6 ms·

Most vendors (at some level) allow flashing custom distributions, as long as you didn't buy that device from carrier: https://github.com/zenfyrdev/bootloader-un

by maxloh 1y ago

Most vendors (at some level) allow flashing custom distributions, as long as you didn't buy that device from carrier: https://github.com/zenfyrdev/bootloader-unlock-wall-of-shame/ https://github.com/zenfyrdev/bootloader-unlock-wall-of-shame... You will lose DRM-based apps (e.g. Netflix), Payment apps, and bank apps though.

xyzal 1y ago
Not in markets without significant Huawei and Xiaomi presence. Local banks (Czech Republic) are not using integrity APIs to keep being usable for most clients.
Xelbair 1y ago
That small little caveat already makes it a non-option
nvdr 1y ago
Most DRM / banking apps work fine for me through the browser and you can add them to your home screen. Android / Samsung Pay will stop working, but if you have a Garmin watch, you can still pay with that.
- fcpk 1y ago
  But this is changing. Already in multiple countries(and soon possibly EU wide) there will be only play integrity(strong verdicts) to enforce availability of many services(if not using ios, which is the same locked in syndrome). Yes some banks still allow classic clunky 2FA(sms, card readers, sometimes SIM generators) but it'll all eventually go away in favor of "locked and favored" os unless legislation fights against it.
- maxloh 1y ago
  Only for now. Google did push the Web Environment Integrity API, which is basically "Play Integrity API for Chrome," that helps websites check if the OS, browser, or installed extensions are "safe". Fortunately, they backed off and decided to abandon the proposal after massive backlash. But we don't know when we will see a 2.0 version of that.
heavyset_go 1y ago
Even phones from Motorola require you to literally ask permission to unlock your bootloader via a form on their website, which they then unlock remotely or you enter some generated code. Other manufacturers do the same, where you have to wait a period of like 45 days before being able to unlock, and then have to ask permission on their website to unlock your bootloader.
- munchlax 1y ago
  And good lock unlocking anything over 5 years old because the updated website doesn't support what you've got. Been there, it sucks.
  - codedokode 1y ago
    To be fair, for "anything over 5 years old" you can probably find a privilege escalation exploit.
    - wiz21c 1y ago
      the question is not "being able to", the question is "being able to with a reasonable effort". wandering the web to find an exploit is way beyond my spare time.
    - VagabundoP 1y ago
      That might get you root but not a bootloader unlock.
      - kube-system 1y ago
        There are privilege escalation CVEs in bootloader code too. I remember unlocking some very early locked bootloaders this way in the early days of android.
        VagabundoP 1y ago
        So much rarer now. Its getting more and more locked down unfortunately.
safety1st 1y ago
This is the place where I think lawmakers needs to be involved. Bearing in mind that laws aren't engineering specs, being able to pay for things and use a bank are about as close to fundamental rights as anything is for participants in society. If you have to buy a second device to use Netflix, so be it, but we need laws that guarantee people can make digital payments without Apple or Google's permission. There are societies today (I live in one) where some businesses are starting to accept payment only through a banking or payment app, no cash, no card, nothing else. And these apps will only function in the very narrow circumstances of "I bought a device which runs software from one of two American tech monopolies and follow all their frequently changing rules for using various software that's unrelated to the payment I need to make." This limitation is mostly in place due to the banks believing it will make things more secure. Security is important, but not important enough that you get to start denying innocent people the ability to make payments or exile them from the banking system because they had some kind of dispute with Apple or Google. Governments need to step in with access mandates here, otherwise this problem WILL come to a jurisdiction near you sooner or later.
- AnthonyMouse 1y ago
  > Security is important The argument that this is actually a security benefit is a farce. It doesn't do anything. If the device is compromised then it's going to capture your password and send it to the attacker without attempting any attestation. So the only time the attestation is attempted is when the device isn't compromised.
  - kevincox 1y ago
    Yes, if it was a measure of device security they would revoke attestation of devices that are behind on security updates. But no, a 5 year old device that never got security updates is A-OK according to Google but a completely up to date custom ROM is not. It's clearly not about real security. It is about control. You follow the rules and get Google's blessing or no SafetyNet for you. These rules include things like ensuring that the user can't access their own data without the controlling app's permission.
LogicHound 1y ago
Bank apps work fine (at least UK ones) on Graphene OS installed via the play store.
codedokode 1y ago
I wouldn't want the bank to access my phone, so it doesn't matter that the app doesn't work, and in a weird case where you urgently need to transfer your money to scammers while not being at home, you can use bank's web app.
- VagabundoP 1y ago
  Banks are all moving to MFA through an app, which then needs play protect, which then maybe need TWRP/Magisk.
- thomc 1y ago
  There are at least a couple of banks or credit card companies in the UK now that only offer mobile apps, as well as those now using push MFA with their apps for every large purchase. Recently I needed to install an app from the UK government to prove my identity via camera to renew my driving license, and that doesn't work in GrapheneOS either. I can do it in person (for now) but there is an extra fee.
  - codedokode 1y ago
    All the banks I use, have a web app, although it can be somewhat limited, but I don't need any advanced functions anyway. > as well as those now using push MFA with their apps for every large purchase. Our banks use SMS OTP (not required for mobile app) for all operations - I assume otherwise the amount of fraud would be exorbitant. > Recently I needed to install an app from the UK government to prove my identity via camera to renew my driving license, and that doesn't work in GrapheneOS either. I can do it in person (for now) but there is an extra fee. Interesting that the government relies on a proprietary, foreign platform.
array_key_first 1y ago
Android and said manufacturers purposefully do everything in their power to make this as awful as possible. For example, you can't relock the bootloader on any device except pixels. Why? No reason. Just fuck you, I guess. That's a huge security hole that they're creating, intentionally. What's going on is they are hoping that if you do use other software that you get malware or get scammed. They are literally, actually, undermining their own device's security just to send a message. These people are psychotic.

by maxloh 1y ago

xyzal 1y ago

Not in markets without significant Huawei and Xiaomi presence. Local banks (Czech Republic) are not using integrity APIs to keep being usable for most clients.

Xelbair 1y ago

That small little caveat already makes it a non-option

nvdr 1y ago

Most DRM / banking apps work fine for me through the browser and you can add them to your home screen. Android / Samsung Pay will stop working, but if you have a Garmin watch, you can still pay with that.

fcpk 1y ago
But this is changing. Already in multiple countries(and soon possibly EU wide) there will be only play integrity(strong verdicts) to enforce availability of many services(if not using ios, which is the same locked in syndrome). Yes some banks still allow classic clunky 2FA(sms, card readers, sometimes SIM generators) but it'll all eventually go away in favor of "locked and favored" os unless legislation fights against it.
maxloh 1y ago
Only for now. Google did push the Web Environment Integrity API, which is basically "Play Integrity API for Chrome," that helps websites check if the OS, browser, or installed extensions are "safe". Fortunately, they backed off and decided to abandon the proposal after massive backlash. But we don't know when we will see a 2.0 version of that.

heavyset_go 1y ago

Even phones from Motorola require you to literally ask permission to unlock your bootloader via a form on their website, which they then unlock remotely or you enter some generated code. Other manufacturers do the same, where you have to wait a period of like 45 days before being able to unlock, and then have to ask permission on their website to unlock your bootloader.

munchlax 1y ago
And good lock unlocking anything over 5 years old because the updated website doesn't support what you've got. Been there, it sucks.
- codedokode 1y ago
  To be fair, for "anything over 5 years old" you can probably find a privilege escalation exploit.
  - wiz21c 1y ago
    the question is not "being able to", the question is "being able to with a reasonable effort". wandering the web to find an exploit is way beyond my spare time.
  - VagabundoP 1y ago
    That might get you root but not a bootloader unlock.
    - kube-system 1y ago
      There are privilege escalation CVEs in bootloader code too. I remember unlocking some very early locked bootloaders this way in the early days of android.
      - VagabundoP 1y ago
        So much rarer now. Its getting more and more locked down unfortunately.

safety1st 1y ago

This is the place where I think lawmakers needs to be involved. Bearing in mind that laws aren't engineering specs, being able to pay for things and use a bank are about as close to fundamental rights as anything is for participants in society. If you have to buy a second device to use Netflix, so be it, but we need laws that guarantee people can make digital payments without Apple or Google's permission. There are societies today (I live in one) where some businesses are starting to accept payment only through a banking or payment app, no cash, no card, nothing else. And these apps will only function in the very narrow circumstances of "I bought a device which runs software from one of two American tech monopolies and follow all their frequently changing rules for using various software that's unrelated to the payment I need to make." This limitation is mostly in place due to the banks believing it will make things more secure. Security is important, but not important enough that you get to start denying innocent people the ability to make payments or exile them from the banking system because they had some kind of dispute with Apple or Google. Governments need to step in with access mandates here, otherwise this problem WILL come to a jurisdiction near you sooner or later.

AnthonyMouse 1y ago
> Security is important The argument that this is actually a security benefit is a farce. It doesn't do anything. If the device is compromised then it's going to capture your password and send it to the attacker without attempting any attestation. So the only time the attestation is attempted is when the device isn't compromised.
- kevincox 1y ago
  Yes, if it was a measure of device security they would revoke attestation of devices that are behind on security updates. But no, a 5 year old device that never got security updates is A-OK according to Google but a completely up to date custom ROM is not. It's clearly not about real security. It is about control. You follow the rules and get Google's blessing or no SafetyNet for you. These rules include things like ensuring that the user can't access their own data without the controlling app's permission.

LogicHound 1y ago

Bank apps work fine (at least UK ones) on Graphene OS installed via the play store.

codedokode 1y ago

I wouldn't want the bank to access my phone, so it doesn't matter that the app doesn't work, and in a weird case where you urgently need to transfer your money to scammers while not being at home, you can use bank's web app.

VagabundoP 1y ago
Banks are all moving to MFA through an app, which then needs play protect, which then maybe need TWRP/Magisk.
thomc 1y ago
There are at least a couple of banks or credit card companies in the UK now that only offer mobile apps, as well as those now using push MFA with their apps for every large purchase. Recently I needed to install an app from the UK government to prove my identity via camera to renew my driving license, and that doesn't work in GrapheneOS either. I can do it in person (for now) but there is an extra fee.
- codedokode 1y ago
  All the banks I use, have a web app, although it can be somewhat limited, but I don't need any advanced functions anyway. > as well as those now using push MFA with their apps for every large purchase. Our banks use SMS OTP (not required for mobile app) for all operations - I assume otherwise the amount of fraud would be exorbitant. > Recently I needed to install an app from the UK government to prove my identity via camera to renew my driving license, and that doesn't work in GrapheneOS either. I can do it in person (for now) but there is an extra fee. Interesting that the government relies on a proprietary, foreign platform.

array_key_first 1y ago

Android and said manufacturers purposefully do everything in their power to make this as awful as possible. For example, you can't relock the bootloader on any device except pixels. Why? No reason. Just fuck you, I guess. That's a huge security hole that they're creating, intentionally. What's going on is they are hoping that if you do use other software that you get malware or get scammed. They are literally, actually, undermining their own device's security just to send a message. These people are psychotic.