I've been trying to execute on this approach, as I'm very interested in checking out of the tracking-by-default ecosystems.

We're using some Xiaomi devices we purchased, and I'm currently seething. I can't root without 'unlocking', which is a process that requires me to activate a Mi Account, which then requires my email and a SIM (?!), and 'find my device' (location) to even allow installation of apps via USB. To unlock the computers I bought, so I can use the root account, to install an alternate.

Seems the prison walls are just set far enough away that we don't notice.

tl;dr, in order to get some privacy, I'm being asked to associate my IMEI, my IMSI, my email, and my location.

There was a massive wave of phones being sold with unlocked bootloaders with preinstalled malware. How do you stop this? Unscrupulous retailers would buy thousands of your latest phone, root it and sell it for $1 less than MSRP, and make much more than that from injecting extra ads and stealing data. Not to mention, all the bad press "you" get for "shipping a phone with ads in it".

Mere tamper-evidence - having a "bootloader unlocked" warning on boot - isn't obvious enough for a new user who has just bought the phone for the first time. So all manufacturers have added time locks and anti-fraud detection for bootloader unlocking. The time lock in particular is the best way to cut down this effect during the early sales process after which time it's hard to catch up in review score. But a time lock can only be implemented securely via a remote server out of the user's hands.

Xiaomi getting the telemetry is a cherry on top, but it's not originally nefarious - or at least - it's less nefarious than the problem it's intending to solve

How about let adults wreck the phone they bought if they 'want' to. Bootloader unlock in a 'hidden' power-on menu is sufficient. If you really want to baby users just have this set a flag that requires a click box to be ticked on next boot in order to actually unlock it (eg "you selected to unlock your bootloader in the power-on menu; unlocking your bootloader may lead to you destroying your phone, do you want to continue?" "are you sure?" "pinky promise?").

The "we're protecting people from themselves" argument seems spurious.

>The "we're protecting people from themselves" argument seems spurious.

Because it isn't the argument at all? The goal is to protect your reputation from having malware and ad laced versions of your latest hardware flooding the market (and hitting the news). Users are just a secondary concern.

His argument is that retailers are intercepting “the phone they bought” and preloading garbage on it and repackaging it before sending it to them. Maybe that’s something that happens a lot in China? If so, requiring registering on the Xiaomi website would be a pretty good way to thwart this.

In a way, it’s to protect naive users. And it still allows you to root the phone - go through this idiocy once and then never worry about it again.

The amount of data that is sent during the unlock process is absolutely ridiculous. Ever had an environment variable you don't want to share with Xiaomi, together with IP address, mail, phone number, geolocation, serial numbers, etc. ? Because all these gets sent. Unnecessary.

Xiaomi phones and their apps especially the freaking weather app are routine offenders on my firewall. I use NoRoot Firewall (beta version), that runs a local VPN, to whitelist connections and man, it's horrifying. I've enabled the "Always on VPN" and "Block connections without VPN" settings (Android 10) so NOTHING goes out unless through the firewall

You should be able to disble those apps for your user with adb without root:

  adb shell pm uninstall -k --user 0 com.[miui,android,xiaomi].<appname>

Have you investigated if xiaomi.eu firmwares successfully curtail those connections?

This situation won't change until these companies are legally required to change, or until they have an economic incentive to do so. If even people like yourself who are interested in rooting don't bother to research the issue before making a purchasing decision, I don't have high hopes for the economic path. So the question is whether there is a sufficiently interested political constituency to get a law passed.

Yeah, Xiaomi seems like a terrible starting point if you're worried about surveillance.

I had the phones prior to the attempt (they're my previous handsets). Not wanting to buy fresh phones just to check feasibility. Sadly the choice just seems to be which nation-state-finance-intelligence cluster you want to feed your data to.

If you're serious about this approach, the best option is (ironically I guess) just buying a Pixel device directly from Google. They tend to be well supported by third party ROMs and are easy to root or flash.

You can also grab a used device with a confirmed unlocked bootloader. You usually have to ask a seller, and some won't know the answer, but you can provide the steps for them to determine this.

yea it's so annoying to unlock the bootloader on Mi phones.. Samsungs are less a pain

I'm currently using LineageOS and I'm not going to use it in the future. The issue I have is that unlocking my phone creates a security trade off that doesn't seem better than the privacy gains. I'm more afraid of losing my phone and someone replaces the bootloader than I am of telemetry.

I really have enjoyed the LineageOS and it's been great to have a phone that isn't as dumb as a flip phone but doesn't have all the bloatware and spying of other devices. The security around the bootloader is my biggest concern.

Is this a real issue for you? I would think that you would not normally leave your phone somewhere that it could be covertly accessed by an attacker. My device is almost always by my side.

If you're in a position that your chain of custody is broken, just wipe, revert the device to stock signed binaries, confirm by locking the boot loader again, then unlock and re-flash your custom binaries.

Or am I missing something here?

How about GrapheneOS instead? https://grapheneos.org/

Well what's wrong with a bootloader unlocked if your device is encrypted?

Android has two ways of encryption. FBE = File Based Encryption, newer. FDE = Full Disk Encryption, older.

FBE is only secure when the system partitions have dm-verity enforced and verity is only enforced when the bootloader is locked.

FDE is a bit more resilient with an unlocked bootloader since there is less data left unencrypted.

However in either scenario without a locked bootloader and verity it is trivial for an attacker to insert malicious code that can then run once your device is unlocked and send off your files.

If left unattended, an attacker could install bootable code that impersonates your normal startup sequence, prompting for your encryption key and booting as normal, but secretly storing or forwarding the key to the attacker.

(I believe this is an example of an evil maid attack, although that name for it is somewhat new to me.)

A locked bootloader would prevent such code from being installed, or at least refuse to run it.

I think the missing part is generating your own key inside the secure boot mechanism, and the disk encryption being tied to that. Evil maid re-unlocks it -> encrypted data is lost.

This reddit thread makes it sound like FBE isn't particularly secure once the bootloader is unlocked. I'm not an expert on this but the more I looked into security around LineageOS the more I realized losing my phone would/could be a serious issue.

https://www.reddit.com/r/LineageOS/comments/ev9c4v/is_androi...

Can't you lock the bootloader again after flashing a new rom?

Depends on the device. This could be done (with some hackery) on Sony Xperia phones from several years ago, but more recent ones will brick if you try it. I think Google's Pixel phones will let you re-lock, but my impression is that most devices are in the latter category.

I've read this is a very easy way to brick your phone because the bootloader will check if the signature matches the one from the OEM.

Been a few years since I was playing with this stuff, but can you not still just unlock the phone with fastboot? Has something changed that it’s actually bricked or is this the modern sense of the word bricked (mildly inconvenient and maybe some data loss)?

Last I tried it (albeit a few years ago), it was a soft-brick; I.E., mildly inconvenient with a brief "Oh shit!" moment.

I've been trying this, and let me tell you, the user experience is absolutely terrible.

The Play store and what it gives you is incredibly hard to live without, unless you really just want to use your phone for texting, browsing, and calling. If you're a minimalist, then great. If you're accustomed to what a smartphone can do, not so great.

The alternative app stores are full of unimpressive, small scale apps. Dozens of calculators and little games, but no maps apps (of worth), no yelps, no IMDb (which I use often), no Sheets or Photos, the list is huge. I'm sorry but these apps make a smartphone worthwhile.

To avoid such a spartan experience, I ended up just installing microG (an open source replacement for Google's Play Services) and Aurora (a replacement Play store client, which allows me to install most apps from the Play store).

The problem is that most modern apps require a mammoth cloud backend, which costs big money to run, which means you're going to need a huge company running it. You'll never find big scale apps like this on F-droid.

I am using a pretty much "degoogled" android with microG as a replacement for the play services and a patched google play store that works with it. So the play store is basically the only google bit that ocassionally runs on my device.

And let me tell you, I almost never have to open up the playstore except for updating my banking apps, because f-droid has a much better selection of apps anyway.

For example, NewPipe is a much superior alternative to the official youtube app and it even works perfectly fine without a youtube account. I don't have to ever worry about having my google account deleted because NewPipe backs up my subscriptions to xml.

I can only recommend this approach of "degoogling" but still having the ability to fall back in case it is really needed. But so far microG has been great, they even implemented the Covid Exposure Notification framework very quickly.

>no maps apps (of worth)

OSMAnd

>no yelps, no IMDb

What do these apps provide that the mobile sites don't?

My guess is that some sites identify a mobile browser and deliberately cripple the experience to promote "download our app to see more."

In particular, I seem to recall if you landed on Yelp, a lot of content was "here's 150 pictures, but you can only see 3 on the browser."

Can I ask what you use Sheets for? For anything a little more serious I always use my desktop, as even typing on my phone is very frustrating.

For me, it is handy for tracking expenses in various categories (tabs in a given spreadsheet) and it's general availability on my devices so the information is always available to me.

I've been in love with the concept of spreadsheets for as long as i can remember :)

I use them all the time for tracking expenses, tracking information for myself, creating forms and responses, etc.

this seems like what they did on the iodé phone,

If you have a supported device, LineageOS is great. But so far the ecosystem for non-Google apps stores is tiny. They exist in certain niches (most notably F-Droid for open source), but not using Google's Play store at all is a major downgrade of your experience.

The lack of the Google Play store isn't actually a problem on LineageOS, because you can use Aurora Store from F-Droid to download any desired apps from the Google Play store. The issue rather is that even if you get those apps indirectly from the Google Play store, many of them will refuse to run on a device that lacks Google Play Services.

This is still mind-blowing to me. The people who have an incentive to make it easy to migrate away from Google services on your devices (Samsung, Amazon, Microsoft, etc.) should be working together to make an open API for app developers to use that allows swapping in different backends for basic services. Instead, projects like openpush are being developed essentially by volunteers.

if you have an old phone sitting around you could have the download apps on that and extract the apk's, then install them on your main phone. there are certain apps you can get in the fdroid store that will download apps from the play store, I can't remember the name of it.