7 - It's in the Settings application of the phone. VPN > [Your VPN] > Block connections without VPN .

4 settings, apps, exploit protection compatibility

7 is not normal

6 read the gos faq it's good info

5 here sandbox just means not privileged, and all apps except Google apps are used to running without privilage. You have three independent spaces on your main interface: owner, work, private you can put apps with different VPNs, google services into each. You have more with account switch, but it's more work

3 depends on what you do with your internet and your threat model, if you have a always on vpn wifi anywhere isn't a threat

2 depends on your threat model: google will give you the most official packages and good chain of custody. You can just use Google play in one account /space copy the app to another space, and let play update it

1 depend on your threat model - reproducible builds where the code is signed by the developer but froid verifies the source used to build the code is the gold standard

3 - I don't do it without a VPN. Some places block VPN (happened to me in a hotel), in that case I don't use Wi-Fi.

4 - I found I had to give WhatsApp basically every permission it wanted to restore the backup, after restoring I could then revoke them again

F-Droid is great.

Aurora is more effort than Google Play, but I find Aurora so much more honest about tracking technologies in each app.

Regarding sandboxing, I think so, but installing an app on GrapheneOS is already so much better than on any other operating system.

I just install apps normally and don't give them any permission I don't feel like they need.

If I realize why an app needs some permission, later - I can adjust the permissions and try again.

2: I have a separate user for closed source apps, and created a new Google account on the sandboxed google play store. Anonymous enough for me.

I don't know the answers to most of these because I've only been using graphene for a few days but here's my supposition:

1. I prefer droidify to obtainium or f-droid. Neither is more safe than another.
2. I didn't know about aurora. Thankyou. My supposition is that for apps that don't use any google apis at all, using aurora means google won't know you have that app. For apps that use google's api in any way, it would be the same as installing with the play store.
3. I don't really understand this question. What constitutes a "risk" is very specific to you and your concerns, your own threat model. I will say though, you can absolutely configure something like wireguard to use different connections for different destinations. For example, on my android phone I've used a wireguard connection for my private server and everything else is not tunneled.
4. I've had trouble with whatsapp. I think I lost my chat history, but I don't really care.
5. IDK.
6. IDK.
7. No, not normal.

4 . I had the same problem; direct transfer didn't work either, even with "exploit protection compatibility" enabled.

What worked for me was to copy the backup folder from the old (Android) phone to the new one (GrapheneOS), respecting the same directory structure:

Android/data/com.whatsapp

Welcome to this great OS!