4 ms·

Too bad Google made the boot password the same as the screen unlock password. Since virtually everyone wants to be able to quickly unlock their phone, this make

by cxseven 10y ago

Too bad Google made the boot password the same as the screen unlock password. Since virtually everyone wants to be able to quickly unlock their phone, this makes security a Hobson's choice.

libeclipse 10y ago
Yeah I can see that being the case for the vast majority of users. Also it's a damned shame that Google enforces a limit of 16 characters for the password. My own password is a random 16 character string.
- ThatGeoGuy 10y ago
  Fortunately the community has addressed both these claims, although you need root to set it up (you can remove after). An app on F-droid known as "Cryptfs Password" can change the encryption password separately from your screen unlock password. It also bypasses the 16 character limit, as the encryption key I used on my last phone was 27 characters. At the end of the day Android encryption runs using dm-crypt, so the same sort of rules apply. The 16 character limit is a UI limitation, and there's no technical reason for it. * Note: I fully acknowledge that Google needs to do better here, as I would never assume a normal user could root + install Cryptfs password + unroot after, but at least for those of us who can, we can do something in the meantime.
golergka 10y ago
Well otherwise the user will most likely forget the separate boot password as phones typically get rebooted once a month or so.
- cxseven 10y ago
  Forcing boot passwords to be the same as what unlocks the screen guarantees that they're so weak that they might as well not exist. Meanwhile, users who want real security are fucked. The same kind of boneheaded removal of features in the name of simplicity is behind Android Pay requiring your phone to have a locked screen -- because that supposedly solves the problem that used to exist of users having to enter a PIN twice when they'd unlock the screen and then unlock Android Pay.
andrewpi 10y ago
Fingerprint readers seem to solve that problem. Booting the phone requires the secure password, but after that a fingerprint will suffice until the phone is powered off or left locked for 24 hours.

by cxseven 10y ago

Too bad Google made the boot password the same as the screen unlock password. Since virtually everyone wants to be able to quickly unlock their phone, this makes security a Hobson's choice.

libeclipse 10y ago

Yeah I can see that being the case for the vast majority of users. Also it's a damned shame that Google enforces a limit of 16 characters for the password. My own password is a random 16 character string.

ThatGeoGuy 10y ago
Fortunately the community has addressed both these claims, although you need root to set it up (you can remove after). An app on F-droid known as "Cryptfs Password" can change the encryption password separately from your screen unlock password. It also bypasses the 16 character limit, as the encryption key I used on my last phone was 27 characters. At the end of the day Android encryption runs using dm-crypt, so the same sort of rules apply. The 16 character limit is a UI limitation, and there's no technical reason for it. * Note: I fully acknowledge that Google needs to do better here, as I would never assume a normal user could root + install Cryptfs password + unroot after, but at least for those of us who can, we can do something in the meantime.

golergka 10y ago

Well otherwise the user will most likely forget the separate boot password as phones typically get rebooted once a month or so.

cxseven 10y ago
Forcing boot passwords to be the same as what unlocks the screen guarantees that they're so weak that they might as well not exist. Meanwhile, users who want real security are fucked. The same kind of boneheaded removal of features in the name of simplicity is behind Android Pay requiring your phone to have a locked screen -- because that supposedly solves the problem that used to exist of users having to enter a PIN twice when they'd unlock the screen and then unlock Android Pay.

andrewpi 10y ago

Fingerprint readers seem to solve that problem. Booting the phone requires the secure password, but after that a fingerprint will suffice until the phone is powered off or left locked for 24 hours.