Pixel phones are sold with bootloader unlocking disabled
fitzsim.org
fitzsim.org
Phoning home before undertaking such an activity takes away the ownership rights from the customers. They do not actually own these devices even after they have purchased them.
The reason is that an important part of their ownership rights, i.e. the freedom to use the software of their choice, has been withheld from them. With a promise that it will be given to them on request. Unless, of course, the manufacturer changes their mind.
Unfortunately, there are cases when the manufacturer did not even make such a promise and disabled bootloader unlocking permanently with no way of enabling it again. On Pixel phones.
This used to happen (and perhaps still happens) to some Pixel phones purchased in the USA from Verizon. They have been known [0] for disabling the bootloader unlocking and for giving their customers no way to enable it. Not even after phoning home.
Some people claim [1] that they paid someone from China to unlock their Pixel 1 phone remotely using some shady approach. I assume that someone with inside information from Google has leaked some software and instructions for doing so. It is unclear whether later Pixel phones sold by Verizon with locked bootloaders could be unlocked in a similar way.
As a result, it seems like the only way to have a chance at unlocking such Pixel phones, which have been made by a US company and purchased from a US carrier, is to pay someone in China and hope for the best. It has gotten that far.
[0] https://forum.xda-developers.com/t/how-to-unlock-bootloader-... [1] https://forum.xda-developers.com/t/how-to-unlock-bootloader-...
Or if the manufacturer decides to simply shut down those servers after some time, at which point the effective default situation will almost certainly be a denied request. In this case, they may not necessarily even be actively changing their mind, but rather just trying to reduce some overhead for those devices they deem to be "no longer supported" but which are nevertheless still out there being used.
This unlock involves: creating a user account in the Xiaomi services website, logging into that account from your phone's system, then having the phone logged in for at least 7 days, then using a Windows software which sends a request for unlocking, which they will grant (at least in my experience).
The most outrageous part of all this process (apart from the fact that it exists at all) is the 7 days of usage with the phone logged in. If you attempt an unlock earlier than that, the software will say: "You have to wait X days and Y hours before you can unlock this device."
EDIT: This Reddit wiki page explains the process. I'm flabbergasted that it actually takes 720 hours aka 30 days:
With LineageOS it handles everything I throw at it without issues. Love the form factor and the finger print sensor on the back. Also SD card slot and headphone jack. Looks like the newer Pocophones are stepping backwards so I have been trying to get my hands on another second hand F1. Haven't been able to find it anywhere though. Surely there must be people out there selling them?!
I'm highly doubtful that it's possible to sell a phone for the equivalent of $100 at a profit.
I now have a $500 phone and overall it's a bit of a downgrade because the battery only barely lasts a day.
I don't love the idea of someone else being able to do it before the phone gets to me.
So how do you feel about PCs then? Because most computers sold doesn't have these draconian protections and apparently that has never been an issue.
I wish that it wasn't that way.
I'm still not going to bash the one major company that consistently comes the closest to being as open as I'd want. I'd love it to be better, but I also understand the real and legitimate reasons that it doesn't work out that way.
Try to put those concerns in direct conflict with openness and the outcome is likely to be the worst possible.
> I don't love the idea of someone else being able to do it before the phone gets to me.
At the time it was their phone, and they can still do it by waiting 30 days.
But what does it matter if you're just going to flash your own system anyway? Let them put whatever they want on it as long as you can blow it away and replace it with yours.
And if you're not going to flash it yourself, make sure you buy it from a retailer you trust not to befoul it, or buy direct from the manufacturer. If you don't trust them then you have bigger problems.
And if you want to talk about security, the most secure thing is to make all of the storage easily removable so it can be verified and reflashed from a known-clean device. Which would also make it upgradable, at the expense of an imperceptible single-digit number of grams in weight. That they don't do this is the proof that the other thing isn't really done for security.
Then they sell the phone as a newer/better model than it is, and most users are unaware. If you complain to AliExpress they'll tell you to run AnTuTu or Geekbench, and both of those apps will report fake results.
Scam products will always exist. What makes phones so incredibly different from laptops, desktops, hard drives, cars (where people may claim false mileage numbers), or any other product category with specs which can be faked?
And why is the solution to lock the boot loader, rather than implementing some tamper evidence system? Show a "This phone has been tampered with!" screen on boot if the boot loader has been unlocked, problem solved.
The vast majority of apps won't run on android 4 anymore.
1. crime organization (or governmental org) buys / steals a bunch of phones
2. org opens boxes, tampers with boot loader in such a way that they (and / or the original OEM and / or the original OS vendor) have a persistent remote administration account on phone
3. org then returns phones to supply chain either covertly or off the back of a truck.
4. org leverages remote access to do shady things
5. "the press" finds out that "vendor phones XYZ are trojaned!" and vendor looks like t-mobile for 5-30 hours until people find another cat video to look at.
A theoretical justification of this is that phones are stolen all the time from the supply chain. Making lots require remote activation allows the vendor to kill the stolen phones, reducing their resale market in that part of the stolen phone ecosystem. Another theoretical justification is to "protect" the average buyer who just wants a damned phone to look at cat videos on and maybe call their spouse when they're late; they don't wear boots and don't care about loaders. Just Want Cat Videos.
You (some big name company) hire some company to make 10,000 widgets; your contractors may turn around and make 300,000 widgets sell you the 10,000 widgets per the agreement and sell the other 290,000 into other channels. They may sell the ones that didn't pass QA, they may make ones with cheaper parts, etc.
How do you stop this? See above - the part has to phone home and you can enable it (or not!) because you've got a registry of which things are legit and which aren't.
Also, this lets the companies spy on you. Errr.. Collect telemetry to allow them to improve the product.
I unlocked the bootloader with the unlock tool less than 12 hours after purchasing my Xiaomi Mi 8. How come everybody has to wait that long?
The phone per-se wasn't bad, but that was my last purchase from Xiaomi.
Replaced the Pocophone with a Google Pixel 5A and I will stick to Google Pixel because GrapheneOS is great.
The other big Chinese brands that have cheaper high end handsets don't offically support unlocked bootloaders as far as i know. They subsidize their handsets with all the junk that their custom Android UIs push, so don't want owners to flash a custom ROM.
The top 3 phones in the LineageOS install stats page are Xiaomi for this reason. https://stats.lineageos.org/
Often phones that do support unlocking (without the hoop jumping) you have to pay a premium for, like the Pixel.
That's what returns are for, I guess.
They'll just keep testing the limits until their analytics tell them that only 23 people made it through the process in the last year, then they'll shut it down for lack of use. Legally obligated, they'll replace the process with a promise that if you mail a newly purchased device to the company, they'll send you an unlocked version within about 3 months. Then, a year later, mail to that P.O. Box starts getting returned, and customer service claims that they're not aware of any mail-in program. The representative claims, honestly, that "we don't sell unlocked phones." You get escalated to a supervisor, and insist that they're legally required to unlock your phone. The supervisor apologizes to you, promises to get to the bottom of the training oversight that led to the escalation, and insists that you mail the device directly to his office and he will take care of you personally.
Only three people made it to the supervisor last year. Two of them never ended up sending in their phones, and for the one that did, the company accidentally sent another locked phone back and the customer failed to follow up.
That reminds me of the right-to-repair article about patched John Deere firmware created by Ukrainian hackers.
It wouldn't surprise me that China has the same skills. I remember coming across a lot of products made to unlock/unbrick Apple's products too, although that was many years ago and I'm not sure if they've gotten through Apple's security for the newer models yet --- and it wouldn't surprise me if they knew but won't easily disclose.
There is absolutely no way that the intelligence agencies don't have this same capability, which makes all of this security posturing utterly pointless, other than to prevent regular users from owning their devices.
Google however made it so that any Pixel phone bought anywhere, even by customers who pay 100% of the price themselves with no carrier involved are not actually owned by those users until they connect it to the internet and Google blesses the device.
I would like to propose that it never is, and only seems so sometimes because our society is insane.
how novel...
instead we have to accept draconian controls on our ownership of devices as a way to combat theft. I would much rather see criminals punished....
It's not that no enforcement happens, a quick search for "phone theft ring busted" returned an article [1] from March of this year. The search results suggest it's far from the only relatively recent bust.
Phones have exceptional monetary value compared to their size/weight. They're easy to steal, and anything that makes wiping the phone easier, faster, or cheaper will be exploited as it increases the value the thieves, fences, etc can extract.
The enforcement scheme needed to substantially reduce phone theft would likely be extremely expensive. It would also likely involve device and purchase tracking methods that many would consider draconic and ripe for abuse by governments and law enforcement.
What would you specifically recommend be done on the enforcement side of things, compared to what happens presently?
[1] https://www.surfsantamonica.com/ssm_site/the_lookout/news/Ne...
very limited enforcement happens, for every story you pull that shows enforcement, i can pull 10 that shows that even when a person can track their stolen phone to a building with "find my phone" many police dept refuse to do anything. This is a common thing.
I am willing to bet the phone theft ring that was busted was only busted as ancillary to a wider investigation in to terrorism, drugs, sex crime, or some other criminal activity and they were not targeting phone thefts at all
It would also be interesting to know if the charges are dropped, as they often are these days for these low level property crimes.
When you have people leaving their windows down, and trunks open to show there is nothing to steal or people can just brazingly walk in to a store and walk out of handfuls of merchandise because theft is soo rampant and prosecutors refuse to prosecute the crimes there is an enforcement issue.
>>The enforcement scheme needed to substantially reduce phone theft would likely be extremely expensive
I disagree, but please enlighten me as to what you think will be expensive
>>What would you specifically recommend be done on the enforcement side of things, compared to what happens presently?
Actually filling criminal charges for theft instead of just the Catch and release model we have today, so much so that police dept often do not even arrest or investigate the crimes at all because they know activist prosecutors will simply refuse to file charges for any theft under a certain dollar value.
I am not sure why this is even debated given that stores are moving out of several cities due to rampant theft that is going unenforced / unpunished. A quick search will show news report after news report of unlawful property theft being done sometimes even in full view of law enforcement who do nothing because they have been instructed not to in many major cities
I've seen this kind of thing before but I have no idea how this works. Is it an insider employee at google or a mobile provider that is doing this on the side? Is it a 0-day exploit? Is it something that anyone can do but someone is productizing it for $30?
These low-level modes likely use proprietary protocols that are only known to the vendors who manufacture the SoC used in the phone, for example Qualcomm. As many of those devices are manufactured in China, it is likely that someone who worked there leaked some tools for performing these low-level programming activities. And then they figured out how to use these tools for unlocking the bootloaders.
Is this just philosophically speaking or were there some actual rights granted by law being violated?
That being said, Google's Pixel phones have widely been known for their ability to unlock the bootloader and install an Android software of the user's choice. It was one of their selling points for a long time.
If this ability is turned into a "possibility" that can be taken away at any time and if it has not been properly communicated to the customers, then it might qualify as false advertising.
This usually involves someone who has bribed a Verizon support rep or otherwise obtained access to their internal systems so they can "unlock" you.
Smartphones have become pocket game consoles, with the same business model.
There may be other Android app stores, but Google Play still owns the Android app store market (except in China where Google is blocked/unavailable) - in spite of charging hefty platform fees comparable to those charged by Apple or Nintendo.
Now I kust try to make up my mind regarding CalyxOS on the Pixel 7. The pure Google andrpid looks good, I think I turned most of the tracking off (unique add ID to improve persobal adds, WTF?). But there are still some annoying things, e.g this crappy, unremovable, Google search bar. If Ibread correctly, one can go back from CalyxOS to stock android now, right? Not that I would really mind so, I didn't miss anything the last couple of years except maybe Google maps at some occassions, and I could have installed that using microG and Aurora store.
May I recommend LineageOS, which supports Pixel 7 [0] and the Pro version. Whatever you go with, yes I do think you can flash stock Android back on your phone if you like.
We'll see when I have time, and patience, to get it on my new phone... Might be a while, so far I manage to convince myself that I got rid of almost all tracking so far...
If they could have somehow stayed ~2003 Google...
Then you have firms like Nvidia which regardless what do you think of them you can probably agree they've at least been consistent for the past 25 years
This is not new to tech companies, I suspect though many people believed they would somehow be different than other corporations. Maybe because the people heading those corporation seemingly were aligned politically when in the past they were not?
Regardless Google is following the same script that many many many other companies, tech and not, follow
If unlocking the bootloader on e.g. Pixel phones sold by Verizon would be as simple as asking Verizon to do it, I do not understand why there would be multiple long threads on XDA developers forum where people try to circumvent this restriction in various shady ways.
Thank you for your comment and info. But be careful, this is the wrong argument here. They are still letting you use the software you choose.
We can look at this move conceptually, keeping in mind the future. Here's one possible outcome.
You need to phone in first. Imagine the phone is just an IMEI number or a serial number, or one part of a key pair. In a future regime, phoning in marks that phone as no longer "trustworthy". It's now in the digital quarantine or isolation pile. And future network services will isolate the device appropriately.
Phoning in doesn't change what software you can install. It possibly changes who you can interact with.
I don't know if the argument can be won.
We could come up with examples where people were isolated wrongly with other technologies. But there's a subtle psychological trick there about solitary confinement and forcing a family of networks and social interactions. Using that argument reinforces the network that limited us. I don't want to hurt that network. But it also limits us.
And the alternative, hidden network lockouts, is also troubling. So, lose lose I guess?
I don't think I have the power to change the story.
At the moment, yes.
My point was primarily about the fact that giving the customer an option to use Android software of their choice on recent Pixel phones is currently fully up to the manufacturer. Phoning in is merely a tool to achieve it.
> possibly changes who you can interact with
I am aware that identifying customers who have requested to have this option can potentially be used to mistreat them. Many mobile apps today are already trying to perform a similar form of identification. They check for non-OEM software or root access. If they detect something they do not like, they show warnings or refuse to provide some functionality. But that is, I think, another topic.
Transfer of control isn't happening exactly at sale time but a few hours later isn't a big deal.
Though of course that depends on it staying unlocked.
I wonder if any of the countries that implement a country-wide firewall block this domain. That would disable bootloader unlocking for the entire country.
I'd imagine the demographic that is buying the cell phone and then not intending to use it as a phone is not one that Google is losing a lot of sleep over serving poorly.
Smartphones aren’t only for the developed world.
Never tried a return because I'd have to pay through the nose on shipping.
That's very unfortunate if you'd have to pay a return for a promised feature not working.
If it's a normal gift, then the recipient won't have any roms or bootloaders they need to install. To get those they will need internet, at which point they can unlock the phone.
> or the even more exotic “person in a foreign country”
What's the problem? Are they buying a phone they won't get a plan for, and can't find anywhere with wifi, and they have no home internet? But they still want to unlock the boot loader because... why?
If that ultra-niche scenario is not what you have in mind, then please explain.
At this point it's being angry for the sake of it.
A few years ago I bought a Nokia N900 which was at the time a 10 year old phone. I did this to use it as a daily driver.
Without community support the phone would have been useless. But, more importantly, if the phone required an internet connection to some server in order to let you replace the stock OS then it would have been a brick because Nokia's servers were long gone by then.
That being said, all things considered, the most important argument here is not of the practicality but the principle.
You handed over money for a piece of hardware but you can't make full use of the hardware until you let the phone talk to the manufacturer once. Thats completely insane irrespective of how small of a perceived issue you think it is.
[0] except for the employer being google in this case
It is very much the case that most people don't care about this definition of freedom.
I didn’t say it wasn’t popular. I’m saying people don’t realize how badly they are exposed because the hammer hasn’t dropped.
The market for PinePhone is weak because it’s “only for the pesky open source people”. It will stay that way a long time and we better hope they survive long enough for Google to keep screwing people into a big enough market.
You're also grossly exaggerating things. We're not talking about a change that would prohibit management, just one that would not allow them to do zero-touch enrollment into their management systems.
I don't think it's reasonable to enforce a provisioning process on every single person just because a small number of the devices go to enterprise-sized companies that want "zero touch" and Google (and their distributors) don't want the expense of stocking two SKUs, one set to require provisioning, and another not.
I shouldn't have to prove ownership of my device to said device straight out of the box.
A company should not have the ability to render millions of devices useless because they purposefully or accidentally shut off a provisioning service
All this bullshit is so that Google and their enterprise customers save a few dollars.
Isn't this considering a hypothetical scenario where somebody buys one of these phones, tosses it in a drawer for years, and only later comes back to discover the provisioning server is gone?
If you buy one of these phones it says it can be unlocked and you can't unlock it, Google is obligated to take it back for a refund or to eat a lawsuit from aggrieved customers for false advertising.
The latter seems reasonable to me in light of your point about enterprise enrollment. However, I'm confused by nelblu's post downthread[1], which describes using wifi to unlock used phones.
My guess would be that if OEM unlocking stays disabled, phone reverts to "greyed-out" setting after each factory reset (yeah, that would be an issue if Google suddenly decides to send Android to graveyard...). I believe actual bootloader unlocking happens inside fastboot mode, outside regular OS and without access to WiFi/cellular data - enabling OEM unlocking is only a prerequisite to actual unlock.
Google might not care, since it’s not likely to consider the EU it’s primary market for these things, but I think they risk finding out that their being “lazy” is going to bite them in the ass.
Or maybe I don’t understand the bootlicking enough, and what I described above of having a Pixel turn on as “owned by organisation” is entirely possible with it.
https://jacobhall.net/2022/01/29/000177/
https://support.google.com/pixelphone/thread/14920605/google...
Support for LineageOS is a key issue for me in the purchase of a phone, so Pixels are desirable as a known quantity. I'm not too bothered about having to "do the thing" because so many other phone brands / models either can't be unlocked easily or aren't supported by LineageOS.
Other comments about Pocophone F1 being compatible with PostmarketOS puts that on my watch list.
OEM unlocking wasn't even an option in the developer settings until I connected the phone to the internet and set the date to one month in the past (I assume this has something to do with the warranty -- you can't even unlock the bootloader right away).
An internet connection was required before even using the phone on the Android initial setup screen.
Apart from that, developer settings can't even be enabled before agreeing with Samsung EULA. Initial setup screen can be weirdly manipulated into opening settings (Accessibility, Additional apps, Live transcribe, Connectivity settings (only shows if there's no inet connection), back), but spamming the Build number does not enable developer settings.
Granted that I did not buy the phone, but it's still disgusting that such devices are being sold.
It always cracked me up that Apple gets bashed for planned obsolescence when they support their phones longer than anyone else in the industry.
There is some planned obsolescence in incremental improvement of technology but that that is probably too slow for them (e.g. my S10/S11 lacked LTE, 5g, eSim...).
Planning for a device's software to be unsupported after a certain period of time, ideally a predefined time made clear up front, is totally reasonable though. Thatjust gets to the question of whether you own a functional phone or a block of hardware that is useful only as long as the company wants it to be.
This was when Apple was so focused on thinness that they used very small batteries. After a couple of years the batteries were not able to supply enough power to the SOC under full load, so Apple had to underclock the SOC to prevent the phones from crashing.
*I'm not saying that was OK. Apple absolutely should have explained what they were doing instead of hiding it. But after this happened it did force them to install bigger batteries in the newer iPhones.
Lithium cells can have increased voltage sag, but they should have well over 1000 cycles before any noticeable decrease in capacity of voltage potential. Even then the total capacity might drop on the order of 5-15% and the voltage say shouldn't be impacted.
It seems lame that you have to phone home to unlock a new device, but it's nothing compared to what they could be doing.
Perhaps they aren't all this onerous, but that really put me off of them.
Their security patch and update support for hardware is also abysmal.
My guess is that it's protection against stolen hardware? They can basically ban S/N of stolen phones, and the thieves can't unlock the bootloader and resell the device.
But yeah, it seems like a reasonable thing. Out of all the vendors, Pixel phones are by far the easiest to unlcok, seems like a weird thing to complain about.
This appears strictly worse than Google.
There is a huge difference between the two approaches.
If you're really worried about Google installing something sinister, it's already too late--the made they thing, they could have installed whatever they want at the factory. Anyway if you're installing a custom OS it's trivial to wipe on install.
So, the way this is done is to, well, connect to the network and allow the phone to be unlocked - which according to the article is what happened?
So the real complaint is that the Pixel can't be loaded with a customized Android OS (or Linux, etc.) without being connected to the internet first and this is bad because the vendor might put bloatware, spyware, etc. on the phone, which, once you install your OS will be gone anyway?
OK, well then other than the underlying hardware needing to still be recognized on the carrier's network, which pretty much means you still have to be connected. The point is you aren't going to be stealthy using the carrier network on a phone, so at the EOD you have a pretty expensive device you can really only use on WIFI using your own VPN without the Vendor's software.
So what's the advantage over a small tablet based on OTS SOC hardware that you have full control over? IOW why buy the phone in the first place?
Because the vendor can anytime say 'fuck you' and disable/remove the process which allows unlocking the bootloader.
Edit: already happened with Pixel 2: https://news.ycombinator.com/item?id=35854552
So the complaint is that in the far future the vendor might not support that on a six year old phone (by that time)? But, it is supported now, so what's the beef?
My old Pixel 2 only works now plugged into power and on WIFI because the battery is dead. I can get super-pissed off at Google for not supporting battery replacement on the Pixel 2, but it's a 6 year old phone. How long should I expect them to support it knowing at the time about the sealed battery. I can't get that pissed seeing as I bought it knowing the facts at the time :)
So anyone who hasn't is fucked and you are fine with that?
> So the complaint is that in the far future
It's not a far future. It's already happening. And if decades ago it took up to years for a company to stop providing the services (or existing as a company) nowadays it takes mere weeks from the announcement.
And this is still not relevant to the problem - you can't do what you want with the device you paid full price for.
It's always amusing to hear people like you who defend the corporate behemoths at the expense of Regular Joe. "Embarrassed millionaires" vibe.
- ***You can't actually back up your Pixel***
When buying a phone directly from Google you are indeed buying the hardware but you don't actually own the software. The OS will work only if Google still supports it and allows you to use it. The article is raising the point that even if you don't want to use Google's software and instead want to jump straight to your own OS installation you can't avoid their OS initialization steps and any network traffic sent back to Google first
I sent a support message a while back asking about it on the google store thing - and they said it was unlocked. I installed grapheneOS today on the pixel 7 actually, and was surprised to read that you had to connect it to the internet just to unlock it. Its strange.
I enjoy grapheneOS so far though.
Edit: if you get the phone through an upgrade with your providers plan it will most likely be locked. There are some threads on grapheneOS' forum about which ones do or dont lock the phone.
This is why I ordered my last phone from Hong Kong (and convinced the seller to take Bitcoin for it https://news.ycombinator.com/item?id=25598831).
Not really. Your choices are:
- Locked by your carrier if they lock it, annoy support to get them to take it off
- Bought directly from google, can be unlocked.
Carrier-locking is not permitted in Canada, so all the discussions about where the phone was bought and that the full price was paid are immaterial.
> Keep in mind that I bought this phone full price6 from store.google.com, where it was advertised right in the FAQ as an “unlocked smartphone”7
https://www.canada.ca/en/radio-television-telecommunications...
https://www.cbc.ca/news/business/crtc-wireless-code-cellphon...
Is there an alternative?
I'm on a Moto g100 that I bought last year, originally intending for it to be a temporary phone while I found a flagship that I actually liked, but it's really grown on me. It has most of the features I was looking for, in particular official LineageOS support, and a microSD slot. I think I might just stick with it.
The other one I had been seriously looking at is Sony's Xperia lineup, but the current and previous generation have had overheating issues. I think their bootloader unlocking process is similar, though.
I think OnePlus is the only one that might be better than Google. But they've been disappointing me in other aspects recently.
> Certain pre-loaded content on your device may also be inaccessible due to the removal of DRM security keys. For devices running recent software versions, for instance Xperia Z3, the removal of DRM security keys may affect advanced camera functionality. For example, noise reduction algorithms might be removed, and performance when taking photos in low-light conditions might be affected. The secure user data partition may also become inaccessible, and you will not be able to get any more official software upgrades if you unlock the bootloader.
Thanks for the thought though. I like that they have a page at least.
That won't happen. I can think of two big reasons off the top of my head:
1. Supply-chain attacks, someone gets a hold of the phone before it gets to you and unlocks the bootloader and then proceeds to modify or install another OS.
2. Warranty reasons, very likely they want to have it phone back and send a record that it was unlocked so they can deny warranty in cases where user damaged the device through software.
They can’t deny warranty coverage because of a user modification unless they can prove the modification caused the damage?
Under the Magnuson-Moss Warranty Act in the USA, activities such as unlocking the bootloader, launching a service menu, removing a sticker or opening a case cannot by themselves void a device's warranty.
If I understand correctly, in order for the warranty to be voided, it is the manufacturer who has to prove that what you did to the device has indeed damaged it or made it otherwise unsuitable for further warranty service.
Unlocking the bootloader is a reversible action. The phone might implement some one-way unlocking mechanisms though. For example, a fuse which needs to be blown. Or some encryption chip whose private key needs to be erased while a new valid private key can only be generated by the manufacturer. Then it would be a process that is irreversible for a regular customer.
That being said, undertaking such activity would only result in some control mechanism being triggered and some software flag being set. It might be permanent, similar to you scratching the case of your phone. But that does not mean it makes the phone unfit for warranty service.
The phone's functionality would remain unaffected.
It would be on the manufacturer to prove that the presence of a flag indicating an open bootloader is in some way detrimental to the device's functionality.
There might be similar laws elsewhere.
Having a device in their database as NEVER_UNLOCKED takes away any onus from having to look for this in the first place for a large % of users.
Additionally this is kind of important for a company that's had a history of selling devices with hardware defects. It'd be very useful for them to know the RMA rate and whether damage was caused by such a defect or whether it was from a 3rd party software issue.
I'd argue that it's possible in 2023.
BTW: PINE64 did better on the PinePhone Pro, and (since it's also going to be Rockchip (RK3566) based in all likelihood) is unlikely to replicate the mistake on the PinePhone 2.
Which court case are you citing?
Collecting that data is about not wasting time looking for issues caused by unlocking and not grouping unlocked device issues in with locked device issues.
Warranty could also easily be achieved by flipping a non-reversible bit that the phone was unlocked at least once. Though even if it couldn't, warranty troubles are not a justification for user-hostile behavior. If it were, they'd use it for all sorts of invasive logging/spying with the excuse they have to know if you used your phone in a way not covered by warranty.
Other people might instead say "Pixels are locked down."
> I don't think this is some kind of dystopian over-reach with security as an excuse.
Why?
> "I must connect to the internet once" problem is a very fair tradeoff from the user's perspective.
Speak for yourself.
I am, that's what a "comment" is.
And the second (I dont think...) follows from the first (very tiny bit). I'd just be repeating myself.
This is opinion-based. We just disagree, that's fine.
Very fair. All Google requires is this: a simple offering of earth and water. A token of submission to its will.
Scenarios in which that's not possible are hypothetical (disaster, totalitarian takeover, alien invasion, sudden policy change), and I'm fine calculating that into the risk calculus and deciding that, yep I don't mind driving home and unlocking it the same day I bought it and praying nothing changes in their policy during the drive.
That's basically what I did. We can disagree on this, but it has worked out OK so far.
And the warranty thing is moot, unlock does not void Pixel's warranty
1. Pixel phones display an "unlocked bootloader" warning (which can't be disabled) during boot. In case it is re-locked with an additional signing key installed (Pixel-s are literally the only phones which you can do this currently in the market), a similar screen with the SHA256 hash of the public key is displayed.
2. Unlocking does not void warranty.
The only reason Google is doing this is they do not want to have two separate SKUs and pay extra cost to configure each phone physically as unlockable or not in the factory.
It is a supply chain risk. The Android & Pixel teams walk a fine line here: they risk upsetting an important (but small) user group if they change the language and defaults to "THE BOOTLOADER IS UNLOCKED: USE AT YOUR OWN RISK" or even stronger language and shipping these devices to end users.
> The bootloader is unlocked and software integrity cannot be guaranteed. Any data stored on the device may be available to attackers. Do not store any sensitive data on the device. Visit this link on another device: g.co/ABH
It's already pretty strong language (and very accurate! which is a rare combination).
[1] https://www.androidauthority.com/wp-content/uploads/2018/10/...
Kudos to the security folks at Google.
Yet. Other manufacturers have the same warning and have had them disabled. (I did it to one of my older moto phones a few years back)
> 2. Unlocking does not void warranty.
Not by itself, but having a signal in place that it was unlocked lets the manufacturer look for common problems caused by doing things like flashing the wrong device images to critical partitions (go search around a bit for people corrupting EFS on their phones).
Critically Pixel devices do not have a debrick tool that's leaked, at least not for the Qualcomm-based Pixel devices. This means that a brick on any of those partitions means the phone needs a trip back to the depot or a service center that has these tools. Can't be fixed by end-user. Maybe this situation has changed for the Tensor/Samsung pixels but the point is screwing up your device due to flashing incorrect images shouldn't be something the manufacturer needs to foot the bill on.
Then maybe the manufacturers should be more forthcoming with making said tools available to the public, such that they don't have to foot the bill for said mistakes to be corrected.
Doesn't the splash screen clearly show some scary warning when the phone was unkocked?
> very likely they want to have it phone back and send a record that it was unlocked so they can deny warranty in cases where user damaged the device through software
So burn an e-fuse like Samsung does.
The fact this is even possible means the device is already broken straight out of the factory.
a) You can unlock the device
b) You can connect via WiFi, why is the device 'phoning home' such a big deal when its brand new and has no data on it?
The whole process was amazingly easy when I did it and took less than 15 minutes.
Hostname Downloaded to phone Uploaded from phone
storage.googleapis.com 383 MiB 8 MiB
fonts.gstatic.com 137 MiB 3 MiB
afwprovisioning-pa.googleapis.com 18 MiB 1 MiB
www.gstatic.com 8 MiB 287 kiB
googlehosted.l.googleusercontent.com 8 MiB 345 kiB
ota-cache1.googlezip.net 3 MiB 175 kiB
dl.google.com 3 MiB 86 kiB
instantmessaging-pa.googleapis.com 1 MiB 300 kiB
www.google.com 46 kiB 24 kiB
ssl.gstatic.com 25 kiB 3 kiB
ota.googlezip.net 17 kiB 6 kiB
digitalassetlinks.googleapis.com 17 kiB 4 kiB
clients.l.google.com 14 kiB 7 kiB
gstatic.com 13 kiB 3 kiB
mobile-gtalk.l.google.com 8 kiB 1 kiB
mobile.l.google.com 5 kiB 1 kiB
lpa.ds.gsma.com 5 kiB 4 kiB
connectivitycheck.gstatic.com 3 kiB 3 kiB
app-measurement.com 1 kiB 0 bytes
time.android.com 180 bytes 180 bytes
Why should the owner of the computer be allowed to see what is being sent to Google? (Maybe the strange folks at Google cannot think of any reasons.)
Who pays for transport of the data to Google? (Is there any reason Google should not pay?)
Putting the data sent aside, there is the question of whether the computer owner should have a choice in whether they want to send it, and there is the fact that these unauthorised connections are all pings to the mothership.
Using NetGuard, it's possible to block all these connections without rooting or installing GrapheneOS. It's also possible to log all the DNS lookups and attempted connections, without rooting or installing GrapheneOS. The log will indicate which software is making the connection attempts. One can also create PCAP files showing the patterns of network activity, again without rooting or installing GrapheneOS. It's relatively easy to determine what connections are actually necessary for the computer to work as desired.
After installing GrapheneOS, I wonder if it is possible to selectively stop connections to GrapheneOS servers. There are probably some connections to Graphene servers enabled by default.
Would be fun to compare PCAP files from a device running NetGuard versus one running GrapheneOS.
This is actually extensively covered in the GrapheneOS FAQ:
Google does. That's why the Google's code is forcing a computer owner to connect the internet using a Google OS before installing an OS that the owner chooses. The customer has paid, title has been transferred, the computer is no longer Google's or the carrier's property. If Google or a carrier does not get to collect some data after purchase, then no harm done.
Oneplus phones just unlock when told 'OEM unlock' over the adb. No big brother home to phone, no bullshit begging for the rights to my device. If I decide to unlock it the worst I get is a nagscreen at boot with a scary warning about security.
Only Google knows precisely what all that data is and what it is used for.
The Wi-Fi BSSID alone is enough to pinpoint someone's exact location.
I am being a bit unfair to author. Is this a problem? yes. But then author is also stretching the definition of personal data
* There are 3 boolean states:
1. whether the bootloader is unlocked
2. whether the bootloader unlocking ability is enabled by the user ("OEM unlocking" toggle)
3. whether the bootloader unlocking ability is allowed to be enabled (carrier restriction)
* The state of `isOemUnlockAllowedByCarrier()` is changed by a call to `setOemUnlockAllowedByCarrier(boolean allowed, @Nullable byte[] signature)`, which is done by the `android.apps.work.oobconfig` package (/product/priv-app/OTAConfigNoZeroTouchPrebuilt/OTAConfigNoZeroTouchPrebuilt.apk) on the Pixel's stock firmware. This is the same package that handles the Android Enterprise zero-touch provisioning. It's not obfuscated and can be trivially reverse engineered. Prior to the December 2022 update, it was actually possible to bypass the check just by disabling this package via `pm` [2]. This is now blocked both by [3] and also the bootloader's requirement of a signed blob to lift the carrier restriction. This package is also responsible for preventing the removal of the carrier restriction (for the bootloader) when the SIM is locked.
* The Android framework talks to `android.apps.work.oobconfig` at all because the stock firmware ships an overlay (/product/overlay/framework-res__auto_generated_rro_product.apk) that contains `<string name="config_deviceProvisioningPackage">com.google.android.apps.work.oobconfig</string>`.
* The communication with the bootloader is done via the `oemlock` HAL: /vendor/lib64/android.hardware.oemlock@1.0-impl.nos.so. Its implementation of `setOemUnlockAllowedByCarrier()` seems to require a signed blob from Google (passed in from `android.apps.work.oobconfig`) before the state of the setting can be changed (see: `carrierUnlockFromSignature()`). Once unlocking is allowed, the setting is persisted by the bootloader unless something calls `setOemUnlockAllowedByCarrier()` again to disable it. Without the carrier restriction, the bootloader allows the user to freely toggle the "OEM unlocking" state.
I don't know for sure since I haven't tested, but I believe even SIM-unlocked Pixels purchased from the Google Store use this "carrier" restriction mechanism. It's just that when the device asks Google's servers for the signed blob to lift the carrier restriction, it's always granted. (EDIT: Though there are reports that refurbished devices from warranty claims for bootloader-unlockable devices may sometimes have a carrier restriction that Google's servers don't allow removing.)
[1] https://cs.android.com/android/platform/superproject/+/andro...
[2] https://nvd.nist.gov/vuln/detail/CVE-2022-20611
[3] https://android.googlesource.com/platform/frameworks/base/+/...
Yep, this happened with my Pixel 2: Bought it directly from google, the usb-c port stopped working after a while, so I sent it in for a repair. I cannot unlock the bootloader on the phone they sent me back, so it's basically just e-waste now.
It really soured me on the Pixel line, I'm not sure I'll ever buy another one.
I don't, but I know I'm the weirdo. The only other people I know who buy phones outright are my brother because he keeps dropping them and smashing them, and a mate who buys my old iPhones when I upgrade every 2 years or so because he knows I look after them.
You have an odd definition of "everything sucks" in android land.
I am thinking of buying pixel just for this.
You have to click Skip when the phone prompts you to log in to a Google account though, as it does this by default.
Not necessarily, but that's the best way to do it. Between apps from F-Droid and a browser, you don't need any apps from the play store. Your bank doesn't have an app on F-Droid you might say? Well that's what the browser is for.
For obvious reasons; we don’t ship to alternate stores - even if such a thing as iOS sideloading existed; we wouldn’t support it, and we of course do not support anything but the Play Store on Android.
It’s obviously partly a support cost issue - there would be less than 1% of our millions of users using F-Droid, etc - and, more importantly; it’s a security and support issue.
I think for a while we even had some sort of check that would detect a jailbroken iPhone or rooted Android device and attempted to refuse to run on them. Security is so far above the #1 priority working in banking it’s insane. We’d never consider anything outside of Apple or Google’s official solutions. We actually have real life contacts at Apple to help address specific security or approval concerns; which is practically unheard of.
(I'm sure I'm missing the obvious here) but why are you happy to have customers log in using a browser on a device they fully control, yet not do the same using your app on a device they fully control?
Your uncertainty about this suggests it's not something you decided, but please let anyone involved in making decisions like that know that's a dick move. It's the user's device, not the bank's.
I've used everything from giant multinational banks to local credit unions in the U.S., and none of them will even let me sign in with U2F. Many of them still have password character limits.
I use some bank apps because they're quicker than the websites. But I do this with a cheap Nexus 7 tablet that stays at home with a label saying "full take" stuck to the top to remind me to not trust it with any sensitive information.
Segregating apps onto different devices is the way to go to protect yourself from corporate malware.
To easily check balances and make transfers wherever I am. This is possible without the app, but the app makes it easier/quicker than the mobile site in most cases.
> So that when you get mugged, it can turn into a kidnapping?
How do you suggest a mugger to find out whether such an app is even installed, let alone do anything about it, in this day and age of full-device encryption being the default? Even assuming a mugger somehow has access to the nation-state-level compute resources and exploit tools necessary to gain access to anything on my phone, by the time the mugger has finished using said tools and compute resources, I'll have already changed my passwords and invalidated existing login sessions.
Also, kidnapping involves considerably more effort and risk than mugging, so this is a weird argument in general. The vast majority of people with both smartphones and bank accounts almost certainly have banking apps installed on their phones, and I know of precisely zero cases of muggers deciding "oh you have a banking app? lemme go find my windowless van and kidnap you, drawing considerably more attention to me and giving you considerably more reason to violently defend yourself instead of cooperating; surely nothing will backfire from that, no siree!".
Muggers quite frankly don't give a flying fuck about the apps on your phone. They want your cash and/or whatever they can quickly fence.
> Segregating apps onto different devices is the way to go to protect yourself from corporate malware.
Having firmware that gives you fine-grained app permissions that you can freely grant/revoke also accomplishes this. If apps on the Play Store are subverting that, then banking apps are probably the least of your worries.
They make you do it, the same way they made you give them the device in the first place.
I don't know why anyone thinks it would turn into a kidnapping, but it's pretty easy for someone who has already forced you to give them your phone to use the same technique to force you to unlock it.
Same deal with home burglaries. No burglar in one's right mind is going to give the slightest iota of a rodent's anus about the possibility of there being a Bitcoin wallet and SSH keys on your laptop; most burglaries are smash-and-grab, and are intended specifically to minimize the amount of time spent inside the victim's home. Every second adds risk of complications; unless the burglar is targeting you specifically and knows ahead of time exactly which devices might have valuable data, it's in said burglar's best interests to take the laptop and run rather than spend precious seconds (or worse: minutes) "persuading" you to unlock it.
I just don't see this as enough of a risk to be concerned about it, maybe it depends on where you live.
https://privsec.dev/posts/android/banking-applications-compa...
https://privsec.dev/posts/android/f-droid-security-issues/
You can use Aurora Store with an anonymous account or just use Google Play with a throwaway Google account.
The project officially develops secure, private access to the Play Store and its apps. My interpretation is that the project's authors prefer users to use the secure Play Store implementation over alternatives like Aurora, even if Aurora works fine.
Why we have this system in place for phones is just... beyond me.
They can do this because Unlike Microsoft Google ports ChromeOS onto new laptops and tests the crap out of them (including the verification that the manufacturer meets about 25 min performance requirement standards for Chrome hardware like LCD viewing angles and speaker volume). They also test the laptops by giving them to employees and then demand hardware improvements of the manufacturers to get the Chrome branding logo.
I bet the have a similar system for for their HTC phones. So your Pixel is probably registering with a panopticon type system because 99.9% of customers are gonna use the stock OS. They do this so their users perceive and experience higher hardware reliability. So it may sound creepy but the goal (100% fleet registration) is hard to meet without forcing 1 internet connection at the 1st boot. It will be hard to meet your freedom goals and google's reliability goals at the same time ..
There is a well known tool named Panopticon (abbreviated pcon) internally and this is not at all what you describe.
(I work at Google)
Which is kinda unsettling. At least it makes it clear how they view their users.
You'll be SHOCKED that Microsoft has been aggregating global crash data for more than a decade. Lmao. Google isn't breaking any new ground here. All Windows BSODs and even app crashes get uploaded to Microsoft as far back as XP. Microsoft has even written a blog post on them fixing a 0day before it even got deployed because it got errantly caught as a crash from an attacker's development machine.
I bet Apple has this for iPhones, as does Microsoft for Windows 10 internet connected devices. It would be important to have for "Find My Device", disabling stolen devices, etc.
I would hope there isn't a direct path for internet traffic to interact with the boot firmware...
Sure, if you're so smart, you can do it and it's up to you to try to dance around whatever the manufacturer wants to throw your way. Don't like it, don't buy it.
Nothing says that any manufacturer is required to sell general purpose hardware. They can restrict it however they want, no?
I'm a little confused as to how you're confused? I bought it, I should be free to set up whatever software I please with it. It's mine.
Say what you want about "socialist" countries in Europe, but I don't think this kind of bullshit would stand in France. Based on laws they've passed over the last decade or two, Europeans seem to protect consumers; while the U.S. government abets corporations in ripping them off.
Google apologists busily downvoting...
France allows carrier locking, just like every other European country.
"In France, SIM locks are not prohibited. However, the mobile operator must inform the consumer of the existence of a SIM lock, and the subscriber has the right to request that the lock be removed at any time. No later than three months after the subscription of the contract, the mobile operator must "systematically and free of charge" provide the subscriber with a procedure to deactivate the SIM lock. Proposal to shorten the time that operators may charge a fee for removing the SIM lock prior from six-month to the three-month deadline."
The stupid thing, at least in the U.S. is that carriers lock phones if the user is UNDER CONTRACT. This is backward; who cares if the user takes the phone to another network, when he has to continue paying the contract? This actually benefits the original carrier.