// STATUS — LIVING BUILD · in test · October
// IN PLAIN TERMS — I buy a used Pixel phone, install the unmodified GrapheneOS release the project's own way, check the install, and hand the phone over with an educational setup walkthrough. A phone you can verify is a small supply-chain problem I can document end to end. This page is the method, not a shop.
// WHY THIS IS IN A SECURITY PORTFOLIO — Supply chain: the image is the official one, the key hash is compared with the project's published value, and the bootloader is relocked before any data exists. Threat model: verified boot targets a remote attacker trying to persist on the device; it does not cover everything, and the limits are written down below. Privacy by design: no apps preinstalled, no account signed in, and no review of the buyer's phone.
Why GrapheneOS
The project publishes the hardware it needs (a relockable bootloader, a secure element, rollback-protected updates) and the date each model stops getting vendor updates. I pick models with long support left and avoid carrier variants, where the bootloader may never unlock. The project allows resale if the seller makes clear they are not the project. I take that literally.
The build, step by step
Procurement checks come first, asked before paying and repeated on receipt:
- The model matches the listing and has long support left.
- The phone is network unlocked, not a carrier variant.
- The OEM unlocking toggle is present and not greyed out, shown in a screenshot.
- The identifier passes a blocklist and history check.
- The previous owner's account is gone, and the parcel opening is photographed.
A failed check means stop and return, never flash. Then I follow the project's own web installer: enable OEM unlocking, unlock the bootloader, flash the official images, relock the bootloader, boot, and switch OEM unlocking off again. The project's own install page is the authority; this page only paraphrases it. Relocking wipes the phone, so it happens before any data is added.
Verification
- The verified boot key hash shown at boot is compared with the published value for that model. I never paste the hash into notes.
- Hardware attestation runs with the project's attestation app, from a separate device that is never a personal one.
- A system update check must finish without error.
- A written post-install checklist also covers camera, calls, messages, data, Wi-Fi, Bluetooth, NFC, GPS, audio, buttons, charging, fingerprint, display and battery.
Any failure means the unit is not listed. Honest limits: the key hash and attestation prove the persistent state, not what is running in memory, and verified boot does nothing against a compromise after boot. Passing means "installed as intended", never "safe".
Hygiene
Stock units stay physically apart from my personal devices and never sign in to a personal account. A test SIM is used for calls and data. Every unit gets a factory reset on receipt and another before hand-off. It leaves in a padded box under a photographed tamper-evident seal. A private per-unit record holds the checks, build and dates; the phone's identifier lives only there, never in a photo or on this site.
The setup walkthrough
The walkthrough is educational. It is a set of short documents: scope, questionnaire, agenda, facilitator script, setup checklist, guidance and follow-up. The buyer taps on their own phone and I explain. I pick no apps, take no remote control and inspect nothing on the buyer's phone.
Listing and compliance
I read the marketplace's policies first: seller status, return rules, UK consumer law and condition grading. I use a plain used grade with a written description, not a refurbished label.
The phone is the item; the walkthrough comes with it. Every listing says the seller installed the OS, is not affiliated with the GrapheneOS project, uses no logo, and that some banking apps may not work. A written question to the marketplace covers bundling, variations and the condition label.
Verdicts, on the policy text I read: the phone alone is permitted, and the bundle is still to verify. If the bundle is not allowed, I switch to the phone alone the same day and give the walkthrough as after-sale help.
Unit economics as a method
The inputs are the marketplace fees, postage, consumables, a returns reserve, labour at an hourly rate and the buy-in price. The outputs are margin per unit, break-even buy price, break-even unit count for the setup kit and sensitivity. Three scenarios (cautious, base, good) are run by a deterministic calculator with a self-test. The headline: the buy-in price decides everything, so this is a sourcing business. This page shows no figures.
The experiment
One lever changes per window. Evidence is a sale, time to sale, enquiries, returns and walkthrough hours, never views. With so few sales I claim no rates. Thresholds are set before the next unit.
Lessons
- Let the project's own page win over any paraphrase.
- Policy wording is a dependency: plan the fallback before listing.
- A private record beats a public claim.
- Money decides at the buying step, not the selling step.
What this page does not claim
It is not a promise of safety for any phone, and no independent review has been done. This is an unofficial write-up; I am not affiliated with, or backed by, the GrapheneOS project. No banking-app support is promised. No prices appear here.