Android's bootloader isn't supposed to be locked when installing custom firmware. An unlocked bootloader is a large physical access vulnerability.

How does LineageOS help security exactly?

Encryption helps.

Does it? It seems useless when anyone with physical access can replace the bootloader.

https://android.stackexchange.com/questions/38909/unlocked-b...

Well, this would require them to wipe your phone's data, so you would be alerted as soon as it happened since your phone would not have any of your old data once you logged in. If a malicious attacker is able to take your phone without you noticing and be able to replace it, the difference of a locked or unlock bootloader won't change the fact that you are going to put in your PIN on boot. Instead of replacing your OS with a malicious OS, they could simply replace your phone with a malicious copy of your phone and get your PIN on the first bootup. They still get your PIN and you still lose your data. The benefit of LineageOS is that it is open source and can be built yourself, so anyone can check the code for backdoors/vulnerabilities. This also means you get all updates as soon as you can build them.

LineageOS is a great OS. People should continue to use it for learning, fun, and getting things done.

Please elaborate though. How is an unlocked bootloader is more secure than than EngineerMode appearing on a phone [1]? Conclusion #6:

> Encryption is insecure with an unlocked bootloader or an open-access recovery.

If you have LineageOS with TWRP and an unlocked bootloader then it appears you have an insecure device.

[1] https://forum.xda-developers.com/android/software-hacking/tw...

I just asked another commenter who suggested Lineage to talk a little about their experience with it since I just flashed PA onto my 3t this past Friday. I'm going to check it out a bit today. Do you know if it's a simple process to go from PA -> Lineage? A little about me: I am a pretty experience developer but not much of a tinkerer when it comes to phones. This flash to PA is only the third time I've done this with a phone and the last time was a few years ago.

Not sure specifically how you installed PA, but, generally, that would look something like:

    1. Unlock bootloader
    2. Install aftermarket recovery (CWM or TWRP)
    3. Install new ROM (PA)

Now that you've done 1 and 2 (usually the difficult parts), you really just need to repeat step 3 with a different ROM.

Assuming you have TWRP installed, LineageOS has instructions for your specific situation (installing from recovery) at: https://wiki.lineageos.org/devices/oneplus3/install#installi...

If you have CWM or something else, it should be relatively easy to translate the instructions to your specific situation. If you have trouble, you can just start from the beginning of that document for instructions to install TWRP instead.

If you want Google Apps (gmail, etc) installed, you'll need to download that from here: http://opengapps.org/ (ARM64, 7.1) and treat that as your "additional packages" for the purposes of those instructions.

I just started messing with LineageOS on my Moto G4. Make sure you make a backup of the stock image so you can flash it back if something goes wrong with your cell network settings. I didn't and now I only have 3G and have been procrastinating flashing the stock everything and starting over.

For the OnePlus hardware the stock system images are all available for download from OnePlus themselves: http://downloads.oneplus.net/

Most OEMs should have some sort of downloads available. If that fails, you can generally find a thread on the xda forums that has links to download the stock ROM and other files (though then not directly from the OEM, so there's some element of trust/risk there).

(In your case, it looks like Motorola hosts the G4 images at: http://motorola-global-portal.custhelp.com/app/standalone/bo...)

I have TWRP installed. Thanks for the links. It looks like this will be simpler than I thought. I'm a little paranoid about bricking my phone as I only bought it a year ago and I'd have to have to get another.

It's generally really hard to truly brick a phone these days.

People throw around the term like it's lost all meaning - usually when someone says they "bricked" their device, they're meaning that "it was moderately inconvenient to recover and I lost my data". Not that it's a literal brick that they now put in the garbage bin.

If you've got recovery, you've got an easy path to getting it up and running again. Just reflash your ROM, a different ROM, a stock ROM, whatever.

If you hose your recovery, you boot your phone into fastboot/odin/heimdall/etc mode which is built into the phone's firmware. From there, you can still flash images to the internal partitions to replace your recovery/system/anything else.

I don't wanna be the guy that doesn't include the "there's always risk" warning on his instructions, but if you're just flashing back and forth between ROMs the worst I'd ever expect you to mess up is wiping your internal storage and photos by accident.

Fantastic. Thanks for the info. Like I said, the last time I had done this was a few years ago when the risk of "bricking" a device seemed a bit more real. I'm glad to know that getting TWRP installed was a good move.