TLDR: GraphenOS is still secure, the last time they were able to exploit it in after first unlock was in 2022, which is the same, they reported in the last leaked docs were in 2024, if I remember correctly.
It's funny that they supposedly can't do full file system when unlocked.
Although with how fast things are moving, I would still recommend anyone that has law enforcement their threat model to use a 6 word or longer random passphrase for their primary unlock.
These docs show that if you have basically any other Android phone, then a long randomly generated passphrase and turning the phone off so it's in BFU before it was seized would be essential to prevent access. Because they can all be extracted and brute forced, due to missing a secure element or it being exploited.
It's a nice usability improvement for people worried about physical security for phones to have effective protections even in afu.
TLDR: GraphenOS is still secure, the last time they were able to exploit it in after first unlock was in 2022, which is the same, they reported in the last leaked docs were in 2024, if I remember correctly.
It's funny that they supposedly can't do full file system when unlocked.
Although with how fast things are moving, I would still recommend anyone that has law enforcement their threat model to use a 6 word or longer random passphrase for their primary unlock.
These docs show that if you have basically any other Android phone, then a long randomly generated passphrase and turning the phone off so it's in BFU before it was seized would be essential to prevent access. Because they can all be extracted and brute forced, due to missing a secure element or it being exploited.
It's a nice usability improvement for people worried about physical security for phones to have effective protections even in afu.