GrapheneOS protections against data extraction from locked devices
5 hours ago
- GrapheneOS builds on Android 17 security and requires Pixel hardware for now, with Motorola partnership expected in 2027.
- Disk encryption is robust; attackers must exploit OS after first unlock or brute-force PIN, with secure element enforcing strict rate limiting (20 attempts, escalating delays).
- Insider attack resistance prevents firmware update bypass of rate limiting by requiring owner authentication for secure element updates.
- GrapheneOS raises password limit to 128 characters for high-entropy passphrases independent of rate limiting.
- Optional 2nd factor fingerprint PIN reduces fingerprint attempts to 5 and requires a short PIN after fingerprint for unlock.
- Exploit protections include hardened memory allocators and hardware memory tagging (MTE) to block attacks.
- Physical attack defenses block USB connections when locked and disable USB data after disconnection.
- Auto-reboot timer (10 min to 72h, default 18h) returns device to Before First Unlock state with memory zeroing.
- Supports secondary user and Private Space end session to revert to Before First Unlock without reboot.
- Duress PIN/password wipes device immediately when entered in any PIN/password prompt, including secondary users and Private Spaces.