4 ms·
you can keep verified boot on custom roms. play services expose you to googles nsa'd taps we'll hear about in 5y. source: im another google engineer
by zobzu 10y ago
you can keep verified boot on custom roms.
play services expose you to googles nsa'd taps we'll hear about in 5y.
source: im another google engineer
- weeks 10y agohttps://source.android.com/security/verifiedboot/verified-boot.html https://source.android.com/security/verifiedboot/verified-bo... How do you propose a custom rom can establish hardware root of trust without being signed by the device manufacturer?
- mixedCase 10y agoI believe the point is that such a signature is useless since the software signed as safe is actually unsafe, while a self-signed rom at least has a chance to be safe.
- zobzu 10y agothis reminds me of when team-teso had their stuff on their website directly accessible over https.. so they used a self-signed cert, so that no govt or corporation could require a MITM with a valid signed cert from any trusted CA.