GrapheneOSUnplugged are a recent entry in the crowded space of selling insecure hardware with significantly worse privacy and security than an iPhone as highly private and secure. Bottom of the barrel MediaTek device with outdated AOSP is worse than status quo. All marketing, no substance.
As part of marketing their products, Unplugged are spreading unsubstantiated spin and misinformation about GrapheneOS and the much more secure hardware we target. We've been aware of it for a while but chose not to respond to it until they began doing it in direct response to us.
GrapheneOS is a hardened OS built on the latest release of the Android Open Source Project rather than older releases with inferior privacy/security and incomplete privacy/security patches. We substantially improve privacy/security with our changes rather than making it worse.
The work we do in GrapheneOS is highly regarded by privacy and security researchers. We've made major upstream contributions to the Android Open Source Project, Linux kernel and other projects, both through submitting privacy/security improvements and reporting vulnerabilities.
We've also reported numerous vulnerabilities in hardware/firmware along with making multiple suggestions for new features which were implemented for Pixels. They're the only devices meeting our security requirements (https://grapheneos.org/faq#future-devices). We target them because of security.
Pixels have first class alternate OS support, which does not come at the expense of security. Support for installing an alternate OS is implemented securely as part of best in class boot chain and secure element security for Android devices. Supporting it has benefited security.
Unplugged has claimed open source and support for alternate operating systems reduces security. Pixel security has benefited from many external security researchers along with contributions from GrapheneOS because of it. They'll benefit more as they publish more firmware sources.
GrapheneOS not only leverages the same hardware-based security features as the OS but implements major hardware-based features unavailable elsewhere.
Hardware memory tagging for production hardening is an exclusive GrapheneOS feature with a best-in-class implementation.
Our USB-C port and pogo pins control feature does hardware-level attack surface reduction with code written for the drivers on each device:
https://grapheneos.org/features#usb-c-port-and-pogo-pins-control
Our Auditor app leverages the pinning-based hardware attestation available on Pixels based on our proposal for it.
Many of our other features are hardware-based, and some of these exist because of features we proposals or helped to secure against weaknesses.
In April, Pixels shipped reset attack protection for firmware based on our proposal, which is not available on other Android devices.
That reset attack protection blocks real world attacks by forensic data extraction companies, which we reported to Android. In April, Pixels also shipped a mitigation against interrupted factory resets used by those companies based on our report, not yet available on non-Pixels.
In June, Android 14 QPR3 was released with a hardware-based OS feature fully blocking interrupting factory resets. This was based on our initial proposal we made as part of our reports of active exploits in January, similar to the reset attack protection shipped in April.
Unplugged uses an older Android release. They do not have this AOSP patch. Their hardware is missing many standard security features including these recent 2 improvements shipped on Pixels. Their hardware doesn't even close to meeting our list of security standards even on paper.
Unplugged has tried to misrepresent these improvements and falsely claimed they're uniquely relevant to Pixels due to alternate OS support. That's not true. Their device is missing these and many other security features, and is not more secure due to lacking alternate OS support.
Unplugged has tried to spread fear, uncertainty and doubt about the hardware we support despite it being much more secure and trustworthy. MediaTek does not have a good security reputation and has repeatedly shipped real backdoors unlike the unsubstantiated claims from Unplugged.
Unplugged was founded by Erik Prince, the same person who founded Blackwater. Erik and others involved in UP are deeply tied to human rights abuses and surveillance around the world. Best case scenario is they're simply grifting like the Freedom Phone. Worst case is much worse.
Our initial response to someone asking about them is here, where we were avoided saying more than necessary:
https://x.com/GrapheneOS/status/1804551479484645421
Unplugged followed up with spin and misinformation about GrapheneOS, which we debunked, and then they doubled down on doing even more of it.
GrapheneOS (@GrapheneOS) on X
@PiereChangstein @weare_unplugged Where do they make any claim about GrapheneOS? It's an ARMv8.2 MediaTek Dimensity 1200 SoC device running a non-hardened fork of the Android Open Source Project. The hardware/firmware doesn't come close to meeting our security requirements, and it's not a hardened OS.
Since they posted huge tweets, we replied with our own huge tweets with inline quotes of everything they wrote for ease of understanding:
1/2:
GrapheneOS (@GrapheneOS) on X
@weare_unplugged @PiereChangstein > Our goal was to create a phone where privacy is convenient. Flashing GrapheneOS, however, is not something most consumers can do easily. GrapheneOS is very easy to install via https://t.co/29OBsAOaiI and many companies around the world are selling devices with the OS
GrapheneOS (@GrapheneOS) on X
@weare_unplugged @PiereChangstein > Here are our responses to continue the conversation. What you've done is push more spin and misrepresentations about an open source project to promote your insecure product marketed based on false privacy and security claims. > Let's agree to disagree. While the web installer
Unplugged in also infringing on the open source licensing multiple projects including DivestOS where they ripped off their AV from without attribution. They even still use DivestOS servers without permission. SkewedZeppelin is lead developer of DivestOS (URLs are in alt text):
Their messaging service is simply Matrix. Matrix is not a good private messaging system because it doesn't encrypt any metadata or even emoji reactions, and all that metadata is stored on each server for each room: room members, power levels, time/size/sender of messages, etc.
Detun3d@GrapheneOS
What do you suggest with same features?
What do you suggest with same features?
Scien@GrapheneOS I think it's a little harsh to call it "not a good private messaging system". There are precious few messaging services to the standard of Matrix or above that have wide capabillities that come close to many non-private, proprietary messengers.
And the few that tick those boxes have huge difficulties irt self-hosting. And afaik none of them have the variety of clients Matrix has, either.
But perhaps I'n being unfair. Maybe it's more accurate to say that Matrix is a good protocol, but not yet satisfactory as an *absolutely* private messenger.
If *absolutely* private is the goal I would be inclined to suggest something else like Briar or Signal - this much is true.
But I think it's plenty servicable for most peoples' - even tech-interested peoples' - standards of privacy in its current state.
Gonzalo🐧 🇨🇱@GrapheneOS what about XMPP?
Kevin Karhan 
@GrapheneOS personally I'll stick wirh #XMPP+#OMEMO & #PGP/MIME since that works and is secure - including 100% #SelfCustody of all the keys!
vPurple@GrapheneOS Could you post a link to that forum post or whatever that is?
Secret Squirrel@GrapheneOS Should have led with this and I wouldn't have had to read any further. Anything involving that dbag is automatically suspect on so many levels.
Thanks for all your work.
@Secret_Squirrel We wanted to focus on the technical argument of it being an awful product with bad privacy and security. The people behind it are awful too, which is worth mentioning so we did.
@GrapheneOS Very fair. :D
Thom Zane@GrapheneOS I have never heard of Unplugged, but it sounds a bit like ANOM from this thread. For those unfamiliar with ANOM, check out Darknet Diaries episode 146: https://darknetdiaries.com/episode/146/
@GrapheneOS Really helps solidify the idea that GrapheneOS is a serious project when someone like Prince is targeting it.
@4Ld0r1thm5 They only seem to be doing that because they have a product to sell. It's a major issue for their business model that there's a freely available open source project with far better privacy/security. They have far less secure hardware than what we target missing many of the security requirements including what we build some of our major features on. They'd have to actually invest substantial resources in making a product with substance which would take a long time. Instead, they lie.
@4Ld0r1thm5 We've been through the same thing many times before with many companies, products and even a few closely related open source projects trying to harm us because they feel threatened by the work we do.
Orca 🌻 | 🎀 | 🪁 | 🏴🏳️⚧️@GrapheneOS Basically another /e/ heh 🙃
Jak2k 🏳️🌈@GrapheneOS
Typo: "rapheneOS"
Typo: "rapheneOS"