Security against theft?

DeletedUser499

Nothing will protect you from a stolen, unlocked device.
A stolen locked phone by a street thief, with no access to special tools, iOS or GrapheneOS are the same
A stolen locked phone by a Government agency, GrapheneOS is the best.
A snatched phone with the added complication of looking down the barrel of a weapon and being asked for a password, nothing will work then...

A locked supported current Pixel with GrapheneOS installed, without a password, there's nothing better

MineralWater

In case of someone forces you at gunpoint to unlock your phone, neither GrapheneOS, nor iOS can protect your data.

In case of someone just runs away with your phone, GrapheneOS offers theoretically better protection against having access to the phones data. Like governments etc have huge problems or can't access data with their forensic software.

Both, iOS and GOS full encrypt the phones data when the phone is locked.

iOS offers that you can only reinstall the OS to set it up as new if the iOS account password is known (Find my Phone), so a thief could only sell parts of the phone but it will not be usable as a smartphone.

GOS doesn't offer that, it protects your data, but it doesn't prevent that someone flashes a new OS over it. So in case of theft, the thief could sell a fully usable phone if he installs the firmware again.

But your personal data like banking etc will be safe in both cases.

If I was in a country like yours, I probably wouldn't buy expensive phones like iPhones or Pixels and just buy the cheapest model that allows your used apps to run.

Android does protect your data anyways, Graphene is on a higher level if forensic software is used, something very unlikely to be used by people who rob you on a street.

ElliesSurviving

GrapheneOS has a primary focus of data protection, not anti theft measures, even if your device is stolen your data is safe, which is what matters most

Pocketstar

octubre4
I use a secondary "outdoors" profile with less personal info on it, this way of someone yanks the phone out of my hand when it is unlocked, they do not have access to my main profile that contains more personal information.
Before I leave safe environments, (home etc) I set it to the "outdoors" profile.
At gunpoint you can also unlock the phone and it looks like a normal environment, not much indicates it is actually at a secondary profile.

W1zardK1ng

octubre4
Case 1: Snatch and run.
Use apps like PrivateLock to lock the phone based on the movements and force. (This app didn't got any love in recent time, maybe you can find some other app with same function)
Use FMD to remotely wipe the device.

Case 2: You are at 🔫 point.
There is not much you can do if the attacker knows about you and user profile setups.
Your life is more important than anything else.

Use user profile for all sensitive things like banking /Crypto.
Or even better, use a dummy user profile when you go out. Give the owner/dummy user profile password and escape from there to a safe place and use FMD to wipe the device.

ryrona

Depending on what threat you are actually facing, it can be good to keep most sensitive data at home, eg on an encrypted computer, or on a phone that doesn't or rarely leaves the house. Those can be turned off too when you are not at home.

For example, maybe only access your bank account from the home device, so your on-the-go device doesn't have any access to it, if you are worried about having your account balance checked or money stolen.

simplenot

ryrona I suppose this is the best option. Working phone to carry arround (GOS installed) and a backup device at a secure location that has the banking/crypto apps turned off, except when needed.

Secondary profiles also work but it is good OPSEC not to have financial stuff on the main phone.

ARCemployee

Tbh I agree with the comments that suggest it depends on ur threat level and unlocked phone is generally not considered safe, even installed with GOS. But I think those comments overestimated that kind of threat model u are facing daily.

I don't believe those criminals have that kind of technical skills and equipments to unlock all profiles only with one profile key compromised. Most android users who got robbed off their phones or forced to turn in their passcodes only used one profile with all apps installed. Despite they may use app locks to further secure their daily use apps but this measure becomes useless when the key to unlock ur phone is compromised. I would say that even a non-security dedicated android phone with default OS installed on it can still secure ur app data against given scenario if u use different profiles or private space feature to install ur apps separately. And using grepheneOS can further improve security massively compared with default OS. Especially with only USB charging setting on, they cannot use universal tools dedicated to android system to unlock app locks, control apps automatically sending spams to ur friends and families, crack e-bank apps and steal ur money from ur bank accounts.

For ur question, I strongly recommend u create at least two profiles, and install all of ur apps in a second profile and set different passwords for main profile and turn on USB charging only, lock bootloader, disable USB debugging. If u can tolerate the inconvenience that installing all of ur apps into private space on ur second profile brings, I would further recommend this measure with another different passcode. Or at least install ur bank apps into private space. Once u are forced to unlock ur phone, u only compromise the second profile with only insensitive apps in it. The main profile and private space of the second profile stays locked which means whoever access the phone can't change critical system settings for security features, and sensitive app data or all app data(if u install all apps into private space) stay locked. Unless they somehow apprehend specific tool dedicated to cracking grepheneOS or zero day exploiting profile keys of android system, I don't think they have any chance to leverage ur stolen phone for financial gains.

Pocketstar

ARCemployee Yeah, I totally agree, even with a secondary profile, turning on charging-only is important! This way people cannot easily access GrapheneOS using ADB which may mitigate some exploitation attempts.
To others; I am not a security expert, so it is best to listen to a miltitude of opinions for a broader understanding and by doing some research on the subject.

Pocketstar

octubre4
One more thing;
I would still would recommend only to put the outdoors "mugging" profile as the secondary profile, not the primary one because if people are forcing you to unlock it, they will have the unlock password of the profile that you wish them to open. If that profile happens to be the primary profile, they will then have the codes to some important security settings that are not available on a secondary profile, which includes the USB settings.

Also I recommend to turn off "app installs and updates" on the secondary outdoors "mugging" profile when you are not updating apps on the secondary profile, it will block them from installing malware apps that may eventually compromise the phone further. (You can always enable it temporarily when you need to update apps, it is best to do that at a safe location)
Also I advise to turn off "Allow running in background".
This way it should limit the actions by whomever it trying to break into your device.

Ilgar

Pocketstar so the best is to have:

1 STRONG passphrase + fingerprint to access owner profile empty or with app stores for convenience of installation of apps (I prefer to disconnect vpn with "block connections without vpn" when not in use so it's offline) and disable apps installs and updates to secondary profiles
2 secondary profile that actually main with all apps
3 an outdoors profile for most important maps when outside like maps, camera, etc that you would give passphrase to armed robber when you are scared of lethal scenario
4 you can have 10 other profiles set randomly (maybe with 2 different paraphrases for each 5 of them, for plausible debiability of main profile, so you can say that you forgot passhrase)

and super easy durress passphrase which would be triggered first upon brute–force or you would use to unarmed robber when you are not scared of lethal damage + auto-reboot for 12/18 hours in case of lost device. this way after auto–reboot adversary must successfully brute–force BFU and then... hahaha, guess which of 12 secondary profiles is a actually a target... nice 3FA (BFU>guess of target>secondary profile BFU).

Pocketstar

Ilgar Well, bruteforcing is unlikely due to the limited amount of attempts enabled by the Titan M-2 secure strongbox, which is currently not bypassed or hacked. However, it is always good to have a strong password just in case your device is stolen and the security of the Titan M-2 chip might one day be broken.

Ilgar

Pocketstar yeah, bruteforcing bfu not a trivial thing but getting into secondary profile is double not trivial!

Pocketstar

Ilgar I have also put a small paper with the duress pincode inside of the phone sleeve and the duress pincode written in tiny numbers. This way it seems like I tried to hide that pincode. When people try that pincode, the phone will be wiped. However, it might be a good idea to include an email-alias when people have found the phone and want to give it back, so they can contact you.

Ilgar

Pocketstar

find "add text to lockscreen" and type your second mobile number or email, other way is to to set lockscreen image.

but I like idea of putting little sticker on back of phone behind case with:

unlock: "durress passphrase"
phone: "mobile number"
email: "email address"

Pocketstar

Ilgar find "add text to lockscreen" and type your second mobile number or email, other way is to to set lockscreen image.

but I like idea of putting little sticker on back of phone behind case with:

unlock: "durress passphrase"
phone: "mobile number"
email: "email address"

That is a good idea indeed!
I did not use the lockscreen information feature myself because I can image that even some people having no bad intensions want to try out the duress passcode for a quick look inside of the phone, and when the phone is wiped, they no longer have access to the email alias on the lockscreen, hence the seperate paper/sticker like you suggested is indeed a great idea, it will cover all the info people need to know in order to return the phone to the owner. But indeed, the email alias can also be placed on the lockscreen, perhaps it is a good idea if I do both!

Ilgar

Ilgar find "add text to lockscreen" and type your second mobile number or email, other way is to to set lockscreen image.

but I like idea of putting little sticker on back of phone behind case with:

unlock: "durress passphrase"
phone: "mobile number"
email: "email address"

I have second number in text on lockscreen, but the idea to put durress pass with contact details in case is perfect combination. I'll put that sticker too. This concept fits me as I consider gos device as a lite client to my always up to date encrypted flash drive backup.

Ilgar

simplenot Secondary profiles also work but it is good OPSEC not to have financial stuff on the main phone.

definetly, secondary device in bfu, in metal safe, for sensitive transactions is obviously the best OpSec.

raccoondad

Recommended concept for duress password:

Keep a note saying your duress pin in the phones case, maybe write 'password' or something.

They type it in, it wipes, win.

grayway2

raccoondad the best anti-theft measure. I think 99℅ of thieves will not resist to type it in.

Also useful during a border search. I don't think that every border agent knows about GrapheneOS and the existence of a Duress PIN. You device don't directly end up in the hand of a digital forensic analyst.

I'm wondering if they can press charges on you if you remain silent during the search and the agent type the passcode himself.