3 ms·

I'm not really familier with the terminology, so maybe you can enlighten me. You can install other operation systems on the Fairphone, but I don't know about re

I'm not really familier with the terminology, so maybe you can enlighten me. You can install other operation systems on the Fairphone, but I don't know about resigning the boot loader chain, but why does that matter?

izacus 3y ago
Android devices use dm-verity to make sure that the OS hasn't been tempered with - bootloader checks signature of first stage bootloader on flash and that one checks the next stage all the way to kernel and contents of the flash. This prevents all kinds of attacks where people could push things onto your phones OS. In desktop world, this is known as "secure boot". Many devices will, however, only accept OS signed by their manufacturer - e.g. Apple iPhones/iPads will only boot an OS signed by Apple and noone else. This is why you can't ever run Linux on an iPhone or iPad. In Android world, many manufacturers allow users to disable this verification (known as "bootloader unlock"). This allows running of non-manufacturer provided OSes (e.g. LineageOS, GrapheneOS, etc.). However, except for Pixels, they don't allow you to supply your own signing key to the bootloader, so you lose the security benefits of the secure boot chain and open yourself to big set of security attacks against your phone. On a Pixel (at least some of them), you can provide your own signing key and reenable secure boot when installing another OS.
- mrweasel 3y ago
  Oh yeah, okay, that pretty silly that you can't do that. If you install a custom OS you're most likely the type of person that cares a lot about security, so not being able to enable secure boot seems weird.
- wkat4242 3y ago
  OnePlus did allow that in fact. CalyxOS was working to implement this functionality, but then OnePlus suddenly removed this feature from their latest update :( The two things were probably not related by the way, because that was also the update where they basically made the OnePlus phones an OPPO with some branding on top (ColorOS faked as OxygenOS). It was really the point where OnePlus as an Enthusiast brand died and is now just an OPPO marketing scheme. Link to the original announcement: https://calyxos.org/news/2022/04/01/fairphone4-oneplus8t-oneplus9-test-builds/ https://calyxos.org/news/2022/04/01/fairphone4-oneplus8t-one... Link to the feature removal by OnePlus: https://calyxos.org/news/2022/07/06/oneplus-android-12-relock-issue/ https://calyxos.org/news/2022/07/06/oneplus-android-12-reloc... Curiously enough this feature does seem to available for the fairphone 4 too! GrapheneOS never tried implementing this for OnePlus or FairPhone because it's not the only reason they stick with Pixels. The Titan security chip offers other benefits they want.

izacus 3y ago

Android devices use dm-verity to make sure that the OS hasn't been tempered with - bootloader checks signature of first stage bootloader on flash and that one checks the next stage all the way to kernel and contents of the flash. This prevents all kinds of attacks where people could push things onto your phones OS. In desktop world, this is known as "secure boot". Many devices will, however, only accept OS signed by their manufacturer - e.g. Apple iPhones/iPads will only boot an OS signed by Apple and noone else. This is why you can't ever run Linux on an iPhone or iPad. In Android world, many manufacturers allow users to disable this verification (known as "bootloader unlock"). This allows running of non-manufacturer provided OSes (e.g. LineageOS, GrapheneOS, etc.). However, except for Pixels, they don't allow you to supply your own signing key to the bootloader, so you lose the security benefits of the secure boot chain and open yourself to big set of security attacks against your phone. On a Pixel (at least some of them), you can provide your own signing key and reenable secure boot when installing another OS.

mrweasel 3y ago
Oh yeah, okay, that pretty silly that you can't do that. If you install a custom OS you're most likely the type of person that cares a lot about security, so not being able to enable secure boot seems weird.
wkat4242 3y ago
OnePlus did allow that in fact. CalyxOS was working to implement this functionality, but then OnePlus suddenly removed this feature from their latest update :( The two things were probably not related by the way, because that was also the update where they basically made the OnePlus phones an OPPO with some branding on top (ColorOS faked as OxygenOS). It was really the point where OnePlus as an Enthusiast brand died and is now just an OPPO marketing scheme. Link to the original announcement: https://calyxos.org/news/2022/04/01/fairphone4-oneplus8t-oneplus9-test-builds/ https://calyxos.org/news/2022/04/01/fairphone4-oneplus8t-one... Link to the feature removal by OnePlus: https://calyxos.org/news/2022/07/06/oneplus-android-12-relock-issue/ https://calyxos.org/news/2022/07/06/oneplus-android-12-reloc... Curiously enough this feature does seem to available for the fairphone 4 too! GrapheneOS never tried implementing this for OnePlus or FairPhone because it's not the only reason they stick with Pixels. The Titan security chip offers other benefits they want.