Anti-theft protection?

ChemicalWonka1

Does GrapheneOS have any plans to implement any mechanism to make the use of the device unfeasible in case of theft?

ignatius

ChemicalWonka1 I've seen conversations that the GrapheneOS account was involved in that basically says it is unfeasible because it would require keeping a server, database, and persistent ID for GrapheneOS devices, as well as implementing the ability to soft brick the device OTA. This is obviously undesirable.

However, there are apps that will reboot your phone (putting it into BFU state) upon sudden movement using the sensors in your phone. This will protect your data in the event your phone gets snatched but will not prevent someone from wiping your device with ADB and selling your phone.

ChemicalWonka1

ignatius I'm talking about something embedded in the firmware so that the one who stole the device can't reset and use it again

stick4611

ignatius
One way to achieve this securely, would be to make it a self hostbale service. So everyone that wants anti theft, track and brick on-demand would need to host the required service by themself.

Eirikr70

You can install FindMyDevice, in order to follow the tracks of your phone if it is stolen.

ChemicalWonka1

Eirikr70 I'm not talking about tracking the device but something that makes it unusable by the thief, some seed, password, something that only the owner has the ability to bring the device back, something incorporated directly into the firmware

Oggyo

https://github.com/GrapheneOS/os-issue-tracker/issues/4557

Open_Source_Enjoyer

ChemicalWonka1 I'm talking about something embedded in the firmware so that the one who stole the device can't reset and use it again

I think this would be very hard because it need to be implemented on a very low code level, and I am not sure if is it possible to implement this without the risks of triggering this by a software bug and unessary brick devices.

KleinesSinchen

Please not.
I never got the appeal of Factory Reset Protection in the first place. What advantage does one get by the "peace of mind" that the thief can't use a stolen phone? It does not bring the device back. A tracking function might, but the "bricked until providing credentials" helps nobody.
More often than not FRP on stock systems could (or maybe still can?) be circumvented on many phones/tablets making it useless for the intended purpose as organized criminals will have access to any tools allowing FRP bypass.
The only thing accomplished by this kind of lock are countless devices prematurely scrapped because legitimate owners are unable to remember anything about their Google credentials (and possible paid manufacturer methods to unlock with proof of ownership often exceed the value of old devices). Just look up the topic. I doubt all of those seeking help in getting rid of FRP on an old, almost worthless phones are stupid thieves asking the internet how to make their stolen goods operable.

If GOS implements FRP there will be bricked Pixels.

As for the ever repeated argument of theft deterrent ("they won't steal phones anymore if they know they can't use/sell them")… well… if this is really the case (I highly doubt it), the same goes for a GOS phone. Unless the thief knows you are using a third-party operating system and they know FRP is not a hurdle in this specific case, the deterrent is still in effect.

natoal

KleinesSinchen

it does seem pointless and isn't exactly a security feature since your data is protected anyway

Actually, if the phone isn't reset by a thief the key and token will remain which technically means a thief could access the data years later with some old exploit? Might be wrong though

lynatic

FRP only serves as a deterrent on large scale (like Find My iPhone just icloud locking every stolen iPhone). And even with FMI, iPhones get stolen regularly. Regarding FRP, it is even less of an deterrent than FMI because

FRP is bypassed so easily for most Android phones that thieves don't care and
even if FRP wasn't bypassable in a lot of cases, a thief still had to recognize that the phone is a Pixel and that it's running GrapheneOS in order for this to even have an effect.

area51

I don't think that any of this is relevant to the person who steals phones.

They don't give a damn if it has this or that app installed or whether its a titan M2 chip or its BFU or AFU.
That glass brick in your hand, you are looking into and are unaware of whats happening around you, is just currency, pure and simple. Its an object to trade for a few dollars/euros, so they can buy a burger or whatever.
Within hours your precious phone is just a pile of parts, ready for resale on eBay. Anything traceable is binned.
Just because you know you have x,y,z installed does not mean a thief on a Lime bike will avoid stealing your device.
Even they know about Faraday bags.

My phone has a 14 digit pin, and auto reboot at 30 minutes, so if it is stolen, my contacts in my phone are given the same level of protection I give myself, its lost. Move on. I was careful enough to buy a cheap phone I could afford to drop, submerge, loose or even have it snached the IMEI is registered online, maybe it will lead to a conviction, who knows..

ryrona

Oh, I intended to answer this thread a few days ago, but forgot. I see @KleinesSinchen has already kind of said what I wanted to say.

It does not matter much if GrapheneOS would implement Factory Reset Protection, because GrapheneOS is such rarely used, and almost all Pixel devices will come with Google stock OS. The thief will not know what OS you are running. So it is Google that will have to implement Factory Reset Protection in order to cause Pixel phones to become less attractive targets for thieves, because only if Google does that will it have any effect on deterring thieves. Google has done that somewhat recently. This means GrapheneOS also gets the protection by extension, because now Pixel devices are less attractive targets. Unless the thief is able to tell at a glance the phone is running GrapheneOS, and actually know about GrapheneOS, both of which are highly unlikely.

Simply setting a wallpaper will remove almost all of the stereotypical GrapheneOS look from the device. So as it is, simply setting a wallpaper will act as strongly to deter thieves as if GrapheneOS would implement FRP. Because it would look like a regular Google Pixel device running stock OS and they have FRP.