0s12BeukNvDGVbT Regarding the "free" battery replacement offered by Google, there have been a number of reports of Google discovering other issues with the phone during their assessment, and refusing to replace the battery, unless the customer pays for other, unwanted repairs.
This is documented on Google's support page for this issue.
0s12BeukNvDGVbT First of all, you have to log in using your Google account just to use the service - not a good start. Then, it asks you to enter your device's IMEI number in order to assess whether your device is affected.
As I see it, the options would be:
- Asking you to open up the device to read the serial number off of the battery,
- Asking you to enter something unique about the device that locates the record in their manufacturing database,
- Writing and shipping code to read the serial number out of the battery and display it, or to display an indication of whether or not the battery is one of the worrisome ones.
I think #1 is clearly impractical.
For #2, their database already includes, for each device, the association between serial number and IMEI, so it wouldn't be any more private at all if they asked for the serial number instead.
For #3, the code is written and they are rolling it out, so the web site is a way for people to find out before the device pops up an alert. There will be a completely anonymous way to find out if the device is affected: as the detection code rolls out, wait until it lands on the device. We don't yet know if GrapheneOS will ship some or all of the code, but if they don't then flashing the device back to Google's supported OS will provide access to the detection code.
Gating the web-based classifier behind a Google account can be inconvenient for people who don't already have one, but, again, the web-based classifier is not the only option. And it sort of makes sense that if they are planning to mail money to people then they would want some sort of anti-fraud provision, or else people would just spam the rebate system with serial numbers until they got a reward.
To flip this around... I wonder what would seem to be the best system, keeping in mind that they are already rolling out on-device detection code, that a web-based detector will need to know something unique about the device (which is the same as all other unique identifiers for that same device), and also that they arguably need some sort of fraud-friction mechanism? Whichever system seems optimal in light of the constraints: has any other company done it that way that could be used as a positive example?
Edit: Please note that I am not a Google employee, nor a family member of a Google employee, etc.