diff --git a/static/features.html b/static/features.html
index cde794d7..b65550e0 100644
--- a/static/features.html
+++ b/static/features.html
@@ -68,8 +68,8 @@
- Hardened app runtime
- Stronger app sandbox
- - Hardened libc providing defenses against the most common classes of vulnerabilities (memory
- corruption)
+ - Hardened libc providing defenses against the most common classes of
+ vulnerabilities (memory corruption)
- Our own hardened malloc (memory allocator)
leveraging modern hardware capabilities to provide substantial defenses against
the most common classes of vulnerabilities (heap memory corruption) along with
@@ -89,19 +89,23 @@
- Enhanced verified boot with better security properties and reduced attack surface
- Enhanced hardware-based attestation with more precise version information
- Eliminates remaining holes for apps to access hardware-based identifiers
- - Greatly reduced remote, local and proximity-based attack surface by stripping out unnecessary
- code, making more features optional and disabling optional features by default (NFC, Bluetooth, etc.) or when the
- screen is locked (connecting new USB peripherals, camera access)
+ - Greatly reduced remote, local and proximity-based attack surface by
+ stripping out unnecessary code, making more features optional and disabling
+ optional features by default (NFC, Bluetooth, etc.) or when the screen is
+ locked (connecting new USB peripherals, camera access)
- Low-level improvements to the filesystem-based full disk encryption used on
modern Android
- - Support for logging out of user profiles without needing a device manager: makes them inactive so that they can't continue running code while using another profile and purges the disk encryption keys (which are per-profile) from memory and hardware registers
+ - Support for logging out of user profiles without needing a device manager:
+ makes them inactive so that they can't continue running code while using
+ another profile and purges the disk encryption keys (which are per-profile)
+ from memory and hardware registers
- Support longer passwords by default without a device manager
- Stricter implementation of the optional fingerprint unlock feature permitting
only 5 attempts rather than 20 before permanent lockout (our recommendation is
still keeping sensitive data in user profiles without fingerprint unlock)
- PIN scrambling option
- - LTE-only mode to reduce cellular radio attack surface by disabling enormous amounts of legacy
- code
+ - LTE-only mode to reduce cellular radio
+ attack surface by disabling enormous amounts of legacy code
- Default enabled per-connection MAC randomization
as an improvement over Android's default per-network MAC randomization reusing
the same MAC address until the DHCP lease with that network expires (can still