51
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 15 Jul 2026
51 points (100.0% liked)
DeGoogle Yourself
17403 readers
68 users here now
A community for those that would like to get away from Google.
Here you may post anything related to DeGoogling, why we should do it or good software alternatives!
Rules
-
Be respectful even in disagreement
-
No advertising unless it is very relevent and justified. Do not do this excessively.
-
No low value posts / memes. We or you need to learn, or discuss something.
Related communities
!privacyguides@lemmy.one !privacy@lemmy.ml !privatelife@lemmy.ml !linuxphones@lemmy.ml !fossdroid@social.fossware.space !fdroid@lemmy.ml
founded 6 years ago
MODERATORS
AFAIK, the only way you can reliably lock your bootloader with a custom firmware, is if the device allows you to upload new avb_custom_keys. This basically allows you change your locked bootloader to allow custom firmware from a single (signed) source (ie graphene, google, your own).
I can't say for certain, but many non-pixel phones do not support this.
So, if you were to lock your bootloader, the loader would notice that you have an "unauthorized" firmware installed and would not run it. You'd basically need to unlock the bootloader again, but I think Motorola has made this process more complicated. Meaning you might need a bootable device to do it.
As far as security: Unlocked phones are less secure. All android devices are encrypted, using a hardware key plus your pin number. When a device is locked, a "secure key" is used as the hardware key. When a device is unlocked "another key" is used. If an attacker gets a hold of your unlocked encrypted phone, they can easily get this "other hardware key" which means they already have 1/2 of the information needed to decrypt your phone.
Afterwards, the only thing protecting your unlock phone is the strength of your pin (which is trivial to brute force). On locked bootloaders, it's much more difficult, as they'd need to figure out the "secure key", in addition to your pin.
Thank you. You have convinced me to try to lock my bootloader.
Hey, I'm glad you found the information helpful.
If you decide to use your own avb custom keys (meaning that you are the only person who can install cfw - this means that google, graphene, etc would fail to install as they aren't signed with your keys).
You can then use tools like Custota to allow you to have/distribute your OTA (over-the-air) cfw updates.
Why would you want to do this?
Well, for sometime I was running a rooted version of graphene w/ magisk (as I wanted "real" offline backups). This means that I needed to "sign" each release and the official graphene updates. The process was a bit tedious, but well documented.
The upshot of custota being installed on my device, was that I got a notification when I had a new self-signed update available... and the release/install process was entirely under my control. ...and if something borked, I could "rollback" to the previous version (tbh, nothing did bork, so I didn't actually need to try this).
Thank you!! This is really in depth and just the kinda info I needed. Sounds like I really should contact the Calyx Institute from that other comment and see if this is doable and not just leave it. This phone has an SD card slot, am radio, and a headphone jack so if I can get the bootloader locked I might not ever need to look at a google pixel. Calyx does have a reset after 5 failed attempts feature tho so that'll be good to have until then.
I don't know if Calyx offers "officially" signed releases, but there appear to be users reporting that moto g84 support avb_custom_keys.
If they don't, you can create your own custom keys and sign the release yourself using ’avbroot' (linked above).