Hacker News Reader

> I don't want a secure boot warning message if a firmware is running that I flashed on the device, I want it visible when someone else placed a manipulated firmware on it.

And how exactly do you propose achieving that, when that someone else might have tampered with the phone before you got it?

The goal of Google's security architecture is that a dodgy phone seller/repair shop can't pre-root the phone and siphon all your private data to Mr Evil unless they have access to a silicon fab to remake the main CPU with a new trust root.

> Mr Evil

Erm, it's Dr. Evil to you sir.

> And how exactly do you propose achieving that, when that someone else might have tampered with the phone before you got it?

Wipe the device as a condition of unlocking the bootloader root trust keyset. Easy, and more secure than any classic x86 UEFI bootloader. That gets rid of the threat of dodgy repair shops.

The only issue will be manipulating devices before they're sold the first time, but tamper-proof packaging resolves that.

Tamper-proof packaging is a poor replacement for a first-time boot replacement warning. Not to mention the sheer impracticality of properly implementing tamper proof packaging (the factory would have to cover the packaging in shiny nail polish or something, encrypt and send a high-res picture of that somehow to the final buyer across the supply chain, at which point the final buyer makes sure the glitters align). Much better to do it the way it's currently done

If a repair shops wipes someone's phone they'll be pissed, but they aren't going to throw out the phone. As soon as they get back that phone they'll reinstall all their apps and log back into all their accounts and any malicious firmware added by that repair shop will wreak havoc.

I 100% agree that we should have ways of getting rid of these warnings on our own devices, but this isn't a simple problem.

> If a repair shops wipes someone's phone they'll be pissed, but they aren't going to throw out the phone. As soon as they get back that phone they'll reinstall all their apps [...]

This depends on whether consumers are made aware that a repair shop that "accidentally" wipes your phone might be trying to steal your bank account etc.

While education is difficult, the consumer has an advantage in this scenario because the event itself is impossible to miss and very disruptive and could lead them to start searching on the internet for advice.

Apple frequently tells customers that their data would be wiped if they send their devices in for repair, I don't see why customers would challenge a repair shops assertion - it doesn't seem implausible either!

I guess the lesson is/would-be less "all resets are signs of nefarious intent" and more like "if seems reset, always reset it again yourself to be safe."

Or maybe just have the phone tell you it’s been tampered with?

Depends on what "wipe the phone" means. That could involve clobbering early-stage bootloaders and firmware on daughter microcontrollers - the kinds of things that can only be replaced through JTAG and a good bit of tribal knowledge. It doesn't stop the most sophisticated attackers, but it certainly would disincentivize a large-scale attack of this variety, especially when you consider the wild variations that exist between Android phones at a hardware level.

That's an easily solved problem. We already have the pre-boot warning. It fixes that problem just fine. Add a reboot on initial setup and make it scarier if you're just setting up the phone and you'll be fine. A week after you've setup the phone there's no reason why you'd keep it.

>And how exactly do you propose achieving that

A signed-by-google first-stage bootloader could display a message warning the user before handing off to an unsigned second-stage bootloader.

>The goal of Google's security architecture is that a dodgy phone seller/repair shop can't pre-root the phone

I'm curious how big a problem this was with refurbished second-hand laptops that often come with a pre-installed OS. At the very least, I have the freedom to reinstall Windows/Linux.

We need to find real solutions to the e-waste problem, it's unacceptable to be throwing away so many working phones simply because their manufacturer has decided to stop publishing OS updates after 2/3/4 years. I own a few older computers that are almost a decade old and run the latest version of Debian/Ubuntu. There is no reason phones should be treated any different.

On Google Pixel devices you can load your own verified boot key into the "avb_custom_key" partition and then it will only boot OSes signed by it (it will also say that you are running a different operating system in the boot screen).

GrapheneOS for instance uses this mechanism.

Unfortunately you can only register one key and you have to wipe the device to change it, but that's still fine for most use cases.

Your phone will still display a warning during bootup, though.

Because it's also the way to preinstall malicious ROM. Fair warning.

Some devices allow you sign your own images and relock the bootloader [0].

This allows you to modify your image, sign it, flash it and relock your bootloader. If you have the infrastructure in place, future updates could be rolled out as OTA updates for your custom rom.

You'll still fail hardware attestation and afaik whatever api that returns the boot status differentiates between a vendor signed and a custom signed image.

So not perfect, but you lose the bootloader unlocked nag.

[0] https://android.googlesource.com/platform/external/avb/+/pie...

Sadly those devices are only Google and Nexus, so expensive.

Part of the issue there is that they’re focused on the 99% of users who aren’t flashing firmware onto their phones.

This is probably the largest (but far from the only) reason why I'm ditching smartphones entirely.

Perhaps you might like GNU/Linux phones, which have no such problem (and also solve many other problems).

None of them appeal to me for various reasons. Instead, I'm switching to a dumb phone and will be carrying a Linux pocket computer for my mobile computing needs.

Could you share which computer is that?

I haven't decided for certain, but it will very likely be one of my home-built ones. I know that's not very helpful to you, and I apologize.

It's the corporations that get to trust your device. You get nothing.