switching to another ROM on a phone with non re-lockable bootloader is a downgrade from the stock ROM?
It depends on your goal. If you plan to have any kind of boot / data security and the device can’t be re-locked with an alternative ROM you’re essentially better with the stock ROM in a locked state.
Now that’s kind of personal choice, I believe the instant damage done by someone stealing your phone and getting your data (because your bootloader was unlocked) is considerably larger than the privacy implications of running the stock / vendor Android. For what’s worth if you can root your stock Android and firewall everything that seems suspicious it might be better than running an alternative ROM without a secure boot. Even with an alternative ROM you can run into privacy issues, take for example here CalyxOS running on Qualcomm CPUs. What’s interesting here is that this issue doesn’t happen in Graphene because they’re actually better at covering all grounds than CalyxOS and others seem to be.
Don’t you think it’s easier, due to inattention when installing a compromised app, a privilege escalation attack through root or actually an invasion due to the amount of bloatware from companies that take their piece of the pie in the Stock ROM (even though they do would cleaning via ADB) and even worse rooted to block these suspicious traffic be something more harmful for the user?
Because the ability to steal the decryption password in RAM memory due to the unlocked bootloader is a little less likely for the thief to have.
I use LineageOS and I feel much better, since my cell phone is Xiaomi, than using MIUI, which is from a chinese big tech company and has proprietary code.
The attack you’re describing is a typical automated thing where hackers are exploiting dozens of devices in some automated fashion, that can happen but the damage is different. They might get your data but that’s usually sold on the black market in a bundle of compromised data. It will take some time for the info to get sold and for the buyer to act on it and sometimes it may never act - after all you’re one compromised device among millions. Even if the buyer it’s more likely he’ll simply use your device in a botnet to fake clicks on ads or DDoS something and profit that way. The key aspect of those attacks is that you’ve time to flag suspicious activity and act.
However if you carry an unlocked phone and someone steals that from you there’s a very high chance that it isn’t a random burglary, according to statistics most burglaries are committed by someone who knows victim aka is targeting you specifically. If you’re targeted by someone or some entity they’ll want your data and accounts and they’ll have the time, resources and attention focuses towards you giving you little to no time to react. This is why I would NEVER use a phone without a secure bootloader.
It depends on your goal. If you plan to have any kind of boot / data security and the device can’t be re-locked with an alternative ROM you’re essentially better with the stock ROM in a locked state.
Now that’s kind of personal choice, I believe the instant damage done by someone stealing your phone and getting your data (because your bootloader was unlocked) is considerably larger than the privacy implications of running the stock / vendor Android. For what’s worth if you can root your stock Android and firewall everything that seems suspicious it might be better than running an alternative ROM without a secure boot. Even with an alternative ROM you can run into privacy issues, take for example here CalyxOS running on Qualcomm CPUs. What’s interesting here is that this issue doesn’t happen in Graphene because they’re actually better at covering all grounds than CalyxOS and others seem to be.
Thanks for the info! I agree, without being able to outright change phone, you can only choose your tradeoffs
Exactly.
Don’t you think it’s easier, due to inattention when installing a compromised app, a privilege escalation attack through root or actually an invasion due to the amount of bloatware from companies that take their piece of the pie in the Stock ROM (even though they do would cleaning via ADB) and even worse rooted to block these suspicious traffic be something more harmful for the user?
Because the ability to steal the decryption password in RAM memory due to the unlocked bootloader is a little less likely for the thief to have.
I use LineageOS and I feel much better, since my cell phone is Xiaomi, than using MIUI, which is from a chinese big tech company and has proprietary code.
The attack you’re describing is a typical automated thing where hackers are exploiting dozens of devices in some automated fashion, that can happen but the damage is different. They might get your data but that’s usually sold on the black market in a bundle of compromised data. It will take some time for the info to get sold and for the buyer to act on it and sometimes it may never act - after all you’re one compromised device among millions. Even if the buyer it’s more likely he’ll simply use your device in a botnet to fake clicks on ads or DDoS something and profit that way. The key aspect of those attacks is that you’ve time to flag suspicious activity and act.
However if you carry an unlocked phone and someone steals that from you there’s a very high chance that it isn’t a random burglary, according to statistics most burglaries are committed by someone who knows victim aka is targeting you specifically. If you’re targeted by someone or some entity they’ll want your data and accounts and they’ll have the time, resources and attention focuses towards you giving you little to no time to react. This is why I would NEVER use a phone without a secure bootloader.