3 ms·
Unless I'm mistaken, the Pixel 1 blindly accepts whatever pubkey is embedded in the kernel, but displays the warning screen on boot if it's not Google's pubkey
by LukeShu 5y ago
Unless I'm mistaken, the Pixel 1 blindly accepts whatever pubkey is embedded in the kernel, but displays the warning screen on boot if it's not Google's pubkey (to clarify, not a click-through screen, just a temporary splash screen). I guess yeah it's technically Verified Boot, but if it just accepts any key you throw at it, then the security guarantees are a lot less. You can't tell it about your pubkey to get the scare screen to go away, and you can't tell it to block other keys to get the security guarantees.
- cdesai 5y agoTelling even the newer devices about your pubkey doesn't get the scare screen away. You see a Yellow Verified Boot warning meaning the OS is signed and verifies but with a custom set of keys. When you lock the bootloader you block other keys, since fastboot is pretty much disabled when you do that, and the only way to install something would be via OTA updates which would have to be signed with your custom keys. I guess maybe if you're able to get a root exploit and replace the boot image? Not exactly sure what would happen then, need to try.