Ask GrapheneOS. Thats literally their mission.

Device support

Devices are carefully chosen based on their merits rather than the project aiming to have broad device support. Broad device support is counter to the aims of the project, and the project will eventually be engaging in hardware and firmware level improvements rather than only offering suggestions and bug reports upstream for those areas. Much of the work on the project involves changes that are specific to different devices, and officially supported devices are the ones targeted by most of this ongoing work.

Hardware, firmware and software specific to devices like drivers play a huge role in the overall security of a device. The goal of the project is not to slightly improve some aspects of insecure devices and supporting a broad set of devices would be directly counter to the values of the project. A lot of the low-level work also ends up being fairly tied to the hardware.

Non-exhaustive list of requirements for future devices, which are standards met or exceeded by current Pixel devices:

• Support for using alternate operating systems including full hardware security functionality
• Complete monthly Android Security Bulletin patches without any regular delays longer than a week for device support code (firmware, drivers and HALs)
• At least 5 years of updates from launch for device support code with phones (Pixels now have 7) and 7 years with tablets
• Device support code updated to new monthly, quarterly and yearly releases of AOSP within several months to provide new security improvements (Pixels receive these in the month they're released)
• Linux 6.1, 6.6 or 6.12 Generic Kernel Image (GKI) support
• Hardware accelerated virtualization usable by GrapheneOS (ideally pKVM to match Pixels but another usable implementation may be acceptable)
• Hardware memory tagging (ARM MTE or equivalent)
• Hardware-based coarse grained Control Flow Integrity (CFI) for baseline coverage where type-based CFI isn't used or can't be deployed (BTI/PAC, CET IBT or equivalent)
• PXN, SMEP or equivalent
• PAN, SMAP or equivalent
• Isolated radios (cellular, Wi-Fi, Bluetooth, NFC, etc.), GPU, SSD, media encode and decode, image processor and other components
• Support for A/B updates of both the firmware and OS images with automatic rollback if the initial boot fails one or more times
• Verified boot with rollback protection for firmware
• Verified boot with rollback protection for the OS (Android Verified Boot)
• Verified boot key fingerprint for yellow boot state displayed with a secure hash (non-truncated SHA-256 or better)
• StrongBox keystore provided by secure element
• Hardware key attestation support for the StrongBox keystore
• Attest key support for hardware key attestation to provide pinning support
• Weaver disk encryption key derivation throttling provided by secure element
• Insider attack resistance for updates to the secure element (Owner user authentication required before updates are accepted)
• Inline disk encryption acceleration with wrapped key support
• 64-bit-only device support code
• Wi-Fi anonymity support including MAC address randomization, probe sequence number randomization and no other leaked identifiers
• Support for disabling USB data and also USB as a whole at a hardware level in the USB controller
• Reset attack mitigation for firmware-based boot modes such as fastboot mode zeroing memory left over from the OS and delaying opening up attack surface such as USB functionality until that's completed
• Debugging features such as JTAG or serial debugging must be inaccessible while the device is locked

In order to support a device, the appropriate resources also need to be available and dedicated towards it. Releases for each supported device need to be robust and stable, with all standard functionality working properly and testing for each of the releases.

The expectation is for people to buy a secure device meeting our requirements to run GrapheneOS. Broad device support would imply mainly supporting very badly secured devices unable to support our features. It would also take a substantial amount of resources away from our work on privacy and security, especially since a lot of it is closely tied to the hardware such as the USB-C port control and fixing or working around memory corruption bugs uncovered by our features. We plan to partner with OEMs to have devices produced meeting all our requirements, providing additional privacy/security features beyond them and ideally shipping with GrapheneOS rather than massively lowering our standards.

Good luck, dumb phone means no encryption, SMS and MMS are stored plaintext and freely shared with US three letters and phone convos have been spied on en masse since the 80s.

For that to be effective you'd have to give up phones, smart, dumb, even carphones and landlines. Not only that, you'd have to reliably know your contacts are never contacting you through their phones, windows PCs, etc, that all themselves have that compromised HW as well. Realistically you'd need to fall back on the postal service, but people can steam open letters, so you'll need directly employed couriers, but can you really trust anyone else? So you need to hand deliver it, but can you really trust your contact to burn after reading? Better say it face to face, if you can be sure they (or third parties) aren't recording, but then Flock knows they were with you and they could be tortured later.