5 ms·

Won't unlocking the bootloader make banking apps not work anymore? Had this issue when I tried LineageOS on my old phone, and I really like the convenience of t

Won't unlocking the bootloader make banking apps not work anymore? Had this issue when I tried LineageOS on my old phone, and I really like the convenience of those apps as opposed to using the website, which is extremely bad. Also, how do I do all you said above? (I need a step by step tutorial). Also is it reversible? Are there any other security implications?

grishka 6y ago
> Won't unlocking the bootloader make banking apps not work anymore? Depends on how paranoid your bank is. There's this SafetyNet thing that checks for "system integrity". It's part of Google Services. For now, it's possible to bypass these checks using Magisk, but I've read that Google is testing the new method involving TrustZone — a hardware trusted execution environment within the SoC where you aren't one of the trusted parties. > Also, how do I do all you said above? (I need a step by step tutorial). There should be plenty on xda-developers.com > Also is it reversible? On Google devices, yes, completely. You can reflash the factory images that Google provides and relock the bootloader. On others... it varies, on Samsung especially. > Are there any other security implications? If you leave the bootloader unlocked, anyone with physical access to your device will be able to reboot it into the bootloader and load arbitrary code with OS kernel privileges. From there they'll be able to modify the installed system. They won't be able to read the /data partition [right away] because it's encrypted with your password/pattern. IMO it's really a shame you can't re-lock the bootloader with your own signing key.
- opencl 6y ago
  You can re-lock the bootloader with your own signing key on Pixels. GrapheneOS seems to be the only third party ROM currently taking advantage of it.
  - 0xdeadb00f 6y ago
    There is another called Replicant IIRC. But it requires you to set up your own build + signing server in AWS.
    - skylanh 6y ago
      https://github.com/dan-v/rattlesnakeos-stack https://github.com/dan-v/rattlesnakeos-stack I haven't tried it, but I believe part of the reason that AWS is recommended is due to the build time.
  - grishka 6y ago
    TIL about `fastboot flash avb_custom_key`. Certainly better than nothing, but seeing how it shows a warning on each boot in this mode, it most probably trips SafetyNet as well.
swiley 6y ago
>make banking apps not work anymore If you live in a country where you have to use your phone for banking and can't use the web then you need to talk to your politicians. That seems like a pretty extreme violation of your freedom. As much as I dislike the US at least we don't have that.
- jlokier 6y ago
  Some banks and bank-like products only make themselves available by mobile app. It's a commercial decision, and seems to have been a trend with some "challenger" banks. I have two of those, and I chose them because of unique banking features (not the mobile app) not offered by other banks which I found valuable. It's nothing to do with the country. To be honest it would be nice to have web access as well (or even phone banking), but we take what we can get.
  - kevin_thibedeau 6y ago
    It's never safe to bank from a computer you can't control. I would always consider a phone to be compromised. These are the richest targets going for exploits so why risk it.
    - jlokier 6y ago
      Although I agree with you, it turns out which banks and similar facilities you use can greatly affect the amount of credit you have access to, how you can use it, and how long the process takes. During this pandemic I've found that to be a big deal, much more important than whatever technology or access method is offered.
  - berdario 6y ago
    I recently opened 3 bank accounts. It's not only the challenger banks: nowadays banks will also encourage you to use their app for 2FA. You can use a proprietary token instead, but you'd have to pay for it (the app instead is free). 2FA sms is not supported with some banks (and that's good). I think the UK is an exception, since for 2 of the banks I had accounts with, they just used a 2nd "memorable" password as "2FA" (avoiding the requirement of a smartphone)
fulafel 6y ago
The how depends on the phone model, but there are step by step instructions available for many. Eg https://www.xda-developers.com/google-pixel-4-root-magisk/ https://www.xda-developers.com/google-pixel-4-root-magisk/ Also, if the phone has a vendor supported way of unlocking the bootloader, it will typically also trigger a wipe / factory reset (presumably because to keep DRM enforcers etc happy).
- Zak 6y ago
  The factory reset is to prevent extracting data from stolen devices. It's obsolete if the device is encrypted.
dheera 6y ago
> Won't unlocking the bootloader make banking apps not work anymore? Is it not possible to unlock the bootloader but modify the OS tell apps that the bootloader is locked no matter what? Can we do this with Xposed?
- ziml77 6y ago
  It's a cat-and-mouse game and unfortunately over the past handful of years it's been a losing battle for root hiding. It's why I gave up bothering with root despite having done it for nearly a decade.
neurostimulant 6y ago
Your mileage might vary, but I'm using 4 banking app (one of them even disallow taking screenshot in Android 10) but they are working on custom rom (lineageos) with unlocked bootloader as long as I don't install root.
- dastx 6y ago
  In case you want to root, you can use magisk hide to prevent banking apps from knowing you've rooted.
mindslight 6y ago
The worst I've found is a few apps that complain and push a bullshit scare story at you ("your device is insecure" LOL. My house is technically less secure because I have a key to it, too). Bank accounts are commodities and most banks have no monthly fees with no minimum balances. The easy answer is to choose banks based on who doesn't engage in user-hostile shenanigans (see also: snake oil "2FA"). Moving between accounts over the course of a few months is quite easy, especially if you do not write checks.

grishka 6y ago

> Won't unlocking the bootloader make banking apps not work anymore? Depends on how paranoid your bank is. There's this SafetyNet thing that checks for "system integrity". It's part of Google Services. For now, it's possible to bypass these checks using Magisk, but I've read that Google is testing the new method involving TrustZone — a hardware trusted execution environment within the SoC where you aren't one of the trusted parties. > Also, how do I do all you said above? (I need a step by step tutorial). There should be plenty on xda-developers.com > Also is it reversible? On Google devices, yes, completely. You can reflash the factory images that Google provides and relock the bootloader. On others... it varies, on Samsung especially. > Are there any other security implications? If you leave the bootloader unlocked, anyone with physical access to your device will be able to reboot it into the bootloader and load arbitrary code with OS kernel privileges. From there they'll be able to modify the installed system. They won't be able to read the /data partition [right away] because it's encrypted with your password/pattern. IMO it's really a shame you can't re-lock the bootloader with your own signing key.

opencl 6y ago
You can re-lock the bootloader with your own signing key on Pixels. GrapheneOS seems to be the only third party ROM currently taking advantage of it.
- 0xdeadb00f 6y ago
  There is another called Replicant IIRC. But it requires you to set up your own build + signing server in AWS.
  - skylanh 6y ago
    https://github.com/dan-v/rattlesnakeos-stack https://github.com/dan-v/rattlesnakeos-stack I haven't tried it, but I believe part of the reason that AWS is recommended is due to the build time.
- grishka 6y ago
  TIL about `fastboot flash avb_custom_key`. Certainly better than nothing, but seeing how it shows a warning on each boot in this mode, it most probably trips SafetyNet as well.

swiley 6y ago

>make banking apps not work anymore If you live in a country where you have to use your phone for banking and can't use the web then you need to talk to your politicians. That seems like a pretty extreme violation of your freedom. As much as I dislike the US at least we don't have that.

jlokier 6y ago
Some banks and bank-like products only make themselves available by mobile app. It's a commercial decision, and seems to have been a trend with some "challenger" banks. I have two of those, and I chose them because of unique banking features (not the mobile app) not offered by other banks which I found valuable. It's nothing to do with the country. To be honest it would be nice to have web access as well (or even phone banking), but we take what we can get.
- kevin_thibedeau 6y ago
  It's never safe to bank from a computer you can't control. I would always consider a phone to be compromised. These are the richest targets going for exploits so why risk it.
  - jlokier 6y ago
    Although I agree with you, it turns out which banks and similar facilities you use can greatly affect the amount of credit you have access to, how you can use it, and how long the process takes. During this pandemic I've found that to be a big deal, much more important than whatever technology or access method is offered.
- berdario 6y ago
  I recently opened 3 bank accounts. It's not only the challenger banks: nowadays banks will also encourage you to use their app for 2FA. You can use a proprietary token instead, but you'd have to pay for it (the app instead is free). 2FA sms is not supported with some banks (and that's good). I think the UK is an exception, since for 2 of the banks I had accounts with, they just used a 2nd "memorable" password as "2FA" (avoiding the requirement of a smartphone)

fulafel 6y ago

The how depends on the phone model, but there are step by step instructions available for many. Eg https://www.xda-developers.com/google-pixel-4-root-magisk/ https://www.xda-developers.com/google-pixel-4-root-magisk/ Also, if the phone has a vendor supported way of unlocking the bootloader, it will typically also trigger a wipe / factory reset (presumably because to keep DRM enforcers etc happy).

Zak 6y ago
The factory reset is to prevent extracting data from stolen devices. It's obsolete if the device is encrypted.

dheera 6y ago

> Won't unlocking the bootloader make banking apps not work anymore? Is it not possible to unlock the bootloader but modify the OS tell apps that the bootloader is locked no matter what? Can we do this with Xposed?

ziml77 6y ago
It's a cat-and-mouse game and unfortunately over the past handful of years it's been a losing battle for root hiding. It's why I gave up bothering with root despite having done it for nearly a decade.

neurostimulant 6y ago

Your mileage might vary, but I'm using 4 banking app (one of them even disallow taking screenshot in Android 10) but they are working on custom rom (lineageos) with unlocked bootloader as long as I don't install root.

dastx 6y ago
In case you want to root, you can use magisk hide to prevent banking apps from knowing you've rooted.

mindslight 6y ago

The worst I've found is a few apps that complain and push a bullshit scare story at you ("your device is insecure" LOL. My house is technically less secure because I have a key to it, too). Bank accounts are commodities and most banks have no monthly fees with no minimum balances. The easy answer is to choose banks based on who doesn't engage in user-hostile shenanigans (see also: snake oil "2FA"). Moving between accounts over the course of a few months is quite easy, especially if you do not write checks.