GrapheneOS Setup Guide: Configuring Pixel Phones for Corporate Surveillance-Free Daily Use
Modern smartphones collect continuous telemetry by default. This article provides an exhaustive engineering guide to deploying, configuring, and operating GrapheneOS, an operating system designed to return full control to the device owner.
Core Principles
The system rests on three fundamental principles: rejection of proprietary ecosystems to reduce surveillance risks, Zero Trust relying solely on cryptography and independent code audits, and strict compartmentalization that physically and logically separates work environments.
Compatibility and Installation
GrapheneOS officially supports only Google Pixel smartphones due to strict hardware security requirements including specialized chips and Verified Boot implementations. Devices must have an unlockable bootloader. Users should purchase only official factory-unlocked global versions and avoid carrier-locked models such as those from Verizon or AT&T.
Installation is performed through the official Web Installer at grapheneos.org/install/web. The process requires backing up data, enabling OEM unlocking in developer options, booting into fastboot mode, unlocking the bootloader, flashing the release, and then locking the bootloader again. After installation, OEM unlocking should be disabled for security.
Owner Profile Configuration
The owner profile must contain no proprietary software or Google services. Users set Russian as the primary language, install system updates, configure a strong PIN with shuffling enabled, and activate automatic reboot after 18–24 hours to clear encryption keys from RAM.
Applications are installed via the built-in Vanadium browser and the Obtainium package manager downloaded directly from its GitHub repository. F-Droid is avoided because it re-signs packages and delays updates.
FOSS Applications and Security Tools
The guide recommends numerous open-source applications installed through Obtainium: KeePassDX for password management, Aegis Authenticator for 2FA tokens, AmneziaVPN and Hiddify for VPN and proxy connections, Signal and Element X for encrypted messaging, and the full Fossify suite for files, gallery, music, documents, camera, and notes.
VPN kill-switch is enabled in network settings to block all traffic outside the encrypted tunnel. Additional utilities include PCAPdroid for traffic analysis, Shizuku for privileged API access, and App Manager for permission auditing.
Isolated Regional Profiles
Separate user profiles named American, European, Russian, and Chinese are created to isolate untrusted proprietary applications. Each profile disables calls and SMS. The American profile uses sandboxed Google Play, the European profile uses Aurora Store, the Russian profile uses RuStore, and the Chinese profile uses Huawei AppGallery. Basic utilities such as LocalSend and Inter Profile Sharing are copied into each profile to enable safe data transfer without network exposure.
Related articles
ONYX 2.0 Removes Central Servers for Fully Decentralized Tor-Based Messaging and Calls
ONYX 2.0-beta marks a major shift from its previously centralized design to a serverless architecture that relies entirely on Tor for all communications. Each user account is now represented solely by a cryptographic key pair generated on first launch, with recovery handled through a 12-word seed phrase. Devices connect directly via onion services, and the application bundles its own Tor daemon on desktop platforms while using tor-android on mobile devices. Voice calls are supported through an embedded local TURN server, delivering acceptable quality with 1-3 second latency despite the anonymity overhead. Message delivery now depends on recipient availability, with undelivered messages stored locally on the sender and retried automatically. The update deliberately removes features such as HTTP or SOCKS5 proxies and link previews to prevent IP leaks or external traffic. Developers released the beta to gather feedback on stability across network changes and multi-device scenarios.
Privacy-Focused Browser Tool Compresses PDFs Locally Without Uploading Sensitive Documents
A developer created a PDF compression tool that runs entirely inside the browser to protect sensitive personal and professional documents from third-party servers. The solution addresses repeated situations where embassy submissions, financial presentations, contracts, and internal reports exceeded size limits, forcing users to choose between installing desktop software or risking data exposure through online services. The tool reduces scanned and photographic PDFs by 66 to 97 percent depending on quality settings while honestly reporting weaker performance on text-heavy files compared with Ghostscript. It works on both desktop and mobile platforms, including iPhone and Android, requires no installation, and continues functioning offline after the first page load. On mobile devices the application respects memory constraints by limiting images to four megapixels, preserving readability for A4 documents intended for printing. The project originated from a single evening script built around Ghostscript and evolved into a full web application after similar compression needs recurred across multiple devices and locations.
Building Prizrak: How a Developer Created a Federated Messenger That Masks All Traffic as Legitimate HTTPS
A developer created Prizrak, a federated messenger with end-to-end encryption where all traffic, including calls, is indistinguishable from ordinary HTTPS connections. The project addresses three common limitations of existing messengers: centralized control points, mandatory phone numbers, and detectable encrypted traffic. It uses real TLS 1.3 handshakes to actual domains, multi-port listening, and a hidden token mechanism inside the encrypted channel. When servers cannot reach each other directly, messages are delivered through a network of storage nodes modeled after Ceph's RADOS system. Voice and video calls run on a native media stack with custom STUN-like functionality and careful UDP buffer sizing to avoid packet truncation. An integrated two-hop VPN reuses the same stealth transport while keeping messenger traffic outside the tunnel.
Following the White Rabbit: Developer Builds Custom Rust VPN PAYPHONE Using QUIC and Obfuscation to Evade Detection
A Russian developer has released PAYPHONE, an experimental IPv4 VPN written entirely in Rust that uses QUIC datagrams and optional TLS-over-TCP transport with custom obfuscation. The project aims to provide an alternative to AmneziaWG and Xray/VLESS+REALITY stacks that are commonly used to bypass Russian internet filtering. The article details the full packet path from TUN interface through a 16-byte PAYPHONE header, session management with Ed25519 tokens, and multiple post-launch bugs including MTU miscalculations, self-routing loops on macOS, and timer lifetime issues in Tokio. Key technical choices include RFC 9221 datagram support to avoid head-of-line blocking for multiplexed TCP flows and token-bucket rate limiting tied to subscription tokens. The author also describes route monitoring every 400 ms and interface-bound sockets to prevent the tunnel from swallowing its own control traffic.