We fully preserve the privacy/security model and then substantially improve it. We use all of the same hardware-based security features as the stock Pixel OS but also a lot more including MTE (hardware memory tagging), PAC/BTI for userspace too, hardware-level disabling of new USB connections, USB data and the overall port for our USB-C port control feature and other features.

[–] [email protected] 1 points 3 weeks ago

@[email protected]

GrapheneOS fully supports hardware-based attestation. Google is entirely capable of verifying a device runs the genuine GrapheneOS releases:

https://grapheneos.org/articles/attestation-compatibility-guide

Play Integrity API has nothing to do with security regardless of how it's marketed. It allows a device to pass if it hasn't received security patches for 8 years. All it does is check if it's a Google certified device and tries to stop spoofing within constraints of allowing highly insecure, ancient devices to pass.