From 06f84856e1de861fb3f6b0297bc32af16392cc8a Mon Sep 17 00:00:00 2001
From: Daniel Micay <daniel.micay@grapheneos.org>
Date: Fri, 20 Dec 2024 15:39:12 -0500
Subject: [PATCH] add basic section on our Setup Wizard app

---
 static/features.html | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/static/features.html b/static/features.html
index e77c27539..a705d895b 100644
--- a/static/features.html
+++ b/static/features.html
@@ -131,6 +131,7 @@ <h2><a href="#table-of-contents">Table of contents</a></h2>
                             <li><a href="#auditor">Auditor app and attestation service</a></li>
                             <li><a href="#grapheneos-camera">GrapheneOS Camera</a></li>
                             <li><a href="#grapheneos-pdf-viewer">GrapheneOS PDF Viewer</a></li>
+                            <li><a href="#setup-wizard">GrapheneOS Setup Wizard</a></li>
                             <li><a href="#encrypted-backups">Encrypted backups</a></li>
                             <li><a href="#location-data-access-indicator">Location data access
                             indicator</a></li>
@@ -1139,6 +1140,22 @@ <h3><a href="#grapheneos-pdf-viewer">GrapheneOS PDF Viewer</a></h3>
                     pinch to zoom, text selection, viewing encrypted PDFs, etc.</p>
                 </section>
 
+                <section id="setup-wizard">
+                    <h3><a href="#setup-wizard">Setup Wizard</a></h3>
+
+                    <p>We have our own Setup Wizard for the initial setup of the device and for user
+                    profiles. It's very similar to the Setup Wizard in the stock Pixel OS but has
+                    more emphasis on security. It detects an unlocked bootloader at the start and
+                    warns the user about it with a button for rebooting to fastboot mode in order to
+                    lock the device. Skipping the warning requires waiting for a timer to prevent
+                    quickly skipping through it and missing the important information. Our setup
+                    wizard also disables OEM unlocking by default at the end of the process with a
+                    toggle to opt-out of it being disabled, which is a small but useful reduction in
+                    attack surface. We plan to include our improvements to lock method options in
+                    our Setup Wizard including 2-factor fingerprint authentication along with
+                    generating random diceware passphrases and PINs automatically.</p>
+                </section>
+
                 <section id="encrypted-backups">
                     <h3><a href="#encrypted-backups">Encrypted backups</a></h3>