4 ms·

The rationale for the hoops and waiting period is IIRC that shady sellers were tampering with phones sold through AliExpress etc.

danuker 3y ago
Security, the classic excuse behind reducing freedom.
- delfinom 3y ago
  To be fair, they probably do have to deal with more creative fraud in the Chinese market. They just implemented a rather lazy solution.
- __MatrixMan__ 3y ago
  Gotta secure your flimsy business model against competitors.
- _ea1k 3y ago
  Sometimes its a valid reason. I love the idea of being able to unlock the bootloader. I don't love the idea of someone else being able to do it before the phone gets to me.
  - froh 3y ago
    so it's about end customer security, thanks for elaborating!
  - eidolon_93 3y ago
    > I don't love the idea of someone else being able to do it before the phone gets to me. So how do you feel about PCs then? Because most computers sold doesn't have these draconian protections and apparently that has never been an issue.
    - HWR_14 3y ago
      I believe it has in fact been an issue with several areas of electronics, including PCs, in the past.
    - _23sd 3y ago
      Never been an issue? Just recently there was a LTT review of an Aliexpress laptop [1] where they found the Windows install had been tampered with (mostly because the Windows was pirated). PC or phone or anything, you buy stuff from shady sources it will not be trustworthy. If Xiaomi is/was locking down their phones to try and make purchasing from places like Aliexpress safer, I think that is a losing battle. [1] https://youtube.com/watch?v=Um0l6ZSxfTE https://youtube.com/watch?v=Um0l6ZSxfTE
      - mort96 3y ago
        I bought a laptop from Dell and found the Windows install had been tampered with; there were all sorts of adware and trial software installed. Luckily, since the boot loader wasn't locked, I could install my own, clean OS.
        _23sd 3y ago
        I don’t think that’s the point, when you get a device from Aliexpress that’s been tampered by the retailer (as opposed to the OEM), the bootloader will already be unlocked and you could install a clean OS. That’s okay if you are the one buying the device and somehow trust that the retailer hasn’t messed with the hardware as well, but it doesn’t help the manufacturer that wants to stop retailers from messing with the OS in the first place.
        hulitu 3y ago
        OEM or retailer it is the same thing: the device has been compromised.
    - fsflover 3y ago
      For laptops, it's a solved issue: https://puri.sm/posts/anti-interdiction-update-six-month-retrospective/ https://puri.sm/posts/anti-interdiction-update-six-month-ret....
  - AnthonyMouse 3y ago
    > I love the idea of being able to unlock the bootloader. > I don't love the idea of someone else being able to do it before the phone gets to me. At the time it was their phone, and they can still do it by waiting 30 days. But what does it matter if you're just going to flash your own system anyway? Let them put whatever they want on it as long as you can blow it away and replace it with yours. And if you're not going to flash it yourself, make sure you buy it from a retailer you trust not to befoul it, or buy direct from the manufacturer. If you don't trust them then you have bigger problems.
    - bippihippi1 3y ago
      the preexisting firmware installs the bootloader, unless you mount the memory chips directly to your pc.
      - salawat 3y ago
        Got any info on how that is done? Curious minds wish to know.
      - AnthonyMouse 3y ago
        That isn't a law of nature. The device could easily have a tiny amount of actual ROM the sole purpose of which is to reflash the device, which would also be useful to recover from a bad flash. And if you want to talk about security, the most secure thing is to make all of the storage easily removable so it can be verified and reflashed from a known-clean device. Which would also make it upgradable, at the expense of an imperceptible single-digit number of grams in weight. That they don't do this is the proof that the other thing isn't really done for security.
jifoxym 3y ago
did it solve this problem? I bought my Xiaomi phone from a shady seller who tampered with it to unlock the bootloader, so that I avoid all of this. I'm probably not the only one.
- londons_explore 3y ago
  Some of the AliExpress sellers use this ability to install a custom kernel that reports more RAM and Flash than is installed. Sometimes they report a higher android version number and CPU too, and if you run any popular benchmarks the results will be faked (through binary patching of the benchmark app). Then they sell the phone as a newer/better model than it is, and most users are unaware. If you complain to AliExpress they'll tell you to run AnTuTu or Geekbench, and both of those apps will report fake results.
  - mort96 3y ago
    People do the same with flash drives and hard drives which report more storage space than available. Scam products will always exist. What makes phones so incredibly different from laptops, desktops, hard drives, cars (where people may claim false mileage numbers), or any other product category with specs which can be faked? And why is the solution to lock the boot loader, rather than implementing some tamper evidence system? Show a "This phone has been tampered with!" screen on boot if the boot loader has been unlocked, problem solved.
  - londons_explore 3y ago
    I has an 'Android 13' which turned out to actually be android 4.2, but faking a higher version number. The vast majority of apps won't run on android 4 anymore.
wkat4242 3y ago
So, they just wait a week and then do it? It's not an effective measure.
cduzz 3y ago
So imagine a scenario: 1. crime organization (or governmental org) buys / steals a bunch of phones 2. org opens boxes, tampers with boot loader in such a way that they (and / or the original OEM and / or the original OS vendor) have a persistent remote administration account on phone 3. org then returns phones to supply chain either covertly or off the back of a truck. 4. org leverages remote access to do shady things 5. "the press" finds out that "vendor phones XYZ are trojaned!" and vendor looks like t-mobile for 5-30 hours until people find another cat video to look at. A theoretical justification of this is that phones are stolen all the time from the supply chain. Making lots require remote activation allows the vendor to kill the stolen phones, reducing their resale market in that part of the stolen phone ecosystem. Another theoretical justification is to "protect" the average buyer who just wants a damned phone to look at cat videos on and maybe call their spouse when they're late; they don't wear boots and don't care about loaders. Just Want Cat Videos.
- thomastjeffery 3y ago
  The answer to that should not be to become the shady seller.
  - cduzz 3y ago
    In these modern times I don't think any company actually trusts the contractors that have been hired to make a product. You (some big name company) hire some company to make 10,000 widgets; your contractors may turn around and make 300,000 widgets sell you the 10,000 widgets per the agreement and sell the other 290,000 into other channels. They may sell the ones that didn't pass QA, they may make ones with cheaper parts, etc. How do you stop this? See above - the part has to phone home and you can enable it (or not!) because you've got a registry of which things are legit and which aren't. Also, this lets the companies spy on you. Errr.. Collect telemetry to allow them to improve the product.

danuker 3y ago

Security, the classic excuse behind reducing freedom.

delfinom 3y ago
To be fair, they probably do have to deal with more creative fraud in the Chinese market. They just implemented a rather lazy solution.
__MatrixMan__ 3y ago
Gotta secure your flimsy business model against competitors.
_ea1k 3y ago
Sometimes its a valid reason. I love the idea of being able to unlock the bootloader. I don't love the idea of someone else being able to do it before the phone gets to me.
- froh 3y ago
  so it's about end customer security, thanks for elaborating!
- eidolon_93 3y ago
  > I don't love the idea of someone else being able to do it before the phone gets to me. So how do you feel about PCs then? Because most computers sold doesn't have these draconian protections and apparently that has never been an issue.
  - HWR_14 3y ago
    I believe it has in fact been an issue with several areas of electronics, including PCs, in the past.
  - _23sd 3y ago
    Never been an issue? Just recently there was a LTT review of an Aliexpress laptop [1] where they found the Windows install had been tampered with (mostly because the Windows was pirated). PC or phone or anything, you buy stuff from shady sources it will not be trustworthy. If Xiaomi is/was locking down their phones to try and make purchasing from places like Aliexpress safer, I think that is a losing battle. [1] https://youtube.com/watch?v=Um0l6ZSxfTE https://youtube.com/watch?v=Um0l6ZSxfTE
    - mort96 3y ago
      I bought a laptop from Dell and found the Windows install had been tampered with; there were all sorts of adware and trial software installed. Luckily, since the boot loader wasn't locked, I could install my own, clean OS.
      - _23sd 3y ago
        I don’t think that’s the point, when you get a device from Aliexpress that’s been tampered by the retailer (as opposed to the OEM), the bootloader will already be unlocked and you could install a clean OS. That’s okay if you are the one buying the device and somehow trust that the retailer hasn’t messed with the hardware as well, but it doesn’t help the manufacturer that wants to stop retailers from messing with the OS in the first place.
        hulitu 3y ago
        OEM or retailer it is the same thing: the device has been compromised.
  - fsflover 3y ago
    For laptops, it's a solved issue: https://puri.sm/posts/anti-interdiction-update-six-month-retrospective/ https://puri.sm/posts/anti-interdiction-update-six-month-ret....
- AnthonyMouse 3y ago
  > I love the idea of being able to unlock the bootloader. > I don't love the idea of someone else being able to do it before the phone gets to me. At the time it was their phone, and they can still do it by waiting 30 days. But what does it matter if you're just going to flash your own system anyway? Let them put whatever they want on it as long as you can blow it away and replace it with yours. And if you're not going to flash it yourself, make sure you buy it from a retailer you trust not to befoul it, or buy direct from the manufacturer. If you don't trust them then you have bigger problems.
  - bippihippi1 3y ago
    the preexisting firmware installs the bootloader, unless you mount the memory chips directly to your pc.
    - salawat 3y ago
      Got any info on how that is done? Curious minds wish to know.
    - AnthonyMouse 3y ago
      That isn't a law of nature. The device could easily have a tiny amount of actual ROM the sole purpose of which is to reflash the device, which would also be useful to recover from a bad flash. And if you want to talk about security, the most secure thing is to make all of the storage easily removable so it can be verified and reflashed from a known-clean device. Which would also make it upgradable, at the expense of an imperceptible single-digit number of grams in weight. That they don't do this is the proof that the other thing isn't really done for security.

jifoxym 3y ago

did it solve this problem? I bought my Xiaomi phone from a shady seller who tampered with it to unlock the bootloader, so that I avoid all of this. I'm probably not the only one.

londons_explore 3y ago
Some of the AliExpress sellers use this ability to install a custom kernel that reports more RAM and Flash than is installed. Sometimes they report a higher android version number and CPU too, and if you run any popular benchmarks the results will be faked (through binary patching of the benchmark app). Then they sell the phone as a newer/better model than it is, and most users are unaware. If you complain to AliExpress they'll tell you to run AnTuTu or Geekbench, and both of those apps will report fake results.
- mort96 3y ago
  People do the same with flash drives and hard drives which report more storage space than available. Scam products will always exist. What makes phones so incredibly different from laptops, desktops, hard drives, cars (where people may claim false mileage numbers), or any other product category with specs which can be faked? And why is the solution to lock the boot loader, rather than implementing some tamper evidence system? Show a "This phone has been tampered with!" screen on boot if the boot loader has been unlocked, problem solved.
- londons_explore 3y ago
  I has an 'Android 13' which turned out to actually be android 4.2, but faking a higher version number. The vast majority of apps won't run on android 4 anymore.

wkat4242 3y ago

So, they just wait a week and then do it? It's not an effective measure.

cduzz 3y ago

So imagine a scenario: 1. crime organization (or governmental org) buys / steals a bunch of phones 2. org opens boxes, tampers with boot loader in such a way that they (and / or the original OEM and / or the original OS vendor) have a persistent remote administration account on phone 3. org then returns phones to supply chain either covertly or off the back of a truck. 4. org leverages remote access to do shady things 5. "the press" finds out that "vendor phones XYZ are trojaned!" and vendor looks like t-mobile for 5-30 hours until people find another cat video to look at. A theoretical justification of this is that phones are stolen all the time from the supply chain. Making lots require remote activation allows the vendor to kill the stolen phones, reducing their resale market in that part of the stolen phone ecosystem. Another theoretical justification is to "protect" the average buyer who just wants a damned phone to look at cat videos on and maybe call their spouse when they're late; they don't wear boots and don't care about loaders. Just Want Cat Videos.

thomastjeffery 3y ago
The answer to that should not be to become the shady seller.
- cduzz 3y ago
  In these modern times I don't think any company actually trusts the contractors that have been hired to make a product. You (some big name company) hire some company to make 10,000 widgets; your contractors may turn around and make 300,000 widgets sell you the 10,000 widgets per the agreement and sell the other 290,000 into other channels. They may sell the ones that didn't pass QA, they may make ones with cheaper parts, etc. How do you stop this? See above - the part has to phone home and you can enable it (or not!) because you've got a registry of which things are legit and which aren't. Also, this lets the companies spy on you. Errr.. Collect telemetry to allow them to improve the product.