It’s great (and IMO the bare minimum in terms of security) that the Librem 5 will have full disk encryption, but that only really protects you against someone else accessing your data when it’s powered off or at a “preboot password” screen. (Assuming they have the ability to bypass the lockscreen or a external method to extract data from the device). Now for my laptop I have it configured so it hibernates and destroys the keys from RAM after I close the lid. But the problem with a phone and full disk encryption is that people leave their phones “decrypted” all the time else they are essentially useless. I use my phone as an alarm clock (I travel), pager, etc, and none of that functionality would work with if my phone was not decrypted (in RAM).
Apple realized this, and several years ago they implemented “File Data Protection”, which is a method of having a second set of encryption keys to protect data of applications on the device, and if the device is locked (but not powered off) it can destroy the keys from RAM and if applications need to write new data (camera, call app, etc) while the device is locked, it uses a public key (of which said private key is protected) to encrypt files written to storage which are then decrypted and replaced after the device is unlocked.
Some forensic devices claim to extract and crack the file based encryption keys from a locked but decrypted iPhone, but it gives a fighting chance at protecting your data if your phone is taken when it’s decrypted but locked.
Here’s a whitepaper from Apple that explains some of this in more technical detail (see pages 15-25)
https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf
File based encryption requires the application be aware of it’s existence and handle the use-case of a locked device where not all of the application data is available. Apple has APIs with documentation for this for app developers to use.
Seeing how PureOS (on mobile) is a new platform and doesn’t have to put up with backward comparability issues like Android does with regards to security it might be a good idea to get this right now, then having to “pay for it” later. Although since most applications (iirc) are ported GTK+ applications unaware of the context of a mobile device I could see that being an issue.
Here’s an article from 2016 (circa Android 7) detailing the pitfalls of trying to implement file based encryption on a legacy platform although personally I don’t know if the situation has changed since then.
https://www.cso.com.au/article/610671/iphone-encryption-six-years-ahead-android-cryptographer/