What are the security concerns of not being able to lock bootloader after installing /e/ on OnePlus Nord N200

[novacane]

After installing /e/ on a OnePlus Nord N200, it works fine, but after rebooting the “bootloader is unlocked” screen shows every time.

What are the security concerns with the bootloader being unlocked? Doesn’t this eliminate all the security benefits of using /e/ over the factory ROM?

Can the bootloader be safely locked?

[novacane]

@Manoj do you know?

Thanks,

Matt

[obacht]

@novacane

What are the security concerns with the bootloader being unlocked? Doesn’t this eliminate all the security benefits of using /e/ over the factory ROM?

If you search the forum you find discussions and detailled explanations on the topic …for quite some phone models it is simply not possible to relock the bootloader on a custom-rom.
(imho the risk is acceptable)
It says " Bootloader relocking support - Data unavailable" for OnePlus Nord N200

[novacane]

That’s what I’ve been finding.

Doesn’t having the bootloader unlocked make it easy for anyone to steal the data on the phone if they got ahold of it, making the passcode to unlock the screen completely irrelevant?

[obacht]

From my understanding that’s why it is recommended to enable encryption, use a pin or passcode for entering the phone and to not keep too sensitive data on the phone.
One should be fairly safe then.

@novacane

Doesn’t this eliminate all the security benefits of using /e/ over the factory ROM?

You still benefit from a degoogled android and specific functions of eOS.
But of course it depends on your threat model.
eOS is surely not for those who are the specific target of intelligence services or the like…

Bootloader unlocked after installing e/OS

risk is if someone can take your device in hands AND if /data is not encrypted, that is the case by default on recent OS version. the advise is to enable protection at system-boot and unlock-screen

Is it safe to have the bootloader unlocked?

A fundamental part of the concept of ‘security’ is the source of the perceived threat. A locked bootloader ensures that the phone’s boot sequence only loads trusted executables during the boot sequence. This helps avoid malware on boot, but a Pixel with stock firmware will be completely trusted…to upload all your data to Google =). Unlocked bootloaders are essential for custom recovery environments and custom ROMs, so that same Pixel phone won’t “trust” an official /e/OS build, but I do, and tha…

https://www.reddit.com/r/LineageOS/comments/n7yo7u/a_discussion_about_bootloader_lockingunlocking/