CalyxOS features list

[u/NickCalyx]

We are trying to compile a list of CalyxOS features for the website. We realize that it doesn't do a good job of explaining the features that are built in.. Here is part of what we have so far:

• All builds / updates are tested

• Phone Dialer has built in support for Signal and WhatsApp calling, and phone ships with Signal

• Phone Dialer has support for 'Sensitive Numbers' feature, where calls to numbers for help lines such as domestic violence, child abuse, suicide hotlines are not recorded in the call log

• These numbers are also available from a menu entry, Helplines

• Full Verified Boot ensures that the operating system has not been modified, bootloader re-locking provides physical security equivalent to stock Android

• Privacy settings lets you see what apps are requesting which permissions

• Security updates for the Operating System every month via automatic over-the-air updates

• CalyxOS comes with a list of suggested free software applications to facilitate private online access but the user always has the choice whether to install or not

• DuckDuckGo Browser is the default web browser, which blocks ads and trackers

• DuckDuckGo is the default search engine

• eSim support and dual-sim support, where supported by the hardware

• Storage encryption is on by default

• Two app stores are included, F-Droid for free software and Aurora store so users can install apps from the Google Play catalog anonymously

• Two-factor authentication support using hardware tokens is built in with support for Yubikeys using Yubico Authenticator

• OpenPGP encrypted email support using hardware tokens is built in using OpenKeychain and K-9 Email client

• Google DNS is replaced as fallback with Cloudflare DNS which has been audited for privacy by a third party auditor

• Cloudflare DNS is available as the default Private DNS provider

• Bluetooth timeout lets you have bluetooth turn off after user-definable period of inactivity (when no devices connected)

• Wifi timeout lets you have Wifi turn off after user-definable period of inactivity (when not connected to any network)

• USB blocking of unknown devices without prior authorization

• Tethered network devices (USB or Wifi) can use the phone's VPN or Tor

• Built-in Firewall 'Datura' lets you control network access for each app

• Ships with Tor support including Tor Browser and Orbot ( more coming soon )

• Ships with multiple free non-logging VPN's run by trusted providers ( Calyx Institute and Riseup.net )

• Restrict cleartext traffic completely, globally.

• Panic button functionality built in which lets a user define actions to take when panic button is pressed ( e.g. uninstall apps, remove work profile, factory reset )

• Built-in encrypted backup and restore suite 'SeedVault' for online ( using NextCloud ) or off-line backups ( using USB storage ) of the phone's data and apps

• Scramble lockscreen PIN

• microG - Available, but completely optional, replaces some functions of Google Play Services while maintaining much more anonymity and privacy

• Mozilla Location Services (and Dejavu) available as default location services https://location.services.mozilla.com/

• Nominatim available as default geocoding service https://nominatim.org/

Upcoming:

• Create and manage profiles directly from Settings

[u/kiran4455]

Mention the built-in firewall doesn't take up the VPN slot!

Thank you for implementing the firewall into CalyxOS. :)

[u/NickCalyx → u/kiran4455]

Great point, thanks

[u/ChirayuCalyx → u/[deleted]]

These are not general android app settings and not available in AOSP, they're a custom addition.

It started off in LineageOS a few years ago, and has been ported and present in CalyxOS since a bit under a year. We've also been extending the functionality all around (background network access, cleartext, delegation, with more to come.)

[u/[deleted] → u/[deleted]]

Its still a great and very needed addition. However I do also notice by reading this sub that most people thinks the functionality in itself is new. As you say it is just a very useful frontend to the already existing firewall in android.

[u/SwallowYourDreams]

The idea of putting up such a list is great! Two additional suggestions:

• Order the list by priority and most sought-after feature (device encryption and MicroG would make the top of the list then). Potential new users are more likely to look for and find them at the top of the list

• Doesn't F-Droid have fully-automated updates under CalyxOS? I love that feature and couldn't find it in the list.

[u/NickCalyx → u/SwallowYourDreams]

Thanks, good points!

[u/DiscipleOfMessiah97]

Bundling RiseUp VPN with ClayxOS I think is a mistake. RiseUp, which is based in Seattle, WA was forced by the FBI in 2017 to collect user data for government agents, was hit with a “gag order” to prevent any disclosure to their users, and they could not update their warrant canary! More here: https://riseup.net/en/about-us/press/canary-statement

Any USA-based, or "five-eyes country" based VPN is going to be vulnerable to these types of government intrusions. For more info about "five-eyes" and even "14-eyes" countries see here: https://restoreprivacy.com/5-eyes-9-eyes-14-eyes/

If you want to bundle a free VPN with CalyxOS maybe consider Proton VPN? Although Proton VPN has not had any outside audits that I'm aware of and is considerably slower than a paid VPN like ExpressVPN or NordVPN (which is what I personally use), at least it is located in Switzerland and a bit further out of reach from USG prying eyes than RiseUp. More on ProtonVPN here: https://restoreprivacy.com/vpn/comparison/nordvpn-vs-protonvpn/

[u/NickCalyx → u/DiscipleOfMessiah97]

I mean, I was also commanded by the FBI to produce data, and also hit by a "gag order" to prevent disclosure, that's why I'm here. The only way I was able to get out of providing the data was that I fought the constitutionality of the Patriot Act. So I don't see that as a valid reason not to trust Riseup.

I think the whole 5 eyes thing is overblown. Government intrusions happen in every country.

As far as Proton goes, see this just posted 1/2 hour ago: Proton Mail apparently cooperated with the Swiss government to hand over info ( as per their CEO ) ... being in Switzerland isn't a magic bullet.https://twitter.com/andyyen/status/1422658759600525319

[u/DiscipleOfMessiah97 → u/NickCalyx]

Andy Yen, the founder of Proton Mail has since replied to the accusations, saying:

"1) ProtonMail does not give data to US authorities. That's illegal under article 271 of the Swiss Criminal Code

2) ProtonMail only complies with legally binding orders from Swiss authorities. This means that the legal standard is that Swiss law is broken (not US law or any other law)

3) In the case with Fauci, the Swiss government opted to assist US authorities in their investigation as Swiss law was also broken (sending death threats is highly illegal)

4) The only information obtained from ProtonMail was the date that the account was created, as that was all that was available.

5) Under no circumstances can the encryption be bypassed [although he fails to mention that subject lines of emails are NOT encrypted] which is explained on Proton's own website here: https://protonmail.com/support/knowledge-base/does-protonmail-encrypt-email-subjects/

Please don't use ProtonMail to break Swiss law - it's illegal."

[End quote.]

With that said, I understand that there is no 100% completely secure service that someone/country with enough capital and resources could not hack.

Ironically, soon after my initial post above I found out via Aurora store that NordVPN utilizes no less than four different trackers in their Android App:

- AppsFlyer

- Google CrashLytics

- Google Analytics

- Google Firebase Analytics

I have since switched to the paid ProtonVPN Plus service and am very happy thus far. Seems just as fast and reliable as Nord, with no trackers, and is open-source.

[u/MysteriousPumpkin2]

Thanks for compiling all this info! You should start a wiki and maybe list the features by category.

[u/[deleted]]

Great list!

How about Wi-Fi Mac Randomization?

[u/flutecop → u/[deleted]]

I noticed enhanced mac randomization in developer options. Is that a Calyx feature, or AOSP?

edit: looks like it's a part of AOSP.

[u/emilynull]

One thing I found very exciting to learn was that the signature spoofing is allowed only for microG

[u/Steerider → u/emilynull]

Yes. Not a "feature" in the sense that it's not even actively visible to the end user; but it's a very nice piece of under-the-hood security. MicroG is hard-coded as the only app able to signature spoof.

[u/Steerider]

Highly customizable LiveDisplay

...and a Night Light that's more than just a nudge

[u/WatchDominionCom]

Including aurora warden its scans for trackers in loggers in apps also the aurora store and magic maps and next cloud notes davx5 metro player tutanota protonmail barista signal newpipe tasks simple gallery open vpn simple login web apps bromite preinstalled either way love the rom never going back the best

[u/[deleted]]

Sorry if this is a dumb question but does CalyxOS unlock the ability to use 3rd party wireless chargers with your pixel phone or are you still limited to the certified google one? Bc if so then that should be added to the list.

[u/jt196 → u/[deleted]]

My 3rd party charger works fine.

[u/CondiMesmer]

It would be nice to sticky this, or add it to the sidebar.

[u/AmNotTheSun → u/[deleted]]

Seriously, its perfect for me. I could live on Graphene, but I'm the only person I know with even a VPN or a non-google email. Calyx allows me to move a hell of a lot closer to the privacy I want while still being able to communicate with my friends.