An unlocked bootloader for a user that cares about physical security and privacy is a show-stopper. It basically gives up the keys to the kingdom, with a smile.
Yes, you can relock it. There is quite a bit of misinformation in this thread, I’m not sure why. As you can see from this chart, bootloader locking is available with iodéOS across multiple devices (including Fairphones), not just Pixels.
Unlocking the bootloader makes the entire system compromised - an adversary can install malware that persists through reboots or even factory resets, since the security regarding verified boot is disabled; they can decrypt the storage and read, copy it; it is relatively easy for a system to experience privilege escalation, and run admin commands - if the user is aware of it or not.
There’s a few other things, and some of it needs an additional step or two, but most things go from ‘impossible’ to ‘trivial’. And when you’re facing an adversary (be it a rootkit in an apk, law enforcement, or government agencies) that expect you to be knowledgeable about tech, they will take advantage of the potential holes users might make along the way.
Relocking the bootloader is incredibly rare on custom roms; I know of only one that supports it (gos). Every other rom I’ve ever used, so in the 50+ range, doesn’t worry about it. So usually the only way to relock is to revert to factory.
An unlocked bootloader for a user that cares about physical security and privacy is a show-stopper. It basically gives up the keys to the kingdom, with a smile.
The ability to run true Linux is nice though.
E: word
Could you explain further please?
What is so bad about the unlocked bootloader? Can’t you relock it?
Yes, you can relock it. There is quite a bit of misinformation in this thread, I’m not sure why. As you can see from this chart, bootloader locking is available with iodéOS across multiple devices (including Fairphones), not just Pixels.
Unlocking the bootloader makes the entire system compromised - an adversary can install malware that persists through reboots or even factory resets, since the security regarding verified boot is disabled; they can decrypt the storage and read, copy it; it is relatively easy for a system to experience privilege escalation, and run admin commands - if the user is aware of it or not.
There’s a few other things, and some of it needs an additional step or two, but most things go from ‘impossible’ to ‘trivial’. And when you’re facing an adversary (be it a rootkit in an apk, law enforcement, or government agencies) that expect you to be knowledgeable about tech, they will take advantage of the potential holes users might make along the way.
Relocking the bootloader is incredibly rare on custom roms; I know of only one that supports it (gos). Every other rom I’ve ever used, so in the 50+ range, doesn’t worry about it. So usually the only way to relock is to revert to factory.
Thank you!
No problem :)
Yes, you can relock the bootloader, though only with official builds
https://doc.e.foundation/os/learn/bootloader-relocking#relocking