Teachable Moment: GrapheneOS DESTROYS Unplugged

GrapheneOS writes to Unplugged: (Emphasis mine)

No, you created it to make money. You do not believe in anything beyond making money. You’ve marketed your products with highly inaccurate privacy and security claims including claiming it’s impenetrable.

You are scamming people, and spreading misinformation about an open source project further contributes to it.

The past history of many of the people involved in your company didn’t get erased through creating a new one.

You aren’t on the same side as us and the deeper you dig, the more of a response there’s going to be from us. You are not our allies, and you are not bringing people privacy and security. You’re grifters.

What?

Alright, let’s rewind a bit. GrapheneOS is an open source custom operating system for Android devices (in the Pixel line) that “de-googles” the device and provides a wide variety of security and privacy features. Unplugged is a “private smartphone” company founded by the Blackwater founder Erik Prince.

The above exchange began when Pierre Chang on X asked Unplugged what makes their phone more secure than GrapheneOS, tagging them.

GrapheneOS then replied with:

Where do they make any claim about GrapheneOS?

It’s an ARMv8.2 MediaTek Dimensity 1200 SoC device running a non-hardened fork of the Android Open Source Project. The hardware/firmware doesn’t come close to meeting our security requirements, and it’s not a hardened OS.

To translate this a bit. Android Open Source Project (AOSP) is the base foundation that all android-based systems are built on top of. It initially doesn’t include Google and other bloatware, but vendors tend to add that on. As GrapheneOS states, hardware and firmware matter a great deal when it comes to security, so getting it right is important. They also claim that the Unplugged phone’s operating system LibertOS isn’t hardened. In this context hardened means making specific modifications to improve security.

What’s interesting to note is that in this exchange, Unplugged doesn’t attack GrapheneOS in their weakest point: dependence on Google manufactured hardware. It’s possible that they don’t do this because they don’t want people taking too close a look at their own hardware choices.

They get close in this exchange where GrapheneOS replies to Unplugged defending their firmware.

When using GrapheneOS (or any other custom ROM), Google driver binaries are required, but Google does not provide any commitments regarding data collection or privacy in this code.

This claim about data collection / privacy for the firmware or drivers isn’t accurate. Additionally, you use a MediaTek SoC device with proprietary MediaTek firmware and drivers, and they aren’t known for having good security. The hardware, firmware and driver security of the devices we’re supporting is much better, not worse as you’re making it seem.

As a side note, GrapheneOS is an operating system. The term ROM isn’t accurate and we don’t want it to be referred to as such. It’s a fork of the Android Open Source Project like the stock OS on any Android device.

Unplugged makes the argument that their product is important because the GrapheneOS web installer is too difficult for much of the general population. You can watch Mental Outlaw demonstrate the process and judge for yourself. Regardless of the overall difficulty, would it not be better to have a trusted friend or relative give you assistance rather than settle for a potentially inferior product? In fact if one wants the privacy and security guarantees of GrapheneOS, you can always buy a pre-flashed version from a provider like Above Phone …but that does require putting trust in that provider.

Back in July in response to a podcast, GrapheneOS wrote:

Unplugged has simply doubled down on false claims about GrapheneOS security, pretending people cannot buy devices with GrapheneOS installed and pretending it’s hard to install along with promoting their blatantly insecure products with false marketing.

…

They keep pushing the false claim that Pi