4 ms·

Google phones allow re-locking the bootloader with your own key, except it still results in a warning during boot, and there's no way you're passing SafetyNet w

Google phones allow re-locking the bootloader with your own key, except it still results in a warning during boot, and there's no way you're passing SafetyNet with this, at least not without hacks like Magisk. Also even when you unlock the bootloader, the TrustZone OS, which runs with hypervisor permissions and manages all the exciting things like DRM and SafetyNet itself, is still off limits for you.

sangnoir 5y ago
> Google phones allow re-locking the bootloader with your own key, except it still results in a warning during boot The warning is a great thing for security: I'd appreciate it if my phone showed me that warning after I've surrendered it to the border control agent (alternatively, a sketchy repair shop), or bought it pre-owned, or if I "lost" it and gets returned to me.
- grishka 5y ago
  Let's start with the fact that unlocking the bootloader wipes the entire /data partition to prevent this exact scenario from happening.
  - feikname 5y ago
    I wish I could have thought of that argument on a previous discussion about iPhone/ iPad jailbreak discussion thread
  - sangnoir 5y ago
    That'a a great point, and you're correct on the impracticality of the evil-maid attack. However, my point remains when it comes to less-than-honest repair shops or second-hand sales where wiped devices are not suspicious. I want to know if my bootloader/kernel may have been tampered with before I am able to trust the apps.
mschuster91 5y ago
There is a fix for SafetyNet - it forces the client-side library to assume that there is no hardware co-processor.
- grishka 5y ago
  It's bound to break in the future. Google will stop, if didn't already, certifying devices that lack the TEE. The issue I'm pointing out is that this device integrity thing exists at all, and that Google ends up having more control over the device and its capabilities than its legitimate owner.

sangnoir 5y ago

> Google phones allow re-locking the bootloader with your own key, except it still results in a warning during boot The warning is a great thing for security: I'd appreciate it if my phone showed me that warning after I've surrendered it to the border control agent (alternatively, a sketchy repair shop), or bought it pre-owned, or if I "lost" it and gets returned to me.

grishka 5y ago
Let's start with the fact that unlocking the bootloader wipes the entire /data partition to prevent this exact scenario from happening.
- feikname 5y ago
  I wish I could have thought of that argument on a previous discussion about iPhone/ iPad jailbreak discussion thread
- sangnoir 5y ago
  That'a a great point, and you're correct on the impracticality of the evil-maid attack. However, my point remains when it comes to less-than-honest repair shops or second-hand sales where wiped devices are not suspicious. I want to know if my bootloader/kernel may have been tampered with before I am able to trust the apps.

mschuster91 5y ago

There is a fix for SafetyNet - it forces the client-side library to assume that there is no hardware co-processor.

grishka 5y ago
It's bound to break in the future. Google will stop, if didn't already, certifying devices that lack the TEE. The issue I'm pointing out is that this device integrity thing exists at all, and that Google ends up having more control over the device and its capabilities than its legitimate owner.