Hacker News Reader

Comment by cdesai | Hacker News Reader

You definitely could, we used to support it in a previous iteration.

This was also possible on the Nexus devices, although the oldest I've tried it is the Nexus 6P.

It just worked slightly differently on those, nowadays you enroll the public key by flashing it to the device, on those (Pixel 1, Nexus) you used to have the public key embedded in the kernel.

View on HN

Unless I'm mistaken, the Pixel 1 blindly accepts whatever pubkey is embedded in the kernel, but displays the warning screen on boot if it's not Google's pubkey (to clarify, not a click-through screen, just a temporary splash screen). I guess yeah it's technically Verified Boot, but if it just accepts any key you throw at it, then the security guarantees are a lot less. You can't tell it about your pubkey to get the scare screen to go away, and you can't tell it to block other keys to get the security guarantees.

Telling even the newer devices about your pubkey doesn't get the scare screen away. You see a Yellow Verified Boot warning meaning the OS is signed and verifies but with a custom set of keys.

When you lock the bootloader you block other keys, since fastboot is pretty much disabled when you do that, and the only way to install something would be via OTA updates which would have to be signed with your custom keys.

I guess maybe if you're able to get a root exploit and replace the boot image? Not exactly sure what would happen then, need to try.

Reply on news.ycombinator.com