11 ms·

I mean, why can't they just have a regular bootloader like a PC? It's a lot of effort for what is essentially 0 gain if you just have full device encryption. T

I mean, why can't they just have a regular bootloader like a PC? It's a lot of effort for what is essentially 0 gain if you just have full device encryption. The phone should at least always be unlockable by a single switch in the developer settings - none of this "oh go to our website and generate an unlock code/pay us money for an unlock code/phone us" which is a HUGE pain in the butt. I swap between roms a lot, and the whole idea of a system partition and data partition etc is just stupid. They always are the wrong size for what they need to be and then I try to install gapps and its like "oh your system partition is too small my dude," so why separate these and just have everything like a regular linux OS. Maybe I'm missing something stupid? But I kinda just want a phone that just starts a linux based operating system like a PC, and lets me do everything I can on my linux PC in a touch-centric way.

pjmlp 8y ago
The PC was an accident, which IBM repented themselves quite heavily, tried to regain with PS2 and failed to do so. If the current trend of UEFI and laptops without any expansion options is any indication, that open PC of yore will fade into a very tiny niche, as computers become appliances.
- snaky 8y ago
  The previous accident of that kind was UNIX. That's acute, considering an open-source is mainstream today - a couple of accidents is enough to change the world.
  - pjmlp 8y ago
    Yes, had Bell Labs not been forbidden to sell it, thus going to the market with a closed source OS, selling it the same price range as VMS, OS/360 and similar systems, the history outcome would have been quite different. Still anyone that has had the pleasure to write portable UNIX code knows that portability is relative.
    - snaky 8y ago
      Maybe UNIX and PC wouldn't be enough actually, without at least four points (half-accidents at least) of that history - RMS, BSD, Sun and Linus. That's quite a fragile chain of events.
      - pjmlp 8y ago
        Agreed.
exDM69 8y ago
These secure boot systems exist because of DRM protection to media that is mandated by the content companies. Their point is to verify that the whole OS from kernel to userspace can't be modified by 3rd parties (such as you, the owner of the device). It boils down to "no secure boot, no DRM, no Netflix 4k for you". At least this was the case when I was still working with consumer electronics a few years ago.
- zeta0134 8y ago
  At least in the mobile space, I get the feeling that theft of the device factors in here. A lot of carriers advertise some sort of remote lock + wipe mechanism, which isn't guaranteed to work if the device's bootloader is unlocked, allowing an attacker to bypass the feature before it has a chance to run. I have no idea if that's actually the case (I only worked tangential to a retail store's mobile department) so take that with a grain of salt, that's just what I observed the carriers making a big fuss about on the regular. I don't think that excuses the practice either; I'll always be in favor of being in full control of any hardware I'm supposed to trust with my data, but ofc I realize I'm in the minority there.
  - drbawb 8y ago
    I'm totally fine w/ there being a disclaimer on bootloader unlocking, e.g: "Warning! Some security features of your device may not work properly w/ secure boot disabled. Visit foo.com/secure-boot to learn more." To a lesser extent I'm OK w/ bootloader unlocks voiding my warranty, esp. since many of these devices ship w/ permanent fuses whereby writing to the wrong MSRs may brick your device. After all that's how my Moto X (2013) worked: I needed a code from Motorola to unlock the bootloader, which in turn required agreeing to a warranty waiver. What's not OK is having a permanently locked bootloader that guarantees my device will be useless after the carrier decides to stop delivering OTA updates in a year or two.
- thaumasiotes 8y ago
  > It boils down to "no secure boot, no DRM, no Netflix 4k for you". I really can't say I'm worried about the theoretical inability to stream 4k video to a 5" screen. At that size, 4k is just wasting bandwidth.
floatboth 8y ago
> unlockable by a single switch in the developer settings Nexuses/Pixels, OnePlus, Xiaomi's Android One line (Mi A1/A2) do not require unlock codes.
- snaky 8y ago
  You can unlock the bootloader on almost any smartphone nowadays, but every one of them requires original firmware installed to lock it back.
  - veeti 8y ago
    Google Pixel (and Nexus before it) can be locked with custom signing keys.
    - snaky 8y ago
      If you are talking about this https://mjg59.dreamwidth.org/31765.html https://mjg59.dreamwidth.org/31765.html does it still work on recent Pixel devices?
      - bubblethink 8y ago
        Self signing is one of the main reasons to buy a pixel. CopperheadOS (now dead) used that. For aosp builds with self signing, look at rattlesnakeos on github.
- JoshuaAshton 8y ago
  Yeah I know quite a lot of Android phones do support this, which is why I mentioned it, however some phones still don't have this functionality or require me to mess on with some online/call service to receive and unlock code.
  - jstanley 8y ago
    So just buy one that does support it.
fghtr 8y ago
>But I kinda just want a phone that just starts a linux based operating system like a PC, and lets me do everything I can on my linux PC in a touch-centric way. Here you go: https://puri.sm/shop/librem-5/ https://puri.sm/shop/librem-5/ (alternatively, https://neo900.org/ https://neo900.org/)
phh 8y ago
PC bootloader is totally insecure. And no, full-device encryption doesn't protect you much in my opinion. First, full-device encryption is much weaker if you can do offline bruteforce. With a secure boot trust of chain, it is online, and is rate-limited by the TEE (and could be made to destroy after too many tries) Even better, per Android documentation, full-device encryption key is tied to boot public key. So if someone flashes another OS, even if you enter the passphrase, noone will access your data. Also, with a PC, if someone replaces your PC, and changes the OS to simply ask for your passcode and send it back to that someone, you won't notice it. With a proper boot chain of trust (which PCs don't have, except for Librem BIOS), it is evident that the OS has been changed, so you know not to give this device your passcode. Also, boot chain of trust makes it harder to do cold-boot attacks. So globally, having a chain of trust, is much more secure for full-device encryption, because it forces online bruteforce. Considering that usually passwords used on smartphones are much more weaker (many people have 6 digits for their smartphone, vs 10 characters on their computers), the added security seem necessary to me.
- snaky 8y ago
  Using offline bruteforce at one hundred trillion guesses per second, https://www.grc.com/haystack.htm https://www.grc.com/haystack.htm says you would need a 15 thousand centuries to crack the password '7jk_nhAYTasd76'.
  - shittyadmin 8y ago
    Yeah, if you can pick a secure password and the device is always on your person like a smartphone usually is, evil maid attacks are out as are most other blackbag techniques. The big problem is that entering a password like that is a real pain on mobile, especially on device unlock. You could potentially set a different password on boot vs on unlock - that's a tad trickier than the average user is likely to want to deal with, but entirely plausible for the paranoid power user.
    - Forbo 8y ago
      That's exactly how fingerprint locks work on the Pixel. First unlock after boot requires a password, after that fingerprint can be used. It requires password entry about once a day or so as well for additional security.
bubblethink 8y ago
>I mean, why can't they just have a regular bootloader like a PC? Because there are several limitations with the PC boot process. See the heads project for what a reasonably secure PC boot would look like. >The phone should at least always be unlockable by a single switch in the developer settings True. That's a business thing. Not technical. Buy pixels in general for fewer hassles. Also, not just unlockable, but also re-lockable with custom keys. Again, only pixels support this. >the whole idea of a system partition and data partition etc is just stupid It's not. System is readonly. It reduces the attack vector significantly. Also makes block based updates simpler, and allows other security features like dm-verity. If anything, traditional desktop OSes are trying to move towards this direction. Look at Fedora's atomic workstation/silverblue.
userbinator 8y ago
I don't know about now, but for a long time MediaTek was the go-to for Android devices without locked bootloaders. My buying decision was almost entirely based on that (and the surprising availability of leaked documentation for the SoC on Chinese sites.)
- solarkraft 8y ago
  Huh, could you elaborate? From what I know MediaTek has a terrible reputation for not publishing information about their chips.
  - snaky 8y ago
    There is a difference between 'published' and 'available', especially in China.
  - userbinator 8y ago
    They don't, yet Linux sources from them show up with good frequency on GitHub and other sites; and if you search hard enough you could find the full (thousands of pages) documentation, reference designs, schematics, etc. for their SoCs. I've had far less (as in, zero) luck with Qualcomm and Broadcom; they publish sources, but there is basically no documentation beyond that.
m-p-3 8y ago
Xiaomi had to switch to such a system (delayed unlock request) because many of their phone were altered to contain malware/spyware from resellers. Not saying that I agree with the method, but I see why they're doing it.
- voltagex_ 8y ago
  What happens to all those locked devices when the server/company goes away?
  - Mediterraneo10 8y ago
    Most consumers treat smartphones as disposable products that get replaced at least every couple of years or, so if the company goes away, it isn’t a big hassle. Unlike PCs or wifi routers, smartphones are not viewed as something people want to hang on to and use for years and years. (Plus, in Xiaomi's case, the build quality is so poor your phone might not last long anyway.)
kevin_b_er 8y ago
The goal is control and to deny you ownership. The device is not meant to be yours. It is owned and takes its orders from its true owners. It is not to obey you, the physical owner.
pdsouza 8y ago
> But I kinda just want a phone that just starts a linux based operating system like a PC, and lets me do everything I can on my linux PC in a touch-centric way. I wanted almost the same thing so I built Maru: https://maruos.com https://maruos.com Maru runs Linux in a container alongside Android so you can have the best of both worlds. Hook up to an external monitor with a BT keyboard and mouse and you have a full Debian-based desktop at your disposal. Maru only supports older hardware (Nexus 5, Nexus 7) at the moment, but newer devices (Nexus 5X/6P, HTC 10, Moto Z2 Force, Galaxy S9) have working ports on our forum and should have official images available soon: https://groups.google.com/forum/#!forum/maru-os-dev https://groups.google.com/forum/#!forum/maru-os-dev We're an open-source project too, so you can even attempt your own port if you own an unsupported device: https://github.com/maruos/maruos https://github.com/maruos/maruos

pjmlp 8y ago

The PC was an accident, which IBM repented themselves quite heavily, tried to regain with PS2 and failed to do so. If the current trend of UEFI and laptops without any expansion options is any indication, that open PC of yore will fade into a very tiny niche, as computers become appliances.

snaky 8y ago
The previous accident of that kind was UNIX. That's acute, considering an open-source is mainstream today - a couple of accidents is enough to change the world.
- pjmlp 8y ago
  Yes, had Bell Labs not been forbidden to sell it, thus going to the market with a closed source OS, selling it the same price range as VMS, OS/360 and similar systems, the history outcome would have been quite different. Still anyone that has had the pleasure to write portable UNIX code knows that portability is relative.
  - snaky 8y ago
    Maybe UNIX and PC wouldn't be enough actually, without at least four points (half-accidents at least) of that history - RMS, BSD, Sun and Linus. That's quite a fragile chain of events.
    - pjmlp 8y ago
      Agreed.

exDM69 8y ago

These secure boot systems exist because of DRM protection to media that is mandated by the content companies. Their point is to verify that the whole OS from kernel to userspace can't be modified by 3rd parties (such as you, the owner of the device). It boils down to "no secure boot, no DRM, no Netflix 4k for you". At least this was the case when I was still working with consumer electronics a few years ago.

zeta0134 8y ago
At least in the mobile space, I get the feeling that theft of the device factors in here. A lot of carriers advertise some sort of remote lock + wipe mechanism, which isn't guaranteed to work if the device's bootloader is unlocked, allowing an attacker to bypass the feature before it has a chance to run. I have no idea if that's actually the case (I only worked tangential to a retail store's mobile department) so take that with a grain of salt, that's just what I observed the carriers making a big fuss about on the regular. I don't think that excuses the practice either; I'll always be in favor of being in full control of any hardware I'm supposed to trust with my data, but ofc I realize I'm in the minority there.
- drbawb 8y ago
  I'm totally fine w/ there being a disclaimer on bootloader unlocking, e.g: "Warning! Some security features of your device may not work properly w/ secure boot disabled. Visit foo.com/secure-boot to learn more." To a lesser extent I'm OK w/ bootloader unlocks voiding my warranty, esp. since many of these devices ship w/ permanent fuses whereby writing to the wrong MSRs may brick your device. After all that's how my Moto X (2013) worked: I needed a code from Motorola to unlock the bootloader, which in turn required agreeing to a warranty waiver. What's not OK is having a permanently locked bootloader that guarantees my device will be useless after the carrier decides to stop delivering OTA updates in a year or two.
thaumasiotes 8y ago
> It boils down to "no secure boot, no DRM, no Netflix 4k for you". I really can't say I'm worried about the theoretical inability to stream 4k video to a 5" screen. At that size, 4k is just wasting bandwidth.

floatboth 8y ago

> unlockable by a single switch in the developer settings Nexuses/Pixels, OnePlus, Xiaomi's Android One line (Mi A1/A2) do not require unlock codes.

snaky 8y ago
You can unlock the bootloader on almost any smartphone nowadays, but every one of them requires original firmware installed to lock it back.
- veeti 8y ago
  Google Pixel (and Nexus before it) can be locked with custom signing keys.
  - snaky 8y ago
    If you are talking about this https://mjg59.dreamwidth.org/31765.html https://mjg59.dreamwidth.org/31765.html does it still work on recent Pixel devices?
    - bubblethink 8y ago
      Self signing is one of the main reasons to buy a pixel. CopperheadOS (now dead) used that. For aosp builds with self signing, look at rattlesnakeos on github.
JoshuaAshton 8y ago
Yeah I know quite a lot of Android phones do support this, which is why I mentioned it, however some phones still don't have this functionality or require me to mess on with some online/call service to receive and unlock code.
- jstanley 8y ago
  So just buy one that does support it.

fghtr 8y ago

>But I kinda just want a phone that just starts a linux based operating system like a PC, and lets me do everything I can on my linux PC in a touch-centric way. Here you go: https://puri.sm/shop/librem-5/ https://puri.sm/shop/librem-5/ (alternatively, https://neo900.org/ https://neo900.org/)

phh 8y ago

PC bootloader is totally insecure. And no, full-device encryption doesn't protect you much in my opinion. First, full-device encryption is much weaker if you can do offline bruteforce. With a secure boot trust of chain, it is online, and is rate-limited by the TEE (and could be made to destroy after too many tries) Even better, per Android documentation, full-device encryption key is tied to boot public key. So if someone flashes another OS, even if you enter the passphrase, noone will access your data. Also, with a PC, if someone replaces your PC, and changes the OS to simply ask for your passcode and send it back to that someone, you won't notice it. With a proper boot chain of trust (which PCs don't have, except for Librem BIOS), it is evident that the OS has been changed, so you know not to give this device your passcode. Also, boot chain of trust makes it harder to do cold-boot attacks. So globally, having a chain of trust, is much more secure for full-device encryption, because it forces online bruteforce. Considering that usually passwords used on smartphones are much more weaker (many people have 6 digits for their smartphone, vs 10 characters on their computers), the added security seem necessary to me.

snaky 8y ago
Using offline bruteforce at one hundred trillion guesses per second, https://www.grc.com/haystack.htm https://www.grc.com/haystack.htm says you would need a 15 thousand centuries to crack the password '7jk_nhAYTasd76'.
- shittyadmin 8y ago
  Yeah, if you can pick a secure password and the device is always on your person like a smartphone usually is, evil maid attacks are out as are most other blackbag techniques. The big problem is that entering a password like that is a real pain on mobile, especially on device unlock. You could potentially set a different password on boot vs on unlock - that's a tad trickier than the average user is likely to want to deal with, but entirely plausible for the paranoid power user.
  - Forbo 8y ago
    That's exactly how fingerprint locks work on the Pixel. First unlock after boot requires a password, after that fingerprint can be used. It requires password entry about once a day or so as well for additional security.

bubblethink 8y ago

>I mean, why can't they just have a regular bootloader like a PC? Because there are several limitations with the PC boot process. See the heads project for what a reasonably secure PC boot would look like. >The phone should at least always be unlockable by a single switch in the developer settings True. That's a business thing. Not technical. Buy pixels in general for fewer hassles. Also, not just unlockable, but also re-lockable with custom keys. Again, only pixels support this. >the whole idea of a system partition and data partition etc is just stupid It's not. System is readonly. It reduces the attack vector significantly. Also makes block based updates simpler, and allows other security features like dm-verity. If anything, traditional desktop OSes are trying to move towards this direction. Look at Fedora's atomic workstation/silverblue.

userbinator 8y ago

I don't know about now, but for a long time MediaTek was the go-to for Android devices without locked bootloaders. My buying decision was almost entirely based on that (and the surprising availability of leaked documentation for the SoC on Chinese sites.)

solarkraft 8y ago
Huh, could you elaborate? From what I know MediaTek has a terrible reputation for not publishing information about their chips.
- snaky 8y ago
  There is a difference between 'published' and 'available', especially in China.
- userbinator 8y ago
  They don't, yet Linux sources from them show up with good frequency on GitHub and other sites; and if you search hard enough you could find the full (thousands of pages) documentation, reference designs, schematics, etc. for their SoCs. I've had far less (as in, zero) luck with Qualcomm and Broadcom; they publish sources, but there is basically no documentation beyond that.

m-p-3 8y ago

Xiaomi had to switch to such a system (delayed unlock request) because many of their phone were altered to contain malware/spyware from resellers. Not saying that I agree with the method, but I see why they're doing it.

voltagex_ 8y ago
What happens to all those locked devices when the server/company goes away?
- Mediterraneo10 8y ago
  Most consumers treat smartphones as disposable products that get replaced at least every couple of years or, so if the company goes away, it isn’t a big hassle. Unlike PCs or wifi routers, smartphones are not viewed as something people want to hang on to and use for years and years. (Plus, in Xiaomi's case, the build quality is so poor your phone might not last long anyway.)

kevin_b_er 8y ago

The goal is control and to deny you ownership. The device is not meant to be yours. It is owned and takes its orders from its true owners. It is not to obey you, the physical owner.

pdsouza 8y ago

> But I kinda just want a phone that just starts a linux based operating system like a PC, and lets me do everything I can on my linux PC in a touch-centric way. I wanted almost the same thing so I built Maru: https://maruos.com https://maruos.com Maru runs Linux in a container alongside Android so you can have the best of both worlds. Hook up to an external monitor with a BT keyboard and mouse and you have a full Debian-based desktop at your disposal. Maru only supports older hardware (Nexus 5, Nexus 7) at the moment, but newer devices (Nexus 5X/6P, HTC 10, Moto Z2 Force, Galaxy S9) have working ports on our forum and should have official images available soon: https://groups.google.com/forum/#!forum/maru-os-dev https://groups.google.com/forum/#!forum/maru-os-dev We're an open-source project too, so you can even attempt your own port if you own an unsupported device: https://github.com/maruos/maruos https://github.com/maruos/maruos