6 ms·

Note how Android unlocking demands never came up in this discussion. That's because the phones are vulnerable. I am a Nexus user.

by cft 11y ago

NeutronBoy 11y ago
Do you have any references for further reading on the Android side of things?
- vskarine 11y ago
  http://recode.net/2016/02/21/what-if-san-bernardino-suspect-had-used-an-android-instead-of-an-iphone/ http://recode.net/2016/02/21/what-if-san-bernardino-suspect-... "In a sweeping November report on encryption, Manhattan District Attorney Cy Vance wrote that Google can “reset the passcodes” on some Android phones without full encryption, when served with a search warrant. “This process can be done by Google remotely and allows forensic examiners to view the contents of a device,” according to the report."
  - NeutronBoy 11y ago
    Selective quoting FTW! It devolves into a he-said/she-said conversation. > "Google has no ability to facilitate unlocking any device that has been protected with a PIN, Password, or fingerprint," [Android’s security chief, Adrian Ludwig] wrote. "This is the case whether or not the device is encrypted, and for all versions of Android." Also note it talks about being able to unlock phones without full encryption. Which yes, understandable. But I'm interested in specifics at the level that we've been talking about with iPhones - eg, on phones with appropriate TPMs (like the new Nexus devices), is it possible to bypass? EDIT: Reading the source post [1] more, it notes that - Google has no ability to facilitate unlocking any device that has been protected with a PIN, Password, or fingerprint. This is the case whether or not the device is encrypted, and for all versions of Android. - Google also does not have any mechanism to facilitate access to devices that have been encrypted (whether encrypted by the user, as has been available since Android 3.0 for all Android devices, or encrypted by default, as has been available since Android 5.0 on select devices). - There are some devices that have been configured to use a "pattern" to unlock. Until Android L, "pattern" unlock did provide a recovery option with the Google account. This recovery feature was discontinued with Android L. - The lost pattern recovery feature never applied to PIN or Password so if you are on an earlier model device and don't want to use the pattern recovery feature, you can switch to a PIN or Password and it will be disabled. [1] https://plus.google.com/+AdrianLudwig/posts/JFPXLnV3M2f https://plus.google.com/+AdrianLudwig/posts/JFPXLnV3M2f
    - makomk 11y ago
      Two-thirds of Android devices in use are still running versions of Android older than L which allow Google to remotely bypass the unlock pattern on demand from the authorities. Companies are still releasing new low-end smartphones with these older Android versions - for example, Walmart recently started selling several $20 smartphones with Android 4.4
kzrdude 11y ago
Same, this is a pretty good ad for iphone for me.
jhardcastle 11y ago
I'm under the impression that Android devices have had optional full disk encryption[0] for a long time, and that encryption isn't dependent upon cloud synchronization. [0] https://source.android.com/security/encryption/ https://source.android.com/security/encryption/
- nindalf 11y ago
  The plan was to have it enabled by default but that decreased disk performance drastically because of limitations of the encryption hardware. So they scrapped that plan, and its now only an option. Since it was optional, I doubt a majority of users looked at it, let alone enabled it. That's probably why Android doesn't figure in these discussions at all. Having said that, high-end devices [1] from Marshmallow onward (6.0+) are supposed to have encryption enabled by default, according to the Android Compatibility Definition Document [2] so we'll probably see Android playing a bigger role in the encryption debate in the future. Budget phones are exempt from the requirement. [1] - For device implementations supporting full-disk encryption and with Advanced Encryption Standard (AES) crypto performance above 50MiB/sec [2] - http://static.googleusercontent.com/media/source.android.com/en//compatibility/android-cdd.pdf http://static.googleusercontent.com/media/source.android.com... Full Disk Encryption (section 9.9)
05 11y ago
At least it's easy to set separate boot and unlock passwords on Android. I'm not sure how likely it is for the police to keep the phone turned on, but to remove the SIM on most of them you'd have to remove the battery, which kills all chances of decryption. Even when kept on, dumping PoP DDR isn't a walk in the park..
erkkie 11y ago
Explain? My locked + encrypted android (nexus 5) did initiate a self-erase after too many failed unlock attempts.
- runholm 11y ago
  Yes, but it is opt-in and require the user to have the phone fully charged and plugged in for an hour while the process is performed. Few people bother doing it. The encryption hardware in most Android phones is also not as fast as the iPhone, so there is a performance hit by encrypting.
josu 11y ago
Encryption is an opt-in for Android users, while it is an opt-out for iOS users.
fooey 11y ago
Android hasn't come up, but more notable to me, why hasn't this come up over Windows machines? Bitlocker has been a thing for quite a while now. Has the FBI/DoJ never encountered an encrypted desktop or server before? or has it not been a problem when they have?
- LeoPanthera 11y ago
  It has been widely speculated that Bitlocker has some kind of back door, or master key. It's a closed system you can never prove it either way.
- zaroth 11y ago
  I believe that by default Microsoft keeps a copy of your BitLocker key and is happy to provide it to the police when requested. Also, see Bill Gates recent comments on the topic.

Note how Android unlocking demands never came up in this discussion. That's because the phones are vulnerable. I am a Nexus user.

by cft 11y ago

Note how Android unlocking demands never came up in this discussion. That's because the phones are vulnerable. I am a Nexus user.

NeutronBoy 11y ago

Do you have any references for further reading on the Android side of things?

vskarine 11y ago
http://recode.net/2016/02/21/what-if-san-bernardino-suspect-had-used-an-android-instead-of-an-iphone/ http://recode.net/2016/02/21/what-if-san-bernardino-suspect-... "In a sweeping November report on encryption, Manhattan District Attorney Cy Vance wrote that Google can “reset the passcodes” on some Android phones without full encryption, when served with a search warrant. “This process can be done by Google remotely and allows forensic examiners to view the contents of a device,” according to the report."
- NeutronBoy 11y ago
  Selective quoting FTW! It devolves into a he-said/she-said conversation. > "Google has no ability to facilitate unlocking any device that has been protected with a PIN, Password, or fingerprint," [Android’s security chief, Adrian Ludwig] wrote. "This is the case whether or not the device is encrypted, and for all versions of Android." Also note it talks about being able to unlock phones without full encryption. Which yes, understandable. But I'm interested in specifics at the level that we've been talking about with iPhones - eg, on phones with appropriate TPMs (like the new Nexus devices), is it possible to bypass? EDIT: Reading the source post [1] more, it notes that - Google has no ability to facilitate unlocking any device that has been protected with a PIN, Password, or fingerprint. This is the case whether or not the device is encrypted, and for all versions of Android. - Google also does not have any mechanism to facilitate access to devices that have been encrypted (whether encrypted by the user, as has been available since Android 3.0 for all Android devices, or encrypted by default, as has been available since Android 5.0 on select devices). - There are some devices that have been configured to use a "pattern" to unlock. Until Android L, "pattern" unlock did provide a recovery option with the Google account. This recovery feature was discontinued with Android L. - The lost pattern recovery feature never applied to PIN or Password so if you are on an earlier model device and don't want to use the pattern recovery feature, you can switch to a PIN or Password and it will be disabled. [1] https://plus.google.com/+AdrianLudwig/posts/JFPXLnV3M2f https://plus.google.com/+AdrianLudwig/posts/JFPXLnV3M2f
  - makomk 11y ago
    Two-thirds of Android devices in use are still running versions of Android older than L which allow Google to remotely bypass the unlock pattern on demand from the authorities. Companies are still releasing new low-end smartphones with these older Android versions - for example, Walmart recently started selling several $20 smartphones with Android 4.4

kzrdude 11y ago

Same, this is a pretty good ad for iphone for me.

jhardcastle 11y ago

I'm under the impression that Android devices have had optional full disk encryption[0] for a long time, and that encryption isn't dependent upon cloud synchronization. [0] https://source.android.com/security/encryption/ https://source.android.com/security/encryption/

nindalf 11y ago
The plan was to have it enabled by default but that decreased disk performance drastically because of limitations of the encryption hardware. So they scrapped that plan, and its now only an option. Since it was optional, I doubt a majority of users looked at it, let alone enabled it. That's probably why Android doesn't figure in these discussions at all. Having said that, high-end devices [1] from Marshmallow onward (6.0+) are supposed to have encryption enabled by default, according to the Android Compatibility Definition Document [2] so we'll probably see Android playing a bigger role in the encryption debate in the future. Budget phones are exempt from the requirement. [1] - For device implementations supporting full-disk encryption and with Advanced Encryption Standard (AES) crypto performance above 50MiB/sec [2] - http://static.googleusercontent.com/media/source.android.com/en//compatibility/android-cdd.pdf http://static.googleusercontent.com/media/source.android.com... Full Disk Encryption (section 9.9)

05 11y ago

At least it's easy to set separate boot and unlock passwords on Android. I'm not sure how likely it is for the police to keep the phone turned on, but to remove the SIM on most of them you'd have to remove the battery, which kills all chances of decryption. Even when kept on, dumping PoP DDR isn't a walk in the park..

erkkie 11y ago

Explain? My locked + encrypted android (nexus 5) did initiate a self-erase after too many failed unlock attempts.

runholm 11y ago
Yes, but it is opt-in and require the user to have the phone fully charged and plugged in for an hour while the process is performed. Few people bother doing it. The encryption hardware in most Android phones is also not as fast as the iPhone, so there is a performance hit by encrypting.

josu 11y ago

Encryption is an opt-in for Android users, while it is an opt-out for iOS users.

fooey 11y ago

Android hasn't come up, but more notable to me, why hasn't this come up over Windows machines? Bitlocker has been a thing for quite a while now. Has the FBI/DoJ never encountered an encrypted desktop or server before? or has it not been a problem when they have?

LeoPanthera 11y ago
It has been widely speculated that Bitlocker has some kind of back door, or master key. It's a closed system you can never prove it either way.
zaroth 11y ago
I believe that by default Microsoft keeps a copy of your BitLocker key and is happy to provide it to the police when requested. Also, see Bill Gates recent comments on the topic.