diff --git a/static/features.html b/static/features.html
index 6193b1ad..c395f0f6 100644
--- a/static/features.html
+++ b/static/features.html
@@ -129,7 +129,15 @@
Disabling app installation
- Many other features
+ GrapheneOS app
+ repository
+ Vanadium: hardened WebView and default
+ browser
+ Auditor app and attestation service
+ GrapheneOS Camera
+ GrapheneOS PDF Viewer
+ Encrypted backups
+ Other features
Services
@@ -357,16 +365,8 @@
Enhanced verified boot
with better security properties and reduced attack surface
Enhanced hardware-based attestation with more precise version information
- Hardware-based security verification and monitoring: the
- Auditor app app and
- attestation service provide strong
- hardware-based verification of the authenticity and integrity of the
- firmware/software on the device. A strong pairing-based approach is used which
- also provides verification of the device's identity based on the hardware backed
- key generated for each pairing. Software-based checks are layered on top with
- trust securely chained from the hardware. For more details, see the
- about page
- and tutorial.
+ Hardware-based security verification and monitoring via our
+ Auditor app and attestation service
@@ -705,8 +705,79 @@
+
+
+
+ GrapheneOS include our own security, minimalism and usability focused app
+ repository client for using our first party app repository. Our app repository
+ is currently used to distribute our own apps and a mirror of Google Play for
+ the sandboxed Google Play feature. In the future, it will be used to
+ distribute first-party GrapheneOS builds of externally developed open source
+ apps with hardening applied.
+
+
+
+
+
+ GrapheneOS includes our Vanadium browser as WebView implementation provided
+ by the OS and our default browser. Vanadium is a hardened variant of Chromium
+ providing enhanced privacy and security, similar to how GrapheneOS compares to
+ AOSP. The Vanadium browser currently doesn't add many features but there are a
+ lot of enhancements planned in the long term.
+
+ More details are available in the web
+ browsing section of our usage guide.
+
+
+
+
+
+ Our Auditor
+ app app and attestation service
+ provide strong hardware-based verification of the authenticity and integrity
+ of the firmware/software on the device. A strong pairing-based approach is
+ used which also provides verification of the device's identity based on the
+ hardware backed key generated for each pairing. Software-based checks are
+ layered on top with trust securely chained from the hardware. For more
+ details, see the about page and
+ tutorial.
+
+
+
+
+
+
+
+ GrapheneOS PDF Viewer
+ is sandboxed, hardened PDF viewer using HiDPI rendering with pinch to zoom,
+ text selection, etc.
+
+
+
+
+
+ Encrypted backups via integration of the
+ Seedvault app with
+ support for local backups and any cloud storage provider with a storage
+ provider app.
+
+ Seedvault was created by a GrapheneOS community member for inclusion in our
+ operating system. We plan on replacing it with a new implementation since the
+ project has been taken over by another group of people not sharing our goals
+ or approach. For now, this is the best available option so we're including it
+ to give people encrypted backup support. We've made several security fixes to
+ work around upstream issues with the project.
+
+
-
+
This is an incomplete list of other GrapheneOS features.
@@ -719,24 +790,6 @@
Improved user visibility into persistent firmware security through version
and configuration verification with reporting of inconsistencies and debug
features being enabled.
- Vanadium: hardened WebView and default browser — the WebView is what most
- other apps use to handle web content, so you benefit from Vanadium in many apps
- even if you choose another browser
- Apps: first-party GrapheneOS app repository focused on security, which is
- currently used to distribute our own apps and a mirror of Google Play for the
- sandboxed Google Play feature. In the future, it will be used to distribute
- first-party GrapheneOS builds of externally developed open source apps with
- hardening applied.
- PDF Viewer: sandboxed,
- hardened PDF viewer using HiDPI rendering with pinch to zoom, text selection,
- etc.
- GrapheneOS Camera: modern
- camera app with a great user interface and a focus on privacy and
- security.
- Encrypted backups via integration of the
- Seedvault app with
- support for local backups and any cloud storage provider with a storage provider
- app
Authenticated encryption for network time updates via a first party server to
prevent attackers from changing the time and enabling attacks based on bypassing
certificate / key expiry, etc.