Samsung Removes Bootloader Unlocking with One UI 8

https://sammyguru.com/breaking-samsung-removes-bootloader-unlocking-with-one-ui-8/

by 1una • 12 months ago

287 246 12 months ago

stavros3• 12 months ago

More devices we no longer own and that are bound to become trash in a few years, and for what reason? So companies can make more profits?

baq2• 12 months ago

They should be economically incentivized to pick up their trash.

charcircuit7• 12 months ago

Is any other product forced to do such a thing? Considering a phone lasts for years and is very small, it produces very little garbage over time compared to disposable product people use. Think how big a garbage can is compared to a phone.

rickdeckard8• 12 months ago

This is already in place in the EU via the WEEE directive (Waste from Electrical and Electronic Equipment), but the costs have apparently been absorbed just fine already by this industry, so it doesn't seem to hurt them sufficiently to be incentivized for longevity.

As much as I hate it, the strongest incentive would maybe be to legally define vendors who supply hardware with a non-interchangable OS-ecosystem as service-providers and put restrictions on the price they can charge for the hardware to render the service (like i.e. a cable-modem from an ISP).

This could force the large players to decide between high-margin hardware or high-margin OS-ecosystem instead of aiming for both.

Come to think of it, these market-dynamics would be interesting to observe...

jjbinx0072• 12 months ago

I decided to part with my Huawei Mate 20 X after about 7 years of ownership not because it was a bad phone - on the contrary, it has a nice big screen, decent enough camera, is still plenty fast enough etc - but because the OS hadn't received any updates in a long time.

Rather than see it go to landfill I donated it to a friend who's happy to use it but what an absolute waste.

Bought a Pixel purely because they are committed to updating their phones for a long time.

stavros3• 12 months ago

I've been using Xiaomi phones but I had to buy a new phone every year or two just because they get so sluggish. My other Android phones kind of had the same, except my Nothing 2 has been going strong.

Has this been your experience as well, or have your phones been OK with responsiveness? Seven years is a long time, I imagine the phone must have been unusable by then.

charcircuit7• 12 months ago

You still own the device even if the bootloader is locked. It's like saying you don't own a CPU because you can't add your own instructions. There are always going to be limits to what you can easily customize for a device.

account01011100• 12 months ago

Adding cpu instructions is something that you can't physically do, however unlocking the bootloader is something you can do via software, and if a vendor chooses to lock it down they're basically taking away your ability to do anything you would want to do with a device. Sadly this is has been the case for a while and it's probably going to continue being the case.

e2le• 12 months ago

I don't believe a user lacking the ability to perform a microcode update impacts their freedom in any meaningful way. The CPU still executes whatever instructions it's given unless the user is deprived of that freedom.

wiseowise• 12 months ago

But think of banks and music services, comrade! Banks need the waste to protect you, and poor music services will go out of business if you control your own phone!

inoperable• 12 months ago

And fuck you over with data mining everything all the time without you having any means to cut it out

trollbridge2• 12 months ago

Doesn’t seem to be any vendor option to avoid this other than Apple, or the niche guys like Fairphone.

delfinom• 12 months ago

Apple 1000% datamines you, it's in their ToS that you agree for them to use your data for their own marketing.

sn0n• 12 months ago

dont worry, samsung knows only 300 people will actually care.

As for me, I already swore off Samdung for their whole Samsung account bs and apps they bundle and won't let me remove (or disable).

crinkly2• 12 months ago

Yep. Everyone I know who bought a Samsung anything (TV/Phone/Washer/Dryer) last time said it's their last Samsung product. Samsung sure know how to piss off customers.

perching_aix• 12 months ago

It's actually incredible how consistent they are with it. I'm hesitant to buy a foldable or a display from them for this very reason, even though I'd be otherwise interested.

cudder• 12 months ago

Well, I dunno. I've seen it as a lesser evil compared to many others.

In ye olden times I had such a horrible time with my cheapo Samsung when trying to upgrade it from Android 1.5 to 2.1 that I swore it'd be my last Samsung, and it was, for well over a decade. During that time I went through some iPhones and a handful of the most popular alternative Android brands.

Since the thread is about Android I'll focus on that. Every manufacturer was hamstrung by one or more of the following issues:

- Subpar hardware

- Difficult and slow RMA process where your device flies around the globe for repairs

- Software bloat, just like Samsung, but from a country I trust even less (China vs SK)

- Very infrequent updates (if you are lucky enough to get them at all), especially once a newer model is out

Now since this thread is about bootloaders this is probably a hot take, but I spend enough of my time troubleshooting stuff at work, so when I use my phone I want it to "just work" and not have to play some stupid anti integrity protection cat and mouse game to access my bank's app. So the last two are not solved with an open bootloader.

Samsung on the other hand has in recent years given me the "just works" experience on decent hardware, paired with frequent updates. And while their authorized repair shop might not be in my city, it is at least in my country and just a train ride away.

That being said, the nerd in me is disappointed in this move, and the recent EU ruling that forces manufacturers to actually support the stuff they sell for a reasonable time even after it's off the shelves might change things for the better w.r.t. other manufacturers.

jemmyw• 12 months ago

I've got a Samsung dryer and when it had a fault with the door sensor they got it fixed pretty quickly. I had better service from them than Bosch or Miele - I replaced a Bosch dryer when I was totally fed up of trying to organise Bosch to fix it and being told it was at least a 6 week wait - Samsung half the price, and surprised us that it is a better dryer (faster, easier to use etc).

I don't love their phones, though my wife has one. However, again on the service front, when my samsung S7 had a problem they fixed it pretty quickly. When my iPhone 5 came with the wifi not working it took weeks to convince Apple that it was actually broken and get a replacement.

All anecdotal of course, and probably varies a lot by location and over time.

catlikesshrimp3• 12 months ago

Is the alternative really better overall. We upgraded to a samsung fridge last year from two consecutive cheapo-chinese-local walmart-brands and it was worth every penny. It will pay itself in energy savings in less than two years.

perryizgr8• 12 months ago

I think their phone in the high end is the best phone on the market, unless ios is a requirement for you. Also, I bought a Samsung AC and really like the smart features. Really nice integration with Alexa too.

FerretFred• 12 months ago

Same here. I got so tired of fighting "the system" that wanted to manage everything, and post-updates meant mire wasted time switching off bloat/features I didn't need.

bjord3• 12 months ago

samsung is the only smartphone manufacturer that still makes phones (though not many) with all the features I want: microSD slot, dual physical sim, side-mounted fingerprint reader, headphone jack, nfc, and regular (long-lasting) security updates

they also have service centers pretty much everywhere in the world, so I can always get my phone fixed (for a reasonable price, as a result of their ubiquity) if and when I inevitably break it

would I also prefer the option to unlock my bootloader? yes. if I'm honest with myself, is it a deal-breaker? sadly, no, I no longer use custom ROMs

jjani3• 12 months ago

Which of their phones have all of these?

dotancohen4• 12 months ago

  > samsung is the only smartphone manufacturer that still makes phones (though not many) with all the features I want

Not to mention the built-in EMR stylus. That makes such a difference in using the device, I cannot believe they are not more common. And they are a terrific backup for the not unusual case of a broken screen being unresponsive.

cosmic_cheese• 12 months ago

They seem to skip some years when bringing updated models to the US for some reason, but Sony Xperia phones check most of these boxes. I have an Xperia 1 V that I use as an app dev test device and as a backup phone and have found it pretty nice. The hardware feels great and their Android build isn’t nearly as junked up as Samsung’s. I’m always surprised they aren’t more popular.

sva_2• 12 months ago

microSD slot

That stopped from S21 on.

side-mounted fingerprint reader

It is in the screen since S10?

headphone jack

Not since S20.

Just speaking of the Galaxys of course.

NoboruWataya2• 12 months ago

What do you use? Samsung are anti-consumer but none of the other big phone manufacturers seem to be much better (and historically at least Samsung's flagship phones have been pretty good hardware-wise).

M95D• 12 months ago

I try to avoid big <anything> manufacturers by default.

Der_Einzige• 12 months ago

Those 300 people include some experts at spiritual warfare which will guarantee that all involved in this decision will reincarnate into durian fruits in the next life.

Sunspark• 12 months ago

Some of the Samsung apps are better than alternatives. Google is not the best at everything.

saidinesh52• 12 months ago

Pixel stopped providing device trees, kernel history,

Samsung has been doing this for a while now.

Which are the devices/vendors that still allow / encourage this?

Even Graphene OS reported that they're in talks with some vendor... Have there been any updates towards that?

The main reason i used to root devices are:

* Get longer support/OS updates than what the vendor provided

* System level adblock using adaway

* Titanium backup

These days firefox/brave browser gets me half way through adblocking and i lost interest in the ad filled apps..

Syncing gets me good level of syncing for backup on my NAS etc .

pentamassiv• 12 months ago

Fairphone does!

https://www.fairphone.com/en/bootloader-unlocking-code-for-f...

lordofgibbons• 12 months ago

Do anyone know why GrapheneOS doesn't support fairphone?

microtonal3• 12 months ago

Unfortunately, it's hard to make Fairphone secure. No separate secure element (so much easier to do brute force PIN attacks) and always lags in monthly security bulletin patches and major OS releases (remember that the monthly patches typically only address high/critical vulnerabilities, for the rest you need OS updates, QPRs, etc.).

Until Graphene works out the deal with the OEM that they are talking to, Pixel is pretty much the only secure phone that allows installing alternative firmware.

gavinray• 12 months ago

You can use AdGuard to block in-app ads on Android as an FYI

pnutjam• 12 months ago

You mean w/ DNS? or an app?

RealStickman_• 12 months ago

Here's an updated list of relatively popular phone manufactures and their bootloader unlocking potential.

https://github.com/melontini/bootloader-unlock-wall-of-shame...

sugarpimpdorsey• 12 months ago

Was anyone else shocked to see Microsoft in the top tier of their list of unlock-friendly phone manufacturers?

mrheosuper3• 12 months ago

Surprise that Oppo is in avoid list, while oneplus is in safe list. Both of them are from same company.

This proves there is no technical difficulty to provide unlock bootloader

subscribed4• 12 months ago

They mix up Google-vendor (pixels are absolutely the best and most unlocking-friendly hardware at this point), with Google Play Services services/limitations (ie dominant player in android ecosystem) AND Google, the dominant contributor to AOSP project.

And it's also partially false, as Gemini works just fine after unlocking/relocking, and all the advanced features (full performance of the cameras, NPU access, secure element) work even on non-Google OS. Things that do not work (mostly wallet) are valid issue, but then again, they work just fine after flashing OEM firmware And relocking The bootloader.

So I can only guess the quality of the contribution is similar with other phone brands.

dbcooper• 12 months ago

You can use nextdns for DNS adblocking.

subscribed4• 12 months ago

So, notice Graphene OS was able to port Android 16 on all the supported devices (from Pixel 6 up) basically within a week without device trees already, without the early (OEM) access to the release.

It's a big inconvenience but not a showstopper for them. Pixels are still viable.

The only blocker with pixels would be if they stopped allowing OEM unlocking or relocking (which is a must).

fsflover• 12 months ago

Which are the devices/vendors that still allow / encourage this?

GNU/Linux phones (Librem 5 and Pinephone).

Jotalea2• 12 months ago

You can block ads without root by using Adguard DNS.

strcat9• 12 months ago

Even Graphene OS reported that they're in talks with some vendor... Have there been any updates towards that?

The startup we were working with before went bankrupt. In June, we started working with a major Android OEM which has provided resources for identifying everything which will need to be done to meet our requirements and provide official GrapheneOS support. They believe they can meet all our official requirements without much trouble and they're going to determine how much resources they want to put into it soon. We don't yet know how many resources are going to go into it.

The main reason i used to root devices are

Note using GrapheneOS does not involve rooting.

System level adblock using adaway

You can use RethinkDNS for filtering combined with still using a WireGuard VPN or multiple chained WireGuard VPNs. Android has a perfectly good API for this.

Titanium backup

GrapheneOS has a built-in encrypted backup system we plan to significantly improve upon. The basics are there already.

guerrilla2• 12 months ago

Exactly. This is why I won't buy from these companies even when conditions look good. It'll be bait and switch every sigle time. Fairphone all the way.

dotancohen4• 12 months ago

When Fairphone comes out with a phone with an EMR stylus built in, I'll be the first in line.

guerrilla2• 12 months ago

That's very picky. I'm sure there are better ways to solve your problem.

altairprime2• 12 months ago

Given the timing, it’s likely related to: https://news.ycombinator.com/item?id=44705240

rickdeckard8• 12 months ago

Unlikely, bootloader unlock is a controlled process and state of the OS for many years now.

The procedure explicitly hands over the responsibility of OS-integrity to the end-user, it's not Samsung's responsibility after that and the user needs to confirm that.

It's much more likely that the cost/benefit profile to develop/maintain/support that feature and its related unlock-process is simply not sufficient, all while several of the biggest customers explicitly require unlock to NOT be supported.

g-b-r3• 12 months ago

What's the cost to develop/maintain/support the feature? It's a simple switch, and since it's probably in AOSP there's cost in removing it, not in leaving it there

aeblyve6• 12 months ago

The writing's been on the wall for custom ROMs in general for a while, so I've been starting to think about a mobile phone vendor I could actually have a decent business relationship with. I.e. use their stock ROM and be fairly happy with it.

Any opinions? Samsung was a candidate for their somewhat unified ecosystem. Maybe even apple.

DobarDabar• 12 months ago

Check Nothing

bestouff• 12 months ago

Whatever floats your boat. I'll remain with the latest vendor making custom OS possible.

FYI Pixels still allow flashing custom ROMs, they've just slightly inconvenienced developers.

aeblyve6• 12 months ago

It's not necessarily about it being possible, but the level of support and refinement.

The future I'm seeing is one in which custom ROMs still exist as hobby projects, but aren't suitable for use in "production".

frizlab• 12 months ago

Apple is good out of the box, and has a strong ecosystem.

Ambroos2• 12 months ago

I still really like Sony phones. Excellent hardware. They have no online services they are trying to push, they just want you to buy their phones. As a result, the stock software is very clean Google Android without much extra. But they're not available in every region, and quite expensive. Used to have very short software support but now they do 4 major Android version updates / 6 years of security updates.

You get no ecosystem benefits though, it's really just plain Android.

piperswe• 12 months ago

Though for Americans, Sony sadly doesn't release their phones in the USA anymore

mmis1000• 12 months ago

Sony phones generally have a ok-ish hardware(their old 4k oled screen is still top-tier for watch videos to date in my opinion) and emmmm-ish software support. And depends on your region, the software support can be even worse. For example, TW-version sony phones have a serious delayed update schedule. You may get an update that others already received for half an year (and pixel phones have already got two years ago)

climb_stealth2• 12 months ago

I really wanted a Sony phone as it ticked all the boxes. Headphone jack, SD card slot and bootloader unlock with LineageOS support. AFAIK no one else does that in current phones.

But the sad reality hit when there were all kinds of hurdles around getting 5G/4G working in Australia. Was not going to risk ~$900 dollars on a phone that could end up being a paperweight and returned it.

It's a sad state and makes me miss the good old days.

hypercube33• 12 months ago

Do they work well on the big US carriers? Especially the ones starting with V?

microtonal3• 12 months ago

Samsung carries a lot of advertising crap, tracking, etc. Pretty much every phones is going to be worse than Pixel in that respect, since you get Google's tracking + whatever pile of crap the vendor added (which in the end they all seem to do).

So it's basically:

Pixel with GrapheneOS > iPhone >> Google Pixel with PixelOS

I wouldn't recommend anything else. Theoretically Fairphone + e/OS may have been an option, but the security is crap.

I guess there is Sony, you could even install Sailfish OS, no experience though.

aeblyve6• 12 months ago

I've owned a few pixels but for whatever reason in my case the hardware had a habit of randomly dying just outside of the warranty period. But maybe I can revisit.

strcat9• 12 months ago

Theoretically Fairphone + e/OS may have been an option, but the security is crap.

Lack of current privacy/security patches and the current privacy protections in Android means having very poor privacy too. There's no equivalent to the privacy protections added by GrapheneOS either including ones also offered by iOS now such as iOS having a more basic equivalent to the GrapheneOS Contact Scopes feature since iOS 18 and iOS having better storage/media control than Android similar to Storage Scopes in GrapheneOS.

I guess there is Sony, you could even install Sailfish OS, no experience though.

SailfishOS is much less private/secure than AOSP and is largely closed source. It's the opposite of a more open OS.

rickdeckard8• 12 months ago

It is really a pity, as this means Android OS is closing down.

Without supported Consumer Hardware available on the market in sufficient volume, even less end-users will use an alternative OS, which will affect quality and size of the alternative OS-market and fragment the remaining users even more.

This will put the future of the entire alternative-OS ecosystem firmly back into the hands of Google. If they start further restricting BL-unlock on the Pixel-series to e.g. only Google Developer Account-Holders, the whole ecosystem will finally close down.

kotaKat3• 12 months ago

I’ve always said that it’s been “Google’s Android”, and wellp —- Welcome to Google’s Android, where the garden walls have been turned into a razorwire fence and you’re not welcome to leave.

It’s really funny that Apple’s finally allowing carefully controlled access outside of their own fences and slowly adding more APIs and expansion (hell, Apple are the only platform now with third party APIs for RCS in the EU) while Google’s spun an about face and will get away with it.

rickdeckard8• 12 months ago

Of course it's been Google's Android, I don't think anyone ever questioned that. The whole reason why the OS still lives as a single entity and the app-ecosystem is not completely fragmented is due to Google's governance to keep it in check.

All the stuff Apple now slowly starts to allow on iOS due to EU's Digital Markets Act is still just scratching the surface of what Android already supports.

hell, Apple are the only platform now with third party APIs for RCS in the EU

They provide third party API's to use APPLE's RCS-Service. The alternative would have been to support registering alternative RCS-services as default on the OS (and then, allow the user to choose a service).

while Google’s spun an about face and will get away with it

Android already allows to install and configure alternative applications for RCS, in fact Samsung uses their own RCS Messaging service on its devices.

293984j29384• 12 months ago

Google is first and foremost an advertising company. They're going to do whatever makes them the most profit. It always had razor wire fences unfortunately.

gmueckl3• 12 months ago

You're ignoring an elephant here: Apple meticulously enables these extras functionality exclusively in the EU. They cut these features out for the rest of the world as much as they can. In that regard, they feel like the corporate equivalent of a stubborn 3 tear old.

ptrl6002• 12 months ago

Been compiling and running lineageos for nigh on five years now. Attention corporate tyrants: I will never give up.

aeblyve6• 12 months ago

Seems you may have to start getting good at SMD rework soon.

ptrl6002• 12 months ago

Either freedom or zip. I'd sooner bang rocks together than use a phone I can't compile the OS for. The number of required binary blobs is a foul enough insult already.

Hackbraten4• 12 months ago

You can always move to a phone that runs on mainline Linux proper.

Zak4• 12 months ago

I have to wonder what Samsung's motivation is here. Of course they probably have some bloatware they profit from, but someone who plans to unlock the bootloader just won't buy their device now. Samsung only benefits if they lose money on device sales (do they?) and make it up on "services".

worldsavior2• 12 months ago

How many people are there that unlock their bootloader?

Zak4• 12 months ago

Few, and far fewer than in the early days of Android. It's odd that a company Samsung's size would care about this.

edelhans• 12 months ago

I just unlocked the bootloader on my Xiaomi Mi Pad 5 today (which was a nightmare to do btw.). Why did I unlock it? The device has nice hardware, but is stuck with Android 13 and does not get any security updates either, so flashing a custom ROM is my only chance of having an up-to-date device.

Next step will be to try PostmarketOS and see how that goes

kotaKat3• 12 months ago

I’ve got five bucks on this being a new requirement from Google to Tier 1 OEMs to eliminate bootloader locking.

Zak4• 12 months ago

Google's own Pixel devices have easy unlocking, so this would surprise me. Google's strategy to keep devices users actually control from being too mainstream is remote attestation.

unyttigfjelltol2• 12 months ago

Samsung botched UI 7.0.[1] Their approach to UI 8.0 is more of the same. Removing features is one thing, this is something worse.

[1] https://us.community.samsung.com/t5/Galaxy-S22/One-UI-7-0-Up...

internetter• 12 months ago

I'm guessing this is your post? Way too anacdoal to make generalizations to OneUI 7.0 as a whole (and, expecting the demands to work in a community forum is funny, and, was the prompt "hey chatGPT, write a frustrated forum post?")

zxcvgm• 12 months ago

Xiaomi apparently have also stopped unlocking their bootloaders, so the "workaround" was to go to an official store and ask them perform a downgrade, and before the staff can relock the bootloader, grab the phone and run:

https://x.com/kobe_koto/status/1949154478298456531

Absolutely hilarious.

sunaookami2• 12 months ago

It's still possible outside of China but you have to have a Mi account and for newer phones you have to make some forum posts or some dumb shit.

unaindz• 12 months ago

I dont think you need to do the forum posts but you need to request unlocking every two days and pray it works. Supposedly at 00:00 chinese local time for any chances of getting permission. Took me several months of trying non continuously.

lawlessone• 12 months ago

I did that a few years ago. Had to download some tool to my PC.

Then make a request that takes 2 weeks to go through. and enter the or whatever (this was like 2016 or something).

Whole process was clearly designed to make you give up.

Their phones where junk then though and i just got something else in the end. They're a lot better now so actually unlocking it is probably worth something now.

ralferoo2• 12 months ago

I did that years ago when I bought a Redmi Note 4 in Shenzhen and discovered that the Chinese ROM is very locked down. I created the Mi post, but I don't remember having to make a forum post (although it does ring a slight bell). AFAIK it was just sending a DM to support on the forum / app to explain why you needed to install the Global ROM rather than the Chinese ROM (and being a foreigner was accepted as a valid reason). About a day later they unlocked the phone bootloader remotely, and then I could install any version of the Global ROM I wanted.

I've bought all my subsequent ones (Note 5, Note 8, Note 11, Note 12Pro) in either HK or UK so they all came with the Global ROM, and I've not felt the need to unlock any of them, so not tried to process since. But it definitely used to be pretty easy.

I suspect the reason for the weird process is legal to ensure that phones in China don't get unlocked in order to circumvent content controls.

WD-42• 12 months ago

This is amazing. Imagine getting the cops called on you for this and having to explain why the phone company was against you stealing your own phone

nunez2• 12 months ago

As someone who roots single-purpose Android devices, this is one of those things that sucks big-time but makes total sense.

The only reason one would unlock a bootloader is to root the system partition. It is impossible to protect data on rooted phones and makes data exfiltration attacks significantly easier to do.

This is a huge problem for banking and music apps that absolutely rely on this capability. Samsung is, by far, the biggest seller of Android phones in the US. (I think Xiaomi is the biggest globally), so they are under much more pressure to clamp down on this.

That said, rooting Samsung devices has been a worthless pursuit for a long time. Doing so irreversibly (via eFuse) disables KNOX, which prevents DeX and Samsung Health from working. It also trips SafetyNet, which disables a whole suite of key apps (banking apps and Apple Music don't work; not sure about Spotify). There's a Magisk module that uses well-known device IDs to work around these, but these only work temporaily. Many people have also reported issues with the camera (a popular reason for buying Samsungs in the first place), and you no longer get OTA updates. I believe you also get degraded camera performance if you flash another ROM since the device module is closed-source and relies on One UI to work. This is before considering that stock ROMs have gotten really good over the years (especially Samsung's), and many of the reasons why we had to root have mostly gone away.

You can work around this by buying a Pixel for now, but I think we're a few years away from bootloader unlocking going away entirely.

That said, I stll root Android devices that will only serve a single-purpose, like my BOOX eBook readers that I use Firefox on. This lets me run AFWall so that I can block network traffic for everything except Firefox (and a few other apps). However, I won't be logging into my Google account on them, and they aren't ever going to run banking apps or anything like that.

ranger207• 12 months ago

It is impossible to protect data on rooted phones

What makes securing rooted phones different from securing rooted PCs?

ACCount362• 12 months ago

Phones are portable, and thus more likely to suffer from a physical attack. But that's about it.

It is, and always was a flimsy excuse to the strip user of control over his own device.

"Secure Boot" isn't actually there to protect the device from an attacker. It's there to "protect" the device from its own user. It's used to "secure" DRM schemes and App Store revenue streams.

seanw444• 12 months ago

Nothing. They just perceive the users as more stupid and incapable of handling their personal property properly.

dawnerd• 12 months ago

I don’t get this too. Laptops are just as portable but don’t have this limitation (yet). This argument that it’s to protect banking and music apps is silly, those products work fine on pcs while maintaining security.

observationist• 12 months ago

Magic rock complicated. Grog say Grug too dumb to do magic rock right, so only Grog have secret magic rock key.

Grug pay Grog many shiny rock for make magic rock work, or Grog use key and magic rock stop working.

dlcarrier2• 12 months ago

To clarify, that line was implying something that makes a big impact:

    It is impossible to protect [the owner from accessing] data on rooted phones

It matters a lot to distributors why like to trick copyright holders into thinking that DRM is effect, which could only be the case if it works 100% of the time on 100% of the users, which it generally doesn't.

RainyDayTmrw• 12 months ago

If PCs were newly invented today, they may well have been locked down from the start. You already seeing the big names, Apple and Microsoft, with MacOS and Windows, respectively, inching along in that direction.

throwaway39381• 12 months ago

This is a huge problem for banking and music apps that absolutely rely on this capability.

In the case of banking, unlocking the bootloader usually requires a full device reset and leaves a very obvious message when you boot up the phone—you can't grab someone's locked device, root it, and grab their financial data just like that.

As for music apps and other apps that download copyrighted content to the user's device, leaving the moral aspects of stripping the user of control of files on their own device aside, preventing their use on rooted devices just loses them users since

- Those are by no means essential apps

- If you know how to root your phone, you probably know how how to pirate media as well

- People can just use computers to exfiltrate copyrighted media instead since most of those apps have PC versions

It "doesn't make total sense", it never has. It's just a kneejerk reaction that conveniently aligns with stripping the user of control.

gmueckl3• 12 months ago

The problem with banking isn't rooting itself as an attack vector, but the insecurity and laxk of reliability guarantees of rooted phones so that banks rightfully don't want any liability when something goes wrong with their apps.

causality0• 12 months ago

My S24 Ultra is unlocked and rooted and I use DeX every day.

wackget• 12 months ago

My response would be it doesn't make any sense. There are so many reasons why blocking rooting is a stupid idea. Just some of them:

- If you're capable of rooting a device then you're capable of understanding the risks which come with doing so.

- The number of users who root their devices will always be so comparitively tiny that the increased risk of data exfil is incredibly small. Also, similarly to above, if you're technical enough to root your device then you're probably not regularly putting yourself at risk by downloading shady apps etc. anyway.

- Rather than decreasing security, rooting allows you to enhance the security of your device by installing lower-level tools and, most importantly, removing all the bloatware crap which comes on most phones. This reduces the surface area of attack.

Let's be honest and admit that the only reason to prevent users from rooting their phones is to protect companies' profits by ensuring users can't fight back against the blatant tracking, data mining, and analytics capture which is so valuable to companies.

neobrain2• 12 months ago

Let's be honest and admit that the only reason to prevent users from rooting their phones is to protect companies' profits by ensuring users can't fight back against the blatant tracking, data mining, and analytics capture which is so valuable to companies.

I'm with you on the general sentiment, but how do the companies that block rooting benefit from any of the nefarious activities you mentioned? Those are executed by different organizations, typically.

dist-epoch• 12 months ago

The number of users who root their devices will always be so comparitively tiny that the increased risk of data exfil is incredibly small
the only reason to prevent users from rooting their phones is to protect companies' profits by ensuring users can't fight back against the blatant tracking, data mining, and analytics capture

You contradict yourself, if the number of users which will root their devices is tiny, the lost profits from tracking, data mining, analytics is tiny as well.

mappu• 12 months ago

The main reason IMO to block rooting is to stop resellers selling phones with preinstalled malware. If the phone has two Amazon/Aliexpress sellers, you're going to pick the cheaper one right? With who-knows-what alterations? It's a really prevalent problem and most people are not going to notice the "insecure" warning at bootup.

nunez2• 12 months ago

- If you're capable of rooting a device then you're capable of understanding the risks which come with doing so.

Spend an hour in xdaforums and you'll see how untrue that is.

Many people root just to get YouTube Revanced or something like that. Meanwhile, you have launchers masquerading as a stock launcher that will happily steal refresh tokens for your Google account.

anonymousiam• 12 months ago

I'm not sure if this is true, or for how long it has been true. I rooted my company phone (Samsung Galaxy S4), removed the crapware, and un-rooted it so that it could join the corporate network. This was a long time ago.

microtonal3• 12 months ago

Rooting certainly blows the Vault eFuse. Knox Vault, etc. are newer than the S4 (Knox Vault was introduced in the S21).

For removing bloatware from the user partition you don't need to root, adb or the universal android debloater will do.

Arch-TK3• 12 months ago

The only reason one would unlock a bootloader is to root the system partition. It is impossible to protect data on rooted phones and makes data exfiltration attacks significantly easier to do.

What are you smoking?

The only reason I've ever unlocked a bootloader has been to replace the OS with a different one. And it had nothing to do with rooting. I have no interest in having a rooted phone on my person at all times. But I have full interest in having GrapheneOS protecting me, among many other things, from opportunistic government spying.

sva_2• 12 months ago

music apps

It is so silly though. Someone who knows how to root a phone can probably also figure out how to download songs from Spotify (librespot wink wink.)

palata2• 12 months ago

The only reason one would unlock a bootloader is to root the system partition.

This couldn't be more wrong. You need to unlock the bootloader if you want to install an alternative OS. Which is a completely valid use-case.

dlcarrier2• 12 months ago

    This is a huge problem for banking and music apps that absolutely rely on this capability

Yeah, I immediately cleared application data and uninstalled it, once I discovered my bank, of all organizations, was relying on Android to silo a token that grants access to my bank account with nothing else but a 4-digit PIN.

I had submitted a vulnerability report, because the option to require a password could be turned off without a password, and their response was that it works as expected, because they only require a PIN and providing a password is optional. That isn't to say that I have the option to make my account require passwords, it's that providing a password isn't needed, but I have the option of providing one anyway.

With only the PIN requirement, and four attempts before a lockout, a security vulnerability in the OS immediately becomes a 1 in 250 chance they'll have full access to may bank account, if I have a truly random PIN, or a 1 in 5 chance, if I have one of the four most common PINs and it always tries those. All that without having to wait to capture me logging in.

Also, Google explicitly states that the phones storage should not be used for sensitive data.

prmoustache• 12 months ago

Banking app do not need to protect data, they are just websites really.

phkahler2• 12 months ago

Samsung also removed my flashlight recently. The whole pull-down that contained it is gone. Not sure what they're thinking over there.

WXLCKNO2• 12 months ago

You're gonna have to explain that one.

Do you mean the new One UI update that made the notification pull down split into left and right swipes instead swipe down and then swipe down again? Because if that's what you mean, you can configure it to be the way it used to be again.

Little pencil button, then panel settings and choose together instead of separate.

phkahler2• 12 months ago

That was it!! How was i supposed to know to swipe down and then right? Grrr!

cheeze2• 12 months ago

... Use the edit functionality to add it back?

I assure you that Samsung doesn't care to remove your... flashlight.

This likely just got removed from a fat finger/phone being on in your pocket/etc.

npteljes2• 12 months ago

I'm surprised they let it go on as long as they did.

mschuster914• 12 months ago

Normally, I'd go and say "vote with your wallet" - but sadly, in the tablet sphere, it's either ultra low spec Alibaba junk or it's Samsung. No Fairphone, no Pixel, nothing.

Seriously Samsung, go and screw yourselves.

The reason I insist on rooting in the first place is because unlike iOS which has a true full backup that you can trigger from your Mac (and restore afterwards), Android decidedly does not, and a bunch of apps don't do any kind of cloud sync.

cheeze2• 12 months ago

Even then, Samsung lags hard in the tablet space.

IMO there is kinda only one option... an iPad.

It's an order of magnitude better than anything else out there. And that's coming from someone who doesn't really like Apple products.

Given that your major reason for rooting is something that... Apple solves for. Maybe there is another option?

mschuster914• 12 months ago

Believe it or not I did consider going the full Apple route. The problem is, Apple doesn't offer anything in the 8 inch zone. I need a tablet that fits into my pant pockets.

And on top of that, there's no way to migrate the data from a bunch of these apps from the Google walled garden to the Apple walled garden, not to mention purchased licenses.

mrheosuper3• 12 months ago

there are countless decent android tablet not from Samsung. Lenovo, oppo, oneplus, xiaomi.

mschuster914• 12 months ago

Oppo is Chinese, so is Oneplus, so is Xiaomi - those are what I meant with "alibaba garbage", especially when it comes to performance. I don't trust either of these brands to deliver updates on time or for more than two years, spare parts just the same, and that's before the question if one wants a brand that may be targeted by US sanctions like Huawei, locking the user out of Play Services.

With Samsung there are established networks on how to get spare parts and they have a proven track record of delivering updates on time.

Lenovo's offerings are a disaster performance-wise.

foresto• 12 months ago

Sony Xperia models have been my choice since the Sony Ericsson days. Unlockable bootloader, LineageOS available, microsd card, headphone jack, good screen, decent camera, reasonably powerful SoC, water/dust resistant, and probably several other benefits that I'm forgetting at the moment.

I don't know if any US carrier offers them, but last time I was shopping, models with North American radios could be bought online.

My main complaints about Xperia phones:

- They don't support re-locking the bootloader at all, let alone with custom keys. This could be problematic for folks who depend on mobile banking apps that require full Google Play Integrity (SafetyNet) attestation, or risky for folks who leave their phone unattended around potential adversaries. To be fair, almost all smartphones have this problem.

- Their wonderful Xperia Compact line, comprising smaller versions of their flagship phones, seems to have been abandoned. Even their most recent "compact" models were bulky compared to their predecessors.

codedokode2• 12 months ago

It is getting incredibly difficult to obtain a non-backdoored smartphone nowadays.

I tried to find which phones support alternative OSes, without Google control and telemetry, but it turned out that alternative OSes (LineageOS, PostmarketOS, Graphenos) support mostly support outdated models and it makes no sense to buy them. There is also "Google Pixel", but the prices start at around $600 which is 3 times more than a reasonable price for a phone.

So now I am wondering if it is possible to extract the ROM from a reasonably priced Samsung phone, remove the components I don't like and write it back.

NoGravitas2• 12 months ago

GrapheneOS supports the newest Pixels, and only the Pixels that are still getting updates from Google. Right now the least bad option is probably a one-generation-old NOS or Open Box Pixel with GrapheneOS.

theandrewbailey2• 12 months ago

I did this. I got an open box Pixel 9A at Best Buy for $450 about a month ago. I immediately installed GrapheneOS on it.

sersi• 12 months ago

Damn, I got a samsung instead of an asus phone because I could unlock it. Now what:s left? Really annoyed at all those companies who refuse to let me own my own phone.

And before anyone asks me if I really need to unlock my phone... It's the principle of it, if I bought it, I own it and I should be able to run what I want on it. I will not buy a phone from a company that denies me that right.

That said, I do use root for a few things:

- AFWall+ (previously I used netguard but can't run multiple VPN on android so I couldn't have that running together with tailscale)

- Neo-backup. Some messaging apps believe that keeping chat history is not important. Or they believe that it's fine that the only way to transfer chat history is to upload it to Google cloud without encrypting it. I hate losing my chat history and I do not want it uploaded somewhere without encrypting it so I need a backup solution. Enters neobackup

- Sometimes, it is useful to be able to spoof one's GPS without the app being the wiser from a privacy perspective.

- A very stupid banking app I have prevent screenshots but then doesn't allow me to download a proof of transfer. So I use root to remove the restriction against screenshots

t0bia_s• 12 months ago

Will this stop you from purchasing a new Samsung device?

Yes. I was buying Samsung devices for years because of size (A5, A7, S10e) and ability to unlock bootloader for Lineage OS. Time to look elsewhere.

metadat• 12 months ago

Yep, if Samsung phones are now just as closed as Apple, well.. Android phones certainly aren't superior in many dimensions. Bummer.

Jotalea2• 12 months ago

I never had the chance to root any Android device (unknown models, locked bootloaders, no benefit on rooting, or simply bad hardware), guess I'll never have it again.

Speedy218• 12 months ago

This seriously pisses me off. We are literally watching the end of true ownership of our phones end right before our eyes, imagine if your laptop or new motherboard you purchased from MSI or whoever did the same and locked the bootloader to only allow booting official Microsoft-signed code (aka Windows only) and if you wanted to run Linux... sorry but no that's what we decided and we know better than you. Despite custom OS support being grainy in phones due to proprietary hardware and ARM chips, I really care about having the option to be able to do it (plus rooting with tools like Magisk is pretty universal across phones anyways since it lets you patch most firmware images).

It was already bad with Huawei stopping their unlock program and Google cracking down more on rooting by introducing strong integrity with their new Play Integrity API (which was an upgrade from the older SafetyNet API), basically meaning there is hardware security called the TEE (ARM TrustZone for most phones if you're interested in reading more) built into the ARM processor which "snitches? (lack of better word)" on you if the firmware booted no longer matches the manufacturer signed firmware, and causes you to fail strong integrity which means apps like bank apps can choose to deny you service (Google Wallet does this for NFC payments). There are workarounds which the custom ROM/root community still uses which mainly relies on older leaked cryptographic signing keys from the TEE being used which bypass the phone's TEE and sign the "integrity verdict" in user land to say "all is good" to Google, but Google can easily tell if these keys have been compromised since they track usage, and the storage of these keys just keeps getting better, getting as close to impossible as you can in a modern phone since to extract it would require you to quite literally de-lid the ARM chip and hope you don't break anything in the process while somehow extracting the key, in other words not feasible.

This is all great when it comes to security which Google and all manufacturers have been pushing on, but it comes at a serious cost of ownership, you cannot tell me we truly own our phones when we have literal hardware protection that, quoted right from wikipedia: "code integrity prevents code in the TEE from being replaced or modified by unauthorized entities, which *may also be the computer owner itself*". I don't know about you but a chip (and Google) that dictates what I can and cannot do with my phone doesn't sound like ownership to me.

All these recent changes and events sounds to me that Google is actively pushing and "encouraging" phone manufacturers to disable bootloader unlocking, we're constantly seeing manufacturers which were once before root and unlock friendly randomly changing their mind and quietly removing or severely limiting that feature in the background (Huawei, Xiaomi, now Samsung, etc). You have to remember these manufacturers won't back down from what Google tells them to do if it's for "security" since they're all in each other's pockets so they won't pushback without a good reason.

And if you want to use the typical excuse "allowing bootloader unlocking is unsafe", we've already proved it can work quite well while maintaining security as demonstrated by UEFI's Secure Boot which allows you to enroll custom boot keys (should you wish), while keeping some popular default keys such as Microsoft for Windows, and allowing you to lock the entire firmware config behind a password (which is stored in a security chip in modern motherboards so you can't use the old trick of removing the CMOS battery). That's more security than any regular citizen might need.

This TEE thing is all about control. Google and manufacturers don't like people installing custom firmware or rooting because then they can't keep you in their ecosystem to keep taking your data and hoping you eventually buy something from them. Some app developers also think this locking down of phones is great in order to protect their app against abuse than actually investing in good backend security which I just find to be hilarious.

I hope some laws get passed to protect us from the 1984 book that society is starting to become thanks to the government and corporate conglomerates themselves, although I sadly find that to be unlikely.

Samsung Removes Bootloader Unlocking with One UI 8

Related Stories