7 ms·

> But then again, what choice do I have? Unlock the bootloader, install Xposed and this module: https://repo.xposed.info/module/fi.veetipaananen.android.disabl

> But then again, what choice do I have? Unlock the bootloader, install Xposed and this module: https://repo.xposed.info/module/fi.veetipaananen.android.disableflagsecure https://repo.xposed.info/module/fi.veetipaananen.android.dis...

sdwolfz 6y ago
Won't unlocking the bootloader make banking apps not work anymore? Had this issue when I tried LineageOS on my old phone, and I really like the convenience of those apps as opposed to using the website, which is extremely bad. Also, how do I do all you said above? (I need a step by step tutorial). Also is it reversible? Are there any other security implications?
- grishka 6y ago
  > Won't unlocking the bootloader make banking apps not work anymore? Depends on how paranoid your bank is. There's this SafetyNet thing that checks for "system integrity". It's part of Google Services. For now, it's possible to bypass these checks using Magisk, but I've read that Google is testing the new method involving TrustZone — a hardware trusted execution environment within the SoC where you aren't one of the trusted parties. > Also, how do I do all you said above? (I need a step by step tutorial). There should be plenty on xda-developers.com > Also is it reversible? On Google devices, yes, completely. You can reflash the factory images that Google provides and relock the bootloader. On others... it varies, on Samsung especially. > Are there any other security implications? If you leave the bootloader unlocked, anyone with physical access to your device will be able to reboot it into the bootloader and load arbitrary code with OS kernel privileges. From there they'll be able to modify the installed system. They won't be able to read the /data partition [right away] because it's encrypted with your password/pattern. IMO it's really a shame you can't re-lock the bootloader with your own signing key.
  - opencl 6y ago
    You can re-lock the bootloader with your own signing key on Pixels. GrapheneOS seems to be the only third party ROM currently taking advantage of it.
    - 0xdeadb00f 6y ago
      There is another called Replicant IIRC. But it requires you to set up your own build + signing server in AWS.
      - skylanh 6y ago
        https://github.com/dan-v/rattlesnakeos-stack https://github.com/dan-v/rattlesnakeos-stack I haven't tried it, but I believe part of the reason that AWS is recommended is due to the build time.
    - grishka 6y ago
      TIL about `fastboot flash avb_custom_key`. Certainly better than nothing, but seeing how it shows a warning on each boot in this mode, it most probably trips SafetyNet as well.
- swiley 6y ago
  >make banking apps not work anymore If you live in a country where you have to use your phone for banking and can't use the web then you need to talk to your politicians. That seems like a pretty extreme violation of your freedom. As much as I dislike the US at least we don't have that.
  - jlokier 6y ago
    Some banks and bank-like products only make themselves available by mobile app. It's a commercial decision, and seems to have been a trend with some "challenger" banks. I have two of those, and I chose them because of unique banking features (not the mobile app) not offered by other banks which I found valuable. It's nothing to do with the country. To be honest it would be nice to have web access as well (or even phone banking), but we take what we can get.
    - kevin_thibedeau 6y ago
      It's never safe to bank from a computer you can't control. I would always consider a phone to be compromised. These are the richest targets going for exploits so why risk it.
      - jlokier 6y ago
        Although I agree with you, it turns out which banks and similar facilities you use can greatly affect the amount of credit you have access to, how you can use it, and how long the process takes. During this pandemic I've found that to be a big deal, much more important than whatever technology or access method is offered.
    - berdario 6y ago
      I recently opened 3 bank accounts. It's not only the challenger banks: nowadays banks will also encourage you to use their app for 2FA. You can use a proprietary token instead, but you'd have to pay for it (the app instead is free). 2FA sms is not supported with some banks (and that's good). I think the UK is an exception, since for 2 of the banks I had accounts with, they just used a 2nd "memorable" password as "2FA" (avoiding the requirement of a smartphone)
- fulafel 6y ago
  The how depends on the phone model, but there are step by step instructions available for many. Eg https://www.xda-developers.com/google-pixel-4-root-magisk/ https://www.xda-developers.com/google-pixel-4-root-magisk/ Also, if the phone has a vendor supported way of unlocking the bootloader, it will typically also trigger a wipe / factory reset (presumably because to keep DRM enforcers etc happy).
  - Zak 6y ago
    The factory reset is to prevent extracting data from stolen devices. It's obsolete if the device is encrypted.
- dheera 6y ago
  > Won't unlocking the bootloader make banking apps not work anymore? Is it not possible to unlock the bootloader but modify the OS tell apps that the bootloader is locked no matter what? Can we do this with Xposed?
  - ziml77 6y ago
    It's a cat-and-mouse game and unfortunately over the past handful of years it's been a losing battle for root hiding. It's why I gave up bothering with root despite having done it for nearly a decade.
- neurostimulant 6y ago
  Your mileage might vary, but I'm using 4 banking app (one of them even disallow taking screenshot in Android 10) but they are working on custom rom (lineageos) with unlocked bootloader as long as I don't install root.
  - dastx 6y ago
    In case you want to root, you can use magisk hide to prevent banking apps from knowing you've rooted.
- mindslight 6y ago
  The worst I've found is a few apps that complain and push a bullshit scare story at you ("your device is insecure" LOL. My house is technically less secure because I have a key to it, too). Bank accounts are commodities and most banks have no monthly fees with no minimum balances. The easy answer is to choose banks based on who doesn't engage in user-hostile shenanigans (see also: snake oil "2FA"). Moving between accounts over the course of a few months is quite easy, especially if you do not write checks.
jimlikeslimes 6y ago
Google's play store requires screen grabs of payment screens when submitting. They recommend you photograph the phone with a separate device...
- BlueTemplar 6y ago
  :facepalm:
- vagrantJin 6y ago
  All those highly paid, highly educated people really and truly believe this to be a solution?
  - exikyut 6y ago
    Yes. Taking a photo with a separate device is reasonable evidence you're not breaking secure boot et al. If I understand correctly.
    - warent 6y ago
      that can't be true because nothing would stop them from taking a screencap and then photoshopping it over a different picture
      - yencabulator 6y ago
        Or just displaying whatever graphic they want full screen on a phone and taking a photo of that.
    - yholio 6y ago
      It's as if the last 30 years of technical evolution never happened and we are back at faxing signed forms and for extra security and applying triple rot-13 to guarantee no unauthorized access.
      - darepublic 6y ago
inquirerofsorts 6y ago
> Unlock the bootloader A dangerous game on anything other than Xiaomi phones these days, the only company to provide official bootloader unlock software, but yeah otherwise, go download it from some shady website and not have a care in the world about the most sensitive device you own. > install Xposed Last updated 2014 :\ You'd be safer shooting heroin into your eyeballs than installing Android root software from 6 years ago. How on Earth is this advice allowed here?
- inquirerofsorts 6y ago
  Prove me wrong anytime folks, I'm sure you can at least flail around and try, or at least mash the squeal button that you all like so much. How exactly do you unlock bootloaders from modern phones (past 2 years)? You get jailbreaks from the internet and sideload them right? Do you disassemble the binary code? Does it void your warranty? Which mobile device manufacturers offer official bootloader unlocks today? There's only one I know of. Did i happen to mention the big bad China company in a good light to warrant such disdain for my as yet undisputed comment? Is that the problem here? [:)] https://repo.xposed.info/module-overview https://repo.xposed.info/module-overview
  - pmontra 6y ago
    My Samsung A40 from 2019 has an unlock bootloader option in the Developer Options. I didn't check what it does neither I googled it but it's promising.
    - BenjiWiebe 6y ago
      The presence of the "Allow OEM bootloader unlock" is NOT an indication that the bootloader is unlockable, sadly.
      - j16sdiz 6y ago
        Most samsung phone are unlockable. But it have a e-fuse to prevent you re-locking it
dheera 6y ago
Does Xposed support Android 11 yet? Can anyone vouch for this Xposed alternative that seems to be more on top of Android releases than Xposed, but also seems closed source? https://taichi.cool/ https://taichi.cool/

sdwolfz 6y ago

Won't unlocking the bootloader make banking apps not work anymore? Had this issue when I tried LineageOS on my old phone, and I really like the convenience of those apps as opposed to using the website, which is extremely bad. Also, how do I do all you said above? (I need a step by step tutorial). Also is it reversible? Are there any other security implications?

grishka 6y ago
> Won't unlocking the bootloader make banking apps not work anymore? Depends on how paranoid your bank is. There's this SafetyNet thing that checks for "system integrity". It's part of Google Services. For now, it's possible to bypass these checks using Magisk, but I've read that Google is testing the new method involving TrustZone — a hardware trusted execution environment within the SoC where you aren't one of the trusted parties. > Also, how do I do all you said above? (I need a step by step tutorial). There should be plenty on xda-developers.com > Also is it reversible? On Google devices, yes, completely. You can reflash the factory images that Google provides and relock the bootloader. On others... it varies, on Samsung especially. > Are there any other security implications? If you leave the bootloader unlocked, anyone with physical access to your device will be able to reboot it into the bootloader and load arbitrary code with OS kernel privileges. From there they'll be able to modify the installed system. They won't be able to read the /data partition [right away] because it's encrypted with your password/pattern. IMO it's really a shame you can't re-lock the bootloader with your own signing key.
- opencl 6y ago
  You can re-lock the bootloader with your own signing key on Pixels. GrapheneOS seems to be the only third party ROM currently taking advantage of it.
  - 0xdeadb00f 6y ago
    There is another called Replicant IIRC. But it requires you to set up your own build + signing server in AWS.
    - skylanh 6y ago
      https://github.com/dan-v/rattlesnakeos-stack https://github.com/dan-v/rattlesnakeos-stack I haven't tried it, but I believe part of the reason that AWS is recommended is due to the build time.
  - grishka 6y ago
    TIL about `fastboot flash avb_custom_key`. Certainly better than nothing, but seeing how it shows a warning on each boot in this mode, it most probably trips SafetyNet as well.
swiley 6y ago
>make banking apps not work anymore If you live in a country where you have to use your phone for banking and can't use the web then you need to talk to your politicians. That seems like a pretty extreme violation of your freedom. As much as I dislike the US at least we don't have that.
- jlokier 6y ago
  Some banks and bank-like products only make themselves available by mobile app. It's a commercial decision, and seems to have been a trend with some "challenger" banks. I have two of those, and I chose them because of unique banking features (not the mobile app) not offered by other banks which I found valuable. It's nothing to do with the country. To be honest it would be nice to have web access as well (or even phone banking), but we take what we can get.
  - kevin_thibedeau 6y ago
    It's never safe to bank from a computer you can't control. I would always consider a phone to be compromised. These are the richest targets going for exploits so why risk it.
    - jlokier 6y ago
      Although I agree with you, it turns out which banks and similar facilities you use can greatly affect the amount of credit you have access to, how you can use it, and how long the process takes. During this pandemic I've found that to be a big deal, much more important than whatever technology or access method is offered.
  - berdario 6y ago
    I recently opened 3 bank accounts. It's not only the challenger banks: nowadays banks will also encourage you to use their app for 2FA. You can use a proprietary token instead, but you'd have to pay for it (the app instead is free). 2FA sms is not supported with some banks (and that's good). I think the UK is an exception, since for 2 of the banks I had accounts with, they just used a 2nd "memorable" password as "2FA" (avoiding the requirement of a smartphone)
fulafel 6y ago
The how depends on the phone model, but there are step by step instructions available for many. Eg https://www.xda-developers.com/google-pixel-4-root-magisk/ https://www.xda-developers.com/google-pixel-4-root-magisk/ Also, if the phone has a vendor supported way of unlocking the bootloader, it will typically also trigger a wipe / factory reset (presumably because to keep DRM enforcers etc happy).
- Zak 6y ago
  The factory reset is to prevent extracting data from stolen devices. It's obsolete if the device is encrypted.
dheera 6y ago
> Won't unlocking the bootloader make banking apps not work anymore? Is it not possible to unlock the bootloader but modify the OS tell apps that the bootloader is locked no matter what? Can we do this with Xposed?
- ziml77 6y ago
  It's a cat-and-mouse game and unfortunately over the past handful of years it's been a losing battle for root hiding. It's why I gave up bothering with root despite having done it for nearly a decade.
neurostimulant 6y ago
Your mileage might vary, but I'm using 4 banking app (one of them even disallow taking screenshot in Android 10) but they are working on custom rom (lineageos) with unlocked bootloader as long as I don't install root.
- dastx 6y ago
  In case you want to root, you can use magisk hide to prevent banking apps from knowing you've rooted.
mindslight 6y ago
The worst I've found is a few apps that complain and push a bullshit scare story at you ("your device is insecure" LOL. My house is technically less secure because I have a key to it, too). Bank accounts are commodities and most banks have no monthly fees with no minimum balances. The easy answer is to choose banks based on who doesn't engage in user-hostile shenanigans (see also: snake oil "2FA"). Moving between accounts over the course of a few months is quite easy, especially if you do not write checks.

jimlikeslimes 6y ago

Google's play store requires screen grabs of payment screens when submitting. They recommend you photograph the phone with a separate device...

BlueTemplar 6y ago
:facepalm:
vagrantJin 6y ago
All those highly paid, highly educated people really and truly believe this to be a solution?
- exikyut 6y ago
  Yes. Taking a photo with a separate device is reasonable evidence you're not breaking secure boot et al. If I understand correctly.
  - warent 6y ago
    that can't be true because nothing would stop them from taking a screencap and then photoshopping it over a different picture
    - yencabulator 6y ago
      Or just displaying whatever graphic they want full screen on a phone and taking a photo of that.
  - yholio 6y ago
    It's as if the last 30 years of technical evolution never happened and we are back at faxing signed forms and for extra security and applying triple rot-13 to guarantee no unauthorized access.
    - darepublic 6y ago

inquirerofsorts 6y ago

> Unlock the bootloader A dangerous game on anything other than Xiaomi phones these days, the only company to provide official bootloader unlock software, but yeah otherwise, go download it from some shady website and not have a care in the world about the most sensitive device you own. > install Xposed Last updated 2014 :\ You'd be safer shooting heroin into your eyeballs than installing Android root software from 6 years ago. How on Earth is this advice allowed here?

inquirerofsorts 6y ago
Prove me wrong anytime folks, I'm sure you can at least flail around and try, or at least mash the squeal button that you all like so much. How exactly do you unlock bootloaders from modern phones (past 2 years)? You get jailbreaks from the internet and sideload them right? Do you disassemble the binary code? Does it void your warranty? Which mobile device manufacturers offer official bootloader unlocks today? There's only one I know of. Did i happen to mention the big bad China company in a good light to warrant such disdain for my as yet undisputed comment? Is that the problem here? [:)] https://repo.xposed.info/module-overview https://repo.xposed.info/module-overview
- pmontra 6y ago
  My Samsung A40 from 2019 has an unlock bootloader option in the Developer Options. I didn't check what it does neither I googled it but it's promising.
  - BenjiWiebe 6y ago
    The presence of the "Allow OEM bootloader unlock" is NOT an indication that the bootloader is unlockable, sadly.
    - j16sdiz 6y ago
      Most samsung phone are unlockable. But it have a e-fuse to prevent you re-locking it

dheera 6y ago

Does Xposed support Android 11 yet? Can anyone vouch for this Xposed alternative that seems to be more on top of Android releases than Xposed, but also seems closed source? https://taichi.cool/ https://taichi.cool/