I thought the security chip was being disabled when unlocking the bootloader but apparently it just skips image validation.
So basically you can flash anything (which kinda is what you want). You could theoretically also modify the system files to being able to bruteforce your pincode.
Unlocking the bootloader also makes your device less secure in other ways. When there’s a root exploit in Android verified boof safes you from it being exploited.
Well it really depends. They definitely are one of the most secure devices.
With the stock ROM only Google gets your data. So it’s better than for example a Samsung device where both Google and Samsung and maybe some other companies get your data
Then with GrapheneOS its the most secure and private device.
It’s asking for a secondary email address or phone number. Security questions are insecure and probably the worst reset methode there is. Most users don’t even know what a security key is so it’s pretty pointless to mention it if only like 1% are actually using it and it could cause more confusion than it helps.
Edit: apparently it actually does ask for both. But it’s not even mandatory. Its just a warning
Not really that huge of a problem. When making requests you also usually send a header which includes the user agent.
The program just logs how many times the image has been requested and it reads the user agent data. No Javascript is actually executed.
Well it might be possible to have a XSS somehow but I haven’t really done much research into this possibility.
In general it’s a pretty standard way of handling embedded images. Email does this too. That’s how you have these services that can check if someone read a mail
But note that you need to download the Fdroid version for the degoogled version