Is GrapheneOS the most secure OS in the world?

oci3o

K8y Assuming you mean Lockdown mode like iOS, this doesn't exist in GOS, they expose more security settings via the exploit protection options in Settings.
There is a "lockdown" mode via the lock screen, it basically requires you to enter your PIN / Password again, instead of say biometrics.

To note further on this, lockdown mode is not the same as a BFU (Before first unlock), BFU is essentially the most secure the phone can be, lockdown mode keeps the phone in AFU mode.

K8y

oci3o Does Gos have BFU...if not can we add it?

oci3o

K8y Yes GOS has BFU, its before first unlock mode.
To "enable" it, reboot your phone and thats BFU activated.
All BFU is, is the data is still encrypted and at rest, there wont be anything like app data in memory and readable.
AFU can keep things in memory like app data for things like background tasks.

K8y

oci3o is it only if you reboot phone or also if you shut it down and turn on?

Is there a difference between shut down and reboot as far as protection from pegasus type attacks?

23Sha-ger

K8y Is there a difference between shut down and reboot as far as protection from pegasus type attacks?

Pegasus works on the device, while it's unlocked. This is a toolkit to extract data from a powered on device
using local privilege escalation exploits. The attack payload is delivered remotely.
Cellebrite works on both BFU and AFU devices. The attack payload is delivered via USB. They have similar
capabilities of extraction, however Pegasus is targeting iOS, Cellebrite targets all devices except latest iOS
and GOS since the 2022 patch level.

K8y

23Sha-ger is rebooting more effective than shut down then?

23Sha-ger

K8y
This is essentially the same procedure.
A reboot is a shutdown+power on :)
With any of those modes, your device becomes BFU. But as we know from the Cellebrite matrix,
the only Android devices that can't be quickly bruteforced are GOS since 2022.

dhhdjbd

K8y

phone turned on and unlocked
-> power button press / standby
-> it is locked and in AFU (after first unlock)

-> power off / restart / empty battery..
-> it is in BFU (before first unlock) (and locked)
(Until you unlock it, then AFU)

edit: grapheneOS is not "faking" a shutdown like windows does

K8y

dhhdjbd so if our gos phones are in AFU mode/standby, they are still vulnerable to Cellbrite and Pegasus?

userofgos

K8y No, GrapheneOS phones are not vulnerable in AFU.

K8y

userofgos No, GrapheneOS phones are not vulnerable in AFU

so what's the advantage of BFU over AFU?

K8y

userofgos No, GrapheneOS phones are not vulnerable in AFU

so what's the advantage of BFU over AFU?

userofgos

K8y See here for more information: https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation

Glossary:

BFU: Before First Unlock exploitation of OS
BF: Brute Force password after BFU exploitation, which requires bypassing secure element brute force protection if implemented
AFU: After First Unlock exploitation of OS
FFS: Full Filesystem Extraction from an unlocked device

BF capability does not bypass hardware-bound key derivation, so a brute force is still rate limited but no longer has an extremely small number of attempts. Cellebrite Advanced Services may be able to bypass this through extracting data from hardware, but it would be difficult.

BF implies ability to bypass random 6 digit PINs. It does not imply ability to bypass a decent passphrase where hardware-bound key derivation slows them down too much. A truly strong passphrase is safe even if they bypass hardware-bound key derivation and use a huge server farm.

K8y

Xtreix apparently, the only phone to compete, or to have competed, with GrapheneOS on a Google Pixel is the Cryptophone from GSMK

is the OS very good with this alternative, and receives updates as often as GOS?

« Previous Page