6 ms·

Long is gone the time where unlocking bootloaders and installing custom ROMs was the best path to follow. Even if you are able to unlock it (with difficulties s

Long is gone the time where unlocking bootloaders and installing custom ROMs was the best path to follow. Even if you are able to unlock it (with difficulties such as this one, or others that involve opening the device and soldering a shortcut), you will have a device where apps check for unlocked bootloaders and rooted OS, and forbid you from use the application.

jMyles 2y ago
> Long is gone the time where unlocking bootloaders and installing custom ROMs was the best path to follow. ...wha? I just installed GrapheneOS on my Pixel 8 Pro and it is, by a decent margin, the best custom ROM experience on a phone I've had to date.
- encom 2y ago
  >GrapheneOS This was not a project I expected to use Discord for support. Sad.
  - asdp9iujaspid 2y ago
    https://grapheneos.org/contact#community https://grapheneos.org/contact#community > Our chat rooms are bridged across Discord, Telegram and Matrix so you can choose your preferred platform. > We have an official forum for longer form posts, which is publicly accessible and easier to search. We are using Flarum for our forum. https://discuss.grapheneos.org/ https://discuss.grapheneos.org/ If they mandated discord as a closed support community sure, but you can't be too upset by the mere affiliation with a discord channel when they also offer all the above
    - encom 2y ago
      I'm just disappointed that they associate with Discord at all, given that it is the antithesis of privacy and Freedom.
      - pulpfictional 2y ago
        The focus is security. Be disappointed in all the other free platforms that cannot provide adequate moderation or stability. Do you happen to know a suitable alternative?
      - cqqxo4zV46cp 2y ago
        I’m disappointed that you associate with Hacker News given the (presumably) myriad anti-Freedom anti-privacy startups Y Combinator has funded.
  - udev4096 2y ago
    If I remember correctly, their matrix channel was flooding with spam and abuse which was primarily coming from Calyx, which by the way is an terrible OS. Even a stock OS would perform marginally better in terms of security than CalyxOS
- npteljes 2y ago
  I have it on my Pixel 7a, and it's a great experience, but I also don't need to run apps that check for phone "security" or integrity. This is the case OP is talking about. https://grapheneos.org/usage#banking-apps https://grapheneos.org/usage#banking-apps
arsome 2y ago
Largely depends on your priorities and level of effort. You can bypass all current app checks using Magisk and Play Integrity Fix, but it's a bit of work to maintain and can break occasionally. You gain in this case full control of your device like a desktop OS, block ads, modify app behavior, disable unwanted system features, but you have to put in effort to maintain it. However if you don't want to deal with that, you can also just not use those apps, use it like you would a Librem or PinePhone, load primarily open source software to it, optionally don't even bother with play store, etc. Might not be for everyone, but if you don't care that much for Google Wallet or multi-player games on your phone, it's not a bad option.
- BizarreByte 2y ago
  > but it's a bit of work to maintain and can break occasionally. Which is a major problem because my tolerance for my bank's app not working when I open it is so low it might as well be non-existent. I personally gave up this fight.
  - rkagerer 2y ago
    Or switch banks and stop fighting.
    - mike256 2y ago
      I just switched to another bank. No one should accept apps with such checks.
franga2000 2y ago
It sure isn't what it used to be, but if you buy the right phone and make a few moderate compromises, it's still a great option. Installing crDroid on my OnePlus 9 Pro took half an hour, another half to install Magisk Delta with a few modules. The universal dark mode alone (Xposed module "DarQ") is worth the effort, but also the ability to clone apps, have proper clipboard sync, make full-system backups and customise the look and functions of my OS to a currently unparalleled degree. The only compromise is I can't seem to be able to do NFC card payments (send or receive), one of my 4 banking apps needs a custom patch every few months to start working and a friend tells me the McDonald's app doesn't work.
- freedomben 2y ago
  Do you keep a factory image for your OnePlus 9 pro in case you want to restore it? If so, how do you go about doing that? After OnePlus decided to stop publishing factory images, I decided to stop buying their phones. It's a real shame, because they really do make some great stuff and prices are quite reasonable generally speaking. I used to buy a new OnePlus phone nearly every year. The OnePlus 6 was one of my favorite phones of all time.
  - franga2000 2y ago
    I wasn't aware they stopped publishing them so I didn't back it up, but I can't say I really care for my use case. The only reason I'd need it is to resell the phone, but my plan is to use it until it's either broken beyond repair or backporting new Android versions becomes impossible, at which point nobody would buy it anyways. I agree the OP6 is great (my girlfriend is still using hers), but I was still on my OP 3 like a year ago, until future ROM updates were deemed impossible thanks to Qualcomm binary blobs. It's a real shame it's all over now. The OP 9 Pro was the last OnePlus phone made in their old way (or close to it) - not too expensive, well built, close to stock ROM, easy to reflash, decently repairable. Hopefully it lasts me as long as the 3 did because currently I don't see anything else like that on the market.
  - boneitis 2y ago
    I might have my hardware/software/firmware components (or your argument) mixed up and conflated. Does Oxygen Updater not source from published images? https://oxygenupdater.com/article/438/ https://oxygenupdater.com/article/438/ Yes, I am still on my beloved OnePlus 6 running Lineage and had been looking around for a used 7 or 8 for 5G capability (I'm a bit sketched out by the overall throttling hoopla of 9th gen). Perhaps it's time to expand the search beyond OnePlus.
Semaphor 2y ago
If you root, you can bypass those issues in most cases. I have 3 apps detecting it, that I can bypass, and only the German health insurance app from TK detects it (according to the internet, it's getting past most solutions somehow). It's not something I'd recommend the average person, but for people who care enough to fiddle, it's still the best way. I think since my first Android (HTC Desire Z/T-Mobile G2) I spent a total of 1 week on stock, never was a fan of any of them.
ac130kz 2y ago
Stock ROMs are still filled with ads and useless extras, rarely providing meaningful features over an AOSP like LineageOS.
myself248 2y ago
Huh. I guess I must not run any of those apps?
nimbius 2y ago
the only app ive seen balk at bootloader status (to date) is google wallet. Using a phone to pay for stuff is an opsec nightmare youd only entertain so long as becoming an integrated and saleable asset in a data brokers portfolio is a life goal. 'pm uninstall' and move on, the custom rom is still far more valuable from a security perspective than bending the knee to some bespoke ecosystem payment app (especially if you have an older device.) the point of oem unlock, and rooting at all, is diametrically opposed to the vendors interest in nearly every facet. The vendor will bark "hackers" as a thinly veiled threat for the uninitiated, but we are initiated. what the vendor doesnt need you doing is erasing their telemetry and walled garden spyware. they dont need you developing alternatives to their store and to their apps, and they especially dont need you turning this effort into something as simple as an ubuntu installation for older phones they expect to follow the strict trade-in model of "buy a new phone every year" arguably Asus refunded the purchase because this person isn't playing by the rules and being a good consumer.
- jjmarr 2y ago
  I'm in Canada and I can literally just tap the card itself on the reader. Every card has this ability and it can't be skimmed.
  - SanDiegoSun 2y ago
    There are many demonstrations of contactless cards being “skimmed.” Unless you store it in a wallet with a faraday cage, this is a laughable opinion to express.
    - jjmarr 2y ago
      It's not the same as traditional card skimming since you can clone the magnetic stripe you skimmed onto another card and buy things with it. If you grab data from a tap transaction, you can't use that data to perform another tap transaction.
- lxgr 2y ago
  > Using a phone to pay for stuff is an opsec nightmare Do you mean "privacy nightmare"? Security-wise, Google Pay beats using your physical card since it uses a device-specific number that can't be skimmed by terminals and reused online. > the custom rom is still far more valuable from a security perspective than bending the knee to some bespoke ecosystem payment app (especially if you have an older device.) I'd argue that it only makes sense if you have an older device that's otherwise not receiving any more security updates.
zamalek 2y ago
> where apps check for unlocked bootloaders and rooted OS Magisk and PINE[1] have solved this for me. Yes, even Google Wallet is all good with my LineageOS ROM. PINE is an auto-updating PIF. [1]: https://github.com/daboynb/PlayIntegrityNEXT https://github.com/daboynb/PlayIntegrityNEXT
yooastan 2y ago
This is untrue, I do this now with my Pixel and have to no issues.
ravenstine 2y ago
This is rubbish. I'm running GrapheneOS and have left my bootloader unlocked, and there's no app that has refused to work. The only caveat is some of them need Google Play services. No, I am not rooted, but my last phone was rooted and there might have been one or two apps out of dozens that wouldn't work with root even with Magisk trying to hide the root status. Using a custom ROM is easily one of the beat choices I have made.
- Fire-Dragon-DoL 2y ago
  What are the downsides with GrapheneOS? I had a few problems with root (Netflix and banking apps) but would love my privacy. My main reason for root is the firewall to block outgoing connections from apps that are not supposed to do it
  - 0xcde4c3db 2y ago
    It's really a downside of the Google app ecosystem and not GrapheneOS per se, but apps requiring higher levels of integrity per Google attestation (Play Integrity/SafetyNet) generally won't work. Intentionally breaking apps on "untrusted" configurations is basically the point of that feature, and GrapheneOS does provide the relevant services, but would need to be specifically enabled by the app developer.
    - Fire-Dragon-DoL 2y ago
      So Netflix and such DO NOT work on phone? That's really frustrating
  - udev4096 2y ago
    Firewall wouldn't be necessary with GrapheneOS. There's a network toggle which you can use to completely cut off internet access for an app. As for the downsides, I would say close to zero. It feels just like a stock OS, without any kind of bloatware and a lot more secure
  - ThePowerOfFuet 2y ago
    GrapheneOS is not rooted, so you won't have those issues. GrapheneOS also gives you a Network permission per-app; if you uncheck it, the app has no connectivity, period. Highly recommended.
NayamAmarshe 2y ago
With KernelSU, this is no longer the case. It's Magisk that causes most problems.

jMyles 2y ago

> Long is gone the time where unlocking bootloaders and installing custom ROMs was the best path to follow. ...wha? I just installed GrapheneOS on my Pixel 8 Pro and it is, by a decent margin, the best custom ROM experience on a phone I've had to date.

encom 2y ago
>GrapheneOS This was not a project I expected to use Discord for support. Sad.
- asdp9iujaspid 2y ago
  https://grapheneos.org/contact#community https://grapheneos.org/contact#community > Our chat rooms are bridged across Discord, Telegram and Matrix so you can choose your preferred platform. > We have an official forum for longer form posts, which is publicly accessible and easier to search. We are using Flarum for our forum. https://discuss.grapheneos.org/ https://discuss.grapheneos.org/ If they mandated discord as a closed support community sure, but you can't be too upset by the mere affiliation with a discord channel when they also offer all the above
  - encom 2y ago
    I'm just disappointed that they associate with Discord at all, given that it is the antithesis of privacy and Freedom.
    - pulpfictional 2y ago
      The focus is security. Be disappointed in all the other free platforms that cannot provide adequate moderation or stability. Do you happen to know a suitable alternative?
    - cqqxo4zV46cp 2y ago
      I’m disappointed that you associate with Hacker News given the (presumably) myriad anti-Freedom anti-privacy startups Y Combinator has funded.
- udev4096 2y ago
  If I remember correctly, their matrix channel was flooding with spam and abuse which was primarily coming from Calyx, which by the way is an terrible OS. Even a stock OS would perform marginally better in terms of security than CalyxOS
npteljes 2y ago
I have it on my Pixel 7a, and it's a great experience, but I also don't need to run apps that check for phone "security" or integrity. This is the case OP is talking about. https://grapheneos.org/usage#banking-apps https://grapheneos.org/usage#banking-apps

arsome 2y ago

Largely depends on your priorities and level of effort. You can bypass all current app checks using Magisk and Play Integrity Fix, but it's a bit of work to maintain and can break occasionally. You gain in this case full control of your device like a desktop OS, block ads, modify app behavior, disable unwanted system features, but you have to put in effort to maintain it. However if you don't want to deal with that, you can also just not use those apps, use it like you would a Librem or PinePhone, load primarily open source software to it, optionally don't even bother with play store, etc. Might not be for everyone, but if you don't care that much for Google Wallet or multi-player games on your phone, it's not a bad option.

BizarreByte 2y ago
> but it's a bit of work to maintain and can break occasionally. Which is a major problem because my tolerance for my bank's app not working when I open it is so low it might as well be non-existent. I personally gave up this fight.
- rkagerer 2y ago
  Or switch banks and stop fighting.
  - mike256 2y ago
    I just switched to another bank. No one should accept apps with such checks.

franga2000 2y ago

It sure isn't what it used to be, but if you buy the right phone and make a few moderate compromises, it's still a great option. Installing crDroid on my OnePlus 9 Pro took half an hour, another half to install Magisk Delta with a few modules. The universal dark mode alone (Xposed module "DarQ") is worth the effort, but also the ability to clone apps, have proper clipboard sync, make full-system backups and customise the look and functions of my OS to a currently unparalleled degree. The only compromise is I can't seem to be able to do NFC card payments (send or receive), one of my 4 banking apps needs a custom patch every few months to start working and a friend tells me the McDonald's app doesn't work.

freedomben 2y ago
Do you keep a factory image for your OnePlus 9 pro in case you want to restore it? If so, how do you go about doing that? After OnePlus decided to stop publishing factory images, I decided to stop buying their phones. It's a real shame, because they really do make some great stuff and prices are quite reasonable generally speaking. I used to buy a new OnePlus phone nearly every year. The OnePlus 6 was one of my favorite phones of all time.
- franga2000 2y ago
  I wasn't aware they stopped publishing them so I didn't back it up, but I can't say I really care for my use case. The only reason I'd need it is to resell the phone, but my plan is to use it until it's either broken beyond repair or backporting new Android versions becomes impossible, at which point nobody would buy it anyways. I agree the OP6 is great (my girlfriend is still using hers), but I was still on my OP 3 like a year ago, until future ROM updates were deemed impossible thanks to Qualcomm binary blobs. It's a real shame it's all over now. The OP 9 Pro was the last OnePlus phone made in their old way (or close to it) - not too expensive, well built, close to stock ROM, easy to reflash, decently repairable. Hopefully it lasts me as long as the 3 did because currently I don't see anything else like that on the market.
- boneitis 2y ago
  I might have my hardware/software/firmware components (or your argument) mixed up and conflated. Does Oxygen Updater not source from published images? https://oxygenupdater.com/article/438/ https://oxygenupdater.com/article/438/ Yes, I am still on my beloved OnePlus 6 running Lineage and had been looking around for a used 7 or 8 for 5G capability (I'm a bit sketched out by the overall throttling hoopla of 9th gen). Perhaps it's time to expand the search beyond OnePlus.

Semaphor 2y ago

If you root, you can bypass those issues in most cases. I have 3 apps detecting it, that I can bypass, and only the German health insurance app from TK detects it (according to the internet, it's getting past most solutions somehow). It's not something I'd recommend the average person, but for people who care enough to fiddle, it's still the best way. I think since my first Android (HTC Desire Z/T-Mobile G2) I spent a total of 1 week on stock, never was a fan of any of them.

ac130kz 2y ago

Stock ROMs are still filled with ads and useless extras, rarely providing meaningful features over an AOSP like LineageOS.

myself248 2y ago

Huh. I guess I must not run any of those apps?

nimbius 2y ago

the only app ive seen balk at bootloader status (to date) is google wallet. Using a phone to pay for stuff is an opsec nightmare youd only entertain so long as becoming an integrated and saleable asset in a data brokers portfolio is a life goal. 'pm uninstall' and move on, the custom rom is still far more valuable from a security perspective than bending the knee to some bespoke ecosystem payment app (especially if you have an older device.) the point of oem unlock, and rooting at all, is diametrically opposed to the vendors interest in nearly every facet. The vendor will bark "hackers" as a thinly veiled threat for the uninitiated, but we are initiated. what the vendor doesnt need you doing is erasing their telemetry and walled garden spyware. they dont need you developing alternatives to their store and to their apps, and they especially dont need you turning this effort into something as simple as an ubuntu installation for older phones they expect to follow the strict trade-in model of "buy a new phone every year" arguably Asus refunded the purchase because this person isn't playing by the rules and being a good consumer.

jjmarr 2y ago
I'm in Canada and I can literally just tap the card itself on the reader. Every card has this ability and it can't be skimmed.
- SanDiegoSun 2y ago
  There are many demonstrations of contactless cards being “skimmed.” Unless you store it in a wallet with a faraday cage, this is a laughable opinion to express.
  - jjmarr 2y ago
    It's not the same as traditional card skimming since you can clone the magnetic stripe you skimmed onto another card and buy things with it. If you grab data from a tap transaction, you can't use that data to perform another tap transaction.
lxgr 2y ago
> Using a phone to pay for stuff is an opsec nightmare Do you mean "privacy nightmare"? Security-wise, Google Pay beats using your physical card since it uses a device-specific number that can't be skimmed by terminals and reused online. > the custom rom is still far more valuable from a security perspective than bending the knee to some bespoke ecosystem payment app (especially if you have an older device.) I'd argue that it only makes sense if you have an older device that's otherwise not receiving any more security updates.

zamalek 2y ago

> where apps check for unlocked bootloaders and rooted OS Magisk and PINE[1] have solved this for me. Yes, even Google Wallet is all good with my LineageOS ROM. PINE is an auto-updating PIF. [1]: https://github.com/daboynb/PlayIntegrityNEXT https://github.com/daboynb/PlayIntegrityNEXT

yooastan 2y ago

This is untrue, I do this now with my Pixel and have to no issues.

ravenstine 2y ago

This is rubbish. I'm running GrapheneOS and have left my bootloader unlocked, and there's no app that has refused to work. The only caveat is some of them need Google Play services. No, I am not rooted, but my last phone was rooted and there might have been one or two apps out of dozens that wouldn't work with root even with Magisk trying to hide the root status. Using a custom ROM is easily one of the beat choices I have made.

Fire-Dragon-DoL 2y ago
What are the downsides with GrapheneOS? I had a few problems with root (Netflix and banking apps) but would love my privacy. My main reason for root is the firewall to block outgoing connections from apps that are not supposed to do it
- 0xcde4c3db 2y ago
  It's really a downside of the Google app ecosystem and not GrapheneOS per se, but apps requiring higher levels of integrity per Google attestation (Play Integrity/SafetyNet) generally won't work. Intentionally breaking apps on "untrusted" configurations is basically the point of that feature, and GrapheneOS does provide the relevant services, but would need to be specifically enabled by the app developer.
  - Fire-Dragon-DoL 2y ago
    So Netflix and such DO NOT work on phone? That's really frustrating
- udev4096 2y ago
  Firewall wouldn't be necessary with GrapheneOS. There's a network toggle which you can use to completely cut off internet access for an app. As for the downsides, I would say close to zero. It feels just like a stock OS, without any kind of bloatware and a lot more secure
- ThePowerOfFuet 2y ago
  GrapheneOS is not rooted, so you won't have those issues. GrapheneOS also gives you a Network permission per-app; if you uncheck it, the app has no connectivity, period. Highly recommended.

NayamAmarshe 2y ago

With KernelSU, this is no longer the case. It's Magisk that causes most problems.