Acquiring Data of the Deceased

Don’t use a six-digit PIN if you don't want it breached.

Blastoidea But I've learned that a six digit pin is best to use for taking full advantage of the security module of the Pixel.

[deleted]
Do you have a reference for that statement?

Blastoidea I do not have a reference to the statement, but I learned it a while back in the Element chatroom from the head of GrapheneOS that a six-digit pin fully utilizes the security module and that the security module enforces delays for incorrect pin entry attempts. More about those delays can be read here https://grapheneos.org/faq#encryption

[deleted] a 20 letters/numbers password is much secure than a 6 digits password ;)

If one wants to depend on secure element, a 6 digit PIN is secure. If one does not, a 7 word diceware passphrase is secure.

Furthermore, things like the auto reboot feature can be utilized to put the phone back at rest and encrypt its data, as well as the "end session" feature for secondary user profiles, which also puts that specific profile at rest.

I remain unconvinced that a six-digit PIN is sufficient in any practical sense.

Blastoidea I recommend reading through https://grapheneos.org/faq#encryption in case you haven't already.

A 6 digit PIN doesn't really provide meaningful protection in cases where the phone doesn't have a proper secure element, but Pixels do. The secure element throttles attempts to unlock the phone:

Standard delays for encryption key derivation enforced by the secure element:

0 to 4 failed attempts: no delay
5 failed attempts: 30 second delay
6 to 9 failed attempts: no delay
10 to 29 failed attempts: 30 second delay
30 to 139 failed attempts: 30 × 2⌊(n - 30) ÷ 10⌋ where n is the number of failed attempts. This means the delay doubles after every 10 attempts. There's a 30 second delay after 30 failed attempts, 60s after 40, 120s after 50, 240s after 60, 480s after 70, 960s after 80, 1920s after 90, 3840s after 100, 7680s after 110, 15360s after 120 and 30720s after 130
140 or more failed attempts: 86400 second delay (1 day)

If you don't want to rely on the secure element, you can go for something like a 7 word diceware passphrase instead, but for most people, a random (and this is important) 6 digit PIN is sufficient.

matchboxbananasynergy A 6 digit PIN doesn't really provide meaningful protection in cases where the phone doesn't have a proper secure element, but Pixels do.

Did the Pixel 4a not have a secure element? And that's how they were able to bypass the PIN?

Could it have been exploited using that SIM PUC vulnerability (patched on GOS)?

Graphite The Pixel 4a sure does. I don't know about the particulars of OP's situation. It is perfectly possible that like @f13a-6c3a said, the phone might have been out of date, and the lockscreen bypass was not fixed, and thus they were able to use that. That would require the phone to have been unlocked at least once after a reboot though.

Beyond that, one can only guess. Not enough info.