[HN Gopher] Asus refunds Zenfone buyer for failing to provide bo...
___________________________________________________________________
Asus refunds Zenfone buyer for failing to provide bootloader unlock
tools
Author : kirenida
Score : 220 points
Date : 2024-04-06 11:16 UTC (11 hours ago)
(HTM) web link (www.androidauthority.com)
(TXT) w3m dump (www.androidauthority.com)
| Rinzler89 wrote:
| _> Given that ASUS has one of the worst software support
| commitments in the Android world [...] It started removing posts
| about bootloader unlocking in its ZenTalk forums._
|
| Which is why I never understood why Asus Zenfone kept being
| recommended on HN all the time when people asked for good android
| phones to buy. I thought this community appreciated long SW
| support. I think the people recommending it were not dogfooding
| it.
|
| Why not go for something that has 5-7 years of SW updates like a
| Pixel or a S-series? The Zenfone wasn't any cheaper than those
| either(at least in EU) so you were also getting a poor value for
| money.
| esalman wrote:
| Tbh I don't share the sentiment that the community appreciates
| long SW support. Otherwise we'd see Windows being recommended
| over Linux more often.
| throwaway11460 wrote:
| This is more about device support for updated OS, which any
| PC does. Especially with Linux, unlike Windows 11 that can't
| be installed on older PCs without some hacks.
| jethro_tell wrote:
| Lol, I guess Linux did just drop 386 and 486 a couple years
| ago.
| HansHamster wrote:
| You mean Microsoft Windows which dropped support for Zen 1
| with Win11 not even 5 years after Zen 1 was released?
| Meanwhile, Linux will still run on a 30+ year old CPU...
| shepherdjerred wrote:
| Isn't Windows 10 still supported?
| shepherdjerred wrote:
| I looked into it. Consumer installs of Windows 10 have
| updates until 2025.
|
| https://en.wikipedia.org/wiki/Windows_10#Support_lifecycl
| e
| skinner927 wrote:
| They said software support, not hardware support.
|
| You can take a win 95 gui app and run it on windows 10
| without issue. You can't do the same on Linux.
| Rinzler89 wrote:
| Pretty much.
|
| For the sake of nostalgia, I downloaded an Encarta 2000
| ISO form Internet Archive, then spun up a Windows 98 VM
| to run it on but that VM had a lot of sound issues in
| Virtual Box, then I realized that Encarta would also run
| just fine installed on Windows 11 lol.
|
| This kind of backwards compatibility is not something I
| need on a daily basis but it's pretty neat that I can
| just run very old SW on my main OS without fiddling with
| VMs.
| yjftsjthsd-h wrote:
| In context, it looks like they meant software updates,
| which is closer to what your calling hardware support.
| yndoendo wrote:
| This is not 100% true. Some legacy Windows software does
| not run on current Windows. Never got Slave Zero running
| on Windows XP or Windows 2000 after upgrading from
| Windows 98 & ME. https://en.wikipedia.org/wiki/Slave_Zero
| dangus wrote:
| Windows 10 support continues until October of 2025. Zen 1
| will be 8 years old at that point.
|
| It's pretty much guaranteed that Microsoft will add an
| extended support period to windows 10. Windows 7 just left
| extended support last year.
| dns_snek wrote:
| It's really not the same kind of support. We get plenty of
| active support and development in the Linux world, and open
| source more broadly.
|
| Windows only offers essential life support, trying to ensure
| that something written 20 years ago still runs today, despite
| being completely abandoned for 19 years with no reasonable
| way of fixing it.
| jsheard wrote:
| The Zenfones mainly carved out a following because they're the
| smallest flagship-tier Android phones on the market. Asus has
| terrible support, but if you want a small-ish device there
| isn't a great deal of choice nowadays.
| as1mov wrote:
| Indeed, today if you want a phone that isn't gigantic the
| options are really limited. Zenfone also had benefit of being
| quite sturdy since the back wasn't made from glass/metal, so
| you can go without a protective case. I have dropped mine a
| couple of times, but it hasn't suffered any damage until now.
| yxhuvud wrote:
| You can go without protective shell, but it is so slippery
| you want one just to avoid airborne phones.
| mablopoule wrote:
| Also, it's one of the rare remaining flagship-tier phone who
| still allows headphone jack, which is the main reason why I
| bought a Zenfone last year.
| praisewhitey wrote:
| >they're the smallest flagship-tier Android phones
|
| They're the same size as the Galaxy S series
|
| https://phonesized.com/compare/#2261,2398
| Audiophilip wrote:
| Does the Galaxy S series have headphone jacks as well?
| magnio wrote:
| No, but can't you use a USB-C earphone?
| Uvix wrote:
| Not while charging.
| dangus wrote:
| USB C to 3.5mm Headphone and Charger Adapter, 2-in-1 USB
| Type C to Aux Jack Dongle Cable with PD 60W Fast Charging
|
| $8.99
|
| I like headphone jacks too but I'm not going to pretend
| that this isn't a solved problem.
| rrix2 wrote:
| Yeah I bet that 9$ widget definitely won't induce audio
| quality issues while you pump 60W through it...
| punchmesan wrote:
| For some people, the ability to use wired
| headphones/earphones while charging has a lot of value.
| Additionally, some invest in quality earphones or IEM's
| and replacing those with the lower-quality limited
| selection of USB-C earphones is not desirable. Likewise
| with Bluetooth.
|
| The 3.5mm audio connection is nowhere near dead yet.
| jsheard wrote:
| FWIW for IEMs with detachable cables, which pretty much
| all of the good ones do, you can get replacement USB-C
| cables now. That has the advantage of decoupling the
| sound quality from the highly variable quality of the
| phones internal DAC since the DAC is instead part of the
| cable, and some of those cables even have configurable
| hardware DSP features. It doesn't solve the charging
| problem though.
| yjftsjthsd-h wrote:
| That's more expensive and less convenient.
| Rinzler89 wrote:
| _> The Zenfones mainly carved out a following because they're
| the smallest flagship-tier Android phones on the market._
|
| They're literally the same dimensions as the basic Samsung
| S23, which was cheaper than the Zenfone as had better SW
| updates.
| as1mov wrote:
| Asus allowed bootloader unlock up until a few months ago, which
| is why I bought the device, i.e even if the company abandons it
| I can just unlock the bootloader and slap on LineageOS on it.
| Seems like a mistake now.
|
| > Why not go for something that has 5-7 years of SW updates
| like a Pixel or a S-series? The Zenfone wasn't any cheaper than
| those either(at least in EU) so you were also getting a poor
| value for money.
|
| SW updates aren't the only criteria when choosing a device, if
| you're looking for a small phone with a headphone jack and a
| non-glass/metal back, the number of options are very limited
| (iirc, Zenfone 9 is literally the only phone which satisfies
| the constraints).
| Hendrikto wrote:
| > Why not go for something that has 5-7 years of SW updates
| like a Pixel or a S-series?
|
| Or an iPhone. People love to hate on Apple, but they actually
| support their devices.
| luuurker wrote:
| On top of the iOS restrictions vs Android, an iPhone comes
| with a set of constraints that the type of user that cares
| about bootloader unlocking doesn't want to deal with. From
| apps that are not on the store to custom ROMs that have
| features that the stock OS doesn't have... iPhones are
| terrible for this.
|
| iPhones are good, but in this case it's a bit like
| recommending a Chromebook to someone that is used to build
| their own computers and runs linux.
| sfmike wrote:
| what good is SW updates on a pixel that can't even get cellular
| connectivity
| cbarrick wrote:
| Honestly, I switched from Pixel to Zenfone for the form factor.
|
| Ever since the visor redesign with the Pixel 6, the Pixel
| series has been too big for my hands.
|
| I do miss the great Pixel software though...
| pohuing wrote:
| Same thing here. Zenfone android is similar to pixel android
| while I find Samsung's android insanely ugly. I just miss
| some of the Google app integrations
| spuz wrote:
| It's not clear whether a standard refund is an option for buyers
| whose phones are still under warranty. Did Timothy try that
| before going to small claims court?
| clementmas wrote:
| The refund is probably not worth the time spent building the case
| but it sends a valuable message. Keep your promises.
| xyst wrote:
| I would be surprised if Asus even sends a lawyer to defend
| against small claims.
|
| Might be better to form a class action.
| avianlyric wrote:
| If this went down the small claims track in the UK then ASUS
| wouldn't bother with a lawyer because you're not allowed to
| reclaim legal costs in the small claims court. So unless ASUS
| thinks they're gonna see a flood of similar claims happening,
| then the cost of a lawyer would probably be triple the cost
| of settling, or even winning the case.
|
| Also class action cases are very rare in the UK. In the past
| the courts have generally refused to approve class action
| cases. It not like in the U.S. where there's a cottage
| industry around class action cases. I've personally never
| heard of a class action case happening in the UK, I know they
| do happen, but they're so rare that they don't make it into
| the news, and most people will never involved in one either
| directly or indirectly.
| kadoban wrote:
| > I would be surprised if Asus even sends a lawyer to defend
| against small claims.
|
| Wouldn't that be a good reason to do small claims? I can't
| imagine why I'd want to wait for years in a class action when
| I can just do a small claims.
| bxparks wrote:
| I would bet that neither small claims or class action is
| possible in the US because ASUS has a forced binding
| arbitration clause in their End User Agreement that almost no
| one read when they activated their phones.
| avianlyric wrote:
| There probably wasn't much time spent building the case.
| Generally solicitors aren't involved in these cases because
| it's not possible to reclaim legal costs, regardless of who
| wins. Instead most people just represent themselves, and
| companies will often just send a local manager to represent
| them. So super low stakes legal process, where in the worst
| case scenario your out of pocket for the filing costs (PS70)
| plus reasonable expenses for the other party (travel costs,
| lost earnings etc) which are all tightly capped, so unlikely to
| more than another PS100-PS200.
| sn0wtrooper wrote:
| Long is gone the time where unlocking bootloaders and installing
| custom ROMs was the best path to follow. Even if you are able to
| unlock it (with difficulties such as this one, or others that
| involve opening the device and soldering a shortcut), you will
| have a device where apps check for unlocked bootloaders and
| rooted OS, and forbid you from use the application.
| jMyles wrote:
| > Long is gone the time where unlocking bootloaders and
| installing custom ROMs was the best path to follow.
|
| ...wha? I just installed GrapheneOS on my Pixel 8 Pro and it
| is, by a decent margin, the best custom ROM experience on a
| phone I've had to date.
| encom wrote:
| >GrapheneOS
|
| This was not a project I expected to use Discord for support.
| Sad.
| asdp9iujaspid wrote:
| https://grapheneos.org/contact#community
|
| > Our chat rooms are bridged across Discord, Telegram and
| Matrix so you can choose your preferred platform.
|
| > We have an official forum for longer form posts, which is
| publicly accessible and easier to search. We are using
| Flarum for our forum.
|
| https://discuss.grapheneos.org/
|
| If they mandated discord as a closed support community
| sure, but you can't be too upset by the mere affiliation
| with a discord channel when they also offer all the above
| encom wrote:
| I'm just disappointed that they associate with Discord at
| all, given that it is the antithesis of privacy and
| Freedom.
| pulpfictional wrote:
| The focus is security. Be disappointed in all the other
| free platforms that cannot provide adequate moderation or
| stability.
|
| Do you happen to know a suitable alternative?
| cqqxo4zV46cp wrote:
| I'm disappointed that you associate with Hacker News
| given the (presumably) myriad anti-Freedom anti-privacy
| startups Y Combinator has funded.
| udev4096 wrote:
| If I remember correctly, their matrix channel was flooding
| with spam and abuse which was primarily coming from Calyx,
| which by the way is an terrible OS. Even a stock OS would
| perform marginally better in terms of security than CalyxOS
| npteljes wrote:
| I have it on my Pixel 7a, and it's a great experience, but I
| also don't need to run apps that check for phone "security"
| or integrity. This is the case OP is talking about.
|
| https://grapheneos.org/usage#banking-apps
| arsome wrote:
| Largely depends on your priorities and level of effort.
|
| You can bypass all current app checks using Magisk and Play
| Integrity Fix, but it's a bit of work to maintain and can break
| occasionally. You gain in this case full control of your device
| like a desktop OS, block ads, modify app behavior, disable
| unwanted system features, but you have to put in effort to
| maintain it.
|
| However if you don't want to deal with that, you can also just
| not use those apps, use it like you would a Librem or
| PinePhone, load primarily open source software to it,
| optionally don't even bother with play store, etc. Might not be
| for everyone, but if you don't care that much for Google Wallet
| or multi-player games on your phone, it's not a bad option.
| BizarreByte wrote:
| > but it's a bit of work to maintain and can break
| occasionally.
|
| Which is a major problem because my tolerance for my bank's
| app not working when I open it is so low it might as well be
| non-existent.
|
| I personally gave up this fight.
| rkagerer wrote:
| Or switch banks and stop fighting.
| mike256 wrote:
| I just switched to another bank. No one should accept
| apps with such checks.
| franga2000 wrote:
| It sure isn't what it used to be, but if you buy the right
| phone and make a few moderate compromises, it's still a great
| option.
|
| Installing crDroid on my OnePlus 9 Pro took half an hour,
| another half to install Magisk Delta with a few modules. The
| universal dark mode alone (Xposed module "DarQ") is worth the
| effort, but also the ability to clone apps, have proper
| clipboard sync, make full-system backups and customise the look
| and functions of my OS to a currently unparalleled degree.
|
| The only compromise is I can't seem to be able to do NFC card
| payments (send or receive), one of my 4 banking apps needs a
| custom patch every few months to start working and a friend
| tells me the McDonald's app doesn't work.
| freedomben wrote:
| Do you keep a factory image for your OnePlus 9 pro in case
| you want to restore it? If so, how do you go about doing
| that?
|
| After OnePlus decided to stop publishing factory images, I
| decided to stop buying their phones. It's a real shame,
| because they really do make some great stuff and prices are
| quite reasonable generally speaking. I used to buy a new
| OnePlus phone nearly every year. The OnePlus 6 was one of my
| favorite phones of all time.
| franga2000 wrote:
| I wasn't aware they stopped publishing them so I didn't
| back it up, but I can't say I really care for my use case.
| The only reason I'd need it is to resell the phone, but my
| plan is to use it until it's either broken beyond repair or
| backporting new Android versions becomes impossible, at
| which point nobody would buy it anyways.
|
| I agree the OP6 is great (my girlfriend is still using
| hers), but I was still on my OP 3 like a year ago, until
| future ROM updates were deemed impossible thanks to
| Qualcomm binary blobs.
|
| It's a real shame it's all over now. The OP 9 Pro was the
| last OnePlus phone made in their old way (or close to it) -
| not too expensive, well built, close to stock ROM, easy to
| reflash, decently repairable. Hopefully it lasts me as long
| as the 3 did because currently I don't see anything else
| like that on the market.
| boneitis wrote:
| I might have my hardware/software/firmware components (or
| your argument) mixed up and conflated. Does Oxygen Updater
| not source from published images?
|
| https://oxygenupdater.com/article/438/
|
| Yes, I am still on my beloved OnePlus 6 running Lineage and
| had been looking around for a used 7 or 8 for 5G capability
| (I'm a bit sketched out by the overall throttling hoopla of
| 9th gen). Perhaps it's time to expand the search beyond
| OnePlus.
| ktosobcy wrote:
| Eh... that's why I'm pondering going back to OnePlus (after
| short affair with Samsung for the past 2 years) because it's
| somewhat annoying not being able to tweak stuff...
|
| Alas, it's also annoying that some dumb banks (I'm looking at
| you ING Poland) consider rooted device as "insecure" but thay
| have no problem if I open a bank page using admin/root
| account on the computer)
| iggldiggl wrote:
| > I'm looking at you ING Poland
|
| Hmm, funnily enough at least a few years ago German Ing-
| Diba didn't care about rooted phones. I switched banks at
| some point though, so I have no idea whether that's still
| true.
| ktosobcy wrote:
| It's only a brand, there is almost nothing in common
| between local branches.
|
| As for ING - about 4-5 years ago it was possible to spoof
| the check but about 3 years ago they went full bonkers
| and if you didn't get the app from playstore (so for
| example aurora) it refused to launch...
| Semaphor wrote:
| If you root, you can bypass those issues in most cases. I have
| 3 apps detecting it, that I can bypass, and only the German
| health insurance app from TK detects it (according to the
| internet, it's getting past most solutions somehow). It's not
| something I'd recommend the average person, but for people who
| care enough to fiddle, it's still the best way.
|
| I think since my first Android (HTC Desire Z/T-Mobile G2) I
| spent a total of 1 week on stock, never was a fan of any of
| them.
| ac130kz wrote:
| Stock ROMs are still filled with ads and useless extras, rarely
| providing meaningful features over an AOSP like LineageOS.
| myself248 wrote:
| Huh.
|
| I guess I must not run any of those apps?
| nimbius wrote:
| the only app ive seen balk at bootloader status (to date) is
| google wallet. Using a phone to pay for stuff is an opsec
| nightmare youd only entertain so long as becoming an integrated
| and saleable asset in a data brokers portfolio is a life goal.
| 'pm uninstall' and move on, the custom rom is still far more
| valuable from a security perspective than bending the knee to
| some bespoke ecosystem payment app (especially if you have an
| older device.)
|
| the point of oem unlock, and rooting at all, is diametrically
| opposed to the vendors interest in nearly every facet. The
| vendor will bark "hackers" as a thinly veiled threat for the
| uninitiated, but we _are_ initiated. what the vendor doesnt
| need you doing is erasing their telemetry and walled garden
| spyware. they dont need you developing alternatives to their
| store and to their apps, and they especially dont need you
| turning this effort into something as simple as an ubuntu
| installation for older phones they expect to follow the strict
| trade-in model of "buy a new phone every year"
|
| arguably Asus refunded the purchase because this person isn't
| playing by the rules and being a good consumer.
| lxgr wrote:
| > Using a phone to pay for stuff is an opsec nightmare
|
| Do you mean "privacy nightmare"? Security-wise, Google Pay
| beats using your physical card since it uses a device-
| specific number that can't be skimmed by terminals and reused
| online.
|
| > the custom rom is still far more valuable from a security
| perspective than bending the knee to some bespoke ecosystem
| payment app (especially if you have an older device.)
|
| I'd argue that it only makes sense if you have an older
| device that's otherwise not receiving any more security
| updates.
| kaszanka wrote:
| AFAIK it only beats magnetic stripe cards, not EMV chip
| cards
| lxgr wrote:
| EMV chip cards still contain your card number and expiry
| date.
|
| Skimmers would need a way to also learn the CVC2 from the
| back of the card to use it at most (but not all!) online
| merchants, but that's feasible using a small camera or a
| waiter/cashier accomplice doing the skimming.
|
| With Google Pay and Apple Pay, and similar mobile
| wallets, that number is never shared during payments (and
| in fact not even stored on the device).
| jjmarr wrote:
| They do, but you can't get the card number from reading
| the chip. The protocol is a challenge-response one based
| on a private key stored within the chip.
|
| https://en.wikipedia.org/wiki/Chip_Authentication_Program
|
| You need to read the entire card number + cvc2 + expiry
| date with your camera. That's not skimming, that's just
| taking a photo of the card.
| worewood wrote:
| Yeah, and it's easily solvable with a sticker or a dremel
| to scrape the number off
| lxgr wrote:
| You can't dremel it out of the chip, though.
| lxgr wrote:
| No, you can most certainly get the card number and expiry
| via the chip and even over contactless, as it's a vital
| part of transaction routing/processing. There are Android
| apps that can do it.
| jjmarr wrote:
| If I could I'd delete my original comment since I did
| more research and you're right.
|
| https://stackoverflow.com/questions/14861908/apdu-
| command-to...
| M95D wrote:
| Any responsible user will learn the CVC, like any other
| password, and then erase it from the card.
| lxgr wrote:
| That seems like a lot of extra effort for something
| that's arguably not your opsec problem, but that of the
| card payment industry.
|
| In the end, you'll always have to enter it on payment
| websites anyway.
| didntcheck wrote:
| I can certainly remember mine from repeated use, but I
| can't say I've ever heard of someone erasing it
| catlikesshrimp wrote:
| I have done it since many years ago
| cqqxo4zV46cp wrote:
| Your claim that using a smartphone for payments is a
| privacy(?) nightmare sounds quite baseless.
|
| The more pertinent factor is probably the fact that you're
| using an operating system built by an advertising company.
| jjmarr wrote:
| I'm in Canada and I can literally just tap the card itself on
| the reader. Every card has this ability and it can't be
| skimmed.
| SanDiegoSun wrote:
| There are many demonstrations of contactless cards being
| "skimmed."
|
| Unless you store it in a wallet with a faraday cage, this
| is a laughable opinion to express.
| paulryanrogers wrote:
| Bank apps, Netflix, and Disney+ also won't work. There are
| spoofing measures though I've been burned by unlocking and
| rooting too often to try again, at least not while my devices
| are still under warranty.
| mmh0000 wrote:
| My solution
|
| * use bank website for the one bank that requires it,
| otherwise I got a new bank account without silly fake
| security.
|
| * thepiratebay has everything Netflix and Disney does and
| it works anywhere
| catlikesshrimp wrote:
| I always use websites when possible instead of installing
| yet more spyware disguised as a useful app. My bank,
| however, has the TOTP built in the app. You can't make a
| transaction without the phone app connected to the
| internet.
| luuurker wrote:
| Magisk + a few modules and most apps should work. The
| warranty part, this depends a lot in the country, but at
| least in Europe I don't think they can deny repairs just
| because you unlocked the bootloader.
| zamalek wrote:
| > where apps check for unlocked bootloaders and rooted OS
|
| Magisk and PINE[1] have solved this for me. Yes, even Google
| Wallet is all good with my LineageOS ROM. PINE is an auto-
| updating PIF.
|
| [1]: https://github.com/daboynb/PlayIntegrityNEXT
| yooastan wrote:
| This is untrue, I do this now with my Pixel and have to no
| issues.
| ravenstine wrote:
| This is rubbish. I'm running GrapheneOS and have left my
| bootloader unlocked, and there's no app that has refused to
| work. The only caveat is some of them need Google Play
| services. No, I am not rooted, but my last phone was rooted and
| there might have been one or two apps out of dozens that
| wouldn't work with root even with Magisk trying to hide the
| root status. Using a custom ROM is easily one of the beat
| choices I have made.
| Fire-Dragon-DoL wrote:
| What are the downsides with GrapheneOS? I had a few problems
| with root (Netflix and banking apps) but would love my
| privacy. My main reason for root is the firewall to block
| outgoing connections from apps that are not supposed to do it
| 0xcde4c3db wrote:
| It's really a downside of the Google app ecosystem and not
| GrapheneOS _per se_ , but apps requiring higher levels of
| integrity per Google attestation (Play Integrity/SafetyNet)
| generally won't work. Intentionally breaking apps on
| "untrusted" configurations is basically the point of that
| feature, and GrapheneOS does provide the relevant services,
| but would need to be specifically enabled by the app
| developer.
| Fire-Dragon-DoL wrote:
| So Netflix and such DO NOT work on phone? That's really
| frustrating
| udev4096 wrote:
| Firewall wouldn't be necessary with GrapheneOS. There's a
| network toggle which you can use to completely cut off
| internet access for an app. As for the downsides, I would
| say close to zero. It feels just like a stock OS, without
| any kind of bloatware and a lot more secure
| ThePowerOfFuet wrote:
| GrapheneOS is not rooted, so you won't have those issues.
|
| GrapheneOS also gives you a Network permission per-app; if
| you uncheck it, the app has no connectivity, period.
|
| Highly recommended.
| Fire-Dragon-DoL wrote:
| Based on the other comment thread, it seems like Play
| Integrity and SafetyNet do not succeed and as such, can't
| really use Netflix, is that correct?
| switch007 wrote:
| No NFC payments with Google wallet.
|
| You can get unlucky with your bank app but someone
| maintains a wiki of compatible banking apps
|
| Android auto works OK.
| nebulous1 wrote:
| Do you use a banking app? Last I read depending on the type
| of check used some apps can still be problematic.
| zerreh50 wrote:
| Same with McDonald's, interestingly enough
| iforgotpassword wrote:
| So I guess next thing we need is someone sueing the fucking
| banks that do that. Mine luckily doesn't because I
| explicitly use an old phone with LineageOS, the banking
| app, and _nothing else_ on it for online banking. It 's
| arguably way more secure than using your main phone with a
| bazillion other Apps installed and online at all times.
| eganist wrote:
| How would that stick? You can just sign into the bank via
| your web browser in the case of a nonfunctional app. The
| apps just give you added security assurances beyond using
| the web.
|
| "The app can't function in a low security environment,
| but complainant is free to use the web client in such
| event." case dismissed
|
| (obviously an oversimplification, but the point stands)
| erinnh wrote:
| This is definitely not the case everywhere.
|
| Where I live the app is 100% needed because it's the
| ,,second factor" in the login process.
| The_Colonel wrote:
| There has to be a fallback like SMS and/or automated
| call.
| akvadrako wrote:
| For my banks the only fallback is a hardware device that
| you put your card into. Before the app you had to carry
| this everywhere when traveling to do online banking.
| Too wrote:
| SMS is magnitudes less secure than the Secure Enclave in
| my phone.
|
| Fallback should never be the weakest link in a security
| chain. Especially not in something as high stakes as your
| banking login.
|
| I can't remember how I got my first bank token in my
| phone. Probably by physically showing up in the bank
| office with my id.
| didntcheck wrote:
| Agreed. Unfortunately almost every bank here forces me to
| use this less secure option "for security" due to my
| rooted phone. Not one has just offered standard TOTP
| (perhaps because the pull-only nature of it means they
| can't present the message explicitly telling the user
| what they're about to authorize. Which is an
| understandable qualm I guess)
| eganist wrote:
| > SMS is magnitudes less secure than the Secure Enclave
| in my phone.
|
| The secure enclave on a rooted phone that no longer has
| execution integrity?
| The_Colonel wrote:
| SMS 2FA is not great, but still seems to be more secure
| than a rooted phone.
|
| If your SMS OTP leaks to the attacker, they still need to
| know the first factor (password, biometrics) to gain
| access.
|
| Meanwhile, if your rooted phone is controlled by an
| attacker ... that's it, the attacker has everything.
| Too wrote:
| Fair. I still wouldn't want to have such a fallback
| available by default. Being stronger than an even worse
| option doesn't change that. Because it eliminates the
| security of the strongest option.
| eganist wrote:
| Curious, can you name this institution that only allows
| the app to be used as the second factor without
| fallbacks?
| iforgotpassword wrote:
| In Germany: all of them.
|
| Well, some offer a hardware device for like 25EUR that
| can do the same thing, but then if you have an account
| with multiple banks, you need multiple of these devices.
| oarsinsync wrote:
| There are app-only banks too. Some of them provide a web
| interface, but it depends on the app to sign you into the
| web interface (similar to the way whatsapp requires you
| to use the app to sign into whatsapp web).
|
| What happens when you primary bank has been one of these
| app-only banks for the last 5 years, and you decide to
| make a technology change to your phone, and can now no
| longer get into your banking app?
| realusername wrote:
| When you reject GrapheneOS, the most secure mobile OS on
| the planet but accept a no-name chinese ROM I feel like
| that you can't invoke security reasons anymore.
| Too wrote:
| Signing transactions usually take you back to the 2FA app
| here, where the amount and receiver is repeated.
|
| Even if someone hijacks my computers web browser, the
| worst they can do is see my statements, any attempt to
| transfer out will pop up a prompt in the phone.
| iforgotpassword wrote:
| The app is for 2fa.
| udev4096 wrote:
| It's far from secure. You are using an outdated phone,
| which hasn't received any kind of firmware or vendor
| security patches in a while. And as far as I remember,
| LineageOS doesn't support relocking the bootloader which
| further reduces the overall security of your phone
| didntcheck wrote:
| A lot of this actually seems to have come _from_ recent
| regulatory pressure for 2FA (which I support in
| principle, don 't get me wrong). I don't even think most
| of them have given much thought to rooted phones, rather
| they're just cargo culting Industry Standard Best
| Practices and turning all the device verification options
| to max. Luckily, most of them realize they still have
| customers without a compliant smartphone, or one at all,
| and offer a fallback, which is almost always SMS...
|
| Though you get those newer "app only" banks. I've never
| used any since I see that as a major downside, not a
| selling point, so idk whether they tolerate root. Even
| with traditional banks, I've come across a few features
| which can only be accessed via the phone app - in this
| case likely due to the belief that "web? Everyone just
| uses apps!" rather than security
| vidarh wrote:
| Yeah, my bank app both did not work with rooted phones,
| last I checked, _and_ they also appear to whitelist phone
| models or something - at one point I had an uncommon mid-
| range Chinese phone and I had to contact support to have
| them approve my phone.
| jiminymcmoogley wrote:
| For UK banks on my Graphened Pixel 6a I can use the apps
| for HSBC, First Direct, Barclays, NatWest, RBS, Co-
| Operative Bank and Metro Bank with no issues, and have only
| had trouble with the Lloyds Bank app as of an update from
| maybe 2-3 months ago which throws an error saying they've
| detected I'm using a jailbroken/rooted device
| White_Wolf wrote:
| I get a message that the device is not secure but I can
| still make transfers and such from the banking app on a
| rooted OP9Pro. Never tried to use NFC payments though.
| doublerabbit wrote:
| Try using Monzo or Sterling.
|
| Both will nail you to the ground.
| baby_souffle wrote:
| > Do you use a banking app? Last I read depending on the
| type of check used some apps can still be problematic.
|
| It's important to distinguish between banking app and
| payment app. If you just want to check your account balance
| or find an ATM, the banking app will probably not mind that
| you're on a device that can't pass integrity checks.
|
| If you want to use your phone's NFC to pay for coffee,
| though, you're going to have a bad time.
| Xfx7028 wrote:
| I use N26, Revolut, ING, and others. No issues, I just add
| the apps I need to the magisk hide list. I also use NFC
| payments. Only Google wallet does not work.
| ravenstine wrote:
| Yes. Wells Fargo, Discover, Alliant CU, Venmo, Paypal, and
| M1 Finance all work.
| didntcheck wrote:
| Also many "corporate" things, usually depending on your
| org's policy. E.g. I can't run OpsGenie (it may actually be
| the Microsoft SSO step failing, I'm not entirely sure, but
| the error definitely mentions my device not meeting
| security policies)
| collegeburner wrote:
| what? safetynet is absolutely a pain in the ass. i think
| there are some xposed and magisk modules or whatever that can
| work around it but that's a cat-and-mouse thing and can
| break. lot of bank and financial apps, lot of stuff with DRM
| will break.
| udev4096 wrote:
| GrapheneOS is not a ROM. It's an OS.
| jstanley wrote:
| What's the difference?
| ThePowerOfFuet wrote:
| You should not leave your bootloader unlocked if you care
| about the security of your device and data.
|
| Unfortunately, locking (and unlocking) it wipes user data, so
| it should be relocked right after installation of GrapheneOS.
| ravenstine wrote:
| I acknowledge that.
| didntcheck wrote:
| Don't most phones only wipe on _un_ lock?
|
| Also can Graphene still update if the bootloader is locked?
| NayamAmarshe wrote:
| With KernelSU, this is no longer the case. It's Magisk that
| causes most problems.
| DoneWithAllThat wrote:
| The article casually refers to Asus breaking "their promise" but
| nothing in the rest of the article suggests Asus ever promised
| anything of the sort. That they used to provide the tools wasn't
| a promise. Did they ever advertise or up-front communicate that
| these tools would be made available and maintained?
| dangus wrote:
| It doesn't matter because my guess is Asus couldn't be bothered
| to show up to small claims court over $900.
| Knork-and-Fife wrote:
| A lot of the zenphone series had bootloader unlock as a listed
| feature which was then removed when they disabled and took down
| the tool. The Zenfone 10 was advertised as going to have the
| feature as well before and even after the launch for a bit.
| Asus claimed that the tool was coming at several points but the
| date in their promises kept getting pushed back and eventually
| turned into we don't know and now it appears to be never. This
| is stuff that was in writing from them, search it up, but
| you'll need to check the Internet archive for the info that
| they've removed from their own sites (like the repeated pushing
| and cancelling of the return of the unlock tool)
| luuurker wrote:
| Asus even used to send free phones to developers over at XDA
| Developers so they could create custom ROMs and stuff like
| that, so that excuse doesn't work for them.
| ReptileMan wrote:
| Okay - so which devices are left that are easily rootable? I will
| be in the market for new one soon. It's good if EU after
| mandating usb-c also mandates unlockable bootloaders for whomever
| wants it.
| handity wrote:
| The pixel 4a is the last good phone that's small, rootable,
| with a headphone jack and good rom options.
| resource_waste wrote:
| I just looked it up... they actually sell Factory 5a... what?
| No...
|
| Maybe I misunderstand the posting.
| freedomben wrote:
| All pixel phones are very easy to unlock the bootloader, and
| Google publishes factory images. So if your root goes wrong or
| you need to revert to stock, it is very easy. The actual
| process of obtaining root is as easy as it is on any other
| device, which is to say, I wish it was a lot easier, but it is
| very doable.
|
| As a bonus, it also opens the door for Graphene OS should you
| choose to go that direction.
| zamalek wrote:
| Pixels can also be re-locked with a custom ROM present (I
| think Graphene is the only one that does this, though). For
| that reason alone I'll be transitioning back to Pixel (once
| this phone is beyond help).
| onli wrote:
| CalxyOS is the other one, with less problematic developer
| history.
| j-bos wrote:
| What are the history problems with graphene?
| cf100clunk wrote:
| https://news.ycombinator.com/item?id=36089104
|
| In tech as in all of life, wellness of those in
| leadership can be ephemeral and is never to be taken for
| granted or assumed. I wish good health to all involved.
| cf100clunk wrote:
| Up until your comma the comment suited me just fine, but
| then... let's not get personal about developers' health
| issues. It isn't helpful, and there has already been an
| HN discussion on the topic that you've unfortunately
| exhumed. There has been great progress at solving
| problems that had come up during a sad time for
| GrapheneOS and CalyxOS.
| onli wrote:
| I understand that position, but one can also not simply
| ignore the situation. It'd be okay if the project had
| removed the maintainer, but they did not, instead he just
| sabotaged the Mozilla location service discussion while
| purporting to speak in the name of the Graphene
| foundation. There is a responsibility to warn users about
| that risk factor.
| cf100clunk wrote:
| GrapheneOS and CalyxOS are great at what they do, and the
| present situation for both is positive and good. It can
| be exhausting digging up old interpersonal stuff that
| does not have a technical bearing on the present,
| especially as there are/were health and wellbeing issues
| that are/were at play. Choose to let it go, for once and
| for all. Peace out.
| onli wrote:
| No, that's sadly not true. With the stepping down having
| been cancelled and the recently repeated paranoid
| accusations in https://github.com/mozilla/ichnaea/issues/
| 2065#issuecomment-... the present situation of GrapheneOS
| is far from good, it's a "absolutely do not use and do
| not recommend the project"-situation. This maintainer
| being active and continuing his bullying is way too risky
| for the users of the project (and the FOSS android
| ecosystem as a whole).
|
| But let's indeed let it be here, it gets OT for the ASUS
| topic. The GrapheneOS warning just had to be mentioned as
| it was related to the bootloader re-locking.
| commoner wrote:
| CalyxOS has been working well for me and I recommend it.
| I appreciate how the included microG allows me to disable
| Firebase Cloud Messaging for any app that I don't need
| push notifications for. Having push notifications without
| Google Ads or Google Analytics is great.
| resource_waste wrote:
| No aux port though.
|
| From Electrical Engineering apps to my various
| current/normal/legacy hardware that uses aux... I don't want
| to carry around a dongle. Ever. I don't want to attach them
| to things. I just want my phone to have the $3 peripheral.
| yjftsjthsd-h wrote:
| Lenovo's Moto phones
| ldmosquera wrote:
| I recently got Lenovo Moto G7 Plus (not recent but recent
| enough for their purpose), because LineageOS fully supports
| them [1].
|
| Then I found out to unlock the bootloader I had to:
|
| 1. get a string via a `fastboot` command
|
| 2. create a motorola.com account
|
| 3. paste string in some motorola.com page to get an "unlock
| code" emailed IF Motorola decides your device is "unlockable"
|
| 4. `fastboot oem unlock UNLOCK_CODE`
|
| 5. connect phone to the Internet and wait between 3 and 7
| days [2] (turned out to be 3 or 4)
|
| Until I did all that shit, the option to unlock the
| bootloader in system settings was grayed out.
|
| Afterwards the device works well, but it was a terrible
| experience and I DO NOT recommend Motorola devices for
| rooting based on this.
|
| [1]: https://wiki.lineageos.org/devices
|
| [2]: https://nerdschalk.com/how-to-fix-oem-unlock-greyed-out-
| or-o...
| yjftsjthsd-h wrote:
| Oh, ew, they've really regressed then. Step 5 is new:(
| resource_waste wrote:
| Seriously sad. I am such an Asus fan after their insanely good
| gaming laptops.. $500-900 and you can run AI Art and LLMs.
|
| I didn't expect their laptop dominance to exactly extend to
| Androids. I was hopeful.
|
| I should have probably known better, apparently they don't do
| native linux support. I had to use some Fedora fanboy stuff to
| get my peripherals to work. It was easy, but still couldn't use
| most distros.
| NayamAmarshe wrote:
| Xiaomi phones are also pretty good for Custom ROMs.
| n_plus_1_acc wrote:
| I'm in love with fairphones
| Cort3z wrote:
| Besides the point here, but why is it so diabolically hard to
| decline cookies on this site?
| tim333 wrote:
| I'm not sure cookie declining is the way to go these days. You
| can use "I still don't care about cookies" to stop the dumb pop
| ups and something like "Firefox Total Cookie Protection" if you
| don't want to be tracked?
| ktosobcy wrote:
| I do hope that (for example) EU would force makers to provide a
| way to unlock the device and install any OS/distribution I
| want...
| hocuspocus wrote:
| The EU wants to mandate 5 years of security updates, which is a
| lot more relevant to the immense majority of consumers.
| ktosobcy wrote:
| One doesn't (have to) rule out the other?
|
| Would it be OK if you were forced to use only the single OS
| that your computer came preinstalled with?
| mnw21cam wrote:
| > This has set a basic precedent
|
| I would note that technically the small claims court in the UK
| does not set precedents. That would be the function of a higher
| court.
| solarkraft wrote:
| How so? I thought a precedent was just any case that has been
| ruled in a certain way, irrespective of the court it has
| happened in.
| adw wrote:
| Not all courts have the power to set precedent. Small claims
| courts in England don't.
| j45 wrote:
| The way it's been explained to me is precedent is often
| referring to rulings that start with the similar courts
| geographically to other ones.
| mnw21cam wrote:
| It's not that simple either. Common law jurisdictions
| often use rulings at higher courts in completely
| different countries (as long as they are also common law
| jurisdictions) as precedent if it helps come to a
| suitable judgment.
| j45 wrote:
| Absolutely. Depends on the court, country, and how
| relevant it might be. A friend recently walked me through
| the order of precedent for one area of law
| nickff wrote:
| It seems like this court does not have the authority to set
| 'legal precedent', though colloquially it has 'set a
| precedent' in the sense that it did something for the first
| time.
| rahimnathwani wrote:
| There was no ruling. The parties settled.
| dragonwriter wrote:
| This is incorrect, courts have specific rules about what
| cases may be cited as precedent, and whether that precedent
| is optional guidance for the court it is presented to
| (persuasive precedent) or rules that must be followed where
| the decision conditions in the earlier ruling apply to the
| current case (binding precedent).
|
| For instance, in a US District Court on most questions of
| federal law, as regards decisions of other federal courts:
| published decisions of any federal court can be cited as
| persuasive (most district court decisions are unpublished),
| and decisions of the Court of Appeals for the circuit in
| which the District Court is located, or of the US Supreme
| Court, may be entered as persuasive precedent.
| FerretFred wrote:
| Hard to believe that it actually reached the Small Claims
| Court, let alone succeeded! Well done that person!
| rahimnathwani wrote:
| > Hard to believe that it actually reached the Small Claims
| Court
|
| It's easy to file a small claim in the UK. More info on the
| process for England & Wales here: https://www.gov.uk/make-
| court-claim-for-money
|
| > let alone succeeded!
|
| The article is light on details, but it sounds like the
| parties settled before any hearing or ruling.
| bbarnett wrote:
| In Ontario, Canada, part of the small claims process is a
| pre-trial conference, with a retired judge moderating.
| Further, nothing disclosed may be used as part of the
| trial.
|
| Its goal is to help with an amicable settlement.
|
| More info: In small claims, lawyers are not forbidden, but
| they may only speak for their client, and their client must
| be there, or present remorely, listening and ready to
| accept offers or deals.
|
| And if lawyers use legalese, the residing judge must
| explain to you what is being said, and will look
| unfavorably at the lawyer for not speaking plainly, and
| wasting everyone's time.
|
| Technically lawyers are not allowed as lawyers, but
| accommodations must be made for a company 1000s of km or
| more away. Someone must speak for them.
| rahimnathwani wrote:
| Did you intend to reply to a different comment?
| bbarnett wrote:
| No! My comments re: Ontario pre-court conference, were
| meant to highlight a reaspn why this might have been
| settled before small claims coirt.
|
| I suspect a similar thing happens in the UK, and that
| forced conference ensures companies must hear reasoning,
| arguments in full before the case.
|
| In Ontario, it's very informal. You just talk. The
| retired judge only intercedes if it becomes heated, or
| runs long.
|
| It helps solve things.
| solarkraft wrote:
| > ASUS makes some of the best Android phones you can buy
|
| > ASUS has one of the worst software support commitments in the
| Android world
|
| How can you possibly say both things in the same article?
| Guzba wrote:
| The type of consumer buying an ASUS device is the type of
| consumer that thinks the spec sheet tells them how good
| something is. Eg, faster CPU and more RAM, or higher screen
| refresh rate or whatever is good regardless of any other
| variables or the package as a whole.
|
| This means they are "some of the best Android phones you can
| buy", as in, they have some of the best specs per $ you can
| buy. Not that they are actually good phones.
|
| It makes total sense someone could think they are great phones
| while they also have terrible software support since software
| support is not a simple hardware number on the spec sheet.
|
| This is very like PC people that hyper-focus on a few metrics
| like CPU frequency since it is simple and numerical and easily
| compared, even if it is not actually sufficient to tell you
| much about full system performance.
|
| Example ASUS phone description from enthusiast: "It's got good
| speakers, 2 charge ports, 165 refresh rate, optimal cooling, a
| set of ultra sonic buttons, ip54, crazy good battery,
| acceptable camera, storage is crazy high 256GB for 1 grand, 512
| for 1.1 grand, 12G ram for 1k, 16G ram for 1.1k, can take 2 sim
| cards."
| akvadrako wrote:
| I disagree - I don't care about most specs, but ASUS Zenfone
| is still one of the best small phones, especially for the
| money.
| Guzba wrote:
| Fair enough! Tho I am curious what you mean by "especially
| for the money"?
| iforgotpassword wrote:
| I have an old Huawei P20 Pro floating around. When it was new,
| you could contact Huawei and get a code for unlocking the
| bootloader after providing your phone's serial number. Great I
| thought, I'll do that later when it stops receiving updates.
| Stupid me, at some point those arseholes stopped giving out the
| unlock codes. I wonder if one could sue, but from googling around
| a bit I can't find a trace of them ever making this a selling
| point explicitly.
| huppeldepup wrote:
| On this page:
|
| https://consumer.huawei.com/en/community/details/P20-Pro-Boo...
|
| there's someone from Huawei who acknowledges the policy change,
| with a date. Maybe check archive.org for the mentioned time and
| url? HTH.
| xjwm wrote:
| I just sent feedback to ASUS expressing my concern at the loss of
| bootloader unlocking. I have 2 perfectly good cell phones that
| are e-waste now, simply because the vendor stopped issuing
| patches, and the bootloader can't be unlocked to use LineageOS. I
| bought a Zenfone recently because I thought I'd be avoiding that
| issue. If they don't fix this, I won't be buying another one.
| ASUS CEO contact page:
| https://www.asus.com/us/support/article/787/
| luuurker wrote:
| Rewarding their bad behaviour by buying more devices doesn't
| feel right.
| blendergeek wrote:
| I just sent feedback as well. I bought an Asus phone in the
| past and was planning on buying more in the future. I used to
| recommend them everywhere. I will not be purchasing any more
| Asus phones until this is fixed.
| brewtide wrote:
| I was on the fence about buying a zenphone but waiting to see
| if the bootloader unlock ever showed back up.
|
| Still holding a pixel 3, unlocked, with lineage. There are no
| small phones with good specs and unlockable. Zenphone seemed
| the way, until they stopped with their unlocks.
|
| What a market to be burying in the mud.
| throwaway5959 wrote:
| Can anyone suggest legitimate reasons one would need to unlock
| their bootloader? Like I get doing it because you can, but for
| say 99% of the population, what would be the practical benefit?
|
| Edit: downvoted already, lol
| jstanley wrote:
| Installing an alternative OS.
| throwaway5959 wrote:
| OK, but that's still a 1% use case.
| NayamAmarshe wrote:
| I'm on a 5 years old phone with Android 14. The OEM stopped the
| update on Android 11 but the Custom ROM community is going
| strong. Not only do I now have the latest software that works
| smoother, but also better camera with GCam, no ads systemwide,
| better privacy controls through Warden and other similar apps.
|
| I just avoided e-waste.
| throwaway5959 wrote:
| > Not only do I now have the latest software that works
| smoother, but also better camera with GCam, no ads
| systemwide, better privacy controls through Warden and other
| similar apps.
|
| Sounds like a lot of that functionality could be achieved by
| just buying an iPhone instead. The 6s received updates
| through 7 major versions.
| BLKNSLVR wrote:
| With the increasing difficulty (impossibility) of bootloader
| unlocking that most manufacturers are building into their Android
| devices, I wonder whether it's market reasons (the longer the
| devices are operational, the longer upgrade cycle) or pressure
| from intelligence agencies due to minimised Google / telemetry
| data back doors in custom ROMs.
|
| Using the "simplest answer is often the best" approach, it would
| historically be the profit motivation at 99% probability.
| Currently, though, feels like surveillance and intelligence
| gathering is edging to the higher likelihood.
|
| Edited to add: and maybe it's not even intelligence agencies,
| maybe it's purely profit driven from the personal-data-selling
| industry.
| bcraven wrote:
| I think this is the original thread:
|
| https://xdaforums.com/t/court-action-against-asus-false-prom...
___________________________________________________________________
(page generated 2024-04-06 23:02 UTC)