Is running rooted OK " security-wise " - Security Discussion

Evening Lads.
I'd like to get your view on a "taboo subject", running rooted whilst having Android Pay/Card details on your phone.
I, personally use my device with VenomROM, and Android Pay.
I know some doubt this idea, being"insecure"
What do you think?

We that all depends on who and where. Most security experts will tell you root alone is a security whole and here things like chipped cards and mobile payments are deemed insecure so they are not allowed. Even all the card readers have nfc disabled and the slot for chips are blocked or has the connections removed.
So it is all a matter of who and where

Related

[Q] phone newbie questions

I have never owned a cell phone before (yeah, I'm one of the last three who never has), and now am wanting to buy one. My preference is Android. I have some questions about this whole space:
* I don't want a contract. Is it generally true that I can buy any unlocked phone, and a prepaid SIM from Amazon or somewhere, and use them together?
* I'm old (early 60's) and have some generational cultural differences from many (but not all) of you that grew up with and accept social networking. Specifically, I have a zero tolerance policy towards my phone leaking ANY data, under any situation, and a zero tolerance policy for any outside control of the device. That is to say, I will not accept remote updates of software, nor any software which "phones home". I will only accept a phone that is 100% under my control. This seems to create complications, even under Android. If I run a custom firmware such as CM7, is this a goal that I can reasonably achieve? Perhaps with a local firewall on the device?
* I want to use the GPS for wilderness hiking, specifically, to retrace my (approximate) path in the unlikely event I become lost. Is the onboard GPS on phones adequate for such a purpose? I don't need meter-accuracy, but 10 or 15m accuracy would be nice, along with software that would sample my position every (say) 60 seconds and overlay this on a map that MUST be stored locally on the device. I will be out of cell tower range.
* These devices can carry a lot of data, but this seems dangerous on a device that may be lost or stolen. I know there can be a numeric code to unlock the device, but that provides no real security in practice. Is it possible for me to use encryption at the block level with a filesystem on an SD card? Conceptually, I want to mount that card through an encrypted loopback device, with a timeout that will unmount it after a period of inactivity. Possible?
* Specific phones: I liked the LG2X, but it seems many people have big problems with it. I liked the Sensation, but it has a locked bootloader -> nonstarter. So I'm looking at the Mytouch 4G. How big a limitation is GSM in practice, within the continental US?
* When 802.11 is available, will I be able to use my existing VOIP provider instead of a cell network to make voice calls?
Thanks for any help that anyone might give a complete phone newbie.
Is there perhaps a more suitable forum for me to ask "hey, I've never even owned a cell phone before" type questions? If someone could point me to a better place to ask my clueless questions, that'd be wonderful.
Maybe you will buy HTC HD2?
It's a good phone for start, and it has all of the things what you need
Thanks Rafal.Sw, but that seems to be a Windows Mobile phone, and I'd prefer to stick with open source operating systems.
In any case, I'm more after information here than specific phone recommendations. Thanks for your reply though.
But you can always install android on this Phone, i have it and it's wonderful for me
The specific phone model is really not my primary question. I'm looking for information on my questions above, or failing that, a place more appropriate for novices to ask such things.
Thanks...
Research is key. Search button is your friend and essential. friendly reminder as always
Yes unlocked GSM devices are able to connect to a compatible carrier / sim card. For instance I have an unlocked GSM from att but i hate contracts and burning a hole in my pocket. So.. i went to best buy and grabbed an h2o sim kit and poppeed. It in VOILA. Service= no contract = more money. Of course there are plenty others. With different. Pre paid plans. That's just one of many i use.
Alot of these devices will work around the world ESPECIALLY an unlocked GSM device. Of course they will have to have the WORLD phone type basebands. To achieve this if traveling the world.
GPS has come along way since eclair, and is getting signifucally better all the time. However this really depends on your device and its hardware/software When you see a phone you like find the oppropriate forum and thread and learn about that device. Here on xda.
As far as security with android its great and getting better and better. They stay up to date with the latest. The biggest RISK/ ONLY common are with an OPEN all wifi access connection. Also The problem lies when someone( the user) puts bad apps or pirate apps and files in the device making it vulnerable.
To keep data safe on your phone can be achieved in a number of ways, to name a couple, numerous locks can be applied on apps files even before the device boots up, there are also apps that will wipe every thing on your device if lost or stolen by using your computer to control it. Also apps that will track your phone so you can find it
I to are very strict on the control of my device and with that there are great apps with the kind of extra protection you look for ex. Firewalls, malwate spyware blockers etc. There is no need to unmiunt an SD card. Do you take out your harddrive on your computer when not in USE? "Rhetorical "
CM7 is built AOSP from the ground up. They are in no way or have anything to do with the carrier or its original manufacture. Its totally custom build. Extremely knowledgeable developers who take pride in their work for all of us for free. This is not for your average user. These builds are still in ongoing development and not available for every device. However these builds are very stable for and a daily driver
YES YOU CAN, For VOIP calls, there are apps for that and I've used it for a couple years now, alot of devices can and have already support it, and takes a litle tinkering to get them to work. Now days the Devices coming out have VOIP already ready for setup out of the box. With easy setup
If you want the the best bang for your Buck,
Samsung Galaxy S 2. Is what i recommend. It's truly the best of the best. Along with EVO 3d. And Motorola D3
Sent from SGS Captivate CM7 or MIUI with Escapist orTKGlitch using XDA premium app.
Search button is your friend and essential
Click to expand...
Click to collapse
<nod> I've done some, but there are things I can't quite find anyone discussing, like the use of GPS for wilderness hiking, or the details of block level encryption.
I agree with you 100% about contracts. I'm not sure why they're so popular. They seem more expensive overall, and less flexible.
There is no need to unmiunt an SD card. Do you take out your harddrive on your computer when not in USE?
Click to expand...
Click to collapse
Well, no, but I don't carry the whole machine around in my pocket, either. Somehow the only thing I really trust to keep my data secure is encryption, but then there's this issue of how long the data stays decrypted. You have to be able to use it, but if you lose the device, no one else should be able to see it.
CM7 is built AOSP from the ground up.
Click to expand...
Click to collapse
Yeah, which is why I'd trust it more than the carrier supplied software. I'm pretty much restricting my device choices to ones that CM7 supports, which does rule out several otherwise attractive phones.
Thanks - the Galaxy S2 does look interesting. Is it supported by CM7? Their "devices" page only lists the Galaxy S.
Thanks for the insights, rwells813!
YES, Samsung has sent a SGS2 over to an Cm7 dev. To play with. So i assume in do time it will be a supported mainline. I believe he has test builds for it already . I haven't tried them yet with mine yet. I stick with one dev. Phone at a time. My captivate is the Guinea. Pig. Good luck mate.
Sent from SGS Captivate CM7 or MIUI with Escapist orTKGlitch using XDA premium app.

NSA Proof Blackphone 2 Purchased, Did I Just Waste My Money?

Hey everyone. New to XDA forum. Just wanted to get real tech opinions and what everyone thinks. I recently purchased the new Blackphone 2, a high end security phone by silent circle. I notice it's not running the normal Android OS that everyone is using, it's running "Android Silent OS".
One thing I notice was, it doesn't come with stupid bloatware that I'm custom to getting with iPhone and Androids. One of the main issue I purchase this one was the promise from Silent Circle that any new discovered security bugs, they will release a patch within 72 hours and it seems like they have a good track record of doing so.
I'm just wondering the money I shelled out for this device, did I just waste money or is it really worth it. I'm tired of smart phone apps that I download always keep track of things and accessing private stuff like contact information, GPS location and other sensitive information where I was a victim of one app that sold my GPS location to an advertising company where I was bombarded with ads on my phone.
Any thoughts on this device if it's really a high security phone or just a gimmick to sell. I know no phone is NSA proof of course but I'm guessing this phone is a little more secure then the average Android/iPhone.
I"m no expert on the Blackphone but, it would be interesting to hear your experience with the phone and in particular between both Blackphones.
Congrats on your purchase. I count it reasonable for 800$, not a waste for sure. I wonder if the phone calls couldn't be listened by third parties like a crypto phone. It would be nice to read a mini review of the device by you.
DylinPrestly said:
Hey everyone. New to XDA forum. Just wanted to get real tech opinions and what everyone thinks. I recently purchased the new Blackphone 2, a high end security phone by silent circle. I notice it's not running the normal Android OS that everyone is using, it's running "Android Silent OS".
One thing I notice was, it doesn't come with stupid bloatware that I'm custom to getting with iPhone and Androids. One of the main issue I purchase this one was the promise from Silent Circle that any new discovered security bugs, they will release a patch within 72 hours and it seems like they have a good track record of doing so.
I'm just wondering the money I shelled out for this device, did I just waste money or is it really worth it. I'm tired of smart phone apps that I download always keep track of things and accessing private stuff like contact information, GPS location and other sensitive information where I was a victim of one app that sold my GPS location to an advertising company where I was bombarded with ads on my phone.
Any thoughts on this device if it's really a high security phone or just a gimmick to sell. I know no phone is NSA proof of course but I'm guessing this phone is a little more secure then the average Android/iPhone.
Click to expand...
Click to collapse
The answer is: nobody knows, but Silent Circle. Their android is closed source, so essentially they are saying: trust us (because we have a PGP creator). No gsm phone call can be encrypted unless the other person is using exactly the same piece of software that you are. You can more or less encrypt sip calls, but again, you need the other person have a similar software and be on the same server. And don't forget, most providers including Google (googlevoice), Truphone and others block channels where encrypted data packets (for phone calls) are carried.
You can't have true security unless the baseband part of your phone is completely isolated from the rest of the system and virtually 100% of manufacturers use the following model: baseband is a separate mini OS that is hooked directly to your hardware and ram bypassing Android system together with all the protection gimmicks. So, if someone is targeting your phone through cellular modem, Android wouldn't even notice it.
Remember: the main threat to security of a user is Google, as well as manufacturers and carriers. You can neuter Google to a large extent, because Android is open source, but there is nothing you can do to the other two...
Buying something NSA proof from an american company...
@DylinPrestly
How do you like the phone so far? Can you relate any experiences? How do communications between the two phones compare to communications between one Blackphone and a non-Blackphone? It seems to me that communications between Blackphones are more secure.
Thanks.
Great discussion, I was actually thinking is there a way to get an "android silent os" on a note 5? If not, are there any roms out there that is like silent os for security and privacy?
Sent from my iPhone using Tapatalk
I have a doubt about Blackphone
I have bought a Blackphone BP1 because a friend sold it very cheap. My main doubt is if this phone can only make phone calls to another Blackphone or there is a way to call any "normal" Android phone.
I don´t want to set up the phone until my doubt has a solution, bacause yes, it's a fact that I want a sure phone, but I dont need a "caged" phone, because I don´t have any friends or relatives that have another Blackphone so it's useless for me.
Another question is if the Blackphone can only talk to another Blackphone, is there a way to swap the PrivaOs for a Cyanogen version or a pure Android version in order that I can use it as a normal phone?
Thanks to anyone that can clarify my doubts.
jolive57 said:
I have bought a Blackphone BP1 because a friend sold it very cheap. My main doubt is if this phone can only make phone calls to another Blackphone or there is a way to call any "normal" Android phone.
I don´t want to set up the phone until my doubt has a solution, bacause yes, it's a fact that I want a sure phone, but I dont need a "caged" phone, because I don´t have any friends or relatives that have another Blackphone so it's useless for me.
Another question is if the Blackphone can only talk to another Blackphone, is there a way to swap the PrivaOs for a Cyanogen version or a pure Android version in order that I can use it as a normal phone?
Thanks to anyone that can clarify my doubts.
Click to expand...
Click to collapse
The Blackphone 1 and 2 are able to communicate fine via standard GSM to all other phones, but the calls are secure when using the Silent Phone app, which can be installed on any Android/iOS device really.
As to being "NSA" proof....
“We have a bit of a problem with the press saying that the Blackphone will make you NSA-proof,” Phil Zimmerman, one of the Blackphone’s creators, tells me at Mobile World Congress in Barcelona. “If someone [at the Blackphone booth] tells you that it’ll protect you from the NSA, I’ll fire them.”
I have both the Blackphone 1 and 2, though the Blackphone 1 has gone into "retirement" now that I'm using the BP2 ,which I'm quite happy with, if you have any questions I'd be more than happy to answer
bitterman said:
The Blackphone 1 and 2 are able to communicate fine via standard GSM to all other phones, but the calls are secure when using the Silent Phone app, which can be installed on any Android/iOS device really.
As to being "NSA" proof....
“We have a bit of a problem with the press saying that the Blackphone will make you NSA-proof,” Phil Zimmerman, one of the Blackphone’s creators, tells me at Mobile World Congress in Barcelona. “If someone [at the Blackphone booth] tells you that it’ll protect you from the NSA, I’ll fire them.”
I have both the Blackphone 1 and 2, though the Blackphone 1 has gone into "retirement" now that I'm using the BP2 ,which I'm quite happy with, if you have any questions I'd be more than happy to answer
Click to expand...
Click to collapse
I have a question about this phone if that's allright. How do regular (unencrypted) calls work? Are they free or do they require some sort of credit? (I mean on the phone side, not the carrier obviously)
Hi, another BP2 owner there.
I've just opened a thread in "Reviews" section about this phone: http://forum.xda-developers.com/gen.../blackphone-2-review-basic-tech-info-t3516371
This phone doesn't introduce any active/passive GSM complexes security, it's a standard phone with modded Android 5.1.1 ROM called 'Silent OS'.
The only way to make this phone secure, is to use their paid app 'Silent Phone', which is paid analog of Telegram and available on Play Market (can be used on any phone).
I am currently working on making a clean AOSP ROM for this device, because Silent OS is totally a disgrace which is impossible to root.
DylinPrestly said:
did I just waste money or is it really worth it
Click to expand...
Click to collapse
Money waste confirmed, read my thread for more information.
varotone said:
I have a question about this phone if that's allright. How do regular (unencrypted) calls work? Are they free or do they require some sort of credit? (I mean on the phone side, not the carrier obviously)
Click to expand...
Click to collapse
Yes, unencrypted calls are free, it's just a usual modded android phone with GAPPS.
Encrypted calls are made via the "Silent Phone" app which is paid and needs a paid subscription on the other end. Doesn't worth your money.
It won't do any encrypted calls if one who you talk to doesn't have Silent Phone installed.
If you need a good and open source communications encryption, use Tox which is available for Android and iOS.
You wasted money...
If you have any knowledge whatsoever on Android Building...
You can pretty much achieve the same and /or close the same point of "safety" the black phone provides.. With the extra that you control what's being built , what your using..
---
How to root this phone? Any custom roms?
Airlock user. What is it?
Bought BP2 few months ago and recently discovered in Data usage statistics that there is unknown to me user consuming Wifi and 4G internet on the background. I have never created this Airlock user.
I wrote to BP support, where they simply said: You should not be alarmed by that.
WTF? What kind of answer is this?
Anybody here knows what is that user for and if there is any way to disable or remove it?
A litle guide to increase bp2 performance
https://forum.xda-developers.com/an...e-make-bp2-t3735815/post75218344#post75218344

Google Pixel 2 Root Help

Hello, XDA Developers.
I joined this forum yesterday, and to be honest, I am a complete Android noob. I got my first Android phone around 6 months ago, and, as you know thanks to the title of this thread, it was a Google Pixel 2, a solid way to dip my toes into Android for the first time, especially after being an Apple sheep for many years in the past. Anyway, I found my interest in rooting coming from me wanting to install a custom icon pack to my Pixel Launcher. I found Pixel Launcher Mods, but discovered it required root. I learned what rooting was, and how to do it. That's not the problem, though.
I've heard tons on what rooting can do negatively to your phone, but using a Google-branded phone, I'm not worried in the least about getting my phone bricked nor am I worried about blowing my warranty (since Google doesn't take away warranty due to rooting). What I am worried about is security.
I use many apps on my phone which are very personal and important, like my AMEX app, Google Pay, and PayPal. Knowing that rooting is risky in the security department, I'm very nervous to make the jump due to exposing those very applications and all of that sensitive information.
I've heard that installing Magisk and TWRP somehow keeps me safe from this kind of risk, but I don't quite understand how. I really need to understand why and how Magisk keeps me safe before I root, since I know that if I don't, I'll have insane paranoia in the back of my head, which will completely ruin my experience rooting.
I've also heard that Netflix and apps similar to it simply do not function. I am a Netflix subscriber and sometimes watch on my phone, so this is kind of concerning for me. Apparently Magisk comes to the rescue again, but I still don't know why!
One other thing (second last one, I promise) I heard was that I can get purchases in the Google Play store for free. If someone can leave a link for me on how I can do that, it would be pretty awesome.
The fourth and final 'thing' as I've been calling them, is that I won't get OTA updates. With some of my own research, I found that I actually do get these updates, however, they break my root. I've heard of things like OTA RootKeeper, but when I looked it up, all I found were forum posts from 2012, which had me slightly worried. This coupled with the fact that Android P was coming out so soon had me bear the question: update or wait?
Thank you so much if you took the time to read this long and confusing thread. I tried to lay it out in the least confusing way as possible. As you can see, I'm really new to all of this, and it would be great if you guys could help me out and answer some of the questions above.
Take care! I look forward to your responses.
- Arrow008
First of all: Good choice and welcome to the community.
1. I can't exactly tell you how Magisk would keep you safe but I can tell you that it is always in your hands to keep your device and data safe. What I mean by that is that you should use your brain while using your phone. Don't download any "fancy apps" which promise to make your battery last longer or something like that. Don't click any shady links etc.
After all you are not more vulnerable just due to rooting but apps could do more harm.
2. Netflix or other apps will work with "Magisk Hide" which is built in feature of Magisk.
3. You are talking about illegal warez which are not allowed on XDA. Anyways apps cost between 1 - 5 $ and are often on sale. So there should not be any need to tinker with warez.
4. There is a guide here to keep Root with Magisk even on OTA. But for this to work you don't have to have TWRP flashed to your device (at least that's what I think).
EDIT: I'm using different Android phones since 2011 and always rooted them and didn't ever have any problems with security.
Arrow008 said:
Hello, XDA Developers.
I joined this forum yesterday, and to be honest, I am a complete Android noob. I got my first Android phone around 6 months ago, and, as you know thanks to the title of this thread, it was a Google Pixel 2, a solid way to dip my toes into Android for the first time, especially after being an Apple sheep for many years in the past. Anyway, I found my interest in rooting coming from me wanting to install a custom icon pack to my Pixel Launcher. I found Pixel Launcher Mods, but discovered it required root. I learned what rooting was, and how to do it. That's not the problem, though.
I've heard tons on what rooting can do negatively to your phone, but using a Google-branded phone, I'm not worried in the least about getting my phone bricked nor am I worried about blowing my warranty (since Google doesn't take away warranty due to rooting). What I am worried about is security.
I use many apps on my phone which are very personal and important, like my AMEX app, Google Pay, and PayPal. Knowing that rooting is risky in the security department, I'm very nervous to make the jump due to exposing those very applications and all of that sensitive information.
I've heard that installing Magisk and TWRP somehow keeps me safe from this kind of risk, but I don't quite understand how. I really need to understand why and how Magisk keeps me safe before I root, since I know that if I don't, I'll have insane paranoia in the back of my head, which will completely ruin my experience rooting.
I've also heard that Netflix and apps similar to it simply do not function. I am a Netflix subscriber and sometimes watch on my phone, so this is kind of concerning for me. Apparently Magisk comes to the rescue again, but I still don't know why!
One other thing (second last one, I promise) I heard was that I can get purchases in the Google Play store for free. If someone can leave a link for me on how I can do that, it would be pretty awesome.
The fourth and final 'thing' as I've been calling them, is that I won't get OTA updates. With some of my own research, I found that I actually do get these updates, however, they break my root. I've heard of things like OTA RootKeeper, but when I looked it up, all I found were forum posts from 2012, which had me slightly worried. This coupled with the fact that Android P was coming out so soon had me bear the question: update or wait?
Thank you so much if you took the time to read this long and confusing thread. I tried to lay it out in the least confusing way as possible. As you can see, I'm really new to all of this, and it would be great if you guys could help me out and answer some of the questions above.
Take care! I look forward to your responses.
- Arrow008
Click to expand...
Click to collapse
I would also like to welcome you to the community. Good choice crossing over from Apple and you made a great choice as far as phones go. Xda is a grea place to start and there are amazing people on here that can help you get to where you want to be.
Some background on myself, I have owned an android phone since 2010 and have rooted every android phone I've had since then. Root is the way to go and it opens so many doors for android devices.
1. Don't let a security risk scare you away from rooting, as long as you are smart with your device then you will be ok. You heard right in that Magisk keeps you safe when rooting. Magisk implements security protocols that allow our devices to pass safteynet checks. Safteynet is what android uses to tell apps that your device is secure and hasn't been tempered with. Things like Google Pay use safteynet checks in order to function. Some apps also won't function if it detects Magisk on your device. This is simply because the app knows your device is rooted and doesn't want to function as it knows it has been tampered with. Magisk has a feature called magiskhide that hides itself from certain apps being able to see it. So that, in a nutshell, is how Magisk tricks your device into thinking it hasn't been tampered with. Magisk also prevents apps from getting root acces to your phones that you don't want to authorize. Everytime an app initially requests root access, Magisk will prompt you with a popup asking if you would like to authorize said access.
2. As far as security goes. Google releases security patches once a month for our devices. if you run a custom ROM then most devs will incorporate these updates in to their ROMs and push them out to users. So when you root, your device will no longer update OTA, you must do it yourself. Even if you run stock Google firmware, you must still manually push updates to your phone (plenty of guides on how to do this). As long as you stay on the most recent Google security patch, then you have nothing to be afraid of.
3. Free apps. Yes, there are illegal markets out there that upload stolen apps but these come with a high security risk and are not allowed to be discussed on Xda. When you install apps from markets like these you run a high security risk. Some apps are made to look like other apps and have different permissions and can have access to parts of your phone that you don't know about. I would never recommend installing apps from markets like these. Stick to the Play Store and support the devs.
4. Like I said in #2, you will not get OTA updates anymore since you are rooted. Yes, in the past with other devices, some devs have come out with apps that allow OTA while maintaining root, as of right now there is not such thing for our phones. Manually pushing updates to our phones is not hard with TWRP. TWRP allows you to backup everything, wipe everything, and install new ROMs/updates. When you install a new ROM it will wipe everything as far as your os goes but will not wipe your storage (pics, music, files) So when you update a new ROM I highly recommend you get an app called Titanium Backup. TB will backup all your apps+data, that way when you install a new ROM/update, all you have to do is restore the apps with TB and its like nothing changed. It can even backup things like call history, texts, wallpaper selection, wifi passwords, etc. Definitely a must have for rooted devices.
Dive in, get involved, but please do your research before just spouting off questions in this q+a thread. People are here to help you but 9/10 times your question has probably already been answered. Read the rules of Xda and happy rooting.

Why Android device manufacturers should not lock the bootloaders of their phones

I had to write an essay for a class, and I wanted to post it here. Please correct me on anything I'm wrong on, or recommend anything I should add. But please be nice.
Samsung and LG have locked the bootloader - the part of the phone that checks the phone to make sure the code has not been modified or corrupted - almost since the beginning of android smartphone devices. This prevents people who want to modify their phones or write their own code for them from doing so. From the beginning, it was a wise move. Google had not implemented any security protocols like this in the early days of Android, and this kept people’s data safe and secure. The problem now is that Google has implemented security protocols now yet Samsung and LG still lock their phones down - hard. Even a device as old as the Galaxy Note III, about a 5 year old device, Still cannot be modified or changed. People have been trying for years. The issue now is that Samsung and LG are now overdoing it. They do not need that much security in this respect.
Phone manufacturers should not lock their phones bootloader for two reasons, It shortens product life, and it reduces security. Locking bootloaders shorten product life.
If Samsung or LG lock their bootloaders, it does not allow developers to create updates for that phone. If the bootloaders were unlocked, then developers could take the latest android versions on their own time and create updated versions of Android that LG or Samsung do not want to hassle with. This is good, as security updates, new features, and software improvements could be integrated into these custom versions of Android, allowing consumers to add features and tweaks to their phones that would otherwise be unavailable. This is a great extension of the product life, adding years to the operation time. This has already been proven on multiple handsets, for example, the Nexus series of phones. They have been discontinued and unsupported for nearly 3 years, but they still can be upgraded to the latest android version.
The second reason that Android phones should not be locked is it reduces security. The way Google has the unlocking procedure set up on their phones is you first have to understand how to reboot your phone to fastboot mode, which quickly reduces the number of people who could break their phone, then you have to install the fastboot client on your computer, then you have to run the “fastboot oem-unlock” command to unlock the phone. This also wipes all data off the phone, making it act like it is brand new, to protect whatever data is on the phone. One more step is also implemented, if a Google account was signed into the device, the phone remembers that and during the setup process it will lock you out until you enter the credentials of the previous account. This is an incredibly secure process, using a hardware implemented chip on the board, meaning it is physically impossible to break past, giving your data and phone a very tight security. Where phones are now, however, is not secure. The phone I use every day is an LG V20, which you can hack very easily, all you have to do is plug the phone into a computer and run a script I downloaded of the internet. I wanted my phone modded, so it is my problem if the phone breaks. That process is extremely easy. It also did not clear ANY of my data. I also could have deleted the password, allowing me access to all of the data on my phone. This is incredibly insecure, as you can probably see. The phone manufacturers should use Google’s method of locking, as then you do not have hundreds of people working to break the security of a phone, they already have what they want, an unlocked bootloader.
These two problems with locking bootloaders, or more specifically not letting us unlock bootloaders can be catastrophic to the safety of your data. The shortened product life means you keep having to move your data every time you upgrade your phone, and the fact that most of the workarounds for locking bootloaders decrease security drastically, makes allowing us to unlock bootloaders a very beneficial and secure design for new android phones from manufacturers. They should listen to us and give us what we want.​
That's it. Any thoughts or suggestions?
Sadly I think we are getting near the end of bootloader unlocking and rooting the next few years. With so many handsets being released so fast. Android finally putting customizations in people want...the days of great Roms that are maintained are fading fast.
Since HTC has gone down the toilet, great Roms like Viper and LeeDroid are gone since they cant maintain so many different platforms since HTC phones are just run of the mill garbage now.
Hope I'm wrong, but I rarely have a desire except for a kernel and a few minor things that requiring rooting personally. Every custom Roms I've tried for OP something that is critical and basic doest work and I end up back on the Beta and now Q again. As a Verizon customer as well, this adds to the problem.
And then companies like Samsung have pulled an Apple so bootloader unlocking or rooting makes your phone whatever they decide it should be, and void your warranty.
Sorry mods, off topic. Been around a long time and did WinMo dev 10yrs ago on here...we know how that ended....haha
Android is an operating system based on Linux. Linux is distributed under the GNU GPL v2 License. The GPL v2 grants some rights to the user, in particular requesting source code and/or being able to modify a program licensed under it.
Even tho there has been an idea of license v3 because of some controversies, Still, it is not possible for any manufacturer TOS (terms of service) and EULA (end user license agreement) to negate the rights guaranteed by GNU GPL (general public license), as that would be a GPL violation on the part of the manufacturer, who'd lose the right to use the Linux kernel.
All I'm saying is any android device manufacturer is obligated to provide you with a way to unlock bootloader, you just have to demand it the correct way. They can't possibly deny your demand.
They'll lock phones more and more because it helps the security state to keep access to your data.
Google and most tech companies are pretty much part of the intelligence complex and serve the state oligarchy as we have seen with censorship of search results and social media.
I remember before this pandemic, it was not hard to find information about treatments and health. Nowadays, everything is focused on "official sources" like the government agencies that serve big pharma, big war, etc.

Galaxy Xcover 4 is driving me insane

I work for an NGO in The Gambia. Every year, a company gives us their decommissioned phones as a gift. We equip them with a few apps, switch the phones to English, and if necessary make a good one out of two broken phones. After we send everything to the Gambia and distribute it to our staff.
About me, I am an IT system technician, I am well versed in the administration of Windows and Linux systems and have many years of professional experience. But I'm only marginally familiar with Android systems, I've played around with ADB a bit or rooted my own phone, but nothing more.
This year we received, among other things, 6 Samsung Galaxy XCover 4 mobile phones. Of these, 5 are blocked, obviously the mobiles had been reset to factory settings. Of course they didn't know that the Google accounts had to be removed BEFORE!
I didn't even know the term FRP until a few days ago. Odin was also a foreign word for me and I had never loaded firmware into a mobile before.
I've learned a lot since then but of course I still don't have a clue.
I suggest that these phones now have a security level that successfully repels all known ways of entering the system. Especially with this tip I had high hopes that this could lead to success: (https://github.com/wuseman/Samsung.Xcover.4-FrpBypass), but that doesn't work either.
Neither does the original of this idea at https://www.hardreset.info/devices/...le-verification/frp-samsung-android-8-2020/?p =5
For the latter, I had specially simulated a battery, because it is almost impossible to insert the SIM card with the battery inserted. But as I said, all unsuccessful.
I thought a solution could be to downgrade the operating system so that one of the exploits could now work again. That's why I started experimenting with Odin. And only Stock FW. I found it here e.g. https://www.sammobile.com/samsung/galaxy-xcover-4/firmware/SM-G390F/DBT/#SM-G390F.
However, the attempt to downgrade within an Android version already fails. So if Android 9 U5 is on the cell phone and I want to downgrade to U4, that's not possible. Thank goodness Odin somehow checks that and breaks off, so far I haven't lost any of the phones.
Is there a way to tweak this somehow? Or are these phones lost?
What exactly does this FRP do. Why isn't this information also deleted from the phone by flashing? Where the hell do they store the info that this phone once was used with a ****ing google account!
I lost several nights to solve this. For that lost time I could buy 5 brandnew phones, but in the meantime that is also a question of prestige.
I would be really grateful for any advice!
Klaus (from germany)
If the Google account wasn't removed it wasn't properly decommissioned!
blackhawk said:
If the Google account wasn't removed it wasn't properly decommissioned!
Click to expand...
Click to collapse
Some of this phones (not the xcover) even have working exchange accounts installed. Is a small company.
Klaus D. said:
Some of this phones (not the xcover) even have working exchange accounts installed. Is a small company.
Click to expand...
Click to collapse
The easiest way is to have the original users remove their Google account and maybe Samsung Knox account if applicable. It needs to all be gone.
FRP is well known and is in place to help secure devices in the event of being lost or stolen.

Categories

Resources