More than a decade after launching in Europe, the Netherlands company is now selling its repairable phones in the US, starting with the Fairphone (Gen 6+).
It’s also missing hardware accelerated virtualization which is necessary for much of GrapheneOS’s sandboxing, has weak security for other keys in the OS keystore, is missing hardware memory tagging which makes it much easier for apps to use overflow attacks, doesn’t have proper verified boot support once a custom alternative OS is flashed, and leaves exposed debugging APIs even when the phone is locked.
This breaks:
Secure app spawning
Memory corruption protection
Integer overflow protection
Most of Graphene’s kernel hardening
Much of Graphene’s attack surface reduction abilities
Hardware-based attestation and security monitoring
Quick tile protection pre-unlock
Debugging access prevention
Verified Boot
The security of your PIN against any automated attack
At that point, GrapheneOS can’t physically provide you essentially any security anymore.
not any, but some benefits, and GrapheneOS maintainers are perfectionists
Entirely lacking disk encryption for typical users due to not having a secure element is a pretty major flaw.
It’s also missing hardware accelerated virtualization which is necessary for much of GrapheneOS’s sandboxing, has weak security for other keys in the OS keystore, is missing hardware memory tagging which makes it much easier for apps to use overflow attacks, doesn’t have proper verified boot support once a custom alternative OS is flashed, and leaves exposed debugging APIs even when the phone is locked.
This breaks:
At that point, GrapheneOS can’t physically provide you essentially any security anymore.