Is GrapheneOS the most secure OS in the world?

dhhdjbd

phone turned on and unlocked
-> power button press / standby
-> it is locked and in AFU (after first unlock)

-> power off / restart / empty battery..
-> it is in BFU (before first unlock) (and locked)
(Until you unlock it, then AFU)

edit: grapheneOS is not "faking" a shutdown like windows does

K8y

dhhdjbd so if our gos phones are in AFU mode/standby, they are still vulnerable to Cellbrite and Pegasus?

userofgos

K8y No, GrapheneOS phones are not vulnerable in AFU.

K8y

userofgos No, GrapheneOS phones are not vulnerable in AFU

so what's the advantage of BFU over AFU?

K8y

userofgos No, GrapheneOS phones are not vulnerable in AFU

so what's the advantage of BFU over AFU?

userofgos

K8y See here for more information: https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation

Glossary:

BFU: Before First Unlock exploitation of OS
BF: Brute Force password after BFU exploitation, which requires bypassing secure element brute force protection if implemented
AFU: After First Unlock exploitation of OS
FFS: Full Filesystem Extraction from an unlocked device

BF capability does not bypass hardware-bound key derivation, so a brute force is still rate limited but no longer has an extremely small number of attempts. Cellebrite Advanced Services may be able to bypass this through extracting data from hardware, but it would be difficult.

BF implies ability to bypass random 6 digit PINs. It does not imply ability to bypass a decent passphrase where hardware-bound key derivation slows them down too much. A truly strong passphrase is safe even if they bypass hardware-bound key derivation and use a huge server farm.

K8y

Xtreix apparently, the only phone to compete, or to have competed, with GrapheneOS on a Google Pixel is the Cryptophone from GSMK

is the OS very good with this alternative, and receives updates as often as GOS?

« Previous Page