The problem
End-to-end encryption protects a message in transit. Once the phone itself is compromised, spyware can read the screen, log the keyboard and reach the keys. Tools like Pegasus do exactly that.
For journalists, lawyers and activists, the device itself is the biggest risk.
Approach
GhostWire tackles this at the operating system level. Like GrapheneOS, it aims to build a hardened system on top of AOSP with a smaller attack surface, with secure messaging built into it.
However well a messaging app encrypts, it still has to trust the OS underneath. GhostWire wants to control that layer too.
Planned features
- Verified boot with our own keys and a relockable bootloader
- A hardened memory allocator and extra exploit mitigations
- Per-app network and sensor permissions
- Message keys kept in the hardware-backed keystore (StrongBox)
- A duress PIN that wipes the device when entered
- Auto-reboot back to the encrypted state when the phone sits unused
- A base system that runs without Google services
Where it stands
The project took 3rd place at Ağrı Startup Weekend 2025. I'm currently working on the messaging layer and the system design.
Roadmap
- A messaging app that runs on stock Android
- A hardened system image for Pixel devices
- Duress PIN and auto-reboot
- An independent security audit