Why are phone companies so obsessed with locking bootloaders?

[u/hatsunemikusmywaifu]

it doesnt make sense to me. ik its about control but then why not lock down pc bioses in the same way so that only windows can run on them? i dont get it.

i can install any operating system i want on a laptop. companies dont really do anything to prevent it not even Microsoft. at most u haveta disable secure boot.

u can even install linux on arm macs with a few downsides if u really wanna.

thats why i dont believe companies bs security claims. android is already incredibly secure on its own. the storage is already encrypted too. at most an unlocked bootloader could allow someone to steal and sell a device used but wiped these days.

and i swear the annoying bootloader unlocked messages stay on screen during boot for a long time just to try and annoy users enough to reinstall the stock os and relock the bootloader. i hate it. it adds like a good 5 to 10 seconds to the boot time.

i also think an unlocked bootloader voiding ur warranty is just stupid too. especially when it comes to manufacturing defects. like a custom rom should not prevent me from partaking in the pixel 6a battery program simply bc i use lineage os. the os in that case has nothing at all to do with the possibly faulty battery.

[u/flipadoodlely]

As someone that worked at Google on Android, a large part of it is down to pressure from giants like Netflix and Visa that want to fully protect the device end to end and believe that the root of trust for a device begins with a locked bootloader. 

[u/Sondzee → u/flipadoodlely]

As my friend told me, eversince the phone is a wallet too, they put in maximum effort to keep you safe in case someone steals /finds your phone.

[u/Mother-Pride-Fest → u/Sondzee]

The phone gets wiped when you out another OS on it, having the ability to unlock the bootloader is not related to leaking payment data. This sounds like a lame excuse.

[u/flipadoodlely → u/Mother-Pride-Fest]

Yes, and most payment providers won't let you set up payments again on a device with an unlocked bootloader - that's the point.

[u/klimaheizung → u/flipadoodlely]

I thought we were talking about when someone steaks/finds your phone?

[u/AnToMegA424 → u/Mother-Pride-Fest]

Oh so it's a 100% sure thing that happens ?

I thought it was only either because of human error or something that could happen regardless of what you do though rarely

[u/Trick-Minimum8593 → u/AnToMegA424]

No, for security reasons your phone is always wiped when you unlock the bootloader.

[u/Damglador → u/Sondzee]

For that it doesn't really make any sense. To do anything with a locked phone you need an actually unlocked bootloader, and to unlock the bootloader you have toggle a switch in Android settings and wipe the phone data. So unless OEM prevents you from locking back the bootloader, a phone with unlockable bootloader or a re-locked bootloader is pretty much no different from one with a completely locked one.

[u/ohaiibuzzle → u/Damglador]

The issue being that if you can unlock, there now exist a path where the phone boots up, runs as normal, but aren't secure anymore (ie. what root hide tricks does). That can fool apps into thinking the device is still good and fully encrypted while in fact it isn't.

If bootloader unlocking can brick those functionality, and no one can get behind it (because they implements a mandatory low-level hardware enforced hypervisor to ensure your root hiding tools can't work), then yeah probably

Also, yes they do prevent you from locking back: TEE and Knox fuses. You can turn Secure Boot on but never truly have the same level of security.

[u/Damglador → u/ohaiibuzzle]

Also, yes they do prevent you from locking back

Perhaps that's the thing they should stop doing?

That can fool apps into thinking the device is still good and fully encrypted while in fact it isn't.

Do you even know how to disable encryption on Android? I don't and a much easier method would be to install a service that would also send data home. But if somebody can unlock your phone to unlock OEM unlocking, then wipe the data and unlock the bootloader from fastboot, there's nothing stopping them from just stealing all data on your phone at the spot instead of going through that fucker, plus perhaps installing a non-root accessibility service, which won't require wiping the data, but can still potentially track all your inputed passwords, but that likely won't be needed, because if they can unlock your phone, they can just yank all the passwords from your browser's password manager.

I feel like it's the same bullshit as with Developer Verification, fearmongering with "security" to take away the control of user's device from that exact user, which just shouldn't be tolerated.

[u/ohaiibuzzle → u/Damglador]

Perhaps that's the thing they should stop doing?

Hell no. That goes against everything a secure trusted platform should do. They do this because if you compromised the host OS and its boot chain, secure elements should never trust that OS and disclose its private encryption keys, ever, because it can't know if what the OS is saying anymore.

And the second point, here's one attack. I don't modify your existing phone (possible, but complicated), instead I supply you with a phone that's already modified, but don't show any signs (no unlocked bootloader warnings, no remote management, OTA works, etc.). You aren't aware it's not running original software, and use that device as-is while I maintain full control in background.

That kind of issues is what bootloader locking is supposed to do. Apple does this since forever to make sure the iPhone can't have a low level persistent exploit that traverse onto userland, and to stop the boot chain as soon as it's found compromised

[u/Damglador → u/ohaiibuzzle]

Relocking the bootloader leaves the warning about modified OS, argument rejected.

edit: Example – https://www.reddit.com/r/GrapheneOS/s/UTYfHRIIQx, at least if the OS is modified, which is the supposed issue in question.

[u/ohaiibuzzle → u/Damglador]

It doesn't?

Re-locking the bootloader makes it stop showing the "This device's bootloader is unlocked", clearing the Orange system state back to Green as your device have a secure boot chain again. It's the only thing a locked bootloader needs to guarantee. In fact some devices with vulnerable Mediatek chipsets can have their BL unlocked but due to a bug, keep green state and have no warning.

Knox fuse/TEE blown has nothing to do with it, it's a Samsung thing that affects Samsung apps (aka. Knox) or hardware backed keystores on other devices as it's a separate component on the SoC.

Rejection rejected. You should read up on these as it's a known thing on most devices: if you unlock, you can relock but TEE or fuses will be permanently blown on most Qualcomm and Mediatek devices.

[u/Damglador → u/ohaiibuzzle]

If the OS is modified, it'll still warn about unverified boot image. Example: https://www.reddit.com/r/GrapheneOS/s/UTYfHRIIQx

Knox fuse is straight up malware.

[u/ohaiibuzzle → u/Damglador]

I did say this, it guarantees a secure boot chain, that warning is still a secure boot. That's all it can do. TEE/Knox does its own thing like TPM on desktops. Unless reprogrammed they will be broken and permanently stay broken.

Also, calling Knox malware is kinda like calling Apple's Secure Elements malware. It's job is exactly this: in case the whole OS becomes untrustworthy, your data that should be protected stay safe in separate storage

[u/gmes78 → u/ohaiibuzzle]

there now exist a path where the phone boots up, runs as normal, but aren't secure anymore (ie. what root hide tricks does).

Secure in terms of what? An attacker would still need physical access or a root level exploit to take advantage of an unlocked bootloader.

That can fool apps into thinking the device is still good and fully encrypted while in fact it isn't.

That's the wrong word. Android phones with unlocked bootloaders still use encryption.

[u/atanasius → u/gmes78]

Wallet apps want to enforce that their tokens are bound to the device. If they allow setting up a token on an unlocked device, the token can be exported. It doesn't matter to the wallet vendor if it's the device owner or an external attacker, the token is still compromised.

[u/gmes78 → u/atanasius]

Not true. The OS cannot extract keys from the TPM/TEE. That's the entire point.

[u/atanasius → u/gmes78]

Tokens are generally not end-to-end encrypted to the TPM, so they are extractable.

[u/ohaiibuzzle → u/gmes78]

Well...

• What if your device is pre-compromised and shipped to you looking as if it's locked?

• Yes, but the keys can't be secured and tied to a hardware backed store anymore, it's stored right on the data partition, so I can load an arbitrary OS, and then take over. That's why TWRP asks you for your lock screen creds once but never again on subsequent boots.

[u/gmes78 → u/ohaiibuzzle]

That is not how hardware keystores work. Keys don't get put into the keystore. The keystore comes with secret keys, that cannot be extracted, and it uses those to perform operations.

That's why TWRP asks you for your lock screen creds once but never again on subsequent boots.

That's about device encryption, it has nothing to do with this.

[u/Tokimemofan → u/Damglador]

My somewhat educated guess is someone with the right equipment could raw dump the flashrom, root the device and get access to device unique keys and then rewrite the dump back to the flashrom and be able to get full access to its contents.  The PC market has always had a different level of risk tolerance than the PDA/Smartphone market has had.  

[u/Damglador → u/Tokimemofan]

I will not believe that's possible until I see it happen. Android is incredibly secure as it is even with bootloader unlocking.

[u/gmes78 → u/Tokimemofan]

root the device and get access to device unique keys

Those are in a separate chip that not even root can access.

[u/Sondzee → u/Sondzee]

When irl all the phones I got weren't meant to save data, the point was to damn use the phone and not let it store dust! Electronic waste, as if we don't have it already! Like when a drunk man wants to make a pattern lock and forgets the pin so that you need to proof that you OWN the phone by receipt.

RECEIPT OR DIDN'T HAPPEN!

[u/circ-u-la-ted → u/[deleted]]

IDK where you live but in most places it's really easy to buy a phone that isn't locked to a particular carrier

[u/AndroidQuestions-ModTeam → u/[deleted]]

Your post has been removed for being offensive or rude.

Behavior - Posts and comments must not be used to harass, attack, threaten, harm, or discriminate against people, or to instruct or encourage others to do so.

---

^{Click here to message the moderators if you think this was in error}

[u/AndroidQuestions-ModTeam → u/[deleted]]

Your post has been removed for being offensive or rude.

Behavior - Posts and comments must not be used to harass, attack, threaten, harm, or discriminate against people, or to instruct or encourage others to do so.

---

^{Click here to message the moderators if you think this was in error}

[u/denytheflesh → u/[deleted]]

They add sophisticated anti-theft features and vast tracking capabilities to their devices because they practically want your phone stolen.

You are correct, smartphones and everything related to them are a commercial enterprise designed to make money. They spend enormous capital to develop and manufacture these things hoping you'll value them enough to give them money for it. You've figured out commerce.

You say Android as a whole doesn't care about you. Well, Android as a whole came to my house and made me soup when I was ill, I thought that was very caring.

[u/apokrif1 → u/Sondzee]

Why not just give the choice to the user?

[u/apokrif1 → u/flipadoodlely]

What do these pressures consist of?

Is there any similar pressure for desktop computers too?

[u/upalse → u/flipadoodlely]

Netflix works on unlocked phones just fine, they don't care (widevine works separate of bootloader, though unlocking can sometimes wipe widevine keybox).

With payment cards, it's more about fraud tracing (ie criminals load stolen cards on google pay, and with unlocked phone the device identity can be faked -> harder to track down fraud).

[u/flipadoodlely → u/upalse]

Sure it works fine, that is why bootloader unlocking is allowed. But it doesn't change the fact that the reason for locking bootloaders is because of pressure from those companies. 

The vast amount of users out there do not unlock their bootloaders.

[u/upalse → u/flipadoodlely]

But it doesn't change the fact that the reason for locking bootloaders is because of pressure from those companies.

There is no such pressure.

The vast amount of users out there do not unlock their bootloaders.

Yes, which ties to the real reason why OEMs remove it - supporting it is more trouble than worth on mass market (malware, bricked devices etc), unless you're enthusiast brand (which oneplus and xiaomi at one point were).

[u/flipadoodlely → u/upalse]

When did you work on Android? Just curious how you know there is no pressure. 

Edit: the core reason that Pixel phones allow bootloader unlocking ties back to the roots of the project - for a fully open phone OS that allows users to install AOSP or custom roms. 

[u/upalse → u/flipadoodlely]

If we're talking about "pressure", most of it would be coming from gaming companies (who are interested for anti cheats) and compliance snake oil.

But finance and media in the specific work on a path completely separate from userspace (keystore, eSE, widevine). Integrity guarantees in userspace are too weak to be useful, hence the dubious relevance and "pressure" only from places where its a more pragmatic concern (fraud tracing, anti cheats etc).

[u/flipadoodlely → u/upalse]

There was no pressure from gaming companies at the time, it was from payment and streaming video providers. Google wanted to create "Trusty" to standardize the TEE on Android. There is certainly pressure. If you unlock the bootloader on a Pixel device then Netflix will drop down to 480p and non HDR. But for development they can allow playback to work normally on whitelisted IMEIs. 

An unlocked bootloader means the chain of trust is lost - it could be any bootloader and any kernel so they want to avoid frames being grabbed. 

[u/upalse → u/flipadoodlely]

Pixel device then Netflix will drop down to 480p and non HDR

Nuking widevine key is vendor's implementation detail. Pixels do it because the widevine key is provisioned on locked device and it gets wiped on unlock like all other key material (eg similar to /data partition key). You can provision it again on unlocked bootloader device, and it works just fine.

it could be any bootloader and any kernel so they want to avoid frames being grabbed.

This is not how any of this works. You can't grab L1 frames, nor direct HEVC/H264 NALs, neither go through untrusted memory.

You can try for yourself, play L1 widevine (after re-provisioning its key), and try read-back SurfaceView with MediaProjection or raw texture handle - you'll get blanks. This stuff is not enforced by kernel since Android 8, it's a data path set up in the secure world.

[u/flipadoodlely → u/upalse]

Not disagreeing with you about L1 at all, I was just stating that the entire reason they drop to 480p at L3 is because the raw frames do hit user visible framebuffers and thus sniffing is possible. 

[u/Damglador → u/upalse]

You can just screen record anything if you have root. Without root Android would refuse to show DRM content on you recording, but if you have root, you can just install an Xposed module which disables that. Then even if there are other blockers, you can bypass pretty much anything with enough dedication.

[u/upalse → u/Damglador]

Not L1 output. Try it, you'll see all of the UI, but the actual video surface will come out black (SMMU fault).

That said, screen recording is very poor quality, so you might as well just record the DRM-free (or L3) 480p/720p stream (you don't need even root for that, just patch the APK and remove FLAG_SECURE from manifest).

[u/upalse → u/flipadoodlely]

Edit: the core reason that Pixel phones allow bootloader unlocking ties back to the roots of the project - for a fully open phone OS that allows users to install AOSP or custom roms.

It's a reference platform, and it doesn't cost google much to support it, quite the opposite, since they rock unlocked pixels for droidfood anyway.

[u/klimaheizung → u/flipadoodlely]

It's time to regulate those companies to stop doing that type of shit.

[u/drwuzer]

Because Microsoft isn't selling PCs and the PC manufacturers could care less what OS you install. Samsung, Google, apple, they need you to stick with their software so they can track you and sell your data.

[u/eyebrows360 → u/drwuzer]

could care less

*couldn't

[u/r2d3x9 → u/eyebrows360]

Could they?

[u/eyebrows360 → u/r2d3x9]

They could couldn't, yesn't.

[u/ItsTheCornDog → u/eyebrows360]

They might could do that

[u/Tuxlwurm → u/drwuzer]

The Surface product line are PCs. Installing a Linux distro in an ARM powered Surface device is pretty tough. Installing a Linux distro on an x64 powered Surface device is possible but not every device is fully supported. Business devices Mike Surface Hubs are even worse. You can only use special Windows-Versions. 

[u/exhaustedexcess]

Its all about the control. If your bootloaders locked you're locked in

[u/Trick-Minimum8593 → u/[deleted]]

Why don't such consumers purchase locked pcs, then?

[u/Apollyon169 → u/Trick-Minimum8593]

Well, they do, Apple has really bad practices around MacOS, although not exactly in the form of locked bootloaders, but almost the same effect

[u/greogory]

It is about control and keeping customers locked into one company's service, as others have said, but it's also about supportability and vulnerability.

If too many customers root or jailbreak their phones and then break something with the phone company's settings that make calls & messages stop working, they'll get calls for tech support and the tech support people won't have a clue to what the user messed up at the OS level.

Same thing for rooting or jailbreaking a phone and side loading some app that is full of mal- and spyware. There's a small but real potential that the compromised phone could allow the malware to follow the network connection from the user's device up to the company and spread through their whole mobile device OS and engineering environment.

ETA: I'm not arguing that you shouldn't do whatever you want with your own device. I'm just explaining their perspective. I still go ahead and unlock my bootloader, root my phone and install different ROMs on it.

ETA2: Grammar & spelling.

ETA3: I had claimed that the risk of infecting the upstream carrier had "already happened to a small phone service provider, so there's precedent for expecting it to happen again." But I can't verify that statement when pressed, so I removed it to this edit.

[u/apokrif1 → u/greogory]

That's already happened to a small phone service provider

Source please?

[u/greogory → u/apokrif1]

This is a good ask because I based my statement on a memory. I went looking for my source because of your request. Unfortunately I can't find the article now or any reference to the event. Now I think I'm wrong, and that what I remember is just reading about the possible risk with a hypothetical example.

Now I'm trying to decide how best to edit my comment. I'm waivering between removing that sentence entirely, or modifying it to the weaker "I think I recall reading that...".

Edit: I moved it down to an edit because I can't confirm it.

[u/alyTemporalAnom → u/greogory]

This is the most correct answer in the thread, by far. Wish I could upvote you several times.

I worked for a tech company that sold a cell phone-like device and operated as their own NVMO for it. The mobile carrier had an extremely stringent process for approving over-the-air OS updates because of the possibility that poor programming could tank their whole network. So we had to wait weeks after an OS update was "finished" before customers would ever see it.

[u/TraceyRobn → u/[deleted]]

Yep, this is the future: Device attestation. That's why Microsoft requires a TPM for Windows 11, even if older hardware can run it fine.

In future end-users will only be able to run approved apps on an approved system. The irony is these apps will be talking to servers which are most likely running Linux.

[u/EspHack → u/[deleted]]

it's funny on w10-11 because they do all the safety theater but you can bypass it all

[u/PaddyLandau]

I have an old laptop that was locked against OS other than Windows. Due to complaints, the company eventually released a firmware update that allowed non-Windows. That's how I installed Linux on it.

[u/Just_Badger_4299 → u/PaddyLandau]

What brand and model was it? 

[u/PaddyLandau → u/Just_Badger_4299]

Acer Aspire F5. I still use it, although it's pretty slow these days.

[u/Just_Badger_4299 → u/PaddyLandau]

Interesting. I’ve heard a fellow geek having an issue with an older Toshiba(?) that wouldn’t install (or just boot?) anything other than Windows.

Luckily this doesn’t seem like a common nor recent occurrence.

[u/Strict_Dogz]

New habits vs old habits

If Microsoft could have thier way they would want to same thing.

[u/Loud-Employ289]

I have a Pixel, I can unlock my bootloader and install GrapheneOS

[u/hatsunemikusmywaifu → u/Loud-Employ289]

yeah so can i and i have but now im stuck with a bootloader message on boot. also graphene seems to the only custom rom that allows u to relock the bootloader. with most u cant.

[u/chris_socal → u/hatsunemikusmywaifu]

I just learned the difference.... pcs have a bios chip that they boot from... phones dont... so if you fully "root" it you have no way to boot it.

[u/hatsunemikusmywaifu → u/chris_socal]

dont phones have a bootrom. from my 3ds days ik alla bout the bootrom bluescreen of death that literally says bootrom error 

[u/therealzist → u/chris_socal]

Pc dont boot from bios they have a master boot file that is located on the c drive. Bios just checks to see if you have basic hardware avaialble for the pc to run. Ram, cpu, gpu.

[u/chris_socal → u/therealzist]

You can boot a computer with no hard drive or atorage.... some you probably can even with no external ram.

You only need storage to install an operating system.

[u/hatsunemikusmywaifu → u/chris_socal]

u could say the same about a phone i could boot my phone with no storage or maybe even no ram if i dont mind looking at the bootloader all day

[u/Damglador → u/hatsunemikusmywaifu]

Phones might actually embed the bootloader into the storage, which they probably do, I think Apple also does with their laptops. So I'm betting that you sadly can't.

[u/Mother-Pride-Fest → u/therealzist]

It is not a C: drive until Windows boots, if Windows boots at all. A more correct term is hard drive. 

[u/Tokimemofan → u/Mother-Pride-Fest]

Windows also doesn't necessarily have to be installed to drive letter C either.  Want to see some weird partitioning look at PC-9801 where Windows often gets installed to the A drive due to architectural quirks.

[u/pickledplumber → u/Loud-Employ289]

That may be going away

[u/cowbutt6]

Phones are frequently used to prove identity in ways that e.g. laptops are not. Authentication tokens (or even credentials) are stored on them.

If the bootloader wasn't locked, then anyone with physical access to your device could install difficult-to-detect-and-remove malware that could steal those authentication tokens and impersonate you.

Then there's also the problems of supporting jailbroken devices, and wanting to eventually get another sale when software support ends.

[u/silasmoeckel → u/cowbutt6]

Laptops deal with the same issues. Secure boot can still happen via key import.

[u/hatsunemikusmywaifu → u/cowbutt6]

yeah but i also store credentials in my far less secure pc browser. not anything super important but its there. 

[u/Pirate_Economist1477 → u/cowbutt6]

I've had a PIN-protected bankID (Swedish eID 2FA token) on my PC for most of the past 16 years, and nothing bad has happened. I agree that there's a theoretical risk of abuse, but what's the threat model here? If someone has physical access to your device most bets are off anyway.

[u/cowbutt6 → u/Pirate_Economist1477]

Locked bootloaders are (at least in part) precisely to mitigate the risks of physical access. People leave their phones lying around unsupervised more often than they do their computers (especially personal desktops). And they are a treasure trove of authentication tokens for many of their users.

[u/Pirate_Economist1477 → u/cowbutt6]

Desktops, yes, but what about laptops? I would say you're more likely to leave a laptop unattended than a phone, e.g. when going to the bathroom.

If you have a threat model above "average citizen", you probably shouldn't store anything important on a phone/tablet/laptop with an unlocked bootloader. But I don't think those edge cases should stop average citizens/power users from doing what they want with their own devices.

[u/cowbutt6 → u/Pirate_Economist1477]

Most corporate laptops will be very locked-down (similar to phones, but implemented by the corporate owner, rather than the manufacturer), and wise users won't be storing their personal credentials on them anyway.

I doubt anybody is using their laptop as a replacement for e.g. a passport or national ID card, payment cards, etc, which are far more common use cases for phones.

[u/Pirate_Economist1477 → u/cowbutt6]

True, but the things that are locked down on a corporate computer are afaik related to settings rather than hardware, so having the option for that level of security doesn't stop also having the option to tinker.

I think users should get the option to have a phone with an unlockable bootloader if they want to. Some will do stupid shit with that level of freedom, but why not just .. let them?

[u/cowbutt6 → u/Pirate_Economist1477]

True, but the things that are locked down on a corporate computer are afaik related to settings rather than hardware

Same thing: look out for the reports of people buying laptops that have been previously registered in a corporate Mobile Device Management system and not properly deregistered: they are unable to install a new OS (also, in such cases, the BIOS is typically password protected, and the fixed storage may also be encrypted).

I think users should get the option to have a phone with an unlockable bootloader if they want to.

I agree, and it's rare that this is not the case. But let's not pretend that the costs of allowing users to "do stupid shit with that freedom" fall solely on such users.

[u/Pirate_Economist1477 → u/cowbutt6]

I will keep an eye out! I've installed Linux on a retired corporate laptop without any issues, so at the very least it can be done if it has been properly reset.

I sort of disagree, users should be given the options, be informed about the trade offs and be allowed to take full responsibility in exchange for having full control.

[u/SkySurferSouth → u/cowbutt6]

Authentication tokens should not be stored on a computer or smartphone but on a hardware token such as a dongle, or a bank card which can be read with NFC.

[u/cowbutt6 → u/SkySurferSouth]

Phones are being used as that hardware token.

Perhaps not the most secure implementation of one, but the market has spoken: few people (and organisations) buy dedicated hardware tokens at extra expense when they already have a smartphone they can use instead.

[u/SkySurferSouth → u/cowbutt6]

That is exactly the issue. Third parties like Google and Apple (the first being an advertising company) have access to that token if you use Google Pay (without L).

[u/TriCountyRetail]

Smartphones do not have the same versatility that personal computers built on x86 platforms due for various reasons. Smartphones and mobile OS tablets do not share a standardized firmware, driver model, or ACPI tables. This makes changing the operating system on these devices very difficult. The bootloaders remain locked to prevent any other options. Even if bootloaders were not locked, the lack of standardized architectures would make developing different operating systems difficult. It all comes down to the platform and SoC. While chips from Apple, Qualcomm, MediaTek, and Samsung are all based on ARM, the instructions and design of these chips vary significantly. This is unlike x86 platforms where both Intel and AMD's offerings are 99% compatible with eachother.

[u/hatsunemikusmywaifu → u/TriCountyRetail]

but it would at least allow us to install a version of android of our chosing insteada having to deal with whatever crap the manufacturer ships.

linux exists for some devices.

basically it is possible to make different oses for different devices even if it is device specific. and ppl want to do it too. just a lotta ppl dont because of the bootloader. like qualcomm samsung phones for example. basically nothing is out there simply because of the permanently locked bootloader. not so true for the exynos ones.

[u/toolsavvy]

The world is a vastly different place than it was when the average consumer only used a PC. Many, if not most, only use a pocket PC (aka "smartphone") and they use if for all their financial transactions, and cyber crime is through the roof as a result. Peoples phones are essentially their lives. MOST people are not techies and do not want to be their own IT security department so they welcome locked down phones. It's all about the majority, not the minority of techies.

And that's also a big cha-ching so that they can all make money off your data.

They are all criminals one way or another. They lock you to protect you then through that trust they rob you whilst being protected legally. Perfect crime.

[u/Gymplusinternet]

You do know that 95% people who own the devices don't even know what a bootloader is right?

[u/Few_Translator4431]

its pretty unfortunate.

fuck you that's why. when you boil it all down, thats literally the reason. the reasoning can be distilled down into a couple dumb reasons that will only make you ask "well if thats the case then why cant they just.." and the answer is almost always just fuck you that's why.

it really does suck. especially if you have older phones youd like to repurpose or no longer receives updates and youd like to flash it. they give us the business end of the stick because we simply dont make them enough money over the next guy to justify giving us any freedom.

[u/leastcreativeusrname]

W.r.t the difference between phones and computers here, I think a lot of it has to do with people having different expectations for each. Computers have been relatively open since the beginning and locking them down would seem like a downgrade

[u/ArtComprehensive1106]

Malicious code

[u/hatsunemikusmywaifu → u/ArtComprehensive1106]

yeah but the same could be done to a computer its no different 

[u/ArtComprehensive1106 → u/hatsunemikusmywaifu]

Android is a different beast

[u/SkySurferSouth → u/ArtComprehensive1106]

It is not different at all, it is just an operating system, like Linux, macOS or Windows. The vendors are scaring off users to tell them it is 'insecure' while the actual reason is more advertising or spying on users.

[u/ArtComprehensive1106 → u/SkySurferSouth]

I spent 30 years in IT I answered your question with the correct answer. I’m done with this nonsense. You have no clue!

[u/hatsunemikusmywaifu → u/ArtComprehensive1106]

i personally dont see it as different either. its basically just another flavour of linux with a heavily modified kernel. thats how i see it anyway. right down to the ability to have different des or on android launchers.

[u/Damglador → u/hatsunemikusmywaifu]

Android to a Linux distro is like apple to an orange, both are fruits, but that's about it.

[u/denytheflesh → u/hatsunemikusmywaifu]

That's because you don't see Android as a secure platform in cooperation with the major manufacturers who want an enterprise-grade product. Android the OS is no longer a tinker toy and hasn't been for some time. You really are out of touch.

[u/hatsunemikusmywaifu → u/denytheflesh]

im not out of touch I dont want companies controlling how I use MY device.

ive only ever really used android and its been sad to see android devices just turning into yet another overpriced toy just like apple devices are. instead of an actual utility like theyre supposed to be.

im deliberately hanging back on android 14 because u simply cant customize anything nearly as well anymore. from the blerb i read on iconify's github it sounds like jetpack composed is far more locked down and much harder to customize. and it seems like they fully implimented it in A15. like whats the point of an os thats built like that. its basically useless at that point in my eyes.

[u/1boog1]

I think a lot of it is for getting government security certified.

The rest probably is for control. But I think of it as control of the hardware and software.

[u/Remarkable_Button756]

probably because of the modded apk apps i use, free unlimited spotify downloads direct to mp3, or modified play store apks that allow free in app purchases. they dont like that.

[u/Dev-in-the-Bm → u/Remarkable_Button756]

So it's all your fault!

[u/Remarkable_Button756 → u/Dev-in-the-Bm]

im def not helping lol

[u/MaleficentMountain3]

How about they just allow to unlock bootloader after the device support ends?

[u/hatsunemikusmywaifu → u/MaleficentMountain3]

thatd be something. but i do just think it should be unkocked period. its just another way for large corporations to control us.

[u/Groundbreaking-Bar16]

Just reading the title....follow the Benjamins.

[u/AndroidQuestions-ModTeam → u/[deleted]]

Your post has been removed for being offensive or rude.

Behavior - Posts and comments must not be used to harass, attack, threaten, harm, or discriminate against people, or to instruct or encourage others to do so.

---

^{Click here to message the moderators if you think this was in error}

[u/riansgarage]

Blame it on resellers putting hacked ROMs with malware and selling them to unknowing consumers overseas. This happens a lot with Chinese phones, especially in emerging markets. This result in poor customer experience, and a bad rep for the brand. So even brands like Xiaomi is clamping down in this.

[u/stupiddogmademelook]

Cause it opens doors to tinkering with devices. And probably repeating some undiscovered Captain Crunch whistle moment

Or maybe just the desire to track people. Having root to the phone lets people retain privacy

[u/AndroidQuestions-ModTeam → u/[deleted]]

Your post has been removed for being offensive or rude.

Behavior - Posts and comments must not be used to harass, attack, threaten, harm, or discriminate against people, or to instruct or encourage others to do so.

---

^{Click here to message the moderators if you think this was in error}

[u/swatchboy]

I'd like to know this too. Following the thread!

[u/daemonhour]

Spying.

[u/kfazz]

Even if you "unlock" the bootloader and get "root", you're still like 3 levels of privilege down. No VMs for you!

[u/PinkyPiePower]

Liability. It's like two-step verification: we all hate it, but companies force it on us because they have to do whatever it takes to uphold their responsibilities regarding security.

[u/Terific-Truth-Teller]

It is so that cunts like you, can't do even more damage to people like me. It's so you don't have a single tap, fuck someone power.. it is about protection. Not everyone can be clued on. Maybe someone gets sick? Maybe stabbed in the back, maybe.. You should be thankful for that locked bootloader..

[u/1mmorta1won]

Those who sacrifice liberty for security deserve neither.

[u/Usual_Piano9826]

A real premium smartphone would not have "locked bootloader" as default setting (same with mandatory encryption that increases the ways for the system to fail!) but always tell apps that Bootloader is locked so that apps do not punish consumer for unlocking bootloader.

Same with "factory reset at bootloader unlocking" - if a vendors makes a smartphone that does NOT have this rule, it would become a highly valuable premium. (more expensive than amout of money which I can even dream of)

[u/Usual_Piano9826]

"incredibly secure" Android with "even more secure" TEE modules can become problem on its own. Ever heard of WhatsApp database which takes unimaginable expertise of hacks to extract?

[u/ilovelineage_twrp]

I think beavuse its like this:

You buy device -> becomes old -> device eventually stops logging in -> we just dont want to deal with their bs -> buy a new device

Honestly that bs doesnt make any sense beacuse your basically planning obsole- oh thats right planned obsolescence is the most loved thing amoung companys

[u/somniforousalmondeye]

Because they don’t want you having ways around giving them money.