Replying to an earlier post

Entirely lacking disk encryption for typical users due to not having a secure element is a pretty major flaw.

It’s also missing hardware accelerated virtualization which is necessary for much of GrapheneOS’s sandboxing, has weak security for other keys in the OS keystore, is missing hardware memory tagging which makes it much easier for apps to use overflow attacks, doesn’t have proper verified boot support once a custom alternative OS is flashed, and leaves exposed debugging APIs even when the phone is locked.

This breaks:

  • Secure app spawning
  • Memory corruption protection
  • Integer overflow protection
  • Most of Graphene’s kernel hardening
  • Much of Graphene’s attack surface reduction abilities
  • Hardware-based attestation and security monitoring
  • Quick tile protection pre-unlock
  • Debugging access prevention
  • Verified Boot
  • The security of your PIN against any automated attack

At that point, GrapheneOS can’t physically provide you essentially any security anymore.