3 ms·
> Won't unlocking the bootloader make banking apps not work anymore? Depends on how paranoid your bank is. There's this SafetyNet thing that checks for "system
by grishka 6y ago
> Won't unlocking the bootloader make banking apps not work anymore?
Depends on how paranoid your bank is. There's this SafetyNet thing that checks for "system integrity". It's part of Google Services. For now, it's possible to bypass these checks using Magisk, but I've read that Google is testing the new method involving TrustZone — a hardware trusted execution environment within the SoC where you aren't one of the trusted parties.
> Also, how do I do all you said above? (I need a step by step tutorial).
There should be plenty on xda-developers.com
> Also is it reversible?
On Google devices, yes, completely. You can reflash the factory images that Google provides and relock the bootloader. On others... it varies, on Samsung especially.
> Are there any other security implications?
If you leave the bootloader unlocked, anyone with physical access to your device will be able to reboot it into the bootloader and load arbitrary code with OS kernel privileges. From there they'll be able to modify the installed system. They won't be able to read the /data partition [right away] because it's encrypted with your password/pattern.
IMO it's really a shame you can't re-lock the bootloader with your own signing key.
- opencl 6y agoYou can re-lock the bootloader with your own signing key on Pixels. GrapheneOS seems to be the only third party ROM currently taking advantage of it.
- 0xdeadb00f 6y agoThere is another called Replicant IIRC. But it requires you to set up your own build + signing server in AWS.
- skylanh 6y agohttps://github.com/dan-v/rattlesnakeos-stack https://github.com/dan-v/rattlesnakeos-stack I haven't tried it, but I believe part of the reason that AWS is recommended is due to the build time.
- grishka 6y agoTIL about `fastboot flash avb_custom_key`. Certainly better than nothing, but seeing how it shows a warning on each boot in this mode, it most probably trips SafetyNet as well.