I got this Moto g84 with CalyxOS from ebay but had to update it to the 7.2.2.0 release. Now the thing is, the seller specifically said if I relock the bootloader the phone will be bricked. I used the web installer for the g84 model and left it unlocked, but that g84 installer says its safe and a different part of the CalyxOS site also says don’t relock any Motorola phones. Do any of you guys know more about this or what the consequences of leaving it unlocked could be?
AFAIK. The only security risk with this is that anyone with physical access to your phone could flash a malicious ROM on it.
This shouldn’t be an issue for most people. And I’m pretty sure that those who cares about this runs GrapheneOS anyway.
Not just “evil maid”. Malware could flash a backdoored OS too. Source: https://kevinboone.me/lineage-eos-graphene.html (the comment from GrapheneOS team at the end)
Bootloader locked = Verified boot = Secure boot = only OSs with valid signature can boot.
That’s exactly what I said? A ROM with a backdoor is a malicious ROM.
Bootloader locking stops web-caught malware from modifying the OS and thereby making itself persistent (reset-resistant).
People with physical access is a different threat.
Sorta assumed this was the only thing to worry of, thanks Hund.
AFAIK, the only way you can reliably lock your bootloader with a custom firmware, is if the device allows you to upload new avb_custom_keys. This basically allows you change your locked bootloader to allow custom firmware from a single (signed) source (ie graphene, google, your own).
I can’t say for certain, but many non-pixel phones do not support this.
So, if you were to lock your bootloader, the loader would notice that you have an “unauthorized” firmware installed and would not run it. You’d basically need to unlock the bootloader again, but I think Motorola has made this process more complicated. Meaning you might need a bootable device to do it.
As far as security: Unlocked phones are less secure. All android devices are encrypted, using a hardware key plus your pin number. When a device is locked, a “secure key” is used as the hardware key. When a device is unlocked “another key” is used. If an attacker gets a hold of your unlocked encrypted phone, they can easily get this “other hardware key” which means they already have 1/2 of the information needed to decrypt your phone.
Afterwards, the only thing protecting your unlock phone is the strength of your pin (which is trivial to brute force). On locked bootloaders, it’s much more difficult, as they’d need to figure out the “secure key”, in addition to your pin.
Thank you!! This is really in depth and just the kinda info I needed. Sounds like I really should contact the Calyx Institute from that other comment and see if this is doable and not just leave it. This phone has an SD card slot, am radio, and a headphone jack so if I can get the bootloader locked I might not ever need to look at a google pixel. Calyx does have a reset after 5 failed attempts feature tho so that’ll be good to have until then.
I don’t know if Calyx offers “officially” signed releases, but there appear to be users reporting that moto g84 support avb_custom_keys.
If they don’t, you can create your own custom keys and sign the release yourself using ’avbroot’ (linked above).
On Pixel devices you can unlock and relock the bootloader as much as you like. Most other phones cannot do this because the manufacturer doesn’t want you to install custom software. If I relock my bootloader on my Pixel 6 Pro it protects from one risk, someone gaining physical access to my phone and booting another operating system to access my data without my permission. This is handy, but not really a big risk for most people. Leaving the bootloader unlocked makes sense for your device and shouldn’t cause any meaningful risk for you.
I believe this is the first release of Calyx that lets you re-lock it. You couldn’t on the older ones. I was running the old one right up until the new one released.
I think general advice is only lock it at the end of installation process to avoid problems (at least that’s what I think I read months ago). You will leave a security hole open by not locking it.
I noticed some of the documentation on the Calyx site hasn’t been updated to reflect changes in the new release. I’d prioritise info from the installer pages and processes over most other info on the site at the moment.
What a cute wallpaper.
Just like other said about physically access, not gonna repeat that. Additionally, afaik there are pixels, brax me, FairPhones (via murena I.e. e/os) and some very custom made phones from sweden/Switzerland that allows relock (like someone said about the keys), I am not aware of any others. Personally I am on FairPhone with e/OS for this very reason. (As my sony’s were unlocked while on lineage or e/os ). I wish EU passes a law that required all odm/oems to allow aosp (non gms) and their custom factory os like the pc market… People should be able to own the hardware they paid for. Not ransomed by the odm/oem with their software keys. (Same goes for cars/bikes/ appliances).
I would only ever worry about leaving a bootloader unlocked if I was working with very sensitive information on my phone and I knew that there are adversaries who are after it, or if I had any other reason that I wanted to ensure the integrity of the data on it.
As to the phone and OS in question, I have no experience with them.
@akunohana @wingnut If you leave the bootloader unlocked, some critical apps like banking apps may not work.
Guess I lucked out with my credit union app then. Thanks for the info!
Thanks, I’ll reach out to them.
