GrapheneOS Setup Guide: Configuring Pixel Phones for Corporate Surveillance-Free Daily Use
Modern smartphones collect continuous telemetry by default. This article provides an exhaustive engineering guide to deploying, configuring, and operating GrapheneOS, an operating system designed to return full control to the device owner.
Core Principles
The system rests on three fundamental principles: rejection of proprietary ecosystems to reduce surveillance risks, Zero Trust relying solely on cryptography and independent code audits, and strict compartmentalization that physically and logically separates work environments.
Compatibility and Installation
GrapheneOS officially supports only Google Pixel smartphones due to strict hardware security requirements including specialized chips and Verified Boot implementations. Devices must have an unlockable bootloader. Users should purchase only official factory-unlocked global versions and avoid carrier-locked models such as those from Verizon or AT&T.
Installation is performed through the official Web Installer at grapheneos.org/install/web. The process requires backing up data, enabling OEM unlocking in developer options, booting into fastboot mode, unlocking the bootloader, flashing the release, and then locking the bootloader again. After installation, OEM unlocking should be disabled for security.
Owner Profile Configuration
The owner profile must contain no proprietary software or Google services. Users set Russian as the primary language, install system updates, configure a strong PIN with shuffling enabled, and activate automatic reboot after 18–24 hours to clear encryption keys from RAM.
Applications are installed via the built-in Vanadium browser and the Obtainium package manager downloaded directly from its GitHub repository. F-Droid is avoided because it re-signs packages and delays updates.
FOSS Applications and Security Tools
The guide recommends numerous open-source applications installed through Obtainium: KeePassDX for password management, Aegis Authenticator for 2FA tokens, AmneziaVPN and Hiddify for VPN and proxy connections, Signal and Element X for encrypted messaging, and the full Fossify suite for files, gallery, music, documents, camera, and notes.
VPN kill-switch is enabled in network settings to block all traffic outside the encrypted tunnel. Additional utilities include PCAPdroid for traffic analysis, Shizuku for privileged API access, and App Manager for permission auditing.
Isolated Regional Profiles
Separate user profiles named American, European, Russian, and Chinese are created to isolate untrusted proprietary applications. Each profile disables calls and SMS. The American profile uses sandboxed Google Play, the European profile uses Aurora Store, the Russian profile uses RuStore, and the Chinese profile uses Huawei AppGallery. Basic utilities such as LocalSend and Inter Profile Sharing are copied into each profile to enable safe data transfer without network exposure.
Related articles
Why Replace Proprietary BIOS and UEFI with the Fully Free GNU Boot Firmware
The Free Software Foundation announced in September 2026 that it is providing financial and legal support to the GNU Boot project, which aims to deliver a completely open-source replacement for traditional BIOS and UEFI firmware. GNU Boot builds on coreboot to initialize hardware at boot time and layers a free bootloader such as GRUB or SeaBIOS on top, ensuring no proprietary binary blobs are required. The initiative emerged after a 2022 split from Libreboot, which began accepting closed-source components to broaden hardware support, while GNU Boot strictly adheres to GNU licensing criteria that prohibit any non-free code. Supported platforms remain limited to older systems from roughly 2008–2012, including specific ThinkPad models, certain early Apple MacBooks, and a handful of AMD and Intel desktop boards, because newer Intel Boot Guard and AMD equivalent mechanisms enforce signed firmware that prevents unsigned replacements. Closed firmware from Intel Management Engine and AMD Platform Security Processor runs before the main operating system, possesses unrestricted memory access, and cannot be audited or disabled on most modern hardware. By offering reproducible builds and clearer installation instructions, GNU Boot seeks to lower the barrier for users who want to eliminate potential backdoors, Wi-Fi whitelist restrictions, and forced updates found in vendor firmware.
WhatsApp Help Pages Hid Secret Instructions Directing AI Bot to Avoid GDPR References
Researchers at Redact discovered hidden instructions embedded in WhatsApp's public help documentation that instructed the company's AI support chatbot to avoid recommending users contact data protection regulators. The instructions also prohibited the bot from referencing GDPR, LGPD, or CCPA when users mentioned legal proceedings or lawyers. The findings emerged after Redact analyzed 545 help pages and identified 102 concealed blocks across 80 of them. One directive explicitly told the bot not to suggest contacting supervisory authorities even when users had lost access to their phone number and could not delete their account, despite WhatsApp's own European privacy policy stating that such complaints are permitted. WhatsApp confirmed to WIRED that the blocks were intended solely for its internal chatbot and attributed their public exposure to an error. The company stated the restrictions aimed to prevent the bot from offering legal advice. All hidden blocks were removed by October 18.
WhatsApp Secretly Instructed AI Support Bot to Suppress References to Data Regulators and Privacy Laws
Investigators discovered hidden instructions embedded in WhatsApp's public help pages that directed the company's AI chatbot to avoid recommending users contact data protection authorities. The instructions also prohibited the AI from citing privacy regulations such as GDPR, LGPD, or CCPA, even when users raised these topics themselves. The directives appeared on pages about account deletion and complaints, remaining invisible to human visitors but delivered to crawlers and the AI model. WhatsApp later confirmed the text was intended for its internal support chatbot and attributed the exposure to an error that has since been corrected. The findings highlight a gap between the company's publicly stated privacy policy and the operational guidance given to its AI systems.
Developer Builds Password Manager with Plausible Deniability Using Argon2id and XChaCha20-Poly1305
A Java backend developer rewrote a personal password manager originally built with Electron and React, migrating it to Tauri and Rust while redesigning its storage to support plausible deniability. The new implementation derives keys with Argon2id using a single per-install salt and encrypts files with XChaCha20-Poly1305, storing only random 32-character hex filenames without any headers or magic bytes. Multiple decoy vaults of identical size are created automatically for every user, and all files in the folder receive synchronized timestamps to eliminate metadata-based identification of the active vault. History and sync data are stored as additional encrypted files of the same format, making it impossible to distinguish real from decoy vaults from the filesystem alone. The approach mirrors VeraCrypt hidden volumes but operates on ordinary files and folders, with the explicit goal of providing deniability when a user is compelled to reveal a password.