The standard Android feature doesn't disable USB data lines and does not disable the USB-C protocol. It only disables high level USB support (peripherals, gadgets). You can even still use DisplayPort via USB-C. The current label refers to data lines, so it's not accurate anymore. I propose splitting it up to properly cover this while acknowledging what LineageOS and AOSP do.
There can be 4 rows instead:
- Disabling USB-C data
GrapheneOS (green): Default (while locked), docs
Other operating systems do not implement this. It involves hardware-specific driver changes.
- Disabling USB-C charging with OS booted
GrapheneOS (green): Opt-in, docs
Other operating systems do not implement this. It involves hardware-specific driver changes.
- Disabling pogo pins data
GrapheneOS (green): Default (while locked), docs
Other operating systems do not implement this. It involves hardware-specific driver changes.
- Disabling USB connections
GrapheneOS (green): Default (while locked), hardware + software, docs
LineageOS and CalyxOS (light red): Opt-in, incomplete software-only
Hover text: Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections. The mode for disabling USB connections while locked continues allowing new connections until existing connections end, including a connection through another method such as a pogo pins USB connection to a stand.
AOSP (red): Device admin API
Hover text: Requires installing a device admin app like Sentry. Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections.
The standard Android feature doesn't disable USB data lines and does not disable the USB-C protocol. It only disables high level USB support (peripherals, gadgets). You can even still use DisplayPort via USB-C. The current label refers to data lines, so it's not accurate anymore. I propose splitting it up to properly cover this while acknowledging what LineageOS and AOSP do.
There can be 4 rows instead:
GrapheneOS (green): Default (while locked), docs
Other operating systems do not implement this. It involves hardware-specific driver changes.
GrapheneOS (green): Opt-in, docs
Other operating systems do not implement this. It involves hardware-specific driver changes.
GrapheneOS (green): Default (while locked), docs
Other operating systems do not implement this. It involves hardware-specific driver changes.
GrapheneOS (green): Default (while locked), hardware + software, docs
LineageOS and CalyxOS (light red): Opt-in, incomplete software-only
Hover text: Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections. The mode for disabling USB connections while locked continues allowing new connections until existing connections end, including a connection through another method such as a pogo pins USB connection to a stand.
AOSP (red): Device admin API
Hover text: Requires installing a device admin app like Sentry. Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections.