Tiktaka When they reach EOL, does it mean I should erase everything and never use it?
https://grapheneos.org/faq#legacy-devices
GrapheneOS aims to provide reasonably private and secure devices. It cannot do that once device support code like firmware, kernel and vendor code is no longer actively maintained. Even if the community was prepared to take over maintenance of the open source code and to replace the rest, firmware would present a major issue, and the community has never been active or interested enough in device support to consider attempting this. Unlike many other platforms, GrapheneOS has a much higher minimum standard than simply having devices fully functional, as they also need to provide the expected level of security. It would start to become realistic to provide substantially longer device support once GrapheneOS controls the hardware and firmware via custom hardware manufactured for it. Until then, the lifetime of devices will remain based on manufacturer support. It's also important to keep in mind that phone vendors claiming to provide longer support often aren't actually doing it and some never even ship firmware updates when the hardware is still supported by the vendors...
GrapheneOS also has high standards for the privacy and security properties of the hardware and firmware, and these standards are regularly advancing. The rapid pace of improvement has been slowing down, but each hardware generation still brings major improvements. Over time, the older hardware starts to become a substantial liability and holds back the project. It becomes complex to simply make statements about the security of the project when exceptions for old devices need to be listed out. Our current standards for security based on current generation devices are only applied to new devices rather than ones which used to meet previous standards. Devices remain supported until end-of-life despite no longer meeting our current standards.
What are your security standards? What is your threat model? What information are you keeping on EOL devices? Are you willing to accept the security risks with using EOL devices?
These questions must be taken into account, and the list of questions could go on. I personally wouldn't keep anything personal/private on EOL devices. I might consider EOL devices for an ofline music player, but that will be the extent of it.
https://xcancel.com/GrapheneOS/status/1827525749286322355#m
We need to get people off legacy devices without proper security patches and we need to start doing more than we already do to push people to get fully supported devices. This is more important to us than getting more users and donations from pretending EOL devices are fine.
This GrapheneOS project's stance is not using EOL devices at all, no exceptions.