Any security concerns on second hand phones?

JeffBu

It's clear the graphene installer wipes spyware from the application level down through the kernel, including even google play services, but what about firmware?

Does graphene reflash the radio, etc? Is there someone else one should do about resetting those firmwares?

You should always factory reset a second hand phone when used without graphene, but this presumably holds when installing graphene too? Would this get everything?

Novalissoide

JeffBu Factory reset after installing GrapheneOS is a good practice imo.

Johnnyloans

JeffBu

There's more than 1 method to verify that your system is A-okay.
https://grapheneos.org/install/web#verifying-installation

This doesn't verify apps that you install afterwards.

de0u

JeffBu It's clear the graphene installer wipes spyware from the application level down through the kernel, including even google play services [...]

GrapheneOS enables users to choose whether or not to install Google Play, which is a great feature of GrapheneOS. But please note that the GrapheneOS team spends substantial time and effort supporting users being able to run Google Play on GrapheneOS inside the Android app sandbox, including supporting an convenient installation process. That effort is not consistent with the development team regarding Google Play as "spyware".

JeffBu [...] but what about firmware? Does graphene reflash the radio, etc?

Yes. This is documented in the "Prerequisites" section of the installation guide.

Note that if the bootloader is locked the boot process verifies the integrity of the firmware at every boot, so it is unlikely that devices are running malicious firmware.

JeffBu

Johnnyloans Ahh okay, so one the boot loader is relocked, then verified boot should kick in? And only google plus the NSA have the required signing key. ;)

ClickClickDrone

JeffBu
Correct; you'll be as secure as you possibly can be :)

Johnnyloans

JeffBu And only google plus the NSA have the required signing key. ;)

The key is private, secret information and is required to create GOS updates. Only GOS can create updates.

The key hash is public info to verify if GOS is running untainted.

nandohyphen1

You can also use Auditor to verify your running GrapheneOS. Note you'll have to verify it TWICE the first time. The first verification will be orange - this is NORMAL. Do a second verification and it should be green