Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pixel phones are sold with bootloader unlocking disabled

fitzsim.org

Post reply on HN
Print view View original

31–40 of 359 posts

Re: Pixel phones are sold with bootloader unlocking disabled

#31

Post by lern_too_spel »

abeyer wrote: post #11
smnrchrds wrote: post #5

> I bought a Pixel 7 Pro from store.google.com (Canada) ... being sold “unlocked” by Google Carrier-locking is not permitted in Canada, so all the discussions about where the phone was bought and that the full price was paid are immaterial.

But carrier locking is irrelevant, as the article is about bootloader locking.

I thought so too, but in order to show that the device was sold as unlocked, the article has a footnote (#7) about carrier unlocking.

> Keep in mind that I bought this phone full price6 from store.google.com, where it was advertised right in the FAQ as an “unlocked smartphone”7

Re: Pixel phones are sold with bootloader unlocking disabled

#32

Post by mlyle »

dingledork69 wrote: post #29
damisanet wrote: post #24

"Magic hostname" mentioned in article (afwprovisioning-pa.googleapis.com) makes me believe this may be related to zero-touch enrollment of Android Enterprise/Android for Work ( https://support.google.com/work/android/answer/7514005 ). I'm sure devices sold to regular customers and enterprises are identical and nobody is going to unbox and pre-provision them before shipment, so unboxed phone needs to contact provision…

That just sounds like "you don't get to own your device"

You get to "own your device" after you connect it to the internet once, to make sure it's not pre-provisioned for enterprise use.

Re: Pixel phones are sold with bootloader unlocking disabled

#33

Post by LiamPowell »

dingledork69 wrote: post #29
damisanet wrote: post #24

"Magic hostname" mentioned in article (afwprovisioning-pa.googleapis.com) makes me believe this may be related to zero-touch enrollment of Android Enterprise/Android for Work ( https://support.google.com/work/android/answer/7514005 ). I'm sure devices sold to regular customers and enterprises are identical and nobody is going to unbox and pre-provision them before shipment, so unboxed phone needs to contact provision…

That just sounds like "you don't get to own your device"

This is correct, people generally don't get to own a device provided by their employer. Not allowing the bootloader to be unlocked on company-owned devices seems like a very desirable feature.

Re: Pixel phones are sold with bootloader unlocking disabled

#34

Post by AaronFriel »

rfoo wrote: post #27
joecool1029 wrote: post #4

> Request to Google: ungrey the “OEM unlocking” toggle in the factory, before shipping store.google.com devices to customers. Do not make your customers connect the device to the Internet before they are allowed to install the operating system they want. That won't happen. I can think of two big reasons off the top of my head: 1. Supply-chain attacks, someone gets a hold of the phone before it gets to you and unlocks…

The two reasons are invalid for Pixel phones: 1. Pixel phones display an "unlocked bootloader" warning (which can't be disabled) during boot. In case it is re-locked with an additional signing key installed (Pixel-s are literally the only phones which you can do this currently in the market), a similar screen with the SHA256 hash of the public key is displayed. 2. Unlocking does not void warranty. The only reason Goo…

I don't think the average user would understand what "unlocked bootloader" means, and may even mistake it for a feature or enhancement.

It is a supply chain risk. The Android & Pixel teams walk a fine line here: they risk upsetting an important (but small) user group if they change the language and defaults to "THE BOOTLOADER IS UNLOCKED: USE AT YOUR OWN RISK" or even stronger language and shipping these devices to end users.

Re: Pixel phones are sold with bootloader unlocking disabled

#35

Post by [deleted] »

damisanet wrote: post #24

"Magic hostname" mentioned in article (afwprovisioning-pa.googleapis.com) makes me believe this may be related to zero-touch enrollment of Android Enterprise/Android for Work ( https://support.google.com/work/android/answer/7514005 ). I'm sure devices sold to regular customers and enterprises are identical and nobody is going to unbox and pre-provision them before shipment, so unboxed phone needs to contact provision…

[deleted]

Re: Pixel phones are sold with bootloader unlocking disabled

#36

Post by Wowfunhappy »

damisanet wrote: post #24

"Magic hostname" mentioned in article (afwprovisioning-pa.googleapis.com) makes me believe this may be related to zero-touch enrollment of Android Enterprise/Android for Work ( https://support.google.com/work/android/answer/7514005 ). I'm sure devices sold to regular customers and enterprises are identical and nobody is going to unbox and pre-provision them before shipment, so unboxed phone needs to contact provision…

Do you need to actively be connected to the internet while enabling bootloader unlocking, or does the phone merely need to have connected to the internet once at some point?

The latter seems reasonable to me in light of your point about enterprise enrollment. However, I'm confused by nelblu's post downthread[1], which describes using wifi to unlock used phones.

[1] https://news.ycombinator.com/item?id=35853135

Re: Pixel phones are sold with bootloader unlocking disabled

#37

Post by rfoo »

AaronFriel wrote: post #34
rfoo wrote: post #27

Earlier quoted context omitted.

The two reasons are invalid for Pixel phones: 1. Pixel phones display an "unlocked bootloader" warning (which can't be disabled) during boot. In case it is re-locked with an additional signing key installed (Pixel-s are literally the only phones which you can do this currently in the market), a similar screen with the SHA256 hash of the public key is displayed. 2. Unlocking does not void warranty. The only reason Goo…

I don't think the average user would understand what "unlocked bootloader" means, and may even mistake it for a feature or enhancement. It is a supply chain risk. The Android & Pixel teams walk a fine line here: they risk upsetting an important (but small) user group if they change the language and defaults to "THE BOOTLOADER IS UNLOCKED: USE AT YOUR OWN RISK" or even stronger language and shipping these devices to e…

The unlocked bootloader warning screen isn't very different from what you described [1]. It says:

> The bootloader is unlocked and software integrity cannot be guaranteed. Any data stored on the device may be available to attackers. Do not store any sensitive data on the device. Visit this link on another device: g.co/ABH

It's already pretty strong language (and very accurate! which is a rare combination).

[1] https://www.androidauthority.com/wp-content/uploads/2018/10/...

Re: Pixel phones are sold with bootloader unlocking disabled

#38

Post by pbasista »

> connect the device to the Internet before they are allowed to install the operating system they want

Phoning home before undertaking such an activity takes away the ownership rights from the customers. They do not actually own these devices even after they have purchased them.

The reason is that an important part of their ownership rights, i.e. the freedom to use the software of their choice, has been withheld from them. With a promise that it will be given to them on request. Unless, of course, the manufacturer changes their mind.

Unfortunately, there are cases when the manufacturer did not even make such a promise and disabled bootloader unlocking permanently with no way of enabling it again. On Pixel phones.

This used to happen (and perhaps still happens) to some Pixel phones purchased in the USA from Verizon. They have been known [0] for disabling the bootloader unlocking and for giving their customers no way to enable it. Not even after phoning home.

Some people claim [1] that they paid someone from China to unlock their Pixel 1 phone remotely using some shady approach. I assume that someone with inside information from Google has leaked some software and instructions for doing so. It is unclear whether later Pixel phones sold by Verizon with locked bootloaders could be unlocked in a similar way.

As a result, it seems like the only way to have a chance at unlocking such Pixel phones, which have been made by a US company and purchased from a US carrier, is to pay someone in China and hope for the best. It has gotten that far.

[0] https://forum.xda-developers.com/t/how-to-unlock-bootloader-... [1] https://forum.xda-developers.com/t/how-to-unlock-bootloader-...

Re: Pixel phones are sold with bootloader unlocking disabled

#39

Post by lostgame »

quaintdev wrote: post #23
Fire-Dragon-DoL wrote: post #21

Earlier quoted context omitted.

What's special about GraphenrOS? It's the first time I'm hearing about it

Make phone Google free. More features here https://grapheneos.org/features

So I’m guessing with this you’d use an alternative store like F-Droid instead of the Play Store? (Pardon my ignorance, I’m an iOS dev and have been for a decade; I don’t really know the Android landscape.)

Re: Pixel phones are sold with bootloader unlocking disabled

#40

Post by ls65536 »

pbasista wrote: post #38

> connect the device to the Internet before they are allowed to install the operating system they want Phoning home before undertaking such an activity takes away the ownership rights from the customers. They do not actually own these devices even after they have purchased them. The reason is that an important part of their ownership rights, i.e. the freedom to use the software of their choice, has been withheld from…

> With a promise that it will be given to them on request. Unless, of course, the manufacturer changes their mind.

Or if the manufacturer decides to simply shut down those servers after some time, at which point the effective default situation will almost certainly be a denied request. In this case, they may not necessarily even be actively changing their mind, but rather just trying to reduce some overhead for those devices they deem to be "no longer supported" but which are nevertheless still out there being used.

Post reply on HN