5 ms·

As usual, security is used as an excuse to lock down more than is necessary. To prevent the supply chain attack you mention, the boot lock just has to be tamper

As usual, security is used as an excuse to lock down more than is necessary. To prevent the supply chain attack you mention, the boot lock just has to be tamper evident, such as showing a "Bootloader unlocked" message during boot. As is already the case in some phones. Additionally, a way to reset to a factory-verified state could undo such an attack. Warranty could also easily be achieved by flipping a non-reversible bit that the phone was unlocked at least once. Though even if it couldn't, warranty troubles are not a justification for user-hostile behavior. If it were, they'd use it for all sorts of invasive logging/spying with the excuse they have to know if you used your phone in a way not covered by warranty.

jvanderbot 3y ago
Pixel's are locked down a very tiny bit, and I don't think this is some kind of dystopian over-reach with security as an excuse. For all the security listed in this thread the whole "I must connect to the internet once" problem is a very fair tradeoff from the user's perspective.
- pessimizer 3y ago
  > Pixel's are locked down a very tiny bit Other people might instead say "Pixels are locked down." > I don't think this is some kind of dystopian over-reach with security as an excuse. Why? > "I must connect to the internet once" problem is a very fair tradeoff from the user's perspective. Speak for yourself.
  - jvanderbot 3y ago
    > Speak for yourself. I am, that's what a "comment" is. And the second (I dont think...) follows from the first (very tiny bit). I'd just be repeating myself. This is opinion-based. We just disagree, that's fine.
  - williamDafoe 3y ago
    In return for this feature a class of lower income users are able to buy hundreds of millions of phones and pay for them over an extended period using monthly payments on their phone account. This is the trade-off Google makes.
- Bran_son 3y ago
  > "I must connect to the internet once" problem is a very fair tradeoff Very fair. All Google requires is this: a simple offering of earth and water. A token of submission to its will.
- ouid 3y ago
  The internet is not a thing you connect to, what you must actually do is register your intent to disable the bootloader with an adversarially controlled server, and that server must respond with a yes.
  - jvanderbot 3y ago
    If the root comment is to be believed, this (connecting via the internet to Google's servers), is required to provide additional security. I'm just taking that as true and deciding that connecting to the provider of my phone's hardware and software _once_ as a purchaser of their hardware, is fine for me. I also imagine it's not too burdensome for others. Scenarios in which that's not possible are hypothetical (disaster, totalitarian takeover, alien invasion, sudden policy change), and I'm fine calculating that into the risk calculus and deciding that, yep I don't mind driving home and unlocking it the same day I bought it and praying nothing changes in their policy during the drive. That's basically what I did. We can disagree on this, but it has worked out OK so far.
    - deleted 3y ago
      [deleted]
  - deleted 3y ago
    [deleted]
- Zak 3y ago
  One of the problems with this is that Google can change the behavior at any time. We have no shortage of examples of big tech companies changing something that's valuable to users because it no longer aligned with their business goals.
- yellowapple 3y ago
  And what happens when that server on the Internet stops authorizing bootloader unlocks, or disappears entirely?
  - williamDafoe 3y ago
    This would only be a problem not when you first buy the phone but only if you buy a very very old used phone that has never had the OS replaced and google has exited the phone business and if you wanted to replace the OS.
  - jvanderbot 3y ago
    Unlock it just after you buy it.
rezonant 3y ago
It is already the case with Pixel as others have described. https://www.androidauthority.com/wp-content/uploads/2018/10/Pixel-3-bootloader-unlocked.jpg.webp https://www.androidauthority.com/wp-content/uploads/2018/10/... And the warranty thing is moot, unlock does not void Pixel's warranty

jvanderbot 3y ago

Pixel's are locked down a very tiny bit, and I don't think this is some kind of dystopian over-reach with security as an excuse. For all the security listed in this thread the whole "I must connect to the internet once" problem is a very fair tradeoff from the user's perspective.

pessimizer 3y ago
> Pixel's are locked down a very tiny bit Other people might instead say "Pixels are locked down." > I don't think this is some kind of dystopian over-reach with security as an excuse. Why? > "I must connect to the internet once" problem is a very fair tradeoff from the user's perspective. Speak for yourself.
- jvanderbot 3y ago
  > Speak for yourself. I am, that's what a "comment" is. And the second (I dont think...) follows from the first (very tiny bit). I'd just be repeating myself. This is opinion-based. We just disagree, that's fine.
- williamDafoe 3y ago
  In return for this feature a class of lower income users are able to buy hundreds of millions of phones and pay for them over an extended period using monthly payments on their phone account. This is the trade-off Google makes.
Bran_son 3y ago
> "I must connect to the internet once" problem is a very fair tradeoff Very fair. All Google requires is this: a simple offering of earth and water. A token of submission to its will.
ouid 3y ago
The internet is not a thing you connect to, what you must actually do is register your intent to disable the bootloader with an adversarially controlled server, and that server must respond with a yes.
- jvanderbot 3y ago
  If the root comment is to be believed, this (connecting via the internet to Google's servers), is required to provide additional security. I'm just taking that as true and deciding that connecting to the provider of my phone's hardware and software _once_ as a purchaser of their hardware, is fine for me. I also imagine it's not too burdensome for others. Scenarios in which that's not possible are hypothetical (disaster, totalitarian takeover, alien invasion, sudden policy change), and I'm fine calculating that into the risk calculus and deciding that, yep I don't mind driving home and unlocking it the same day I bought it and praying nothing changes in their policy during the drive. That's basically what I did. We can disagree on this, but it has worked out OK so far.
  - deleted 3y ago
    [deleted]
- deleted 3y ago
  [deleted]
Zak 3y ago
One of the problems with this is that Google can change the behavior at any time. We have no shortage of examples of big tech companies changing something that's valuable to users because it no longer aligned with their business goals.
yellowapple 3y ago
And what happens when that server on the Internet stops authorizing bootloader unlocks, or disappears entirely?
- williamDafoe 3y ago
  This would only be a problem not when you first buy the phone but only if you buy a very very old used phone that has never had the OS replaced and google has exited the phone business and if you wanted to replace the OS.
- jvanderbot 3y ago
  Unlock it just after you buy it.

rezonant 3y ago

It is already the case with Pixel as others have described. https://www.androidauthority.com/wp-content/uploads/2018/10/Pixel-3-bootloader-unlocked.jpg.webp https://www.androidauthority.com/wp-content/uploads/2018/10/... And the warranty thing is moot, unlock does not void Pixel's warranty