Develop Bugs

[Q] Customization done. Relock the bootloader?

I've flashed a rom, kernel, radio, some UI tweaks, and I think I'm done with all that and reached a point I'm happy with. Should I relock? Will I lose root/my tweaks by doing that? What are the security risks with keeping the bootloader unlocked? I don't use google wallet or anything else super personal/detrimental if in the wrong hands, but I do have a chasebank app (that requires login every use), the standard gmail integration, and a sensitive photo here and there. I understand that I'll have to unlock it again (and deal with the wipe) if I want to do more serious customizing, but at this point I'm more curious about the pros/cons of keeping the bootloader unlocked during day to day use. In terms of used networks, I connect to my home wifi, and the occasional open wifi when out and about, but usually I forget/don't realize and just keep it on 3g/4g. I also tether every so often. Don't know which of those makes me more vulnerable than others. I live in a pretty unpopulated area so I'm not too concerned about all this, but I am curious.

Don't relock...its pointless if you're not stock

No reason to re-lock. You'll just have to do a data wipe the next time you want to change anything.
Sent from my Galaxy Nexus using Tapatalk

There truly is no reason to relock, there is no difference/point.

I understand having to unlock it again would mean another wipe, as mentioned in the OP. I'm fine with that.
All of these posts conflict with this post from this recent Q&A thread. Which is correct? Why would that user post such a thing if it isn't true?
bfroehlich said:
I would suggest locking it if you plan on doing anything remotely sensitive on your device, Google Wallet, corporate email, naked pics of your spouse, etc.
Sent from my Galaxy Nexus using XDA App
Click to expand...
Click to collapse

not saying it's the case here, but a lot of people just think they know something.
@JBQ said in android-building something like
-However, if you're keeping your bootloader unlocked at all times
(which is a bad idea) and you're running an official build already,
you can flash a newer one without wiping data and that'll work fine.
Note that you can only move forward, not back. Be careful, though,
it's very easy to wipe data by accident when doing that, and the
default script does that.
Click to expand...
Click to collapse
he didn't go any further on that. source
perhaps it's a matter of privilege escalation?

relocking the bootloader help security
relocking the bootloader will help defend against "Evil Maid Attacks" amongst other things.
More background info available if you search for "evil maid goes after WhisperCore
why we need a securable bootloader"
(I'd post a link but account is too new)

Yes it will help with security. But by that point, you might as well get one of the "android lost" apps and remotely brick your phone if it's stolen, imo.
As a custom ROM user, you're responsible for your own updates. Which means you can expect to be reflashing stuff in the future. Thus, I don't think it's worth it to have your data wiped again and again.
(But then again, I flash stuff like crazy, so that might be bias on my part.)

It'd be kinda funny to to lock your bootloader for security after flashing completely custom firmware from some unknown source bit of a contradiction.

No.
In another week or so you are gonna be browsing xda and see a new kernel/rom/theme that you like and you're gonna think well I can't flash it coz for some reason I locked my bootloader and I don't want to wipe my sdcard coz I have stuff I want there.
A few days later you are gonna say f*ck it and you are gonna unlock your bootloader again and lose all your sdcard data.
Why?
Because you may not know it yet but you are now a crackflasher. You tried it once and that's all it takes to get addicted.

As others have said, there is only added security if you lose your phone and at that point if there is extremely sensitive data and you can't get it back, you can just remotely wipe it using an app from the marketplace.
Note: said app must be installed before you lose your phone
Sent from my GT-I9100 using xda premium

joshnichols189 said:
As others have said, there is only added security if you lose your phone and at that point if there is extremely sensitive data and you can't get it back, you can just remotely wipe it using an app from the marketplace.
Note: said app must be installed before you lose your phone
Sent from my GT-I9100 using xda premium
Click to expand...
Click to collapse
Note: Said app not doesn't necessarily have to be installed before you lose your phone because you can go to Play Store, remotely install the app, and issue the commands for tracking. (But if you want it to wipe, I believe you have to give it administrative permissions, which does require you to have it installed before and set it up that way). Maybe Avast! even lets you wipe without administrative positions (haven't tried yet).

In order for you data to be secure in case of theft/loss, locking the bootloader is not enough. You need to turn off USB debugging in settings. Otherwise, if someone finds a GN, he can access all the files on it anyway. Bootloader locked or not.

Root and Google Wallet (also NFC)

I hear that Google Wallet does not work if the phone is rooted. I got unsupported device message. Here's my question :
- Can you use wallet app with rooted phone ? (actual work , I haven't tried yet ; I denied root access but the message still there)
- Do other NFC apps request root to run ?

Nhan Lam said:
I hear that Google Wallet does not work if the phone is rooted. I got unsupported device message. Here's my question :
- Can you use wallet app with rooted phone ? (actual work , I haven't tried yet ; I denied root access but the message still there)
- Do other NFC apps request root to run ?
Click to expand...
Click to collapse
It works fine with a rooted device, it just warns that it's not supported (and links to the article describing the security risks briefly).
In general root access isn't needed for anything NFC related - this was a recent addition to Google Wallet.

So you still can pay with GWallet on root phone :great: I also interested with NFC modding. I see there are many NFC card with vary capability (from 50b to 1Kb) , which one should I buy ? (I'll use for turn Wifi/Bluetooth on/off or Change brightness e.t.c)

Nhan Lam said:
So you still can pay with GWallet on root phone :great: I also interested with NFC modding. I see there are many NFC card with vary capability (from 50b to 1Kb) , which one should I buy ? (I'll use for turn Wifi/Bluetooth on/off or Change brightness e.t.c)
Click to expand...
Click to collapse
There's a thread for that...
http://forum.xda-developers.com/showthread.php?t=1697563

Confused
krohnjw said:
It works fine with a rooted device, it just warns that it's not supported (and links to the article describing the security risks briefly).
In general root access isn't needed for anything NFC related - this was a recent addition to Google Wallet.
Click to expand...
Click to collapse
I have an EVO 4G LTE and prior to rooting I definitely cleared my Google Wallet. But just now since rooting and installing Charmeleon, when I load Google Wallet I get this message:
Not Supported
--------------
Unfortunately, Google Wallet has not yet been certified in your country or on your device / carrier.
Obviously, this is not true, because it worked just fine prior to rooting.
Clicking OK merely closes it out, so how can it still work if I can't go any further?

It can still run up until that verification takes place, I've seen it many times on my sgs2 when we first got nfc enabled awhile back. Anyway to address your problem it could be a couple of things, first thing that comes to mind is your apn settings. My reasoning is you said it worked completely before and you flashed chameleon so the error your getting could definitely be that. Check your apn settings, make sure your connecting to the same servers as before. If that isn't the issue let me know as I don't have your lg so I couldn't tell you if it has something to do with the secure element at this time.

Actually I just did some quick research for you. It seems even people on stock rom are having issues with nfc and not just Google wallet but a lot of reports of not being able to detect nfc cards or other credit cards,pay pass etc. Does your nfc work in any of those capacities? If not I would start there because if that doesn't work Gwallet surely won't. Lastly I just read a few issues in the sprint version of the phones forum on xda people believe there's an issue with the placement. Check it out
Sent from my SGH-I777 using xda premium

Nizda1 said:
Actually I just did some quick research for you. It seems even people on stock rom are having issues with nfc and not just Google wallet but a lot of reports of not being able to detect nfc cards or other credit cards,pay pass etc. Does your nfc work in any of those capacities? If not I would start there because if that doesn't work Gwallet surely won't. Lastly I just read a few issues in the sprint version of the phones forum on xda people believe there's an issue with the placement. Check it out
Sent from my SGH-I777 using xda premium
Click to expand...
Click to collapse
Thank you for looking into this, and for discovering others are having issues. I'm not sure how to go about checking my APN settings, but I am looking it up.. so as soon as I figure that out I will post back and let you know what I find lol
---------- Post added at 09:02 PM ---------- Previous post was at 08:57 PM ----------
I believe my APN was and is LTE/CDMA unless I'm miss understanding, this doesn't appear to have changed. As far as the other trial&error's you've suggested, I am going to have to try those later because I am at work for the night, and don't have access to anything here. Thank you for looking into this!

I can't Help You *_*

USAMac said:
I have an EVO 4G LTE and prior to rooting I definitely cleared my Google Wallet. But just now since rooting and installing Charmeleon, when I load Google Wallet I get this message:
Not Supported
--------------
Unfortunately, Google Wallet has not yet been certified in your country or on your device / carrier.
Obviously, this is not true, because it worked just fine prior to rooting.
Clicking OK merely closes it out, so how can it still work if I can't go any further?
Click to expand...
Click to collapse
You can check out my guide here for your answer http://forum.xda-developers.com/showthread.php?t=1810282

[Q] Cannot unlock my Wonder

I've got a problem here. Well, I put a PIN code for the unlock screen as my friend sometimes use it without my permission. Then, somehow someone is tring to guess it until it reah maximum opportunity which I have to input my e-mail account. I've already done it but the phone says wrong, but tried on computer and it works fine. I am actually avoiding doing hard reset as I think that's the final solution.
Anyone have a suggestion?
Thanks in advance
Sent from my ST26i using xda premium

my advice is to do a nandroid backup 1st then try wtvr u want

goldenboyz said:
I've got a problem here. Well, I put a PIN code for the unlock screen as my friend sometimes use it without my permission. Then, somehow someone is tring to guess it until it reah maximum opportunity which I have to input my e-mail account. I've already done it but the phone says wrong, but tried on computer and it works fine. I am actually avoiding doing hard reset as I think that's the final solution.
Anyone have a suggestion?
Thanks in advance
Sent from my ST26i using xda premium
Click to expand...
Click to collapse
Well I simply don't understand why unlocking the phone with your google account did not work. Are you on a custom ROM? Are you using the correct google account which is set to be used with the phone? It seems to me that you are using a google account other than the one on the phone...
Say somebody finds your phone and can not guess the security pin, they can't get in the phone with their google account. It has to be your google account to begin with.
Well AFAIK, the only way I know how to by pass this is to wipe data via recovery. (i.e.: hard reset) but then you will lose all the data...This is a good thing so that people who finds/steals your phone can not get their hand on your personal data..

thearif said:
Well I simply don't understand why unlocking the phone with your google account did not work. Are you on a custom ROM? Are you using the correct google account which is set to be used with the phone? It seems to me that you are using a google account other than the one on the phone...
Say somebody finds your phone and can not guess the security pin, they can't get in the phone with their google account. It has to be your google account to begin with.
Well AFAIK, the only way I know how to by pass this is to wipe data via recovery. (i.e.: hard reset) but then you will lose all the data...This is a good thing so that people who finds/steals your phone can not get their hand on your personal data..
Click to expand...
Click to collapse
I also cannot afford to think 'how come I cannot log in to my own account?' A way I think is how to back up data from internal memory while as I know, when we plunging in USB cable, it needs confirmation through the phone...

Can't unlock phone on boot

Hi all,
bit of an emergency here. I am running rooted Chroma rom, just went into twrp to backup my EPS, and upon reboot it is saying I need to enter my password. I have done this several times. Now, it keeps saying the password is incorrect, and after the 5th time, there is no option to reset it! Help please!! Don't feel like wiping my phone again...

greves1 said:
Hi all,
bit of an emergency here. I am running rooted Chroma rom, just went into twrp to backup my EPS, and upon reboot it is saying I need to enter my password. I have done this several times. Now, it keeps saying the password is incorrect, and after the 5th time, there is no option to reset it! Help please!! Don't feel like wiping my phone again...
Click to expand...
Click to collapse
You can search that but might as wipe in the meantime. Get yourself a working phone.

bobby janow said:
You can search that but might as wipe in the meantime. Get yourself a working phone.
Click to expand...
Click to collapse
Thanks for the reply. Going through the post-wipe setup now. Grrrr. It's just that I entered the password a bunch of times, and it always worked. Just on reboot from recovery it didnt. Now I'm afraid to go back into twrp...
Anyone know if this could be caused by some android security feature that doesnt like systemless root, xposed, etc.

greves1 said:
Hi all,
bit of an emergency here. I am running rooted Chroma rom, just went into twrp to backup my EPS, and upon reboot it is saying I need to enter my password. I have done this several times. Now, it keeps saying the password is incorrect, and after the 5th time, there is no option to reset it! Help please!! Don't feel like wiping my phone again...
Click to expand...
Click to collapse
I assume this is the same problem as the Nexus 6P. You need to disable the security before making a TWRP backup. The fix is:
After restoring the nandroid, boot into twrp and then delete /data/sytem/locksettings.db. If that doesn't fix it, delete the locksettings.db-shm and locksettings.db-wal in the same location. If that doesn't fix it either, delete gatekeeper.password.key and gatekeeper.pattern.key in the same location.
Click to expand...
Click to collapse

KennyG123 said:
I assume this is the same problem as the Nexus 6P. You need to disable the security before making a TWRP backup. The fix is:
Click to expand...
Click to collapse
Thanks for this fix. I'll keep it in mind next time. My broader question is now about security in general, since there seems to be a way to remove security from our roms?? For example, if someone got ahold of your phone, couldnt they just follow these steps to get in? Is this just a side-effect of unlocking the phone that is unavoidable? If I'm missing something about how to maintain security in the unlocked/rooted environment, please let me know. I've looked around but I haven't found any great guides for best practices regarding nandroids/security, etc. Thanks all!

greves1 said:
Thanks for this fix. I'll keep it in mind next time. My broader question is now about security in general, since there seems to be a way to remove security from our roms?? For example, if someone got ahold of your phone, couldnt they just follow these steps to get in? Is this just a side-effect of unlocking the phone that is unavoidable? If I'm missing something about how to maintain security in the unlocked/rooted environment, please let me know. I've looked around but I haven't found any great guides for best practices regarding nandroids/security, etc. Thanks all!
Click to expand...
Click to collapse
Rooting is in itself the biggest security risk. This is why carriers are working with manufacturers to make many phones fully locked and unrootable. Our main security expert Jcase does not use a rooted phone. He recommends if you need to root, go ahead, make the changes you want, then quickly unroot. So sure, if someone stole your phone they could follow that procedure to get into it. They could also just force a fresh stock version on it to wipe everything. Security and locks are meant to keep out honest people and slow down the dishonest.

KennyG123 said:
Rooting is in itself the biggest security risk. This is why carriers are working with manufacturers to make many phones fully locked and unrootable. Our main security expert Jcase does not use a rooted phone. He recommends if you need to root, go ahead, make the changes you want, then quickly unroot. So sure, if someone stole your phone they could follow that procedure to get into it. They could also just force a fresh stock version on it to wipe everything. Security and locks are meant to keep out honest people and slow down the dishonest.
Click to expand...
Click to collapse
Just so I'm clear, the only thing keeping a stock phone safe is that when its locked, it can't be unlocked/rooted because the option to allow oem unlocking/adb connections are not (or should not be) checked in the developer options, is that correct? From what you're saying, as long as those two boxes are checked, there is essentially nothing stopping someone from wiping out your password and getting into your device. I'd love to run unrooted, but would adaway still have an effect? I'm thinking that the definitions are already applied, so maybe it would work unrooted. But cf.lumen, which I love and can't find the same functionality anywhere else, seems to always "enable interactive shell" on boot. Would this work unrooted? But again, as long so you're doing all this stuff, you can't lock your bootloader again, can you? Or can you lock it on a stock rom with the kind of modifications I'm talking about. I read that locking bootloader while having a custom rom loaded can cause a brick, although I'm not quite sure why. Couldn't you just always get into fastboot to unlock it again?

greves1 said:
Just so I'm clear, the only thing keeping a stock phone safe is that when its locked, it can't be unlocked/rooted because the option to allow oem unlocking/adb connections are not (or should not be) checked in the developer options, is that correct? From what you're saying, as long as those two boxes are checked, there is essentially nothing stopping someone from wiping out your password and getting into your device. I'd love to run unrooted, but would adaway still have an effect? I'm thinking that the definitions are already applied, so maybe it would work unrooted. But cf.lumen, which I love and can't find the same functionality anywhere else, seems to always "enable interactive shell" on boot. Would this work unrooted? But again, as long so you're doing all this stuff, you can't lock your bootloader again, can you? Or can you lock it on a stock rom with the kind of modifications I'm talking about. I read that locking bootloader while having a custom rom loaded can cause a brick, although I'm not quite sure why. Couldn't you just always get into fastboot to unlock it again?
Click to expand...
Click to collapse
Pfew...so many questions...there are always vulnerabilities out there that hackers can find..like Stagefright...but a rooted phone is the most vulnerable. So having a phone with a locked bootloader and unrooted is the best security...still not guaranteed against every possible thing. But it is the best...now what are you trying to protect? Your data...or someone being able to wipe and use the phone as their own? All you can do really is try to protect from a phone being hacked remotely...and a rooted phone is like leaving the safe door open. But if someone steals your phone, there are always nefarious ways to make it usable.

KennyG123 said:
Pfew...so many questions...there are always vulnerabilities out there that hackers can find..like Stagefright...but a rooted phone is the most vulnerable. So having a phone with a locked bootloader and unrooted is the best security...still not guaranteed against every possible thing. But it is the best...now what are you trying to protect? Your data...or someone being able to wipe and use the phone as their own? All you can do really is try to protect from a phone being hacked remotely...and a rooted phone is like leaving the safe door open. But if someone steals your phone, there are always nefarious ways to make it usable.
Click to expand...
Click to collapse
Yeah, sorry for the wall of questions. I am just trying to wrap my head around some of these issues. At the end of the day, I don't really keep sensitive data on the phone, although it would not be good if a bad actor got into my gmail, for instance. I suppose I should migrate the last of my sensitive accounts to a secondary email, so no password resets could be initiated from a stolen phone. It's always a tradeoff between convenience and security I know. It's also a little worrysome that simply unlocking the phone activates it for androidpay. An unlocked phone stolen out of someone's hand is essentially the same as stealing all the credit cards in their wallet. It would be nice if android pay allowed an additional fingreprint/pin/password to make the transaction. Anyway, I'm now taking my own thread way off topic. Thanks for the insights though.

greves1 said:
Yeah, sorry for the wall of questions. I am just trying to wrap my head around some of these issues. At the end of the day, I don't really keep sensitive data on the phone, although it would not be good if a bad actor got into my gmail, for instance. I suppose I should migrate the last of my sensitive accounts to a secondary email, so no password resets could be initiated from a stolen phone. It's always a tradeoff between convenience and security I know. It's also a little worrysome that simply unlocking the phone activates it for androidpay. An unlocked phone stolen out of someone's hand is essentially the same as stealing all the credit cards in their wallet. It would be nice if android pay allowed an additional fingreprint/pin/password to make the transaction. Anyway, I'm now taking my own thread way off topic. Thanks for the insights though.
Click to expand...
Click to collapse
For most phones that have fingerprint security Android Pay can be set up that way. I won't use it anyway because it would be crazy to hand a waiter your unlocked phone, or to have to follow him to the register. It would only be useful to me in the supermarket but I am carrying a credit card anyway. But that is one thing people forget, rooting a phone means removing the main security.

KennyG123 said:
For most phones that have fingerprint security Android Pay can be set up that way. I won't use it anyway because it would be crazy to hand a waiter your unlocked phone, or to have to follow him to the register. It would only be useful to me in the supermarket but I am carrying a credit card anyway. But that is one thing people forget, rooting a phone means removing the main security.
Click to expand...
Click to collapse
N5X and android pay seems to tell me to just "unlock your phone" and hold it close to the reader. No need for an additional fingerprint. And no option to require this in settings...

greves1 said:
N5X and android pay seems to tell me to just "unlock your phone" and hold it close to the reader. No need for an additional fingerprint. And no option to require this in settings...
Click to expand...
Click to collapse
Yes, that should get you to the authorization screen and then if you have fingerprint set up should ask you for the fingerprint to authorize. Android Pay also now works on phones without fingerprint sensors so that is why they provide those simple instructions. Final authorization instructions will appear on your screen.

KennyG123 said:
Yes, that should get you to the authorization screen and then if you have fingerprint set up should ask you for the fingerprint to authorize. Android Pay also now works on phones without fingerprint sensors so that is why they provide those simple instructions. Final authorization instructions will appear on your screen.
Click to expand...
Click to collapse
Ah, great to know. Thanks.

greves1 said:
Ah, great to know. Thanks.
Click to expand...
Click to collapse
Unfortunately I can't test that theory since I am on a custom ROM and also Xposed. But everything I read says it should utilize the fingerprint if available.

KennyG123 said:
Unfortunately I can't test that theory since I am on a custom ROM and also Xposed. But everything I read says it should utilize the fingerprint if available.
Click to expand...
Click to collapse
Real word use shows that android pay does not ask for an additional fingerprint at the time of use. It's just as the instructions say, as long as your phone is unlocked at the time it is held up to the scanner, androidpay will work. I kind of wish they allowed for the additional security of an at-scan fingerprint read, but oh well. I have yet to test if the password/pin can be removed by the methods discussed in this thread, and androidpay working after defeating this security. If it does, then this is obviously a major security vulnerability of having an unlocked phone and using androidpay at the same time. Probably not more dangerous in terms of protecting against CC thieves, since they can just swipe a card stolen from your wallet at a terminal, but you probably wouldn't want to keep too many cards on your phone. Again, I haven't tested this out, if a fingerprint is still required to get in after a password database defeat, but someone should do this test.

If you have your phone lost or stolen just cancel your cards as if it happened to your wallet. Simple no?

android pay keeps popping up as i try to beam pictures

why dose android pay pop up everytime i use android beam is there a way to disable it some times I can't even beam what I want because the stupid thing just keeps popping up

My phone's rooted as well so I can't use it

I know that you cannot use Android Pay if you have a rooted device. The application does not allow it and you will have to unroot and perform a Data Factory Reset in order to use Android Pay. Your phone does daily scans to detect if it is rooted and Android Pay picks up on this.

jordancking95 said:
I know that you cannot use Android Pay if you have a rooted device. The application does not allow it and you will have to unroot and perform a Data Factory Reset in order to use Android Pay. Your phone does daily scans to detect if it is rooted and Android Pay picks up on this.
Click to expand...
Click to collapse
I don't care for android pay I just want to use android beam without it asking me to set up android pay

darkberry19 said:
I don't care for android pay I just want to use android beam without it asking me to set up android pay
Click to expand...
Click to collapse
Have you tried uninstalling Android Pay?

jordancking95 said:
Have you tried uninstalling Android Pay?
Click to expand...
Click to collapse
Yup with titanium back up there was still a pop up asking me to set it up

Reviving an old thread....
I've got this problem, and this thread is the best Google result I've found. I don't have android pay installed, but every time I try to pay using a bank app, I get a pop up telling me to install android pay, so can't use the app.
The most frustrating part is I solved this once before, but I had to do a factory reset and I can't remember how I fixed it. ?
Any suggestions?
TIA
Edit it's a ZTE phone, but the same problem described here.

jefmcg said:
Reviving an old thread....
I've got this problem, and this thread is the best Google result I've found. I don't have android pay installed, but every time I try to pay using a bank app, I get a pop up telling me to install android pay, so can't use the app.
The most frustrating part is I solved this once before, but I had to do a factory reset and I can't remember how I fixed it.
Any suggestions?
TIA
Edit it's a ZTE phone, but the same problem described here.
Click to expand...
Click to collapse
should be around the same location for you but under settings->wireless&network->Tap & pay, if you set use default as "except when another payment app is open
it might help fix the issue.
other note is, just install suhide and call it a day

lil-devil said:
should be around the same location for you but under settings->wireless&network->Tap & pay, if you set use default as "except when another payment app is open
it might help fix the issue.
other note is, just install suhide and call it a day
Click to expand...
Click to collapse
Thanks
That was it. Unfortunately I didn't get my email notification that you had replied, so finally solved it on my own, and just came back here to reply in case it happened to me a 3rd time, google would give me answer.
But thanks. When I found it I felt so stupid.
And it turns out I have 3 different apps that all are contactless-ready. Who knew?
Edit: It's actually Settings->Device->Tap and pay, but your instructions would have led me to it.
Edit 2: Ironically, the phone has just - I think - died of the problem that drove me to do the previous factory reset