4 ms·

Android's bootloader isn't supposed to be locked when installing custom firmware. An unlocked bootloader is a large physical access vulnerability. How does Lin

Android's bootloader isn't supposed to be locked when installing custom firmware. An unlocked bootloader is a large physical access vulnerability. How does LineageOS help security exactly?

tmikaeld 9y ago
Encryption helps.
- electricEmu 9y ago
  Does it? It seems useless when anyone with physical access can replace the bootloader. https://android.stackexchange.com/questions/38909/unlocked-bootloader-encryption https://android.stackexchange.com/questions/38909/unlocked-b...
  - styyle14 9y ago
    Well, this would require them to wipe your phone's data, so you would be alerted as soon as it happened since your phone would not have any of your old data once you logged in. If a malicious attacker is able to take your phone without you noticing and be able to replace it, the difference of a locked or unlock bootloader won't change the fact that you are going to put in your PIN on boot. Instead of replacing your OS with a malicious OS, they could simply replace your phone with a malicious copy of your phone and get your PIN on the first bootup. They still get your PIN and you still lose your data. The benefit of LineageOS is that it is open source and can be built yourself, so anyone can check the code for backdoors/vulnerabilities. This also means you get all updates as soon as you can build them.
    - electricEmu 9y ago
      LineageOS is a great OS. People should continue to use it for learning, fun, and getting things done. Please elaborate though. How is an unlocked bootloader is more secure than than EngineerMode appearing on a phone [1]? Conclusion #6: > Encryption is insecure with an unlocked bootloader or an open-access recovery. If you have LineageOS with TWRP and an unlocked bootloader then it appears you have an insecure device. [1] https://forum.xda-developers.com/android/software-hacking/twrp-password-protection-thread-t2990816 https://forum.xda-developers.com/android/software-hacking/tw...

Android's bootloader isn't supposed to be locked when installing custom firmware. An unlocked bootloader is a large physical access vulnerability. How does LineageOS help security exactly?

tmikaeld 9y ago

Encryption helps.

electricEmu 9y ago
Does it? It seems useless when anyone with physical access can replace the bootloader. https://android.stackexchange.com/questions/38909/unlocked-bootloader-encryption https://android.stackexchange.com/questions/38909/unlocked-b...
- styyle14 9y ago
  Well, this would require them to wipe your phone's data, so you would be alerted as soon as it happened since your phone would not have any of your old data once you logged in. If a malicious attacker is able to take your phone without you noticing and be able to replace it, the difference of a locked or unlock bootloader won't change the fact that you are going to put in your PIN on boot. Instead of replacing your OS with a malicious OS, they could simply replace your phone with a malicious copy of your phone and get your PIN on the first bootup. They still get your PIN and you still lose your data. The benefit of LineageOS is that it is open source and can be built yourself, so anyone can check the code for backdoors/vulnerabilities. This also means you get all updates as soon as you can build them.
  - electricEmu 9y ago
    LineageOS is a great OS. People should continue to use it for learning, fun, and getting things done. Please elaborate though. How is an unlocked bootloader is more secure than than EngineerMode appearing on a phone [1]? Conclusion #6: > Encryption is insecure with an unlocked bootloader or an open-access recovery. If you have LineageOS with TWRP and an unlocked bootloader then it appears you have an insecure device. [1] https://forum.xda-developers.com/android/software-hacking/twrp-password-protection-thread-t2990816 https://forum.xda-developers.com/android/software-hacking/tw...