Security risk with official /e/OS v3.7 for Pixel 5?

[eos.b02pz]

Hi Community,

the official build for the Pixel 5 is based on AOSP 13, whcih reached end of life. Does that mean there will be no security patches anymore, hence it becomes increasingly insecure to use the official build?

If so it would be great if that would be communicated through the updater app of /e/os to give users a heads up.

And if one would switch to the community build, whcih to my understanding is based on AOSP 15, does that also work with banking apps and the like?

So what are my options here?

Thanks in advance.

[aibd]

Seems very quiet about redfin official. I gave this answer recently

@aibd

I do not see any mention of the possibility of OTA Android version upgrade in /e/OS Smartphone Operating System > Development Updates the last mention in a quick search was

@Manoj

@vincenth

pixel 5 redfin A14 official build

Most probably will get a direct to A15 OTA OS upgrade. Will share details once I have them.

[eos.b02pz]

Would be great to get an update on this one as the EOL of AOSP13 has been reached. So this is a somewhat pressing issue in terms of security. @Manoj

[piero]

Week 17, Development and Testing Updates

UNOFFICIAL TIP : if coming from an already installed “official” /e/OS and you want to upgrade to a16 “community” (without loosing data and locked bootloader) using → Settings → System updater → Local_update or using “recovery mode” and “adb sideload” you will face a signature mismatch, simply choose “install anyway” A clear guide to Upgrade your /e/OS to a new Android major version without loosing /data Files for upgrading an existing /e/ system via local update or the /e/ recovery can be …

/e/OS community redfin download

Week 17, Development and Testing Updates

@Lobster I guess you are on an FP3, so the download link would be at https://ota.ecloud.global/api/v1/FP3/community/. Here is my report of how I switched an FP3 from T-official to A15-community: https://community.e.foundation/t/feedback-for-v3-1-1/73830/46?u=urs_lesse As I remember, data was taken over and not reset – I did not need to change the (locked) bootloader, so no factory reset was triggered.

Week 17, Development and Testing Updates

there is yet no feedback about reverting from “community” to “official” without data loss… But switching back to “official” with a new install (and data loss) will be possible if the command fastboot flashing get_unlock_ability is able to return 1. (check the possibility to enable the “allow OEM unlock” option in “–> Settings → system → Developper Options”) NEVER DISABLE IT !

[freechelmi]

Android version Upgrade is really tough , it will be ready when it’s ready

I would suggest to stay on the official channel and help testing when the beta is here

[PLA]

I guess it’s difficult for the devs to do an upgrade.
But A13 obsolescence was expected years ago, and upgrade to A14 or A15 could have been planned, to extend the end of life of the device.
That’s not a too big expectation for a phone that once was sold by Murena.

I maybe don’t need the top security GrapheneOS can provide (but why not ? It doesn’t harm).
But I’m not comfortable with the poor security that is now facing my Pixel 5 under eOS.

This device with stock OS (A14) would be more secure, even if vendor patches have ended too…

[Manoj]

As mentioned previously on this forum we are working on upgrading all A12 and A13 builds. Official builds require detailed development efforts as the upgrade has to happen OTA and should not result in data loss.
As revealed in the latest issue we had with the release of the A16 build of Oneplus nord avicii where the EU version of the device had some specific firmware which did not work correctly post the upgrade. Development and testing of OS OTA upgrade builds can be tricky.
Every week we do share dates and release information of upcoming builds here.
Will post when we have any updates for the Pixel 5

[rezoe]

It’s nice that old devices still get support but getting no security updates is a severe problem. A12-devices like the Gigaset GS290 haven’t got security updates for more than a year which is just too long and makes the devices practically unusable. As PLA mentioned it doesn’t come as a surprise - the end of support from Google is known before. If the OTA update is too difficult to implement in time, than at least a newer version for a fresh install should be offered.
Nevertheless thanks for still working on the upgrades to the e/os-developers.