This does not make any sense. GrapheneOS supports all pixel phones. In fact, they support pixel phones only. I am thinking of buying pixel just for this.
What's special about GraphenrOS? It's the first time I'm hearing about it
Pixel phones are sold with bootloader unlocking disabled
21–30 of 359 posts
Re: Pixel phones are sold with bootloader unlocking disabled
#22> Request to Google: ungrey the “OEM unlocking” toggle in the factory, before shipping store.google.com devices to customers. Do not make your customers connect the device to the Internet before they are allowed to install the operating system they want. That won't happen. I can think of two big reasons off the top of my head: 1. Supply-chain attacks, someone gets a hold of the phone before it gets to you and unlocks…
As usual, security is used as an excuse to lock down more than is necessary. To prevent the supply chain attack you mention, the boot lock just has to be tamper evident, such as showing a "Bootloader unlocked" message during boot. As is already the case in some phones. Additionally, a way to reset to a factory-verified state could undo such an attack.
Warranty could also easily be achieved by flipping a non-reversible bit that the phone was unlocked at least once. Though even if it couldn't, warranty troubles are not a justification for user-hostile behavior. If it were, they'd use it for all sorts of invasive logging/spying with the excuse they have to know if you used your phone in a way not covered by warranty.
Re: Pixel phones are sold with bootloader unlocking disabled
#23This does not make any sense. GrapheneOS supports all pixel phones. In fact, they support pixel phones only. I am thinking of buying pixel just for this.
What's special about GraphenrOS? It's the first time I'm hearing about it
Make phone Google free. More features here https://grapheneos.org/features
Re: Pixel phones are sold with bootloader unlocking disabled
#24"Magic hostname" mentioned in article (afwprovisioning-pa.googleapis.com) makes me believe this may be related to zero-touch enrollment of Android Enterprise/Android for Work (https://support.google.com/work/android/answer/7514005). I'm sure devices sold to regular customers and enterprises are identical and nobody is going to unbox and pre-provision them before shipment, so unboxed phone needs to contact provisioning server at least once to verify that there is no pending zero-touch enrollment configuration prepared for it (which may prevent bootloader unlocking if device is enterprise-owned).
Re: Pixel phones are sold with bootloader unlocking disabled
#25> Request to Google: ungrey the “OEM unlocking” toggle in the factory, before shipping store.google.com devices to customers. Do not make your customers connect the device to the Internet before they are allowed to install the operating system they want. That won't happen. I can think of two big reasons off the top of my head: 1. Supply-chain attacks, someone gets a hold of the phone before it gets to you and unlocks…
As usual, security is used as an excuse to lock down more than is necessary. To prevent the supply chain attack you mention, the boot lock just has to be tamper evident, such as showing a "Bootloader unlocked" message during boot. As is already the case in some phones. Additionally, a way to reset to a factory-verified state could undo such an attack. Warranty could also easily be achieved by flipping a non-reversibl…
Pixel's are locked down a very tiny bit, and I don't think this is some kind of dystopian over-reach with security as an excuse. For all the security listed in this thread the whole "I must connect to the internet once" problem is a very fair tradeoff from the user's perspective.
Re: Pixel phones are sold with bootloader unlocking disabled
#26This does not make any sense. GrapheneOS supports all pixel phones. In fact, they support pixel phones only. I am thinking of buying pixel just for this.
Bootloader unlocking is disabled until you connect to the internet.
Just out of curiosity, is it "just" the Internet or "connect to the internet, log in to a foogle account"?
Re: Pixel phones are sold with bootloader unlocking disabled
#27> Request to Google: ungrey the “OEM unlocking” toggle in the factory, before shipping store.google.com devices to customers. Do not make your customers connect the device to the Internet before they are allowed to install the operating system they want. That won't happen. I can think of two big reasons off the top of my head: 1. Supply-chain attacks, someone gets a hold of the phone before it gets to you and unlocks…
The two reasons are invalid for Pixel phones:
1. Pixel phones display an "unlocked bootloader" warning (which can't be disabled) during boot. In case it is re-locked with an additional signing key installed (Pixel-s are literally the only phones which you can do this currently in the market), a similar screen with the SHA256 hash of the public key is displayed.
2. Unlocking does not void warranty.
The only reason Google is doing this is they do not want to have two separate SKUs and pay extra cost to configure each phone physically as unlockable or not in the factory.
Re: Pixel phones are sold with bootloader unlocking disabled
#28> I bought a Pixel 7 Pro from store.google.com (Canada) ... being sold “unlocked” by Google Carrier-locking is not permitted in Canada, so all the discussions about where the phone was bought and that the full price was paid are immaterial.
But carrier locking is irrelevant, as the article is about bootloader locking.
It is relevant because the excuse made for disabling bootloader unlocking is that unlocking the bootloader can defeat a carrier lock. They are interrelated.
Re: Pixel phones are sold with bootloader unlocking disabled
#29"Magic hostname" mentioned in article (afwprovisioning-pa.googleapis.com) makes me believe this may be related to zero-touch enrollment of Android Enterprise/Android for Work ( https://support.google.com/work/android/answer/7514005 ). I'm sure devices sold to regular customers and enterprises are identical and nobody is going to unbox and pre-provision them before shipment, so unboxed phone needs to contact provision…
That just sounds like "you don't get to own your device"
Re: Pixel phones are sold with bootloader unlocking disabled
#30Earlier quoted context omitted.
Bootloader unlocking is disabled until you connect to the internet.
Just out of curiosity, is it "just" the Internet or "connect to the internet, log in to a foogle account"?
Just the Internet.
You have to click Skip when the phone prompts you to log in to a Google account though, as it does this by default.