System Hardening in Android 11

However, most people do not unlock their bootloaders and install custom ROMs.

For them having an unlockeded system is an indication of something "bad" happening (spying, fraud, theft) and given how central smartphones are becoming in users life, I prefer that my mothers banking app refuses to work if her smartphones chain of trust is compromised.

I also happen to believe that it is impossible to "out-tech" OEMs in the long run and that the path to a fair app ecosystem is through legislation, regulation and anti trust measures.

That approach worked in other aspects of the economy and society.

The problem with unlocked devices is that it's a legitimate security risk.

With a signed OS and hardware attestation, you can verify with 100% certainty that the foundation of the device's security model is there and fully intact. Upon that foundation you can build features that you might not be comfortable with otherwise, like an OTP app, authenticator app or a payment app. You wouldn't build an "OTP" app for Windows for example because Windows doesn't have a solid security model, it's quite easy for one application to access another application's resources.

Once that foundation is broken, all bets are off. If the bootloader is unlocked, you have no way of knowing what's running on a user's device. For all you know, all of the permission checks have been removed and nothing is secure anymore. Even the APIs you'd expect to interact with a secure enclave could be replaced.

Others are suggesting that this is the user's choice and so perhaps developers should just deal with it but I disagree. A device isn't necessarily unlocked by the user. A device can be unlocked by anybody with physical access and the passcode. For example a malicious party could install a malicious version of Android on your device if they have unattended access to your phone for a while. They could also buy phones, flash malicious versions of Android and then sell them at a slight loss, making profit off the money stolen from their victims.

There's also the problem of malware that gains root privileges. With a locked bootloader, there's limited opportunity for such malware to become persistent. It can't modify the system partition at all. With an unlocked bootloader, it can modify the system partition and permanently modify the OS. Basically, locking the bootloader prevents rootkits.

This is why these features are here. They're not here to make enthusiasts' jobs harder, they're here to provide a solid foundation of security upon which an OS that's secure enough to handle high-value information can be built.

> When this is enforced for all devices some apps, like the eBay app, won't run on unlocked devices anymore.

In some cases (e.g. games), I think this is ridiculous. For apps that deal with finance or other sensitive areas, as explained above, I think this is entirely reasonable.

All that said, I can see a world in which we have custom ROMs as well as security:

- We make custom signing keys [0] commonplace, not just a thing for Pixel devices.

- Set up an automated service through which a device can submit CTS [1] results and have its build of Android whitelisted.

[0]: https://android.googlesource.com/platform/external/avb/+/mas...

[1]: https://source.android.com/compatibility/cts

I was also an early adopter of Android with the HTC Hero (Android 1.5/1.6), then the HTC Desire (Android 2.0) then the Galaxy Nexus (Android 4.2/4.3/4.4), but I got fed up of the support timelines too. I don't think my Galaxy Nexus even got an official update to KitKat (4.4). I got it via custom ROMs which were of questionable quality. Battery life and performance were also among my complaints. I eventually switched to an iPhone 6 in 2014 which lasted me 4 years and even then I only had to replace it because the storage capacity wasn't enough for me (16GB). The fact that apps have to ask for each permission also gave me the impression that iOS was more private/secure by default compared to Android. I know it's a moot point in current versions of Android, but it's still shocking to me that it took them so long to address the issue and that it even existed to begin with.