I got this Moto g84 with CalyxOS from ebay but had to update it to the 7.2.2.0 release. Now the thing is, the seller specifically said if I relock the bootloader the phone will be bricked. I used the web installer for the g84 model and left it unlocked, but that g84 installer says its safe and a different part of the CalyxOS site also says don’t relock any Motorola phones. Do any of you guys know more about this or what the consequences of leaving it unlocked could be?
AFAIK, the only way you can reliably lock your bootloader with a custom firmware, is if the device allows you to upload new avb_custom_keys. This basically allows you change your locked bootloader to allow custom firmware from a single (signed) source (ie graphene, google, your own).
I can’t say for certain, but many non-pixel phones do not support this.
So, if you were to lock your bootloader, the loader would notice that you have an “unauthorized” firmware installed and would not run it. You’d basically need to unlock the bootloader again, but I think Motorola has made this process more complicated. Meaning you might need a bootable device to do it.
As far as security: Unlocked phones are less secure. All android devices are encrypted, using a hardware key plus your pin number. When a device is locked, a “secure key” is used as the hardware key. When a device is unlocked “another key” is used. If an attacker gets a hold of your unlocked encrypted phone, they can easily get this “other hardware key” which means they already have 1/2 of the information needed to decrypt your phone.
Afterwards, the only thing protecting your unlock phone is the strength of your pin (which is trivial to brute force). On locked bootloaders, it’s much more difficult, as they’d need to figure out the “secure key”, in addition to your pin.
Thank you!! This is really in depth and just the kinda info I needed. Sounds like I really should contact the Calyx Institute from that other comment and see if this is doable and not just leave it. This phone has an SD card slot, am radio, and a headphone jack so if I can get the bootloader locked I might not ever need to look at a google pixel. Calyx does have a reset after 5 failed attempts feature tho so that’ll be good to have until then.
I don’t know if Calyx offers “officially” signed releases, but there appear to be users reporting that moto g84 support avb_custom_keys.
If they don’t, you can create your own custom keys and sign the release yourself using ’avbroot’ (linked above).