How to protect phone from content extraction?

PMUSR

Im reading on internet that phone content cant be extracted in BFU mode but in AFU mode. Is this really true?

Second. What would be the best way to stand against content extraction? I read somewhere that GOS have a feature that it can reboot or shut down itself by set a timer or what it is called?

Third. Does USB cables or chargers have unique "ID"? If yes, then would it be possible to whitelist a specific USB cable or charger and blacklist everything else that is not whitelisted to protect it from extraction?

treequell

PMUSR Im reading on internet that phone content cant be extracted in BFU mode but in AFU mode. Is this really true?

Broadly speaking, yes. Because it's only BFU that the user data is encrypted at rest. Please read https://grapheneos.org/faq#encryption for more information.

PMUSR Second. What would be the best way to stand against content extraction? I read somewhere that GOS have a feature that it can reboot or shut down itself by set a timer or what it is called?

Yes, auto-reboot is a feature on GrapheneOS, which returns the phone to BFU state when left locked. It's documented here https://grapheneos.org/features#auto-reboot, and you can change the time after which auto-reboot occurs here in Settings > Security > Auto-reboot. By default it's set to 72 hours, and can be reduced in intervals down to 10 minutes, or switched off altogether.

PMUSR Third. Does USB cables or chargers have unique "ID"? If yes, then would it be possible to whitelist a specific USB cable or charger and blacklist everything else that is not whitelisted to protect it from extraction?

A USB charger connected is not able to to data transfer unless you switch to USB data transfer in the menu that appears on your device. By default new USB peripherals are disabled when the phone is locked, as documented in https://grapheneos.org/features#attack-surface-reduction. This setting applies to USB data transfer and not to charging, and can be found in Settings > Security. There's no way to prevent a USB cable from charging the device, at least currently on GrapheneOS.

de0u

PMUSR Does USB cables or chargers have unique "ID"? If yes, then would it be possible to whitelist a specific USB cable or charger and blacklist everything else that is not whitelisted to protect it from extraction?

Some USB devices (e.g., storage) can have USB-visible serial numbers, but many do not. Generally speaking, cheaper device types will not.

GrapheneOS

PMUSR

Im reading on internet that phone content cant be extracted in BFU mode but in AFU mode. Is this really true?

Extracting data while a profile is logged in would require exploiting the device. It being theoretically possible doesn't mean that it's easy. This is per-user-profile due to separate keys for each user profile, not global.

Second. What would be the best way to stand against content extraction? I read somewhere that GOS have a feature that it can reboot or shut down itself by set a timer or what it is called?

Use at least a random 6 digit PIN if you're fine with depending on the secure element. Use a strong random passphrase such as 7 diceware words if you want to avoid depending on the hardware security at all. A passphrase such as 4 random diceware words would fall in between where it still depends on the key derivation work factor and hardware-bound key derivation. If you want to entirely avoid the possibility of it being brute forced, you should use 7 random diceware words. There's no reason to use more than 10 (over 128 bit entropy), but even before 10 there aren't real security benefits to making it longer.

Third. Does USB cables or chargers have unique "ID"? If yes, then would it be possible to whitelist a specific USB cable or charger and blacklist everything else that is not whitelisted to protect it from extraction?

GrapheneOS disallows new USB peripherals while locked by default, unless they're connected at boot. Leave the setting at the default.

L8437

treequell By default new USB peripherals are disabled when the phone is locked

Hi with regards to a "new usb device"
Does this mean a brand new device like plugging into a computer that you've never connected to previously?

Or does a new usb device mean connecting a usb device for the first time in that "session"?

PMUSR

Can user profiles that are at rest be extracted on data or is it like it is in BFU mode?

treequell

PMUSR Logging out of a secondary user profile is indeed the equivalent of your owner profile being in BFU, in the sense that the encryption keys are purged and the profile is fully at rest.

GrapheneOS enables support for ending secondary user profile sessions after logging into them. It adds an end session button to the lockscreen and in the global action menu accessed by holding the power button. This fully purges the encryption keys and puts the profiles back at rest.

https://grapheneos.org/faq#:~:text=GrapheneOS%20enables%20support%20for%20ending%20secondary%20user%20profile%20sessions%20after%20logging%20into%20them.%20It%20adds%20an%20end%20session%20button%20to%20the%20lockscreen%20and%20in%20the%20global%20action%20menu%20accessed%20by%20holding%20the%20power%20button.%20This%20fully%20purges%20the%20encryption%20keys%20and%20puts%20the%20profiles%20back%20at%20rest.

GrapheneOS

L8437 Our added feature controls whether new USB peripherals are accepted. Android already doesn't allow the device itself doing anything but charging such as file transfer without authorization requiring unlocking. They're not the same things. Once you've plugged in a device it will continue working while unlocked. It doesn't remember anything about the devices because those IDs can be freely spoofed.

treequell

New, as in, you just plugged it in. If you unplug a USB device, and plug it back in immediately, the USB device is already considered a new USB peripheral.