Refurbished FP4 with "bootloader unlocked", security risk?

[Markus_Th]

Hi,
I just bougth a refurbished FP4 and when I put the charger in and it briefly showed “bootloader unlocked”.
Could this easyly be reset to factory standards?
Greetings,
Markus

[OldRoutard]

Hi Markus and welcome to the community forum.
Here are some thoughts.

@Markus_Th

bought a refurbished FP4

From whom? If from Fairphone, and if you want to run the stock FP OS then I’d send it back. In theory same answer for any seller of course, but if you got it cheap that may be why.

Having said that, as usual “it depends”.
Obviously there is a risk with an unlocked bootloader, otherwise the message wouldn’t be there, but in the past phones have been sold without the possibility even of locking their bootloaders (I’m thinking of the FP2).
It’s your decision, and you should take it after considering at least the following:

• If you want to install a different OS then you would need to unlock the BL anyway, so see it as an advantage.
• It’s likely the BL is unlocked because a lot of people have had problems in the past when they wanted to relock, ending up with a bricked phone. Those problems are largely sorted now, I believe, but I’m no specialist and I’m sure it’s still quite easy to brick a phone if you don’t know what you’re doing. Take good advice in that case.
• What is the risk? An unlocked bootloader may expose data to unauthorised access if the phone gets lost or stolen, so you’d be wanting to either limit the data stored on the phone and / or make sure it’s encrypted.
  [Edit: see below on flashed malware]

There’s plenty you can read up on in the forum on the subject of relocking the bootloader of an FP4. Some examples.
Keep in touch.

[Volker]

I mainly agree with your answer but am in doubt regarding two points:

@OldRoutard

ending up with a bricked phone. Those problems are largely sorted now

Well, if you mean “it’s quite known how the phone can be bricked when relocking the BL” then you’re right. But there’s still no solution to this problem (if you mean this).

@OldRoutard

What is the risk? An unlocked bootloader may expose data to unauthorised access if the phone gets lost or stolen

I don’t think so. Data on an FP4 is encrypted be default. So I don’t think it’s easy to break this encryption and get the data out.
The problem of an unlocked bootloader is afaik rather that you get your device back with some malicious SW flashed extracting your data when you use your unlock password on startup.

[OldRoutard]

@Volker

there’s still no solution

I stand corrected, thank you Volker.

[Markus_Th]

Thanks a lot for the helpful responses, @OldRoutard & @Volker.
I’ll contact the refurbisher and think about putting a different OS on it after seeing the momentary is stock Android and only relies on GApps.
While looking trough the Forum I saw a lot of people loading new roms on their FPs, is that because of the open nature of the phones and people want to mirror this softwarewise or is it because the stock OS is quite bad?

[OldRoutard]

I think most people install a different OS to avoid Google as much as possible, but there are other reasons too.
The two most commonly used alternatives are LineageOS and /e/.
See a list here.
See also livingwogoogle