Re:Asahi Linux alpha release
by yjftsjthsd-h on Friday March 18, 2022 @10:09PM
(#30730228)
> Full data wipe when switching between security modes is outright user-hostile,
I don't think it's user hostile to prevent all security models from being dragged to the lowest common denominator. If they didn't do that, an attacker could just switch to a more insecure mode and go after your data.
> being dragged to the lowest common denominator
It's rather the reverse. How macOS handles it is by asking for user credentials on a security policy downgrade, and enforcing that by the Secure Enclave.
(and if you have user creds, you _have access to user data anyway_)
On other platforms, that tying... just doesn't exist.
On modern Android you also need user credentials for OEM unlock; the user needs to enable the developer options menu and allow unlock from there, otherwise the fastboot step won't succeed. (Notably, this preserves the effectiveness of FRP; even "wiping" the hardware and restoring the stock OS install won't allow unlock unless the existing user is verified). But a successful unlock still wipes all data, same as in previous Android versions where the user-side step was not needed.
That's not even the most painful part. Full data wipe when switching between security modes is outright user-hostile, and would be widely considered as unacceptable if Microsoft or Apple did that on their general-purpose computing platforms.