4 ms·
The way Google does it seems fine to me. You have to explicitly unlock the bootloader, which wipes all the data. As an extra, if you want to use the phone after
by ehsankia 7y ago
The way Google does it seems fine to me. You have to explicitly unlock the bootloader, which wipes all the data. As an extra, if you want to use the phone after wiping, you need to have the auth of the last user (to avoid reselling of stolen phones). Once you unlock the bootloader, you can do whatever, but the phone explicitly shows that it's unlocked on boot so you know that you know your bootloader is no longer safe.
These seem like a fair compromise.
- scarface74 7y agoAnd how many people would know what “an unlocked boot loader” meant if someone else unlocked it — like an over possessive spouse wanted to install malware or a government actor?
- amiga-workbench 7y agoSo it's literally an education problem? The same issue exists with authentication on the web, if it weren't for normies being unable to wrap their head around it, we could be signing into websites with public key crypto instead of faffing with passwords. Must we continue to drag things out and design for the lowest common denominator?
- scarface74 7y agoIt’s an “education problem” that has been going on at least since the dawn of the web where people had 10 toolbars installed on their browser and adware installed on their computer.
- Wowfunhappy 7y agoThey don't need to know what the symbol means. There's text! https://source.android.com/security/images/boot_orange.png https://source.android.com/security/images/boot_orange.png
- scarface74 7y agoWe have decades of research that people ignore warnings — see Vista UAC. People always click continue. There is so much scare ware out there people have become immune.
- Wowfunhappy 7y agoPeople became immune to UAC because they saw it everywhere, and were trained that it was safe to ignore. Users don't ignore novel warnings, at least not when they're sufficiently noticeable. If you try to visit a site in Google Chrome that Google thinks is hosting malware, they pop up a huge red message saying the site will harm your computer. There is a continue link, but... well, I don't have access to any analytics on this, but I would guess not many people visit those sites.
- scarface74 7y ago“People disregard security warnings on computers because they come at bad times, study finds“ https://www.sciencedaily.com/releases/2016/08/160817142911.htm https://www.sciencedaily.com/releases/2016/08/160817142911.h... Why does everyone on HN act like this phenomena? I’m often talking about the HN bubble and this is another example.
- Wowfunhappy 7y agoIsn't "before the device turns on" a perfect time to display a security warning?
- scarface74 7y agoAnd if they do see the warning? Where will they go to get more information? Will they use their computer? It’s becoming more common for people’s only “computer” being their mobile phone. What do they do when they do get the warning? Do they go to their local non existence “Android store”? Do they ask the clueless CSR from their carrier? Or do they just keep clicking continue like most people do on their computer? How many people in other context like cars ignore warning lights?
- Avery3R 7y agohttps://source.android.com/security/verifiedboot/boot-flow https://source.android.com/security/verifiedboot/boot-flow You can sign your own firmware and re-lock the bootloader. It goes into the yellow state, and re-unlocking will wipe it again.