AMD stripped [Transparent Secure Memory Encryption] from its consumer CPUs

byte:

Mobile is waaay worse.

How so? I feel that GrapheneOS is the best operating system for privsec.

GrapheneOS: The desktop Linux software stack has horrible privacy and security compared to AOSP.

GrapheneOS: Desktop OSes don’t have anything close to the security model or hardware-based security features of AOSP or iOS.

We can see proof of this in practice. All of these exploits were possible on mainstream desktop linux:

GrapheneOS isn’t vulnerable to the 3 recently disclosed Linux kernel vulnerabilities named Copy Fail, Copy Fail 2 and Dirty Frag. Current Android Open Source Project SELinux policies block exploiting all 3 bugs. Standard AOSP GKI kernel configuration also has 2/3 of the vulnerable features disabled.

Android has a robust app sandbox, while desktop linux lets apps have full file access.

byte:

On PC you at least have ability to install any operating system…

I referred to privsec, not user freedom.

byte:

Physical security is consumer responsibility. You lock doors at home, right? Why not to lock laptop in safe if you have this threat model?

Ok? And I don’t have to lock my phone in a safe if I had this threat model because of its outstanding hardware security.

byte:

And the main point: never store anything sensitive inside any machine (even with FDE). Use encrypted external drive, so you can hide it, if needed.

Agree, but maybe cloud instead of locally at all.