[HN Gopher] Universal Android Debloater
___________________________________________________________________
Universal Android Debloater
Author : acqbu
Score : 79 points
Date : 2021-10-30 10:42 UTC (12 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| jitl wrote:
| I thought the list of packages to uninstall was interesting:
| https://github.com/0x192/universal-android-debloater/blob/ma...
| cf100clunk wrote:
| Similarly, for debloating non-rooted Amazon Fire (Android)
| tablets over ADB:
|
| https://forum.xda-developers.com/t/windows-tool-fire-toolbox...
| Sn0wCoder wrote:
| Awesome thank you!!
| NotPractical wrote:
| This is a step in the right direction for security/privacy, and I
| appreciate the effort, but ultimately you have no real control
| over your device if you are forced to use the proprietary OS that
| came with the phone. (Unfortunately this is the case with most
| Android phones, aside from the Google Pixel series, which allow
| custom versions of Android, like open-source GrapheneOS, to be
| installed.)
|
| Fortunately, as of now, it seems most Android OEMs allow you to
| disable their bloatware with adb, but there's no reason they have
| to allow this, and they could easily block it with a software
| update.
| ignoramous wrote:
| > _disable their bloatware with adb, but there 's no reason
| they have to allow this_
|
| There's a reason. It is Google and its Compatibility Definition
| Document: https://source.android.com/compatibility/ So no: OEMs
| that want to market their phones as running "Android" cannot
| break things as they please.
| NotPractical wrote:
| Can you please link to somewhere it says that OEMs can't
| prevent adb from disabling system apps? They obviously can't
| disable adb entirely (because it's useful to Android
| developers), but they can probably add restrictions on top of
| it.
| Groxx wrote:
| The first entry in their FAQ covers this:
| https://gitlab.com/W1nst0n/universal-android-debloater-
| rs/-/...
|
| > _Q: How is it possible to delete a system package without
| root permission?_
|
| > _A: It 's actually not possible. [more details on what
| can be done and what cannot]_
| ignoramous wrote:
| (disclosure: _I co-develop apps in the android sec /privacy
| space_)
|
| Every device branded as running "Android" _must_ pass
| Google 's Compatibility Test Suite (CTS) [0]. One look at
| the tests suggest that many of the _adb_ commands
| _Universal Android Debloater_ (UAD) [1] relies on are
| infact part of CTS:
|
| - _pm uninstall_ : https://cs.android.com/android/platform/
| superproject/+/maste...
|
| - _pm clear_ : https://cs.android.com/android/platform/supe
| rproject/+/maste...
|
| - _am force-stop_ : https://cs.android.com/android/platform
| /superproject/+/maste...
|
| and so on...
|
| [0] https://source.android.com/compatibility/cts
|
| [1] _adb_ commands used by _UAD_ :
| https://github.com/0x192/universal-android-
| debloater/blob/28...
| kiallmacinnes wrote:
| I don't see anything in there that requires `adb
| uninstall com.sony.foo` to work, for example?
|
| The command should generally work, sure, but that doesn't
| appear to require the command should work for all stock
| package names.
| ignoramous wrote:
| If you are an OEM, you may violate the _spirit_ of the
| CTS at your own expense.
| hagbard_c wrote:
| There are far more Android phones which support AOSP-derived
| distributions. Have a look at the support list for e.g.
| LineageOS [1], it shows 27 brands with 195 models in total.
|
| [1] https://download.lineageos.org/
| NotPractical wrote:
| Most of these devices don't "support" LineageOS though;
| rather, LineageOS supports _them_. As in, they are not
| designed to support custom OSes, but people make it work
| anyway through bootloader unlock exploits and other weird
| hacks, which may introduce security issues. Using hacks to
| install a custom open-source OS might be better than sticking
| with the proprietary one it came with, but ideally your
| device would natively support custom OSes.
| hagbard_c wrote:
| This is not true for many, if not most of the devices on
| that list. You may have to jump through some hoops to
| unlock the bootloader but once that is done installing
| alternative distributions is no more difficult than
| installing a vendor distribution. Have a look at the
| installation instructions (click on a model and follow the
| 'Installation instructions' link in the header) to see how
| things are done for that model.
| NotPractical wrote:
| That may be true, but most of the devices on that list
| are either old or not devices people actually want to
| use. Apple, Samsung, Lenovo (Motorola), and LG combined
| make up 94% of the market share in the US, while others
| make up only 6% [1]. Of these, only Motorola seems to
| allow bootloader unlocking. Samsung locks bootloaders on
| all US smartphones (though international versions
| reportedly aren't locked) and uses proprietary "download
| mode" instead of fastboot mode.
|
| [1] https://www.counterpointresearch.com/us-market-
| smartphone-sh...
| commoner wrote:
| In the global smartphone market, the leading Android
| manufacturers are Samsung (22%), Xiaomi (14%), Oppo
| (11%), and Vivo (10%). Affecting these percentages: Apple
| (17%) and other (26%).
|
| https://www.counterpointresearch.com/global-smartphone-
| share...
|
| Among the named manufacturers, Samsung (excluding U.S.)
| and Xiaomi sell phones with unlockable bootloaders.
|
| In the U.S., OnePlus is the most popular phone brand with
| unlockable bootloaders. Google takes second place.
| hagbard_c wrote:
| Going down the list:
|
| - Apple: next...
|
| - Samsung: supports unlocking the bootloader (enable
| developer options, enable OEM unlock, boot into download
| mode and follow the on-screen instructions for "Unlock
| Bootloader")
|
| - LG: supports unlocking the bootloader (see http://devel
| oper.lge.com/resource/mobile/RetrieveBootloader....)
|
| - Lenovo: supports unlocking the bootloader (see
| https://www.zui.com/iunlock)
|
| - Motorola: supports unlocking the bootloader (see
| http://motorola-global-
| portal.custhelp.com/app/standalone/bo...)
|
| In other words, all devices in your list support
| unlocking the bootloader.
|
| I've used devices from many different manufacturers from
| around 2010 onwards, none of them run vendor
| distributions. It used to be difficult to install new
| distributions but this has not been the case for more
| recent devices. I'm in Europe but often source devices
| from elsewhere since they are not 'officially' sold here.
| NotPractical wrote:
| > Samsung
|
| As I said, bootloader unlocking is not supported on any
| modern US Samsung phone with a Snapdragon SoC. [1] It is
| at least """nice""" that they allow unlocking the
| international models though. (Perhaps the EU legally
| requires this?)
|
| > LG
|
| The site you linked says this:
|
| > we offer a method to unlock the bootloader on _some_ of
| our devices
|
| Looking at the list, we see that many LG phones are
| excluded for some reason. Also, LG doesn't sell phones
| anymore. [3]
|
| > Lenovo/Motorola
|
| That's nice, but unlocking the bootloader requires
| visiting this website, entering your serial number, and
| voiding your warranty, which means most people won't do
| it. Unlocking your Pixel phone's bootloader does not void
| the warranty, and all you have to do is enable "OEM
| unlocking" in developer options, rather than visit some
| website that tries its hardest to convince you that
| bootloader unlocking is scary and you shouldn't do it.
|
| [1] https://forum.xda-
| developers.com/t/3902961/#post-78960111
|
| (Spoiler alert: no, the US model S10 is not unlockable.
| [2])
|
| [2] https://forum.xda-
| developers.com/t/4085447/#post-82345735
|
| [3] https://arstechnica.com/gadgets/2021/04/after-a-
| decade-of-fa...
| cute_boi wrote:
| Well EU is one reason to not unlock the phone. Due to
| their law banking app requires some google safety net
| which means if we root our phone our bank app wont work.
| And many app which uses safety net might not work. (I
| know magisk might make it work but its icky when the
| opponent is Google).
|
| Regarding unlocking I think Chinese phones like Xiomi,
| Oneplus are better. We just need to provide phone number
| (so that distributor can't abuse it so I think its fair)
| and using fast-boot we can unlock it. And we can go back
| if we want so AFAIK warranty doesn't gets void due to
| unlocking as long as we can re flash stock firmware.
|
| Pixel phones are also better for unlocking but they come
| with premium price.
| cmeacham98 wrote:
| Unlocking your phone does not fail safetynet. Installing
| a custom ROM _can_ cause a safetynet failure, but it is
| possible for ROM developers to pass it. In other words,
| for most phones, safetynet shouldn't be a major barrier
| to unlocking.
|
| Rooting, on the other hand, does trip safetynet unless
| you take extra steps to hide it.
| NotPractical wrote:
| Tragically, Google is gradually moving to hardware-backed
| attestation, which is nearly impossible to bypass in most
| cases: https://www.xda-developers.com/safetynet-hardware-
| attestatio...
|
| SafetyNet is, of course, anti-user and unacceptable.
| Random developers on the Play Store have the audacity to
| demand that you use a Google-approved OS on your phone if
| you want to use their apps. But "Google-approved" just
| means "proprietary". For example, GrapheneOS is leaps and
| bounds more secure than any Samsung ROM, yet Samsung's
| ROMs are Google-approved, and GrapheneOS is not. Google
| also releases vanilla AOSP builds for Pixel phones
| without Google apps, but these are not "Google-approved"
| according to SafetyNet, either.
|
| Besides, no corporation should get to influence what OS
| you choose to run on your device. As the user, you should
| make the decision whether to trust a custom OS or not on
| your own. That's how it works on PCs. You are warned of
| the risks at every stage of the process of installing a
| custom ROM, from the moment you enable "OEM unlocking" in
| developer settings. You're even greeted with a non-
| hideable warning to remind you that the OS is not OEM
| every bootup [1]. (I think this is good, by the way. It
| also protects those buying used phones, which is another
| silly argument I've heard in favor of SafetyNet. IMHO, if
| you continue using a phone that warns you every bootup
| that it's unsafe, you deserve to be hacked.)
|
| Google says they're doing all this for the sake of user
| security, but I find it very suspicious that it also
| happens to make de-Googling your phone much harder (if
| you rely on apps that rely on SafetyNet, like most
| Android banking apps).
|
| [1] https://source.android.com/security/images/boot_yello
| w1.png
| shaicoleman wrote:
| If you have a rooted phone, you can try to use Magisk
| Hide. That worked for me on various banking apps (but not
| Google Pay).
|
| An alternative solution is to use another device with the
| stock ROM (e.g. an older/used/slightly-cracked phone) for
| banking purposes. Then it can be locked down to reduce
| the attack surface (e.g. uninstall non-banking apps,
| stored in a secure place, bluetooth disabled, remove SIM,
| turned off when not in use, etc.)
|
| An older device may not have the latest OS security
| updates, but it'll still be reasonably secure if you
| reduce the attack surface. Most of the exploitable
| security issues will be updated via the Play Store, and
| due to the Android's heterogeneity and security
| protections, OS/driver vulnerabilities are difficult to
| exploit.
| White_Wolf wrote:
| excuse the pun but it's not practical to support some
| devices if the manufacturer keeps placing road blocks.
| THeya re simply not worth the effort when there are so
| many great options that make it easy to unlock and flash.
| Some even give you unbrick tools in case you kill the
| bootloader.
|
| If you want a devices that can be easily customized, just
| buy one of the ones that have the OEM unlock option in
| the dev menu. For power users, those are the only ones
| worth buying and supporting.
|
| Vote with your wallet.
| yyyk wrote:
| >> LG ...
|
| >Looking at the list, we see that many LG phones are
| excluded for some reason. Also, LG doesn't sell phones
| anymore.
|
| Err. You mentioned LG earlier ("Apple, Samsung, Lenovo
| ... and LG combined"). Now, you complain that they
| shouldn't have been mentioned because they don't sell
| phones anymore? That's just your list.
| NotPractical wrote:
| I pulled the OEM list from the source of the percentages
| that I cited. Also, I am not "complaining" about
| anything; I am simply sharing information. I can see how
| it could be interpreted this way, so if I could edit the
| comment, I would probably change it to something like "by
| the way, LG doesn't sell phones anymore".
|
| Here's something else I said:
|
| > most of the devices on that list are either old or not
| devices people actually want to use.
|
| Since LG doesn't make phones anymore, all of their phones
| on the LineageOS list qualify as "old". This is what I
| was getting at; it doesn't matter much that they used to
| make _some_ phones with unlockable bootloaders because
| they will soon be obsolete and the market share
| percentage will creep further and further down until it
| joins the "others".
| axiolite wrote:
| > but unlocking the bootloader requires visiting this
| website, entering your serial number, and voiding your
| warranty, which means most people won't do it.
|
| Now you're just moving the goal posts...
|
| With all listed phones, you are NOT "forced to use the
| proprietary OS that came with the phone", and they all
| "allow custom versions of Android, like open-source
| GrapheneOS, to be installed". Those are your words.
|
| It's also rather banal to go through a list of supported
| phone models, reduce that list to just the brands, and
| then complain that not all phones from each of the brands
| are supported.
|
| > Most of these devices don't "support" LineageOS though;
| rather, LineageOS supports them.
|
| That's usually how a "custom open-source OS" works. It's
| not as if Google "support" the open source OSes that they
| allow you to install on their Pixel devices, either.
|
| Go buy a Pixel if you want to, just stop spouting off
| that they're the only phones that give you options when
| they clearly are not. Hell, some of the non-Google phones
| LineageOS supports have SD card slots and easily swapable
| batteries, which is the kind of freedom Google never
| offers with their phones.
| causi wrote:
| Yes. Depending on what features are important to you,
| choosing an android phone can be quite difficult,
| especially if you're on a whitelisted-only carrier like
| Verizon and AT&T that only activate certain models and
| completely rule out major brands like Xiaomi.
___________________________________________________________________
(page generated 2021-10-30 23:01 UTC)