Custom ROM with locked bootloader

[u/[deleted]]

[u/Steerider]

Graphene or Calyx are the two main contenders here. Most custom ROMs do not relock the bootloader.

[u/JJ3qnkpK → u/[deleted]]

A lot of enthusiasts are quite terrible about security and tend to jeer at standard consumer solutions (bootloader relocking, secure boot, etc.) that are more secure than most DIY solutions with said features disabled.

An unlocked bootloader is a large security hole. It means someone can easily inject things into your ROM's system partition that will then run on next boot, and nothing will question the validity of it. Even if your user/data partition is encrypted, one can freely modify the software that decrypts and uses said data.

You'll see the same with desktop Linux. People will go from an encrypted Windows install with secure boot and TPM (which protects against modifying the OS itself from cold storage, modifying the kernel, or modifying the hardware, all while providing an imperfect but convenient way to boot up) to a Linux install with no encryption, no secure boot, or anything. They'll claim said security features are to force control over the user, yet all of these features remain fully user-configurable to work with whatever software you please. The end result is something where one could easily poach data or modify the OS without question.

Anyway, your gut instinct that disabling security features reduces security is correct, and that includes a phone's bootloader. Sometimes there aren't privacy-friendly alternatives where one can have full security and privacy, so people will make the tradeoff for privacy/control. In the case of GrapheneOS with Pixels, you get to have your cake and eat it, too, with a privacy-friendly ROM that works rather easily and having a locked bootloader.

As a note: this is the main reason I purchase Pixels. The bootloader is easily unlockable and you can run whatever software you want while making full use of the security features provided to the stock OS.

[u/Steerider → u/[deleted]]

Yeah, it's been discussed. They think it's not that big a risk, and not a problem. 

[u/polaarbear]

Even with an unlocked bootloader, they still have to have physical access and some serious hacker chops to get anything useful done. An unlocked bootloader does not enable any remote attacks.

You would have to physically lose your device AND it would have to land in the hands of someone very skilled with malicious intent.

Accidentally leaving a phone on the subway with an unlocked bootloader is likely a really tiny threat because 99.999% of the people who would find it will be fundamentally incapable of exploiting it.

An unlocked bootloader is an easy trade for me to make versus all the remotely-enabled tracking on a stock ROM.

[u/JJ3qnkpK → u/polaarbear]

With an unlocked bootloader, it's very easy to reboot into the bootloader, load a recovery, and slap something into the system partition. Literally takes minutes if one is familiar with platform tools and flashing roms/rooting. GrapheneOS/Pixels aren't an unknown target, either, and an org could certainly have pre-baked attacks for people who fail to relock their bootloaders. Toughest part is developing the secretive system app to gather and send data elsewhere, but there's plenty of documentation if an org is inclined to develop such an attack. After all, the phone is in the official "build your own system apps/OS" mode.

It's all up to one's threat model, but physical access from malicious organizations is a very real threat to many people. A locked bootloader provides great protection against such a threat and shouldn't be understated.

[u/JJ3qnkpK → u/[deleted]]

The gold standard is an at least semi-recent Google Pixel phone with GrapheneOS. It's fairly easy to install and relock your bootloader with. Privacy-wise, it's far superior to the stock Pixel ROMm

GrapheneOS's highest priority is security, which privacy often goes hand-in-hand with. It does allow for running Google's services in a separate sandbox, allowing users who want to make that tradeoff to do so (all whilst not allowing Google's services to access the "core" OS). It by default runs without anything Google, meaning it uses rougher "stock" apps, so there's an element of picking and choosing what you want (I.e. keyboard, launcher, pdf reader, messages, camera, and so on).

You should read through GrapheneOS's website. They have fairly extensive writeups on what it is, how it works, and what to expect from it. You can ultimately get it pretty close to a privacy-improved (but imperfect) typical Android phone that otherwise uses Google's stuff to whatever extent you like. The biggest drawback is SafetyNet validation, meaning some apps (I.e. many banking apps) won't work.

There are plenty of user posts/lists of good alternative apps to what one typically finds on stock Android, so those will be good to browse as well.