The installer has verified that the Pixel reports its bootloader locked. Start the phone normally and complete the mandatory SecureOS first boot security flow before using the device.
KEY
MANDATORY FIRST BOOT SECURITY
YubiKey enrolment and SecureOS activation are part of SetupWizard.
Do not try to skip these steps. The enrolled YubiKey establishes the physical security boundary used by the protected Security User, while SecureOS activation binds this installation to the active SecureOS subscription.
Privacy: SecureOS activation does not send your email address, IMEI, IMSI, SIM identifiers, phone number, MAC address or Pixel serial to Obris Core.
01
Create Owner security
Create the normal Owner PIN or password and the mandatory duress credential.
02
Enrol the YubiKey
Connect the YubiKey, create its six digit authentication PIN and complete the required physical touch.
03
Activate SecureOS
Generate a one time activation code in this Customer Portal and enter it on the Pixel.
04
Create Security User
After first boot finishes, authenticate with the already enrolled YubiKey and create the protected Security User.
POST FLASH DEVICE SETUP
Complete mandatory first boot security, then create the protected workspace.
The standard Owner user remains the normal everyday phone environment. SecureOS first establishes the Owner credential, duress protection, YubiKey enrolment and subscription activation before allowing setup to finish.
PIXEL
PHASE 1
Complete SecureOS first boot security and activation
01
Create the normal Owner credential and duress credential
Choose the Owner PIN or password used for normal device access. SecureOS then requires a separate duress credential of the same type. The duress credential is part of the SecureOS security design and cannot be skipped.
02
Enrol the mandatory YubiKey
When SetupWizard reaches YubiKey enrolment, connect the YubiKey directly to the Pixel USB-C port and allow USB access. Create the requested six digit YubiKey PIN, enrol the key and touch the YubiKey when physical confirmation is requested.
Keep the PIN separate: the YubiKey authentication PIN is separate from the Owner credential, duress credential and later Security User PIN.
03
Generate the SecureOS activation code
In this Customer Portal, use Generate activation code. The Portal will display a short one time code in the format XXXX-XXXX-XXXX. Activation codes expire after two hours, so generate a fresh code if the previous one has expired.
No hardware identity required: the activation process uses a device generated cryptographic key and does not require the Pixel serial, IMEI or SIM identity.
04
Enter the activation code on the Pixel
When SecureOS asks for activation during first boot, enter the one time code from the Customer Portal. The Pixel proves possession of its device activation key to Obris Core and the active SecureOS subscription is bound to that installation.
Network required: keep the Pixel connected to Wi-Fi while completing SecureOS activation.
05
Finish SetupWizard
After YubiKey enrolment and SecureOS activation both succeed, continue to the final SetupWizard screen and start the normal Owner user. SecureOS should not allow initial provisioning to finish if either mandatory check is incomplete.
06
Create the protected Security User
After reaching the standard Owner user, open Security User with the already enrolled YubiKey attached. Authenticate using the enrolled YubiKey and physical touch, then create the separate Security User PIN when SecureOS presents the protected user setup.
The YubiKey is already enrolled: do not provision another YubiKey during this step. The first boot enrolment is the key used by the Security User security boundary.
07
Understand the Security User boundary
The Security User is deliberately restricted for sensitive work. Ordinary cellular SMS and outgoing cellular calls are unavailable there. Removing the YubiKey deactivates the protected session and returns the phone to the standard Owner environment.
PHASE 2Set up Remote Wipe Recovery
Destructive recovery feature: the recovery SMS is designed to delete the Security User and its data. Store the recovery QR securely and only test this feature when you are prepared to rebuild the Security User.
06
Open Remote Wipe RecoveryMake sure the enrolled YubiKey is attached. In the standard Owner user, open the Security User app and tap Remote Wipe Recovery. Enter the requested YubiKey authentication PIN and tap Authenticate with YubiKey. Touch the YubiKey when prompted.
07
Generate the recovery QRA screen titled Remote Wipe Recovery will appear. Enter the mobile number assigned to this Pixel and tap Generate Recovery QR.
08
Store the recovery QR offlineSave or export the generated QR code, then store a copy offline in a secure location. Do not rely on the Pixel as the only copy of the recovery QR.
What the QR is for: from another device, the QR can be used to prepare the recovery SMS for this Pixel. When the target Pixel receives the correctly generated SMS, SecureOS deletes the Security User in the background. The SMS does not need to be opened.
PHASE 3Keep Owner normal, then add Obris apps to the protected user
09
Install Google Play in the standard Owner userReturn to Owner. Open the built-in App Store and install the Google Play components. Open Google Play Store and sign in with the Google account you use for normal applications.
Normal phone experience: Owner is intended to feel and operate like a normal device. Keep ordinary applications, accounts and day-to-day activity here.
10
Install Obris VPN and OBRIS Chat in OwnerIn Google Play Store, search for and install Obris VPN and OBRIS Chat. OBRIS Chat is free and works with any active Obris VPN subscription.
11
Add Obris VPN and OBRIS Chat to Security UserKeep the YubiKey attached and open the Security User app. Enter the YubiKey authentication PIN and tap Manage Security Apps. Touch the YubiKey when prompted. On the Security Apps screen, find Obris VPN and OBRIS Chat and tap Add on both.
Fresh app instances: adding the apps makes them available in Security User, but it does not copy Owner logins, Google accounts, app data, permissions or private files.
12
Enter Security User and configure the secure applicationsReturn to the main Security User app screen and tap Authenticate with YubiKey. Enter the six digit YubiKey PIN and touch the YubiKey when prompted. Enter the Security User PIN when Android requests it. Inside the protected user, Obris VPN and OBRIS Chat will now be available as fresh applications.
Set up Obris VPN first and connect it. Then configure OBRIS Chat inside the Security User. Chat requires the active Obris VPN connection for messaging and voice.
PHASE 4Test the emergency actions before loading sensitive data
These tests erase the Security User. Perform them only on a test setup or before placing important information in the Security User. You will need to set the protected user up again afterwards.
13
Test the duress PINRemove the YubiKey so the phone returns to the standard Owner user. Lock the screen, then unlock the device using the configured duress PIN. The phone should return to the normal Owner environment and the ordinary Owner data should still be present.
Now try to enter the Security User. It should no longer be available because the protected user and its information have been deleted. Restart the Pixel, log back into Owner, and confirm that the Security User must be set up again before it can be used.
14
Understand and optionally test remote wipe recoveryIf the Pixel is stolen or misplaced, retrieve the recovery QR from the secure offline location. On another device, scan the QR and use it to prepare and send the recovery SMS to the Pixel's mobile number. The target Pixel only needs to receive the SMS; the message does not need to be opened.
When the valid recovery message is received, SecureOS deletes the Security User in the background. If you choose to test this now, expect to rebuild the Security User afterwards.
OPSEC REMINDER
Keep ordinary activity ordinary, and activate the protected environment only when you need it.
Use Owner for normal daily phone activity. Use the YubiKey controlled Security User for sensitive applications and communications, connect Obris VPN before using OBRIS Chat, remove the YubiKey when sensitive work is finished, and keep the recovery QR offline. These controls reduce exposure and create clearer operational boundaries, but they do not replace careful behaviour or guarantee protection against every threat.
