5 ms·

There will still need to be the option for a locked boot loader though. If I’m Snowden, knowing my boot loader could be unlocked and a key logger side loaded i

There will still need to be the option for a locked boot loader though. If I’m Snowden, knowing my boot loader could be unlocked and a key logger side loaded isn’t reassuring.

causi 5y ago
I'm not aware of any manufacturer who allows bootloader unlocking without also displaying a warning screen every time the phone boots up. Example: https://www.thecustomdroid.com/wp-content/uploads/2019/06/How-to-Unlock-Bootloader-on-OnePlus-7-and-OnePlus-7-Pro.jpg https://www.thecustomdroid.com/wp-content/uploads/2019/06/Ho...
- piaste 5y ago
  My current phone (Xiaomi POCO F2 Pro) only displays a faint lock/unlock icon above the logo while booting. Easy to miss. But that's not really important, because unlocking the bootloader factory resets the device on every Android phone that I know of. AFAIK it's not possible to unlock a bootloader without the owner's knowledge.
  - causi 5y ago
    Even if it's easy to miss, a person like Snowden would be looking out for it.
2Gkashmiri 5y ago
If such snowden like person wants to use such a device, wouldn't he be able to change to lineage os or whatever knowing full well he is now the master of the device or is there malware that persists still ?
- yoavm 5y ago
  Someone could flash a hacked version of lineage when you're not looking.
  - 2Gkashmiri 5y ago
    that is on you
craftinator 5y ago
No, locked bootloader's are the stuff of nightmares. Much rather be able to scratch all memory on the device and reinstall. Perhaps what I mean is "locked bootloaders at POS". Selling them locked should be illegal, but locking them yourself with your own key should be trivial.
- iszomer 5y ago
  How about splitting the difference like locking the bootloader at point of sale with guaranteed period for updates? After the period has lapsed, allow users to unlock the bootloader to extend with custom software upgrades or, a subscription base to continue with original POS policy. This weirdly intersects for the Right to Repair movement, or for consumers whom would rather be conservative on new device purchases and software licenses.
  - HelixEndeavor 5y ago
    Reminds me of the idea I've been thinking about - kind of unrelated - but once a device is officially no longer supported by a company - particularly consoles and online games - they should make the source code available so people can continue from there on their own.
    - mschuster91 5y ago
      Ideally, companies should be forced to deposit everything needed for manufacturing a product - 3D designs, software toolchains, PCBs, BOMs, service tooling - at the national archives to be held in trust. Once the manufacturer ceases supporting a product, everything becomes open source.
      - HelixEndeavor 5y ago
        This is kind of solved by Right to Repair legislation. It would prevent companies from making exclusivity deals and force them to allow this stuff to be sold to the public - not that they have to sell it themselves, but their partners would be free to. I don't know if putting the government in charge of maintaining all of that would be the best idea.
Youden 5y ago
Ironically, Google's own Pixel devices are basically the only ones on the market that allow locking the bootloader with your own key [0]. They even follow the recommended bootflow [1], displaying a warning screen with the hash of the installed ROM when you boot the phone. [0]: https://android.googlesource.com/platform/external/avb/+/master/README.md#pixel-2-and-later https://android.googlesource.com/platform/external/avb/+/mas... [1]: https://android.googlesource.com/platform/external/avb/+/master/README.md#recommended-bootflow https://android.googlesource.com/platform/external/avb/+/mas...
- jefftk 5y ago
  Why is this ironic?
  - rav3ndust 5y ago
    Probably because it effectively means that Google’s own devices are the simplest to “deGoogle.”
kop316 5y ago
In all fairness, a locked bootloader won't help against exploits in the OS: https://news.ycombinator.com/item?id=28516095 https://news.ycombinator.com/item?id=28516095 If I'm Snowden, I would be far more concerned about that.

There will still need to be the option for a locked boot loader though. If I’m Snowden, knowing my boot loader could be unlocked and a key logger side loaded isn’t reassuring.

causi 5y ago

I'm not aware of any manufacturer who allows bootloader unlocking without also displaying a warning screen every time the phone boots up. Example: https://www.thecustomdroid.com/wp-content/uploads/2019/06/How-to-Unlock-Bootloader-on-OnePlus-7-and-OnePlus-7-Pro.jpg https://www.thecustomdroid.com/wp-content/uploads/2019/06/Ho...

piaste 5y ago
My current phone (Xiaomi POCO F2 Pro) only displays a faint lock/unlock icon above the logo while booting. Easy to miss. But that's not really important, because unlocking the bootloader factory resets the device on every Android phone that I know of. AFAIK it's not possible to unlock a bootloader without the owner's knowledge.
- causi 5y ago
  Even if it's easy to miss, a person like Snowden would be looking out for it.

2Gkashmiri 5y ago

If such snowden like person wants to use such a device, wouldn't he be able to change to lineage os or whatever knowing full well he is now the master of the device or is there malware that persists still ?

yoavm 5y ago
Someone could flash a hacked version of lineage when you're not looking.
- 2Gkashmiri 5y ago
  that is on you

craftinator 5y ago

No, locked bootloader's are the stuff of nightmares. Much rather be able to scratch all memory on the device and reinstall. Perhaps what I mean is "locked bootloaders at POS". Selling them locked should be illegal, but locking them yourself with your own key should be trivial.

iszomer 5y ago
How about splitting the difference like locking the bootloader at point of sale with guaranteed period for updates? After the period has lapsed, allow users to unlock the bootloader to extend with custom software upgrades or, a subscription base to continue with original POS policy. This weirdly intersects for the Right to Repair movement, or for consumers whom would rather be conservative on new device purchases and software licenses.
- HelixEndeavor 5y ago
  Reminds me of the idea I've been thinking about - kind of unrelated - but once a device is officially no longer supported by a company - particularly consoles and online games - they should make the source code available so people can continue from there on their own.
  - mschuster91 5y ago
    Ideally, companies should be forced to deposit everything needed for manufacturing a product - 3D designs, software toolchains, PCBs, BOMs, service tooling - at the national archives to be held in trust. Once the manufacturer ceases supporting a product, everything becomes open source.
    - HelixEndeavor 5y ago
      This is kind of solved by Right to Repair legislation. It would prevent companies from making exclusivity deals and force them to allow this stuff to be sold to the public - not that they have to sell it themselves, but their partners would be free to. I don't know if putting the government in charge of maintaining all of that would be the best idea.

Youden 5y ago

Ironically, Google's own Pixel devices are basically the only ones on the market that allow locking the bootloader with your own key [0]. They even follow the recommended bootflow [1], displaying a warning screen with the hash of the installed ROM when you boot the phone. [0]: https://android.googlesource.com/platform/external/avb/+/master/README.md#pixel-2-and-later https://android.googlesource.com/platform/external/avb/+/mas... [1]: https://android.googlesource.com/platform/external/avb/+/master/README.md#recommended-bootflow https://android.googlesource.com/platform/external/avb/+/mas...

jefftk 5y ago
Why is this ironic?
- rav3ndust 5y ago
  Probably because it effectively means that Google’s own devices are the simplest to “deGoogle.”

kop316 5y ago

In all fairness, a locked bootloader won't help against exploits in the OS: https://news.ycombinator.com/item?id=28516095 https://news.ycombinator.com/item?id=28516095 If I'm Snowden, I would be far more concerned about that.