AmbitiousProcess (they/them)

all android devices have been using file based disk encryption since several Android versions now.

All Android devices are supposed to support it, but not all do. (or at least, not all do effectively without compromising the cryptographic root of trust by not implementing proper hardware security chips)

I’ll grant it to you on the scopes, PIN changes, etc, but realistically I just don’t think anyone can justify GrapheneOS being something that should be supported on Fairphone given how absolutely desolate the phone looks with regard to any attempt at all to hardware security.

It really depends on what security level you want out of a phone

It does, but that’s exactly my point. GrapheneOS will provide you essentially no more security than any other alternative Android operating system, should it have to operate on a Fairphone with all those features not supported by a Fairphone stripped away.

Unless Fairphone adds more hardware security features that are standard on most other phones, and highly supported on Pixels, installing a heavily crippled GrapheneOS on a Fairphone would get you essentially none of the benefits of GrapheneOS in the first place.

Entirely lacking disk encryption for typical users due to not having a secure element is a pretty major flaw.

It’s also missing hardware accelerated virtualization which is necessary for much of GrapheneOS’s sandboxing, has weak security for other keys in the OS keystore, is missing hardware memory tagging which makes it much easier for apps to use overflow attacks, doesn’t have proper verified boot support once a custom alternative OS is flashed, and leaves exposed debugging APIs even when the phone is locked.

This breaks:

• Secure app spawning
• Memory corruption protection
• Integer overflow protection
• Most of Graphene’s kernel hardening
• Much of Graphene’s attack surface reduction abilities
• Hardware-based attestation and security monitoring
• Quick tile protection pre-unlock
• Debugging access prevention
• Verified Boot
• The security of your PIN against any automated attack

At that point, GrapheneOS can’t physically provide you essentially any security anymore.

It wasn’t just the update cycle either, it’s that they don’t have the physical hardware chips to support Graphene’s minimum requirements for security, which would severely weaken any benefits you actually get from GrapheneOS.

Especially given it has a similar effect to how spam emails are often deliberately bad so they just don’t waste their time with people that waste some of their time before wising up. If you only get the most easily duped people in the first place, that’s a lot less time wasted.

With LLMs, you’re explicitly targeting people that are less likely to strongly ideologically object to things (like LLMs, or genocide funding) on moral grounds, you’re getting the people that are willing to just get a quick answer without having to look into it deeply, and you’re getting the people who’s sole goal it is to flood the web with any SEO-optimized slop they can with the least effort possible.

LLMs self select for people not willing to put in cognitive effort, that are easily influenced and less careful about fact-checking things.