[Windows Phone 8 Development and Hacking] GoodDayToDie:
While I'm no fan of JTAG myself, it is a workable way to unlock phones (I've got a Lumia 520 next to me that was unlocked via JTAG, I use it for researching Lumia stuff when I have the time). If your method relies on changing registry values after boot, and they don't persist across reboots or something like that, that's weird but cool!

If you're not sure whether to report a vuln publicly or not, I strongly recommend PMing one or more of the RDs (myself, [MENTION=2854207]snickler[/MENTION], [MENTION=1827790]ceesheim[/MENTION], [MENTION=2734362]-W_O_L_F-[/MENTION], [MENTION=3254428]Heathcliff74[/MENTION], etc.) with a description of what the hack does and what it takes to use it. You don't have to go into detail if you don't want to, though if you do and ask me not to release the hack I'll go along with your wishes (ask [MENTION=5118143]Myriachan[/MENTION] if you're curious; I'm sitting on a couple findings of hers). You will find *in general* that the overwhelming majority of the people on this forum operate under the belief that "it's my phone, I should be able to run whatever I want on it" and are therefore going to want you to publish your findings. With that said, as an information security consultant, part of my job is figuring out how severe a vulnerability is, which has a big impact on whether it is safe to report it. I have reported a number of findings to MS already - stuff that is not helpful to WP8 owners looking to run their own stuff, only to malware authors - although they actually haven't been very good about fixing them yet...

Here's some of the questions that determine how dangerous it is to release your discovery publicly:

Is it remotely exploitable (for example, just visiting a web page or connecting to a WiFi network with the attacker on the same network), or does the user need to install something / run some special command? Part of the reason I had no problem releasing the Interop-unlock hack for Samsung was because it required the user carry out a bunch of specific steps first.

Does it completely break the security model of the OS, or just reduce the lockdown? Something that, for example, made every app run as SYSTEM (the equivalent of root) would be very useful to us here at XDA but would also be potentially very dangerous. Something that simply allows sideloading more-privileged apps is actually pretty hard for an attacker to exploit - they have to get you to install their malicious app, and anybody who wants to can read the manifest before installing the app to see what privileges the app is demanding - but takes away most of the "you think it's your device but you can't actually control what runs on it, Microsoft/Nokia does" lockdown.

Is it globally usable or specific to one group of phones? While universal hacks are the most useful to us, they're also more likely to be abused by an attacker. They're also rarer; Microsoft's code is usually way more secure than any given OEM's code because OEMs focus on hardware first and software as a distant second.

Is it reversible? If somebody wants to "re-lock" their phone, how hard is that? For example, interop-unlock and even capability-unlock can be undone by reversing the relevant registry changes, or by doing a hard reset.

Is it persistent? If the hack goes away every time somebody reboots, that's really hard to exploit because users won't unlock their phones except when they need to. The Windows RT 8.0 jailbreak is a good example of this.

Something else you should keep in mind is that, whether or not you tell Microsoft/Nokia directly, if you release the hack here they will see it and patch it soon enough. I promise you that they have people who read this forum. Therefore, there will be an opportunity for people who want to keep their phones fully locked down to patch whether or not you tell the rest of us what you've found. The question is, for all those Lumia owners who want to have more control over their own devices, will they get *that* chance?

One final thought: When the first iPhone jailbreak came out, it worked for all models of the phone that existed at the time, but Apple only patched it for the newer versions that they still supported. That was a remotely exploitable direct-to-kernel vulnerability - visit a website and get arbitrary code execution with full privileges - and was quite dangerous to leave unpatched. Therefore, if you had an older iPhone and wanted to be safe (without buying hundreds of dollars worth of new phone), you had to use the jailbreak *yourself* so that you could patch the vulnerable code. You say you want to "really improve the security more and more"? Give the people who own the phones the ability to do that! Right now, for example, I have made my phone invulnerable to the POODLE attack (see https://www.poodletest.com/ to check if you're vulnerable, but by default WP8 is) by changing a single registry value. On the desktop, there's UI for blocking SSLv3, but on the phone there isn't - editing the registry is the only way, and you need interop-unlock to do it. Microsoft will *eventually* release an update to secure people's phones - it's possible they already did, though I doubt it, and they definitely hadn't a few weeks ago when I secured myself - but everybody who doesn't have an unlocked phone will be vulnerable until then. Allowing people to control their phones means allowing people to make them *more* secure, too!