Pixel 6 Stolen with GrapheneOS: What to Do? + Next Device Recommendations

KrisprCas9

Note: English is not my native language, so I used a translation tool to help write this post clearly. Please let me know if anything needs clarification!

Hey GrapheneOS community,

My Pixel 6 running GrapheneOS was recently stolen. So far, I haven’t noticed any suspicious activity on my accounts (Google, banking, WhatsApp, etc.), so it seems the thief hasn’t managed to access the device. Huge thanks to GrapheneOS for that extra layer of security! 😎

I was using an eSIM (plus a nano-SIM that came with the phone), but I can’t track it via Google Find My Device—it shows as “Not available.” My guess is they’re using a Faraday bag or forced a shutdown (power + volume up). I thought the eSIM would allow offline tracking, but it hasn’t worked. Does anyone know if the eSIM on a Pixel 6 should enable tracking in this scenario? Or is this a hardware/software limitation?

Crazy idea: Would it be possible to have remote SSH access in GrapheneOS to send commands to the device (e.g., force a sound, lock it, or wipe data) from my PC? I know it sounds sci-fi, but given how robust GrapheneOS is, is there anything like this or plans for it?

What I’m looking for now:

What to do with the stolen Pixel 6: I’ve already reported it to the police with clear footage of the thief (face visible) and blocked the IMEI with my carrier. Any extra tips to secure data or track it if it’s powered on? Are there GrapheneOS features I can leverage here?

Next device recommendations: I want to stick with GrapheneOS for its privacy and security. I’m eyeing the Pixel 9a (seems compact and efficient), but I’m open to suggestions. What’s the best device for GrapheneOS in 2025? Any thoughts on the “conflict” between Google and GrapheneOS (Google pushing control vs Graphene’s open-source philosophy)?

Post-theft cybersecurity: No unauthorized access so far, but what else should I check to be 100% sure?

Feel free to ask about my setup or the theft—I’ll reply quickly. Thanks for any advice or ideas!

GrapheneOS

KrisprCas9 They're going to be able to wipe your device and use it as a fresh device. There's nothing you can do about it. GrapheneOS doesn't provide an anti-theft feature for making it a brick. If you didn't have SIM PINs configured, they can use your SIMs, so you should deal with that.

I was using an eSIM (plus a nano-SIM that came with the phone), but I can’t track it via Google Find My Device—it shows as “Not available.” My guess is they’re using a Faraday bag or forced a shutdown (power + volume up). I thought the eSIM would allow offline tracking, but it hasn’t worked. Does anyone know if the eSIM on a Pixel 6 should enable tracking in this scenario? Or is this a hardware/software limitation?

There's no offline tracking via cellular. If they're in airplane mode or powered off, cellular is off. The only way to do that is via a stock OS feature for setting up a Bluetooth beacon which is kept active when otherwise powered off.

Crazy idea: Would it be possible to have remote SSH access in GrapheneOS to send commands to the device (e.g., force a sound, lock it, or wipe data) from my PC? I know it sounds sci-fi, but given how robust GrapheneOS is, is there anything like this or plans for it?

People can set up apps for remote access but it's a significant attack vector especially without end-to-end encryption. We don't recommend using remote management apps in the form they currently exist. It's often not going to accomplish anything since the phone can be off from networks by turning it off. It can also be wiped, and we don't tie devices to an account stored in the FRP data area to require logging into an account before the setup wizard can be completed. Apple and Google rely on account recovery including via customer support to avoid this bricking devices.

What to do with the stolen Pixel 6: I’ve already reported it to the police with clear footage of the thief (face visible) and blocked the IMEI with my carrier. Any extra tips to secure data or track it if it’s powered on? Are there GrapheneOS features I can leverage here?

Your data is safe unless you set a horrible lock method someone can guess in a small number of attempts. Beyond that, you didn't set up anything you could use to find it and it likely wouldn't help since it's probably turned off and potentially wiped already. The only feature which could help is the Bluetooth beacon one which can work when powered off, although wiping the device might stop that working anyway, and even if it doesn't that would depend on having account-based anti-theft integrated.

Next device recommendations: I want to stick with GrapheneOS for its privacy and security. I’m eyeing the Pixel 9a (seems compact and efficient), but I’m open to suggestions. What’s the best device for GrapheneOS in 2025? Any thoughts on the “conflict” between Google and GrapheneOS (Google pushing control vs Graphene’s open-source philosophy)?

The flagship 9th gen Pixels are currently the best devices. 8th gen Pixels or the Pixel 9a are close behind. It's worth noting the Pixel 9a has a similar cellular radio to 8th gen Pixels which is a lot less efficient. The larger battery in the Pixel 9a likely still results in worse battery life than a Pixel 9, although likely still significantly better than 8th gen due to the much more efficient SoC.

Post-theft cybersecurity: No unauthorized access so far, but what else should I check to be 100% sure?

If you have at least a random 6 digit PIN, this is really not an issue. They're not going to get any of your data. GrapheneOS has very strong security and the 18 hour default locked device auto-reboot timer will kick in and get data at rest. The secure element throttling prevents and OS exploit from being used to brute force a PIN/password.

Fay_Wilmont

KrisprCas9 Huge thanks to GrapheneOS for that extra layer of security! 😎

What extra layer of GrapheneOS-specific security did you use? Do you think the thief could've unlocked your phone without it?

I thought the eSIM would allow offline tracking

I'm confused... how would this work? Why did you think it would?

Crazy idea: Would it be possible to have remote SSH access in GrapheneOS to send commands to the device (e.g., force a sound, lock it, or wipe data) from my PC? I know it sounds sci-fi

I don't understand why you think it sounds sci-fi. About every smartphone sold nowadays comes with this functionality out-of-the-box. Google's Find My Device, which you mentioned using, is one example. Am I misunderstanding what you're asking for? Are you looking for a self-hosted solution maybe?

neotux

GrapheneOS at least a random 6 digit PIN,

Would you recommend a combination of fingerprint plus a 2nd factor pin as a strong mitigation for such a scenario?

vactorio

GrapheneOS The larger battery in the Pixel 9a likely still results in worse battery life than a Pixel 9,

Perhaps just the following regarding battery life, for your purchasing decision: @KrisprCas9

The German consumer protection organization “Stiftung Warentest” tested battery life, among other things, finding that the “operating time with regular use approx. (comparable brightness)” for the Pixel 9a is 40 hours and for the Pixel 9 is 28:30 hours.

The result was determined under the following conditions:
"Using an industrial robot, we run each device through the following usage scenario once at maximum adjustable screen brightness and once at a brightness of 300 candelas per square meter until the battery is empty and the phone turns off: Play a YouTube video via Wi-Fi for 7.5 minutes per hour, navigate via GPS for 1.25 minutes, make phone calls for 2.5 minutes, take five photos, receive two notifications. The device remains on standby for the rest of the time (Wi-Fi and GPS on, Bluetooth off). We evaluate the resulting operating times."

But of course, if you mainly use mobile data, the results may be quite different.

GrapheneOS

neotux Fingerprint unlock is only for secondary unlock. 2nd factor PIN is to make it more secure as a secondary unlock method so it can be used with a strong passphrase for convenience without having biometric-only unlock. There are only 5 attempts for secondary unlock, it can't be used for the main key derivation process (i.e. doesn't work for first unlock) and times out (48 hours form last primary unlock). If you use a random 6 digit PIN for primary unlock there's not much reason to use 2-factor unlock. 2-factor unlock is meant for use alongside a strong passphrase such as 6-8 diceware words if you don't want to depend on secure element throttling for encryption security. Biometric unlock is not suitable for primary unlock and that's not going to change.

neotux

GrapheneOS

Thank you so much for the explanation! I do have a 6 digit which to other people might seem as random.

Then as a secondary unlock, I have fingerprint plus a 4 digit pin. If I've not misunderstood you, the pin here doesn't make any sense then?

de0u

neotux That depends on jurisdiction. In some places the authorities can compel a fingerprint but not entering a password.

phone-company

neotux You should think of your fingerprint as your username, not as your password, so a PIN with at least 6 characters as a second factor makes perfect sense. Biometric locks are never secure because they are visible and may also be accessible.

neotux

phone-company @de0u
Thanks for replies! I appreciate it. It seems that no precautions are too much!
And I never thought of fingerprints as usernames. That makes sense. Thanks for sharing the perspective!

IDtheTarget

phone-company

"You should think of a fingerprint as your username"

Good point, easy way to describe biometris to laypeople. I understand that this technology is being commercially developed:

Scientists Extract Fingerprints from photos

phone-company

IDtheTarget already done CCC takes fingerprints from "von der Leyen " from a picture years ago as i remember :) and from "Angela Merkel" they could take an Irisscan from a picture