GrapheneOS (@[email protected])
grapheneos.social
We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.

cross-posted from: https://piefed.zip/c/[email protected]/p/1776518/grapheneos-not-supporting-pixel-11s

If GrapheneOS stops supporting future Pixels, and Motorola is only targeting the flagship market for their compatible phones, we’re looking at truly dark days ahead.

  • girsaysdoom@sh.itjust.works
    11·
    1 day ago

    We strongly recommend against buying Pixel 11 devices. Pixel 8, 9 and 10 have much better overall security for GrapheneOS. Pixel 10 is cheaper with similar hardware and MTE. Pixel 11’s Titan M3 should improve BFU security for users without a strong passphrase, but losing MTE craters AFU security.

    BFU - Before First Unlock

    AFU - After First Unlock

    MTE - Hardware memory tagging

    Modern mobile device OS’ are more resilient to attacks if they had been rebooted but haven’t been logged onto yet (before first unlock). GrapheneOS leverages MTE in a way that secures the device even after the first unlock (but with the device on the lock screen). This means that while the new Pixel 11 phones improve the phone’s security when it hasn’t been in recent use it reduces security while it is in use.

    TLDR: new phone has weaker security on lock screen