starbright
what's BFU?
TLDR:
Term meaning phone has not been unlocked since powered On.
Most user's data on phone is protected by very strong encryption, believed to be not possible to decrypt. Most important part of encryption is the key used to encrypt/decrypt, this key is protected by pass code and a second pass code (a token or what ever it's called). Pass code is user based, second pass code is pixel based(contained in phone). When user enters pass code it is combined with second pass code then decryption key is provided that decrypts user's data and it becomes available.
BFU - Before First Unlock - is a term used to describe a phone's state for a period when phone has been powered On, but pass code to unlock it has not been entered. I would also apply it to when the phone is off.
Before First Unlock is considered most secure state of the phone, because most user data on it is heavily encrypted and even if bad guys take a copy of this data to put lives on decrypting attempts they wont succeed. Regardless of pass code complexity. That is assuming phone is a Pixel and BG cant hack or work around the security chip Titan M and are not lucky enough to just guess the pass code. Not to rely on lack of their luck or technical preparedness use a >90 bit entropy pass code.
Then there is AFU - After First Unlock, this starts right upon entering pass code usually a phone is in this state. It is considered a lot more vulnerable to bad guys since in AFU the actual key to encryption of most user data that decrypted the data for phone become usable is kept in phone's memory. AFU state provide an additional option of decryption, no pass code, fuck security chip - they can try extract the key directly from memory and decrypt data..
AFAIK Auto reboot feature makes exploiting AFU hard, since it shrinks the AFU to as low as 10 minutes(default set to 18 hours).
Implementing emory encryption would erase AFU security concern completely, someone more knowledgeable please correct if I'm wrong.
Hopefully we'll get with Graphene own designed phone.