Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Samsung Removes Bootloader Unlocking with One UI 8

sammyguru.com

Post reply on HN
Print view View original

161–170 of 254 posts

Re: Samsung Removes Bootloader Unlocking with One UI 8

#161

Post by Arch-TK »

BobaFloutist wrote: post #137
gruez wrote: post #71

Earlier quoted context omitted.

Yeah, otherwise the bad guys can just wait till you're not looking at your phone, reflash your it with a backdoored version, and wait for you to unlock it (evil maid attack).

>the bad guys can just wait till you're not looking at your phone, reflash your it with a backdoored version I hate it when the bad guys do this to my phone

The bad guys e.g. the police detaining you during a protest and temporarily seizing your property, or the border police "scanning" your phone.

Re: Samsung Removes Bootloader Unlocking with One UI 8

#162

Post by Tharre »

neobrain wrote: post #134
Tharre wrote: post #69

Earlier quoted context omitted.

No secure element, no memory tagging support, no proper cellular baseband isolation, no verified boot, taking months to ship security updates .. the list is long. From a security/privacy perspective the fairphone is on the worse side of options unfortunately.

> From a security/privacy perspective the fairphone is on the worse side of options unfortunately. Compared to Pixel phones this is without a doubt true, but how does it compare against your average mid-range Android device? Do those typically have any of the features you mentioned?

Very roughly, and assuming mid-range is around 400-500 bucks like the fairphone:

- Memory tagging is still pixel exclusive for now, but it's part of ARMv9 so it should be available on more devices in the future unless they disable it

- Most devices now have a secure element, though the exact capabilities vary

- Baseband isolation - no idea really, most chipsets should support IOMMU (or SMMU as ARM calls it) but is not very obvious if that's setup sanely or even used at all on your average device. So I'm guessing most devices are about the same.

- Security patches certain vendors are much better (like Samsung, for their non-budget devices anyway) but a lot do much the same. It shouldn't generally be worse because of Google's requirements.

- Verified boot is pretty standard

Re: Samsung Removes Bootloader Unlocking with One UI 8

#163

Post by Arch-TK »

nunez wrote: post #79

As someone who roots single-purpose Android devices, this is one of those things that sucks big-time but makes total sense. The only reason one would unlock a bootloader is to root the system partition. It is impossible to protect data on rooted phones and makes data exfiltration attacks significantly easier to do. This is a huge problem for banking and music apps that absolutely rely on this capability. Samsung is,…

> The only reason one would unlock a bootloader is to root the system partition. It is impossible to protect data on rooted phones and makes data exfiltration attacks significantly easier to do.

What are you smoking?

The only reason I've ever unlocked a bootloader has been to replace the OS with a different one. And it had nothing to do with rooting. I have no interest in having a rooted phone on my person at all times. But I have full interest in having GrapheneOS protecting me, among many other things, from opportunistic government spying.

Re: Samsung Removes Bootloader Unlocking with One UI 8

#164

Post by codedokode »

It is getting incredibly difficult to obtain a non-backdoored smartphone nowadays.

I tried to find which phones support alternative OSes, without Google control and telemetry, but it turned out that alternative OSes (LineageOS, PostmarketOS, Graphenos) support mostly support outdated models and it makes no sense to buy them. There is also "Google Pixel", but the prices start at around $600 which is 3 times more than a reasonable price for a phone.

So now I am wondering if it is possible to extract the ROM from a reasonably priced Samsung phone, remove the components I don't like and write it back.

Re: Samsung Removes Bootloader Unlocking with One UI 8

#165

Post by codedokode »

Arch-TK wrote: post #161
BobaFloutist wrote: post #137

Earlier quoted context omitted.

>the bad guys can just wait till you're not looking at your phone, reflash your it with a backdoored version I hate it when the bad guys do this to my phone

The bad guys e.g. the police detaining you during a protest and temporarily seizing your property, or the border police "scanning" your phone.

If your phone was in hands of police you better sell it anyway because they could install a physical GPS tracker, etc. So locked bootloader doesn't change much.

Also if you live in a truly democratic country you don't even need to set the PIN code - your rights are protected by the law.

Re: Samsung Removes Bootloader Unlocking with One UI 8

#166

Post by ThePowerOfFuet »

codedokode wrote: post #165
Arch-TK wrote: post #161

Earlier quoted context omitted.

The bad guys e.g. the police detaining you during a protest and temporarily seizing your property, or the border police "scanning" your phone.

If your phone was in hands of police you better sell it anyway because they could install a physical GPS tracker, etc. So locked bootloader doesn't change much. Also if you live in a truly democratic country you don't even need to set the PIN code - your rights are protected by the law.

>a physical GPS tracker

Every mobile phone already is one.

Re: Samsung Removes Bootloader Unlocking with One UI 8

#167

Post by gmueckl »

throwaway39381 wrote: post #97
nunez wrote: post #79

As someone who roots single-purpose Android devices, this is one of those things that sucks big-time but makes total sense. The only reason one would unlock a bootloader is to root the system partition. It is impossible to protect data on rooted phones and makes data exfiltration attacks significantly easier to do. This is a huge problem for banking and music apps that absolutely rely on this capability. Samsung is,…

> This is a huge problem for banking and music apps that absolutely rely on this capability. In the case of banking, unlocking the bootloader usually requires a full device reset and leaves a very obvious message when you boot up the phone—you can't grab someone's locked device, root it, and grab their financial data just like that. As for music apps and other apps that download copyrighted content to the user's devi…

The problem with banking isn't rooting itself as an attack vector, but the insecurity and laxk of reliability guarantees of rooted phones so that banks rightfully don't want any liability when something goes wrong with their apps.

Re: Samsung Removes Bootloader Unlocking with One UI 8

#168

Post by gmueckl »

kotaKat wrote: post #37
rickdeckard wrote: post #30

It is really a pity, as this means Android OS is closing down. Without supported Consumer Hardware available on the market in sufficient volume, even less end-users will use an alternative OS, which will affect quality and size of the alternative OS-market and fragment the remaining users even more. This will put the future of the entire alternative-OS ecosystem firmly back into the hands of Google. If they start fur…

I’ve always said that it’s been “Google’s Android”, and wellp —- Welcome to Google’s Android, where the garden walls have been turned into a razorwire fence and you’re not welcome to leave. It’s really funny that Apple’s finally allowing carefully controlled access outside of their own fences and slowly adding more APIs and expansion (hell, Apple are the only platform now with third party APIs for RCS in the EU) whil…

You're ignoring an elephant here: Apple meticulously enables these extras functionality exclusively in the EU. They cut these features out for the rest of the world as much as they can. In that regard, they feel like the corporate equivalent of a stubborn 3 tear old.

Re: Samsung Removes Bootloader Unlocking with One UI 8

#169

Post by Tharre »

IshKebab wrote: post #150
Tharre wrote: post #126

Earlier quoted context omitted.

For people out of the loop, parent is referring to TikTag[0], a side-channel speculative execution attack breaking MTE in a probabilistic defense scenario, and the weird cope coming from some people that "MTE was only supposed to be a debugging feature anyway". However, you need some form of code execution beforehand already for this attack, and more importantly it doesn't affect any of the deterministic guarantees o…

> MTE was only supposed to be a debugging feature anyway It literally was. MTE is a padlock with 16 combinations.

The number of combinations is irrelevant if you're not relying on randomness. Graphene sets the tag to a static value on deallocation[0] to prevent use-after-free, you don't even need to guess! The same is true for a lot of buffer overflows, as their allocator ensures two adjacent allocations have different tags, so unless the vuln allows you to skip ahead you'll always trigger a fault.

[0] https://github.com/GrapheneOS/hardened_malloc/blob/7481c8857...

Post reply on HN