Apologies If I can't list specific 3rd Android OS here. I know you can't on some reddit privacy subs due to some beef between devs I guess. I'll take down if needed :)

Wut?

Meaning: what kind of privacy community bans discussion on free and open privacy because of a dev? That's ridiculous. Exchange of money, sure, but discussion?

Been using it for a while and it's great.

Next up: auto wipe device after x days of no authentication.

I am wondering why GrapheneOS don't implement biometric BUT only with 2FA , for example: use finger and then a Android ask for specific password/pin to unlock device, this would let people use biometric with pass and don't worry about forcing by law enforcment or other

If you're concerned about these kind of things, you might want to know about the GrapheneOS duress password. You set a second PIN, called duress PIN/password. If you're ever forced to type a PIN, you can type this one instead of the real one. It will lock/wipe out the phone within a few seconds. There's a few youtube videos showcasing this self-destruct mode.

So I'm still on stock android on a pixel and there is no option for just pin? Maybe I have to remove fingerprint from the phone first but there is basically a serious backdoor built in. How many people will be able to turn there phone off under duress?

Yooo ive been wanting this for years. They should totally bring back pattern unlock for this.

In addition to this

• require pin to unlock, but fingerprints for apps

GOS has a nice feature

• require two factors to unlock, pin PLUS biometrics
• duress pin, wipe phone if used
• reboot phone if not unlocked in x hours

Of course it also has the standard AOSP mode

• private spaces, hide apps unless unlocked

Which is different than the

• workspaces, can use different biometrics

And if your very paranoid GOS supports many user profiles, which can all have their own distinct biometrics and pins, this works with their cross profile notification system. So you can keep your banking apps in a totally different profile and if you get mugged they won't see the apps (or you could use private spaces as well)

Most Android versions have this now. Became popular as soon as SCOTUS ruled that police can compel you to unlock your device via biometrics. Enable it. If you think you may be arrested, simply restart your phone and now they need a court order to unlock your phone which means they have to convince a judge with probable cause.

There's an old app on FDroid called AdminControl that let's you set this up on other ROMs. Basically just disables biometrics for lock screen.

Thanks for sharing, this is indeed a great feature and makes GOS even stronger! Just enabled and love it!

For the home screen, I keep the regular PIN, so I have to type instead of using fingertips. But for apps that requires authentication (after you are already logged in), it's really convenient use fingertips instead of the pin for convenience.

FYI, for folks currently using a normal PIN and looking to use this, it's intended that the 2nd factor PIN at least be different than the main unlock PIN. Otherwise you can just swipe up to dismiss the fingerprint prompt and get to the main PIN prompt; if its the same as your 2nd factor, that's pointless.

I was told on the Graphene matrix channel that the most secure configuration for this is:

Main unlock method: 6 word diceware password

Secondary unlock method: biometric + 6 character 2nd factor PIN

Be aware that if you use this config that you will be prompted for the main unlock method (long password) at reboot, and also every 48 hours.

Related:

Download Wasted (https://f-droid.org/en/packages/me.lucky.wasted/) - You can set your phone to auto-wipe after X amount of time without being unlocked, and also various other triggers for wipe, like creating a fake "Signal" or "Telegram" icons on your homescreen that would trigger a wipe if tapped, or a fake "Airplane mode" tile that would trigger a wipe. Very useful stuff. (Might wanna learn the laws in your jurisdiction tho, could get you in trouble.

There's also Duress (https://f-droid.org/en/packages/me.lucky.duress/) which doesn't work on my Samsung, but it worked on a Motorola that I once has. It sets up either a fake pin (aka: duress pin), and the duress pin can also be to just enter X characters, where X is at least 2 chracters more than your real password (example: if your pin is "2025", all you have to say is any string of 6 characters or more like "123456" and the wipe will happen, very useful since you probably won't remember a specific duress pin under stress)

I need to use pattern after restart. I can restart my phone pretty quickly if needed.

Ha, I found this the other day and thought it was neat... And turned it off after 30 minutes.