start, select your language Next, set your timezone. Next I’m going to skip connecting to Wi Fi for now skip I don’t have a SIM card in my device but you can put one in if you want. Next, I’m going to disable location services for now. Next fingerprint you can set this up if you want to.
I do suggest setting a PIN code at the very least then please set something else besides 12345. Once you type that in and again press confirm if you had a backup from an existing graphene OS installation, you can restore it now. Otherwise, if this is a new installation for you, press skip
and then start so back on the webpage disabling OEM unlocking OEM unlocking can be disabled again in the developer settings menu within the operating system after booting it up again. After disabling OEM unlocking we recommend disabling developer options for a device that’s not being used for app or OS development. So we’re going to follow the same steps We did it when we initially enabled OEM unlocking, we’re going to go into settings, scroll to the bottom, select About phone, go to the bottom, tap build number to be prompted for your PIN code. You are now a developer, select back, go into System developer options. We can see here OEM unlocking is enabled, we want to disable that, please restart the device to enable device protection feature. So we’re going to do that in a moment. And then again, we want to disable developer options. So on select that, you need to restart your device to change this setting. Tap Restart. Now on the boot screen, I’m going to press my power button. When that initial warning shows up, tell you why in a second.
So pressing the power button pauses the boot. And the reason for that is down below here, we can verify the boot key hash. And so what you want to do depending on the device you have, if it’s a pixel six or newer, you want to look at this screen. In my case, I’m on the pixel seven. And I want to verify that this string matches what is displayed on my device. So take a minute to do that. Looking at it, I can see it does match. The reason as to why is listed here. So give that a read over. And so once you confirm that, press the Power button again to resume the boot. So at this point, you have successfully installed graphene OS and you can start using it if you like. But if you are new and looking for the simplest way to get started, I want to quickly cover that one feature of graphene OS is they offer sandbox Google Play services on stock Android OS plays services are installed in a way where they bypass the app sandbox and receive a massive amount of highly privileged access. On Griffin OS Play services can be installed as standard apps with no special access or privileges. So if you’re new and looking for the simplest way to get started, this is what I recommend. And that’s what I will be demonstrating. There’s a couple other options if you want a bit more privacy, such as installing them in a separate user profile. And I cover that in a video which I will link down below. But if you’re at all hesitant about this switch, and using graphene OS, then I suggest installing them as I’m about to demonstrate. Once you get more comfortable, you can watch my other videos or check out different blog posts on some ways to enhance your privacy and security. But for now, take the simplest approach get comfortable and go from there. So the first thing we need to do to install sandbox Play services is connected to Wi Fi. So I’m going to swipe down, select Internet, I’m going to select my Wi Fi network. Once you’ve successfully connected to your Wi Fi, we’re going to swipe up, select the Apps app. We’re going to go to Google Play Store, select that, as we can see here, it’s also going to install a Google services framework and Google Play services. Select Install all it’s going to take about five minutes to complete, I will be linking this down below, I do suggest you take the time to read it over, as well as the usage guide that’s linked at the bottom. There’s a lot of great information in here. It explains how it works, the actual configuration, limitations, things like that. So take the time read it over. There’s a lot of good stuff. So once that’s completed, you’ll see down here and now says open instead of installing. I’m just going to swipe up. We’re going to swipe up again, go into our app drawer. And you’ll now see Play Store listed here. So this will function just like Play Store on stock Android OS, you can select that sign in. If you’re looking for a little more privacy, create a separate Google account that you just use on here to download apps and things like that. Go ahead and sign in, download your apps, get yourself started. And then like I said at that point once you’re comfortable, check out some of my other videos or different options that are available. On my last piece of advice, privacy and security. It’s a journey. Don’t try and do everything at once. If you change too much, it’ll be hard to keep the habit so take it step by step. Do what you can and every little bit helps.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So let’s talk about mastodon. There’s a lot of videos out there on why you should sign up for Mastodon, but I thought I would make a video on what it is a step by step guide with a live demo on how to sign up some basic usage, importing your Twitter followers and how to log into the mobile app. It’s also important to realize that you shouldn’t see Mastodon as a direct replacement for Twitter, or wonder if it can replace Twitter. It’s a different platform, it’s going to be a different community. So I suggest just checking it out, giving it a try seeing what you think, and kind of going from there. So before we go into the step by step of how to sign up for an account on Mastodon, I want to first talk about what it is and what it means to be a federated service. If you already understand the basics of Mastodon, you can skip this part, I will have the timestamps in the play bar below. So Mastodon is a federated service, which means it’s a group of servers hosted by individuals, even you could host your own if you wanted, and they’re federated together, which means they have a common communication protocol, which lets each individual server interact with one another. To understand that a little bit better. Let’s take a look at some pictures. So the first example is what a non federated service looks like. So if you, the user want to sign up for twitter.com, you go to the one location of Twitter, which is twitter.com. users sign up and they interact with each other on that platform. Another example is Facebook. If you want to sign up for Facebook, you go to facebook.com, sign up with an account, and you interact with users on that platform. But for all intents and purposes, these two platforms operate independent of one another. If you’re searching for something on Twitter, if you’re posting to Twitter, you’re not going to be interacting with anyone on Facebook, there’s a hard line between the platforms, they are run by a singular organization. There’s no Twitter to Twitter, three, Facebook to you sign up on one platform, it’s all centralized. And all content and interaction happens on that singular instance. So again, this is an example of a non federated centralized service. So now before we talk about Mastodon, let’s talk about another federated service that you are most likely already using, but did not realize it. So email is a federated service, you can sign up on different providers, whether that’s Yahoo, AOL, Gmail, proton mail. And so even though you signed up for your email address on these individual platforms, someone on proton mail can send an email to someone on Gmail, and vice versa. These platforms are all independently operated, but they use a common protocol, which lets them communicate with one another, which is why email is considered federated. Another example would be cell phone service, you can call another number that’s on another carrier, T Mobile AT and T you could even call someone from the United States to someone in Europe and communicate. They’re all operated by individual companies. But they use an agreed upon standard which lets them communicate with one another scenario that we saw an example of a non federated service, a federated service, such as email, let’s talk about Mastodon specifically. So Mastodon is not a centralized service. It is Foss, or free and open source software that is run on different servers operated by different individuals or groups on what are referred to as instances. So what you have here is you’ll have someone hosting a mastodon instance, you have other individuals or groups again, hosting the same software running on their server that they control. And then what makes Mastodon a federated service is that each of these instances that are operated by different groups or individuals use an agreed upon protocol that allows them to communicate and interact with one another. So as you’ll see, shortly, when we sign up for an account, we’re going to pick a specific instance where we sign up with our account. So for example, let’s say we sign up for an account on Tiger since Mastodon is a federated service. Even though we just signed up on this singular instance, we will be able to communicate with anyone on a different instance. So you sign up on Tiger, you can still talk with someone on lizard or fish, they’ll be able to search for you and your content, they’ll be able to see your posts, but this is mostly so you can get the basic understanding that it is a decentralized service comprised of different instances run by individuals and groups that can all talk with one another. No singular organization controls the mastodon network. It’s a group of instances that can communicate with one another that creates the federated network. So that was a basic overview of Mastodon and how a federated network operates. If that just made it more confusing, don’t worry, the actual signup might make things a little bit clearer once you can see it. So the first step for actually signing up for a mastodon account is to head on over to join mastodon.org. As always, links will be down below in the description. Once you get here, we’re going to select Create Account. And so like I mentioned in the example, we’re going to have a bunch of instances that we can select from ritually sign up for our account. And so the reason we’re going to join mastodon.org to find a server is that while this isn’t a list of all servers that are out there, it’s a list of servers that have committed to the mastodon covenant, which is a good starting point. Like I said, these servers are operated by individuals or small organizations, which means that those individuals or groups control the content that can appear on there as well. As how those servers are run, such as backups and different things like that. So at the bare minimum, at least know the servers listed here committed to the following four items, which is a good starting point. And just because you don’t see a server listed here doesn’t mean it’s bad. It just means that the operator did not submit their server to be indexed here. So the instance you choose is kind of like selecting your local bar or pub that you might frequent. And once you get in there, you can still communicate with everyone else, it’s just that that location you selected is your entry point into the network. Let’s say that your Pub is located in North America. And you want to find one that has the same interest as you so that when you enter there, first UC people that like to talk about the same things. In my case, North America, I like technology, some locations might require you to apply for an account. But for the sake of this example, I want an instant account. And so now we’re looking at instances that are legally based in North America with the topic of technology that have instant sign up. So I’m just going to pick this IOC data exchange. But regardless of what I initially choose, I can still interact with anyone on the mastodon network. And one more thing before we sign up, if you’re like me and afraid of commitment, do not worry, you can sign up for an instance. And if for some reason you don’t like the people that are on there, you can always migrate and switch to a different one at a later time. So take your time look around to try out different instances until you find one that you’d like. So to actually sign up, we’re going to click Create Account. And we are now taken to the homepage for this instance, which is IOC data exchange, as we can see in our browser. So as I was mentioning about looking around and checking out the instance, before you actually join, once you get to the homepage, you can kind of take a look around and see what the posts look like. You can see some stats about the server, this IOC that exchange has 17,000 active users, you can check out the Explorer option, local, they give a little explanation here, these are the most recent public posts from people whose accounts are hosted by IOC data exchange. So again, local to the instance that we are on currently, there is then the federated option. And these are the most recent public posts from people on this and other servers on the decentralized network that the server knows about. So let’s say that someone on IOC that exchange follows another user on a different federated server. And since someone on IOC that exchange is following someone on mastodon.rt, those two servers know about each other in the federated network, which is why you see posts from mastodon.rt on the federated page. And so as far as researching the instance that you want to sign up for goes, here, we have who it’s administered by, again, server stats, we can click learn more, we can kind of see some details about it, the server roles. And so since this is decentralized, and individuals are hosting these instances, you can see some details about the hosting. So here we have, it’s hosted in Linode. It’s costing them around $300 a month, where media files are hosted different details like that. So each of the servers here should have some sort of information like that. So if we take out, so we check out tech hub dot social. Again, we can see who it’s administered by 42,000 active users. Learn more, we can see details about it. So look through different servers, check out the local content, see if it’s things you’re interested in. There’s a lot of servers to choose from. So take your time and test them out. So for this example, like I said, I’m going to create an account on IOC that exchange. So create an account, just some ground rules, except, so your display name is what will show on your profile. So in my case, I’m just going to put side of burritos, your user name, this is going to be your handle on mastodon. So I’m just going to do side of burritos, enter your email address, password, agree and sign up. Select most online accounts, you need to go click the confirmation link that went to your email address. Once you click that, you’ll then be able to login.
So we’re back I just clicked the confirmation message in my email, we can see we’re presented with a page of individuals we can follow. Click the plus to follow people if you want. So we just followed these two individuals. So this is the home feed, we can see here the individuals that I followed a little bit earlier. On the left side here we have or we can write whatever we want and then publish it along with different options, add photos, who can view it different things like that. Bottom right, we have things that are trending on the right side notifications explorer local. So again, just explore click around you can see different things. There’s a couple things I want to cover on the actual profile page. So I’m going to go to my profile. This is not my actual profile. I just signed up with this for an example. So don’t try and follow this. And so what I want to note on this page, so if you used Twitter, you might have seen that you had a handle. Mine was outside of burritos, but on Mastodon there’s one extra part on here, which is the actual domain of the instance that we signed up for, in my case IOC data exchange. And the reason for this is that this username that I configured on IOC that exchange is unique to this instance. So if we go back to the mastodon servers page, someone could also go ahead and create an account, which is outside of burritos at Tech Hub dot social because user names are unique per instance on the mastodon network. So now what you might be thinking is well, that could lead to a lot of impersonations, or someone making a fake profile and a different instance and pretending to be you or, or me in this example. And that could definitely be a problem. And so that’s why I want to talk about how you can validate someone on Mastodon to make sure it’s the individual that you’re actually looking for. So my actual account where I am on Mastodon is at side of burritos at info, sec dot exchange. So we search for that we find my actual profile here, again, InfoSec. That exchange is the actual Mastodon instance that I signed up with. If you go to a profile on Mastodon and see a green box like this, that means the user validated, they own the domain or URL listed. The validation works by adding a small bit of code to the listed website that tells this Mastodon instance that my profile is associated with that domain, only someone that owns the actual domain they are claiming could add this code to it, which is why this works for validating domain ownership. So if you know someone is associated with a specific domain, and they validated it, this is a good indication that the profile is valid, and they are who they claim to be. You can validate domains under your profile settings. So in my case, I validated that I owned the site of burritos.com. I have my newsletter, if we go to those actual URLs, we can see that is indeed the actual site. So that’s just one way to validate someone is who they say they are. Another way to validate an account is to go to a site where you know, that individual already has an account. So in my case, there’s my Twitter page and my display name, I added my actual Mastodon account. So again, this is another way to validate my actual profile. So while this might sound a little bit confusing, at first, this is honestly just good practice to validate online profiles. Go to known good sources, such as Twitter, or YouTube channel, or someone’s individual website, and validate that actually claimed that they own a profile that you’re seeing for them, and it’s not someone impersonating them. Oh, and one more thing, while we’re on the topic of validation, if you see a checkmark or a blue checkmark on Mastodon, anyone can add those, it’s just a little icon, I added a burrito that does not have the same meaning as a checkmark on Twitter, not that checkmarks on Twitter mean much anymore. But just be careful if you see a blue checkmark on Mastodon, don’t assume that has any meaning behind it. And on the topic of getting set up, there’s a couple tools that exist that allow you to find your existing followers on Twitter that already have Mastodon accounts, the one I’ll be demonstrating with is deeper certify. Again, links will be down below in the description. And so what this does is connects to your Twitter account with Read Only permissions. And it’ll look through your followers or those you follow. And it’ll look for their account name, they might have listed on their profile. So in my case, I have it in my display name. It also searches for pin tweets, different things like that. And if it finds a mastodon account, it lets you export it, and then you can import that to your profile. So it’s an easier way to find people and kind of already get set up on the platform. So I’ll just run through an example. So authorized with Twitter, I’m going to authorize this app. So on an unrelated point to this video, always be careful authorizing apps don’t just authorize some random app to your account. As we can see here, it’s going to be able to see the tweets from your timeline that so can look through my pin tweet and see if I have an account listed there. It’s going to be able to see my profile information. And then it’s also going to be able to see those I follow mute and block someone to authorize app. I want to search followed accounts. We can see here that it searched 35 Twitter accounts. That’s how many accounts I’m following. It goes through which instances they are on. It’s all for mastodon. Here’s the details of those users. At the very bottom, I can download a CSV for export for Mastodon import. I’m going to do that. So now we’re going to go back to Mastodon where we created our account, we’re going to go into preferences. On the left hand side, import and export and go to import. The import type is following list. This is going to be people who I was following. I’m going to leave it set to the default of merge choose file. Following accounts. This is the CSV export from the Berta fi going to click Upload. Your data was successfully uploaded and will be processed in due time. If we go back to Mastodon I’m going to go to my profile. And we can now see that I’m following 12 accounts on mastodon. That’s how many accounts the Berta fi found out of the 35 individuals that I was following. So this is a quick way to import any of the accounts who were following on Twitter if those individuals added their profile information to their Twitter account. And since this is a popular tool, I would suggest that if you sign up for a mastodon account, add that to your display name on Twitter so that if someone else uses this tool to import their followers or those they’re following to their Mastodon account, they’ll be able to find you and start following you. So now that we signed up for an account, like most things, you might want to access that on your mobile device. So I want to walk through that and show you how to set that up. So once you open the app, we’re going to select login. And I think this is the part where most people get confused. So since we signed up on a specific instance, IOC that exchange, that’s the URL that we need to use inside the app to actually sign into our account, since that’s where our account exists. So I’m going to search for my server IOC dot exchange.
Here it is selected. Next, we’re taking the login page. So I’m going to sign in.
And so as long as you selected the correct instance, where you initially created your account, your email address and password will work for authentication, you’re going to see this page where you need to authorize the app with the ability to actually access your account. I’m going to allow it Authorize. And at this point, you’re in the app, you can post information, see your profile, see who you’re following everything like that. So if you have any difficulties, remember, you need to select the exact server that you signed up for an account on. If you don’t, your sign in will not work. So that’s Mastodon if you want to follow me or tag me in a post or slide into my DMs Feel free. So far, my experience has been positive. So I hope you have a similar experience after you sign up. I’m excited to see what the future holds. A big shake up on any platform is always kind of exciting leads to interesting times and whether the shake up leads to permanent platform changes or temporary ones. It’s still far too early to tell
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So the main purpose of today’s video is to install graphene OS on the Google Pixel six a specifically, the process will be similar regardless of which pixel you have. But the one I’m demonstrating on today is the six A, we’re going to be following the instructions on graphene os.org. I’ll put the link down below in the description as well as on the screen right now. And we will be using the web installer, it’s essentially impossible to break your phone using the web installer. So don’t be scared to try this, I’ve done the process probably about 50 to 100 times at this point, I’ve never had an issue with it. Now that being said, there are some issues that come up for some individuals when they are going through the install process. And I will point those out throughout the video for any tips, you can try to overcome those. But with that out of the way, let’s begin the installation process. So we’re at Griffin os.org, the web installer, we’re going to go down to the prerequisites, give this a read through the supported OS. I’m installing this from Mac OS today using brave browser, make sure you are using a supported browser and a supported OS. Otherwise you will encounter issues. This is a very important note for those on Ubuntu. If you’re using chromium that is broken and will not work. So make sure if you’re on a boon to you are not using chromium. So once you know you’re using a supported browser and OS, we can continue, make sure to give all this a read through I’m not going to waste your time reading it to you. But there’s some other important bits of information in here such as Do not use an incognito browser or private browser. Because again, you will encounter issues. So once you make sure all the prerequisites are met, we are on to enabling OEM unlocking. So just a note about where you get your information from always go to the source directly, in this case, Griffin os.org. That’s why I’m following along in their guide when showing you the developers do a great job documenting the installation process and different features. Always go to the source. First, don’t trust some random YouTuber talking about it, or some random forum posts that you saw, you’ll always get the best information directly from the source. So the first step for this OEM unlocking needs to be enabled from within the operating system, enable the developer options by going into settings about and pressing the build number entry until developer mode is enabled. So I’m going to be demonstrating this, like I just took my pixel out of the box. When you turn it on for the first time, you will see this screen. If you already past the initial setup, and you want to skip ahead, I’ll have that in the play bar below. So you can skip this section. But if you’re here, go ahead and press Get Started. I don’t have a SIM card in the phone yet. So go ahead and click Skip. So you could connect to Wi Fi at this point. But I like to skip this because we don’t need a Wi Fi connection, we can set up the pixel offline first. So we’re gonna go to Setup offline. Just a quick warning about setting up offline continue. Date and time. I uncheck these just for good practice. Except Except it’s always good practice to set a pin. Even if you’re just going to be erasing the OS quick. Sometimes I don’t but you should anyways.
No fingerprint, no thanks. Skip, and then swipe up to go home. So at this point, we’re on the home screen, the first step is to go into settings about so swipe up,
you’ll see settings, go to Settings, scroll down to the bottom, we’re going to go into about phone, scroll down at the bottom here you see build number. Now tap on that you will get this screen if you set a PIN number, type in the pin. And we can now see you are now a developer. So developer options are enabled. And that’s where the setting for OEM unlocking will be located. So next, go into settings, system developer options and toggle OEM unlocking. So we’re gonna go back word in the settings, so go to System developer options. And here’s the option to enable OEM unlocking. So there’s a couple things to note about OEM unlocking. So if you purchase your device brand new OEM unlocking will be grayed out and you won’t be able to enable it. The reason for that is that you need to actually connect to Wi Fi at this point before you can enable OEM unlocking. So we can see here OEM unlocking requires Internet access so that the stock OS can check if the device was sold as locked by a carrier. And so what does that actually mean? So the founder and lead developer of graphene OS has a thread on Twitter describing how OEM unlocking actually works, which again, I’ll link down below if you want to read through it. So essentially, how that works is that Google has a database of the pixels serial numbers and which ones were sold as an unlocked device not locked by the carrier. Your device will check with Google if the device is enabled for OEM unlocking after you connect to the internet. You will then be able to enable OEM unlocking. If your device checks with Google and your serial number is not authorized for unlocking, then that option will remain grayed out because it’s locked by the carrier devices that are commonly locked or Verizon branded pixels. So if you have a Verizon pixel, you will not be able to enable OEM unlocking and you cannot install graphene unless your only option is to return it or sell it and buy a OEM, unlockable pixel. For me personally, I buy my devices directly from Google as unlocked, so I know that it’s unlockable, I don’t need to worry about it being locked. If you decide to buy used online, I would suggest asking the seller to confirm if OEM unlocking is available, had them send you a screenshot so that you know, I’ve made the mistake in the past of buying a locked pixel, I had to return it. So don’t make the same mistake as me. One other note on the site is so for the pixel six A, this phone in particular, if you’re using one, unlocking won’t work with the version of the stock OS from the factory, you need to update it to the June 2022 release or later, via and over the air update. After you’ve updated it, you also need to factory reset the device to fix the OEM unlocking issue. So depending on when you bought your pixel, this may not be an issue for you. This pixel was purchased around a month ago, and it shipped with the newer updates. And I did not have to factory reset or follow this at all to get it to work. But if you purchased a pixel earlier, you may need to do this and follow these steps to actually get OEM unlocking to work. So I’ve unlocked this device in the past, which is why OEM unlocking is available. So again, connect to Wi Fi, if it’s not, if your device is able to be unlocked after a checksum with Google, you will then be able to enable it, enable OEM unlocking if you have a pin set you need to enter it. Allow OEM unlocking enable, and we can now see it’s enabled. So on to the next step flashing as non root. This is for Linux distributions, I’m not going to cover this part. So the next step is booting into the bootloader interface, you need to boot your phone into the bootloader interface. To do this, you need to hold the Volume Down button while the phone boots. The easiest approach is to reboot the phone and begin holding the Volume Down button until it boots up into the bootloader interface. So now what that looks like we have OEM unlocking enabled. Going to swipe down, going to pull down again, in the bottom right hand corner is the power button. And then from here, we’re going to select Restart, hold down the volume down button on the right side of the phone. So as you saw that took about 10 seconds. And once you see this screen, we are in the bootloader interface. If the screen doesn’t come up for you, the phone will just boot up like normal, try restarting and again, hold the Volume Down button until you get to this screen. So the next step is actually connecting the phone to our computer. And so for this step I want to mention, make sure you use the stock cable that actually came with your device. Now that being said, the most common issue that I’ve heard others talk about is that their computer doesn’t see the phone. And that’s because they have a faulty USB cable. So if you plug in your USB cable to your computer with your phone, and it doesn’t see it or you have any other strange issues when downloading the OS later in this guide, go ahead and try a different USB cable, and likely that’ll solve your issue. Also, when connecting the USB cable to your computer connected directly to your computer, don’t connect it through a dongle that’s plugged into another port. While it still might work. This could lead to some other strange issues. Let’s go ahead and connect the USB cable to our device. So just some notes here. If you’re using Windows on Windows, you need to install the driver for fastboot. If you don’t already have it, you can obtain the driver from Windows Update, which will detect it as an optional update when the device is booted into the bootloader interface and connected to the computer. So you should see a little pop up if you’re on Windows. Another method is to go here and just download the driver manually. But the easiest option will likely be through Windows Update. So once you have your device connected to your computer with a USB cable, and you have all the drivers installed, if you’re on Windows, the next step is unlocking the bootloader. It’s important to note that unlocking the bootloader will erase the device and wipe all data. It’s impossible to recover your data if you erase it. So make sure if you had any contacts or calendar events or photos that you need to save that you save those before proceeding because your device will be erased. So if you’re ready to continue, we’re going to press the unlock bootloader button, you’ll see this prompt in your browser. If you have issues or if the drivers didn’t install or you’re using an unsupported browser, you’ve likely will not see your phone here. If that’s the case, the first and easiest step, go through again, if you’re on Windows, make sure you install the drivers. And what I usually suggest to people is if you’re not using Google Chrome, just go ahead and install it even if it’s temporary google chrome Rome is supported and will work. So that’s one easy way to rule out that your browser is the issue. But if you do see it in your browser, and you see you can select your phone, go ahead and select Connect, you’re going to see this warning on the phone, take a second to read that through. Once you do, press the volume down or up button, so that it says unlock the bootloader. And once you see that, press the Power button to select that. And if this was successful, you will now see device state red unlocked, as compared to before where it was green and said locked. So once you see device state unlocked, we’re ready to proceed on to the next step. Next one is obtaining the factory images. So go ahead and press download release. This will download the release in your browser. Depending on your internet connection speed. This could take a minute, a few minutes or an hour. And so while that’s downloading it, just want to mention that once you start using graphene OS consider donating to the project. The developers put in a lot of hard work supporting current devices and new devices very quickly. The donations are used for paying developers and purchasing hardware. Me personally, I like the GitHub sponsors option. So I set that up. So I have a reoccurring monthly donation. And again, I’ll link this down below. So you can check out the page and set up your donation. And so once that finishes, you’ll see the progress bar is full and this will say downloaded and then the name of the release dot zip. And the next step is to actually flash the image to our device. So the initial install be performed by flashing the factory images. This will replace the existing OS installation and wipe all existing data. The main thing to note here is avoid interacting with the device until the flashing script is finished and the device is back at the bootloader interface. So once you’re ready, select flash release, you’ll see your screen change waiting bootloader. And your device will now flash and go through the entire process. And again, this will probably take five to 10 minutes. So while that’s flashing and you and I are both waiting for this to finish, I just want to mention that I have a monthly newsletter that I send out, you can sign up for that at side of burritos.com. So the other day I was talking to my best friend who was a truck driver and he asked me if I knew what frogs did when their car breaks down. I said no, I do not know what frogs do when their car breaks down. And he said they get it towed. So with that great joke out of the way I’m going to fast forward the video and I will see you shortly
so once that’s completed, for me, it took about five minutes for that to complete. You will see flashed and then again the name dot zip to device. And I want to the next step which is locking the bootloader which is extremely important as it enables full verified boot. And some of the reasons why this is extremely important are in the rest of this paragraph, which I would suggest you read over. So to do that, we’re going to select Lock bootloader again, we can see do not lock the bootloader use the volume up or down to change that. When it says lock the bootloader Press the Power button to select and once that is successful, you will see device state is now green locked. So once that’s completed, we can go on to the next step post installation booting. You’ve now successfully installed graphene OS congratulations and can boot it. pressing the power button with the default start option selected in the bootloader interface will boot the OS. So we can see here it says start press the power button the screen is normal. Do not be afraid if you see that we have a customer lesson installed. Seeing the Google screen is normal and then once you see the graphene OS screen, this is now the boot animation booting into graphene OS so the next step after booting is disable OEM unlocking. So for that we have to go to the initial setup. So start set your language, date and time set that we’re going to skip Wi Fi for now. I don’t have a SIM card if you do, you can put it in now just turn location services off by default. Next, I’m going to skip fingerprint setup but you can set that up if you want. I’m just going to set a PIN code quick just for the demo but again, set a secure PIN code along with fingerprint if you want. I don’t have a backup to restore from Skip and start. So we have now reached the GrapheneOS home screen. And now to disable OEM unlocking we’re gonna go into settings. We’re going to scroll down again to About phone. Go to the bottom tap Build Number or type in the PIN code. We can now see your now developer, go back system developer options.
Disable OEM unlocking, please restart the device to enabled device protection feature. And also, I’m going to disable developer options, you don’t really need those enabled,
we can now see developer options are gone. So as the instruction said, Let’s Reboot the device, since we disabled OEM unlocking, restart so I’m just gonna press the power button quick, so I can pause it on the screen. So the next part, verifying installation, give this a read over some very good information. This verified boot key hash, the reason I paused it by pressing the power button on boot is that we can verify the boot key hash. And here we have the pixel six A in this example, can make sure the number matches there. Which does so we’re good to go. So I’m gonna press the power button to resume. So I’m just gonna log in quick. So the next thing I want to cover quick is what I think is the best setup for anyone that’s new to Griffin OS. If you’ve read around, there’s a lot of videos, including my own channel or blog post that talks about using F Droid or Aurora store or all these different things you can do to increase your privacy and security. And while some of them are valid, it can be a bit overwhelming for anyone that’s new. So what I’m going to do is show you a basic initial setup that I think is best for anyone that’s new here. So for that we need to connect to Wi Fi.
And some other Wi Fi is connected, we can proceed on, we’re going to swipe up, we’re going to go into apps.
And the apps app support allows you to install different apps that are provided by Griffin OS. In this case, we’re going to be installing the sandbox Google Play services. Again, like I said, this is going to be a basic setup for anyone that’s new, I get a lot of messages from people that say they’re new to privacy or the security community. And it’s overwhelming at first they get a VPN, they get a new phone, they get this, they get that they want to use F droid. And I can understand how that’s overwhelming. And that’s why don’t suggest trying to do everything at first, privacy and security as a journey. You can’t do it all at once. Because if something’s too difficult, you’re not going to stick with it, you’re gonna give up easily. And that’s why I think it’s easier to go ahead and install the sandbox Play services use Google Play, like we’re about to do and start there. Once you get comfortable with the OS, you can make changes one by one, you can check out some other videos I have, you can see different suggestions that users might have online. But the first step is getting a solid base that you’re comfortable with using Griffin OS. And I think sandbox Google Play services are a great place to start. So to do that, we’re going to go down to the bottom, and we want to install Google Play Store. We can see here it’s going to install these other two dependencies, services framework and Play services. So select Install. All right. So that took about three minutes, we can now see that it’s finished. Because we see the Open option. You can either select open, or you can go swipe up. And you’ll now see Play stores installed. This is the same Play Store you’d get on Android OS except on graphene OS it’s sandboxed and installed as a normal app instead of an app with system level access. So select the Play store. You can select Sign In. And then at this point, you can either sign in with your personal Gmail account. Or another option if you want a little bit of increased privacy, create a separate gmail account that you can use specifically for this. That’s not tied to anything else you have. If you have paid for apps, you can sign in with that account. You can installed paid apps like anything else. And since we now have all the Google services installed in our device, notifications, and everything else will work as expected. And if you’ve used Android in the past, this is going to feel like the standard Android experience.
]]>If you’re on Arch Linux or Debian/Ubuntu, use the following commands to install as non-root:
sudo pacman -S android-udev
Arch Linux
sudo apt install android-sdk-platform-tools-common
Debian/Ubuntu
cd Downloads
Change to the directory of the files we downloaded earlier – Link to section in video
dir
Show the contents of the directory – Link to section in video
CertUtil -hashfile device-flasher.exe SHA256
OPTIONAL – Verify device-flasher – Link to section in video
CertUtil -hashfile redfin-factory-202112110.zip SHA256
OPTIONAL – Verify CalyxOS image – Link to section in video
sudo apt update
Update local repositories – Link to section in video
sudo apt install android-sdk-platform-tools-common
Install required packages – Link to section in video
sudo apt install adb
Install Android Debug Bridge – Link to section in video
cd ~/Downloads
Change directory to where files were downloaded – Link to section in video
sha256sum device-flasher.linux
OPTIONAL – Verify device-flasher – Link to section in video
sha256sum redfin-factory-202112110.zip
OPTIONAL – Verify CalyxOS image – Link to section in video
chmod +x device-flasher.linux
Make device-flash executable – Link to section in video
./device-flasher.linux
Execute device-flasher.linux – Link to section in video
cd ~/Downloads/calyxos
Change Directory (if stored in your downloads folder). If you named the folder differently, then change “calyxos” to what you named it – Link to section in video
shasum -a 256 device-flasher.darwin
OPTIONAL – Verify device-flasher – Link to section in video
shasum -a 256 redfin-factory-number_in_file_name.zip
OPTIONAL – Verify CalyxOS image – Link to section in video
pwd
Print Working directory – Link to section in video
cd ~/Downloads/calyxos
Change to the directory of the files we downloaded earlier – Link to section in video
chmod +x device-flasher.darwin
Make device-flasher.darwin executable – Link to section in video
./device-flasher.darwin
Execute device-flasher.darwin – Link to section in video