https://www.devilreef.net/securing-a-personal-android-phone/
It's been far too long since I've made time to sit down and write. I recently went through the ritual of swapping phones, so I will use the opportunity to jot some notes down. I keep separate devices for work and personal usage. For the last several years, my personal
"securing a Google Pixel Phone" would be a more appropriate headline.
anyone without a pixel, this guide will do nothing for you.
https://grapheneos.org/faq#future-devices
Hardware, firmware and software specific to devices like drivers play a huge role in the overall security of a device. The goal of the project is not to slightly improve some aspects of insecure devices and supporting a broad set of devices would be directly counter to the values of the project. A lot of the low-level work also ends up being fairly tied to the hardware.
TLDR - Google open bootloader, able to relock the bootloader with custom keys, AOSP, hardware binaries freely accessible, as well as the hardware security features on pixel phones.
Selected Items
Support for using alternate operating systems including full hardware security functionality
Complete monthly Android Security Bulletin patches without any regular delays longer than a week
Vendor code updated to new monthly, quarterly and yearly releases of AOSP within several months to provide new security improvements (Pixels receive these in the month they're released)
Isolated radios (cellular, Wi-Fi, Bluetooth, NFC, etc.), GPU, SSD, media encode / decode, image processor and other components
....
Is google pixel the only group capable of making a secure phone? No, anyone could do it, but only google pixel IS doing it.