BOOX Palma

Security Grade

Calculator v1

BOOX Palma

   Brand: BOOX (Parent: Onyx International Inc.)

   Category: Ebook Reader • Model / Gen: 1 Black, White

   Release Date: 2023-09-28 • Status: In sale

   Classification Date: 2025-10-11 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	Sealed unibody design, not intended for user service. No public reports of supply chain tampering.
Known vulnerabilities	Rare	🔗 Proof	Device receives firmware updates from Onyx, but is based on an older version of Android (11). While device-specific exploits are rare, it may be susceptible to unpatched Android OS vulnerabilities.
Prior attacks	None	🔗 Proof	No publicly known, widespread security incidents targeting the BOOX platform.
Updatability	Very common	🔗 Proof	BOOX provides regular Over-the-Air (OTA) firmware updates, which can be accessed and initiated from the device via the official support infrastructure.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Full	🔗 Proof	The device runs Android, which uses standard secure protocols (e.g., WPA, TLS). The privacy policy outlines secure data handling, which relies on these protocols.
Communications	Encrypted with up-to-date encryption	🔗 Proof	The privacy policy states that the company takes "reasonable precautions... to protect your information," which includes standard encryption for data in transit.
Storage	Encrypted with up-to-date encryption	🔗 Proof	As an Android 11 device, it supports file-based encryption by default to protect user data at rest, a standard security measure.
Category Score	Score: 1 / 3

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	The device uses standard Android account management. The Onyx Account for cloud sync is detailed in their privacy policy.
Authentication	Secure	🔗 Proof	The underlying Android OS supports secure screen lock methods like PIN, pattern, and password, as is standard for modern mobile devices.
Brute-force protection	Exist	🔗 Proof	This is a standard feature of the Android OS. The system enforces a timeout after multiple incorrect unlock attempts.
Event logging	Access event logged	🔗 Proof	Android's internal system logging (logcat) records security events like unlock attempts. Cloud account access is logged server-side as per the privacy policy.
Passwords	Require change after setup with complexity requirements	🔗 Proof	The standard Android setup process requires the user to configure a screen lock method before completing setup.
Category Score	Score: 1 / 3