In the end I decided Degoogling the phone was the more important goal. If it ever becomes possible to get a tiny phone I can put GrapheneOS on, I will. But I have bought myself a refurbished Pixel 9 Pro [1], flashed it with Graphene, and this is now my primary phone. I’ll keep the Bluefox NX1 handy just in case this turns out to suck.
So, good points:
- You can really lock down the permissions any individual app has. I have the Google Pixel camera app (which is pretty good) but I switched off its ability to community with the Internet so it doesn’t send anything back for training. That’s the kind of power I want to wield over a device I actually own.
- Google Play Services runs in a sandbox like any other app, so you can really restrict what it can do.
- Installing an app always asks if I want to enable Internet access, which means I can stop pretty much any app from communicating its telemetry outwards. Except, of course, for apps that actually need the Internet to function.
- The camera is awesome
- Bluetooth works much better than in my tiny phone
- It’s super fast and super snappy
- It supports NFC which means I can store my ID card in it.
- You can lock individual apps away in isolated profiles, so if controlling their permissions on a per-app basis isn’t enough you can ensure they can only ever talk to cut down versions of your life.
- Fingerprint scanning actually seems to work
The bad points:
- My Bluefox allowed for microSD. The Pixel doesn’t, because fuck you that’s why.
- It is aggressively large
- The camera extends out of the back of the phone like a tumor, which means you need a case just to protect the lenses.
- Flashing Graphene on it seems to have permanently destroyed the eSim functionality, and there’s only one physical Sim slot. This seems to require a motherboard replacement to fix (!).
- It doesn’t support tap to pay in Google Wallet.
The last of these isn’t a big deal in Sweden but my Tapster fob with Nordea doesn’t work reliably in the UK. Nordea really don’t like giving you access to your money. It’s probably best though I don’t use any fintech and use my Nordea card instead when I’m abroad.
The fine-grained control over apps is great but the reality here is that network access is a broad tool for approval or disapproval. I may have to allow apps to access the Internet for a lot of reasons, but I can’t just selectively permit ‘real internet’ and ‘no spyware’. Still, it’s a real improvement, as is the ability to get some insight into why certain apps have such weird permission requirements. I use GBoard as my keyboard because I like swipe typing, but even when you install it it says ‘Jesus, this thing sends info everywhere, including everything you type’. So I can switch off its network activity and bam – that’s no longer an issue. So long spyware.
My intention here though is to continue to enact device hygiene. No social media (except for the Haunted Playground) goes on it. No Reddit apps. Nothing I don’t legitimately need. However, what I do need is – well, it’s an extensive list:
- Discord (for running my program)
- BankID (for being a person in Sweden)
- Outlook (for work, alas)
- Nodea, and SEB banking apps (which still work even on Graphene, Halifax doesn’t).
- I assume these will stop woking at some point
- Thunderbird
- A translation tool
- PostNord
- Microsoft Authenticator (in case I need to access to work stuff on the go)
- EduVPN (god, fuck you)
- Antenna Pod
- Steam (for authentication)
- Swish (for payments)
- Vasttraffik’s ticket app
The self-hosting, de-big-teching though has gone pretty deep:
- Organic Maps rather than Google Maps
- Immich rather than Google Photos.
- The camera aoo complains bitterly about this.
- A self hosted Bitwarden server rather than Google Pass or saving passwords on the device
- Jellyfin using my self-hosted media library rather than Netflix
- Syncthing and Tailscale to give me file access
- Symfonium accessing my Navidrome server instead of Spotify
- Zettle Notes
- Paperless (for scanning paper documents)
And there’s some generally useful stuff that’s just a quality of life bonus:
- Libib for tracking my library
- Storygraph, for tracking my reading
- Pedometer, for measuring pedophiles.
- Actually now I look closer this is just an unfortunately titled step counter
- Mathem for groceries
- Hedvig for insurance
- The Haunted Playground (my only real social network now)
- Classic Words+ (Because I do love having a good Scrabble implementation on the go)
- A Soft Murmur (for white noise in strange environments)
Note what’s not here and was so omnipresent on my last phone(s)
- Youtube
- Gemini
- Google Search
- Google Messages
- Gmail
- Gallery
- Google Maps
- Google Photos
- Samsung Pass
- Excel
- Intune
- Lens
- Samsung News
- OneDrive
- OneNote
- Powerpoint
- Samsung Store
- Samsung Smart Switch
- Microsoft Teams
- Microsoft Word
Or, all the bloatware that I have had installed against my will on my work provided phone. This is maybe the real value of something like Graphene – it comes in an installation that is borderline austere. If you don’t want it, by and large, you don’t have to have it. Graphene is opt in rather than you can’t even opt out.
Actually, you know, my loadout – that’s not really that bad right?
- Sweden Citizenship – BankID / Vasttraffik / PostNord / Translations
- Money – Nordea / SEB / Swish
- Work – EduVPN / Microsoft Authenticator / Outlook / Discord
- Fun – Antenna Pod / Steam / Symfonium / Jellyfin / Libib / Storygraph / The Haunted Playground / Classic Words+
- General iife – Thunderbird / Syncthing / Tailscale / Bitwarden / Immich / Zettle / Pedometer / Mathem / Hedvig / A Soft Murmur
The bolded ones are the things I’m basically forced into using. I don’t need to have PostNord on my phone, I could use the computer. Translations – I really should get around to learning the language anyway. I don’t really need banking on my phone and likewise Swish. I use Discord for running my program but that was my choice. Everything else – that’s my call. And importantly, I can lock everything down to the point I’m okay with it. BankID doesn’t have access to my location, for example. Vasttraffik does (for giving me info for the nearest stop) but it doesn’t have sensor access. Outlook can’t remotely wipe my phone. Even the apps I have to use have been firewalled quite effectively.
So I guess I could easily enough strip the ‘Money’ part out of the phone. Could do Discord only on the computer. That said, I could do the same with Outlook and Thunderbird. And Postnord. The MVP of my phone stack probably looks more like this:
- Sweden Citizenship – BankID / Vasttraffik / Translations
- Work – EduVPN / Microsoft Authenticator
- Fun – Antenna Pod / Steam / Symfonium / Jellyfin / Libib (I need its camera) / Classic Words+ (Fight me)
- General Life – Syncthing / Tailscale / Bitwarden / Immich / Zettle / Pedometer / A Soft Murmur
That said, I don’t consider this fully deshittified or deshittifiable. The Pixel is huge and obtrusive. I much prefer the form factor of my adorable little Bluefox. I shouldn’t have to adopt a defensive threat posture with my phone. It shouldn’t be this stressful. And of course there’s the eternal irony that in order to degoogle my phone I need a Google device.
I think though this might be the best I can do. The MVP is probably four and a half stars deshittified – the last half star involves escaping the Swedish fetish for digitalisation and my employer’s penchant for security theatre. But by keeping their apps locked down I do at least have the opportunity to minimise the shitware stench. Everything else I choose to include.
The current loadout I have now with my apps is probably four and a quarter stars, but it’s likely a fair compromise that people can access me via email even I’m not in the office. And while a lot of it my activities can wait until I get to a computer (updating my reading history for example) I don’t think it does any harm. These aren’t attention demanding apps. They are, ‘Shit must remember to add laxatives to tAhe shopping list’ apps. Actually, they’re probably not even slightly shittified in my original conception of the project. They’re just not mandatory. Screw it, four and a half stars there too.
This represents then the end of the mobile portion of the project:
- Bluefox NX1 – a valiant experiment, I love the device, but the fact you’re still tied into Google telemetry and shitware means it puts a hard ceiling on how deshittified it can get. Ceiling of three stars.
- Google Pixel 9 pro – a stupidly excessive supercomputer, but one that still gives you the right to exert sovereign control over your own mobile life. Ceilling of four and a half stars.
So, final deshittification rating here – four and a half stars. Would be four and three quarters if I could get Graphene onto a tiny phone. For now, that is not an option.
[1] So no money goes to Google.