Your PIN decides what opens.
os.ivan.gg is a personal research fork of GrapheneOS for the Pixel 8 Pro. One lock screen, several PINs, each with its own outcome: your everyday phone, a protected space with its own keys, an immediate restart, or a wipe.
This is alpha software built and tested by one person on one test phone. Expect bugs, data loss and changes. It is not meant for anyone whose safety depends on their phone. No warranty, no liability: see the terms.
One PIN pad, several outcomes
The lock screen looks and works like any other. What happens next depends on the PIN you type.
| You type | The phone |
|---|---|
| Everyday PIN | opens your everyday profile |
| Protected space PIN | opens the protected space |
| Reboot PIN | restarts at once; every profile needs its PIN again |
| Duress PIN | wipes the device (a GrapheneOS feature) |
| Anything else | says "wrong PIN" |
The reboot and duress PINs are optional. All PINs on the phone have the same number of digits.
The protected space
A second profile on the same phone, with its own apps, its own data and its own encryption key.
- Opened from the normal lock screen by typing its own PIN.
- Separate keys. Unlocking the everyday profile does not unlock the protected space.
- Locked again when you leave. When the screen turns off, the phone goes back to the everyday profile's lock screen and the protected space is stopped. Its data stays encrypted until its PIN is typed again.
- Straight from boot. After a restart you can open it without unlocking the everyday profile first.
- Holds the security settings. The duress PIN, the reboot PIN and user management are set from inside the protected space. Someone holding the phone unlocked in the everyday profile can't see or change them.
- PIN only. Fingerprint unlock opens the everyday profile; the protected space always asks for its PIN.
The everyday profile works as a normal phone and doesn't list the protected space. That is all: the protected space is kept out of the way, not hidden. Anyone who examines the phone, or knows this build, can tell that it exists. Don't rely on it staying secret.
Everything else is GrapheneOS
os.ivan.gg keeps all of GrapheneOS and follows its releases: sandboxed Google Play (optional), network and sensors permissions, storage and contact scopes, hardened memory allocation, auto-reboot, USB-C port control, PIN scrambling, the Vanadium browser, verified boot with a locked bootloader. Full list: grapheneos.org/features.
Status
- Supported device: Pixel 8 Pro (husky) only.
- Based on GrapheneOS 17 (Android 17).
- Alpha. No release has been published yet. Releases will appear at github.com/os-ivan-gg/releases, each one stating which GrapheneOS release it is based on.
- How to install: install guide.
Source
Design notes, test scripts and per-feature patches:
os-ivan-gg/os-ivan-gg. The code is on the
envs-17 branch of each fork in github.com/os-ivan-gg.