3 ms·

What's the encryption story with Pixel 3a? I know when I lock my old iPhone 6 that not even the Federal Government can get into it. Can the same be said for the

by j_m_b 7y ago

What's the encryption story with Pixel 3a? I know when I lock my old iPhone 6 that not even the Federal Government can get into it. Can the same be said for the Pixel?

power78 7y ago
I thought the federal government was able to from the whole San Bernardino shooting suspect's phone?
- slenk 7y ago
  They did get into his phone
  - RaceWon 7y ago
    > They did get into his phone I'm not a hacker, But I am a skeptic; wouldn't it behoove the Gov't to just pretend they had to pay a private hacker a boatload of greenbacks to crack an Iphone? I mean, that's the smart play, no?
    - Grangar 7y ago
      What would they stand to gain from that? They had to use a 0day on it, they would never use that on the general public.
      - RaceWon 7y ago
        > What would they stand to gain from that? They had to use a 0day on it, they would never use that on the general public. Again that would be the beauty of it. If they did have to use a hack Apple didn't know about. We don't really know how they cracked it--only what "they said". Maybe it was a Day Zero, maybe it wasn't. If the NSA has access to Everthing that Everyone does online, (and Yes I do know that E2EE is unbreakable, but were Apple engineers using that to communicate?); its possible they know as much, if not more more, about the architecture than Apple does. Have you seen the size of their data centers, and the extremes they go to for spying on us. And speaking of Gov't State sponsored crackers: here's a nice litte article about one of our (The USA's) allies [1] who break iOS, allegedly--When Ever They Want To, not a Five Eyes Nation but still a close ally. https://www.vice.com/en_us/article/pajkkz/its-almost-impossible-to-tell-if-iphone-has-been-hacked https://www.vice.com/en_us/article/pajkkz/its-almost-impossi...
kop316 7y ago
That entirely depends on the strength if your password. That iPhone 6 had a 4 digit PIN plus a hardware salt. 4 digits is bad as that's only 1000 guesses to get the correct code (if you get the salt). The iPhone 6 had additional code to stop brute forcing, and that was the crux of the issue. Eventually they paid someome for a software exploit (the FBI director at the time, Comey complained that was "unsustainable"). If your extra paranoid about the government or whoever decrypting your phone, use a strong passphrase and only use it for decrypting your phone. Also turn if off before any interactions with police/TSA/NSA/whoever. This will work for any reasonably new Android. If you don't trust me feel free to dig into the code yourself!
Eridrus 7y ago
The Pixel 2+ have an equivalent to the iPhone's Secure Enclave: https://www.blog.google/products/pixel/titan-m-makes-pixel-3-our-most-secure-phone-yet/ https://www.blog.google/products/pixel/titan-m-makes-pixel-3... But honestly, the government will either shoulder-surf your PIN code or make you unlock it with your finger, or just snatch the phone from you while its unlocked. They bought an exploit to unlock the San Bernardino phone, but they only really needed to do that because the owner was dead and Apple stopped their routine cooperation. If the federal government is in your threat model, this is the wrong place to be protecting.
- delfinom 7y ago
  >make you unlock it with your finger https://www.zdnet.com/article/police-cant-force-us-citizens-to-unlock-their-phone-by-face-or-finger/ https://www.zdnet.com/article/police-cant-force-us-citizens-... Another ruling: https://www.forbes.com/sites/thomasbrewster/2019/05/10/the-us-government-cant-force-you-to-unlock-your-phone-with-your-fingerprint-another-judge-rules/#7ae3b0e24445 https://www.forbes.com/sites/thomasbrewster/2019/05/10/the-u...
  - jessriedel 7y ago
    This is not at all settled law, so it is not safe to assume the government can't force you to provide biometric decryption data. https://reason.com/2019/01/15/search-warrants-and-compelled-biometric/ https://reason.com/2019/01/15/search-warrants-and-compelled-... https://observer.com/2019/05/police-force-unlock-phones-nj-supreme-court/ https://observer.com/2019/05/police-force-unlock-phones-nj-s...
  - martin_a 7y ago
    They will drug you and beat you to shit until you unlock it. Wonder why you are so naive and think that they won't do bad things if they are _really_ interested into getting into your phone.
- deleted 7y ago
  [deleted]
mattlondon 7y ago
From what I understand, the pixel 3a contains the titan m security hardware that is detailed here: https://www.blog.google/products/pixel/titan-m-makes-pixel-3-our-most-secure-phone-yet/ https://www.blog.google/products/pixel/titan-m-makes-pixel-3... (this talks about the pixel 3 but the 3a has the same thing from what I have read) ... but of course XKCD got it completely right: https://www.xkcd.com/538/ https://www.xkcd.com/538/

by j_m_b 7y ago

What's the encryption story with Pixel 3a? I know when I lock my old iPhone 6 that not even the Federal Government can get into it. Can the same be said for the Pixel?

power78 7y ago

I thought the federal government was able to from the whole San Bernardino shooting suspect's phone?

slenk 7y ago
They did get into his phone
- RaceWon 7y ago
  > They did get into his phone I'm not a hacker, But I am a skeptic; wouldn't it behoove the Gov't to just pretend they had to pay a private hacker a boatload of greenbacks to crack an Iphone? I mean, that's the smart play, no?
  - Grangar 7y ago
    What would they stand to gain from that? They had to use a 0day on it, they would never use that on the general public.
    - RaceWon 7y ago
      > What would they stand to gain from that? They had to use a 0day on it, they would never use that on the general public. Again that would be the beauty of it. If they did have to use a hack Apple didn't know about. We don't really know how they cracked it--only what "they said". Maybe it was a Day Zero, maybe it wasn't. If the NSA has access to Everthing that Everyone does online, (and Yes I do know that E2EE is unbreakable, but were Apple engineers using that to communicate?); its possible they know as much, if not more more, about the architecture than Apple does. Have you seen the size of their data centers, and the extremes they go to for spying on us. And speaking of Gov't State sponsored crackers: here's a nice litte article about one of our (The USA's) allies [1] who break iOS, allegedly--When Ever They Want To, not a Five Eyes Nation but still a close ally. https://www.vice.com/en_us/article/pajkkz/its-almost-impossible-to-tell-if-iphone-has-been-hacked https://www.vice.com/en_us/article/pajkkz/its-almost-impossi...

kop316 7y ago

That entirely depends on the strength if your password. That iPhone 6 had a 4 digit PIN plus a hardware salt. 4 digits is bad as that's only 1000 guesses to get the correct code (if you get the salt). The iPhone 6 had additional code to stop brute forcing, and that was the crux of the issue. Eventually they paid someome for a software exploit (the FBI director at the time, Comey complained that was "unsustainable"). If your extra paranoid about the government or whoever decrypting your phone, use a strong passphrase and only use it for decrypting your phone. Also turn if off before any interactions with police/TSA/NSA/whoever. This will work for any reasonably new Android. If you don't trust me feel free to dig into the code yourself!

Eridrus 7y ago

The Pixel 2+ have an equivalent to the iPhone's Secure Enclave: https://www.blog.google/products/pixel/titan-m-makes-pixel-3-our-most-secure-phone-yet/ https://www.blog.google/products/pixel/titan-m-makes-pixel-3... But honestly, the government will either shoulder-surf your PIN code or make you unlock it with your finger, or just snatch the phone from you while its unlocked. They bought an exploit to unlock the San Bernardino phone, but they only really needed to do that because the owner was dead and Apple stopped their routine cooperation. If the federal government is in your threat model, this is the wrong place to be protecting.

delfinom 7y ago
>make you unlock it with your finger https://www.zdnet.com/article/police-cant-force-us-citizens-to-unlock-their-phone-by-face-or-finger/ https://www.zdnet.com/article/police-cant-force-us-citizens-... Another ruling: https://www.forbes.com/sites/thomasbrewster/2019/05/10/the-us-government-cant-force-you-to-unlock-your-phone-with-your-fingerprint-another-judge-rules/#7ae3b0e24445 https://www.forbes.com/sites/thomasbrewster/2019/05/10/the-u...
- jessriedel 7y ago
  This is not at all settled law, so it is not safe to assume the government can't force you to provide biometric decryption data. https://reason.com/2019/01/15/search-warrants-and-compelled-biometric/ https://reason.com/2019/01/15/search-warrants-and-compelled-... https://observer.com/2019/05/police-force-unlock-phones-nj-supreme-court/ https://observer.com/2019/05/police-force-unlock-phones-nj-s...
- martin_a 7y ago
  They will drug you and beat you to shit until you unlock it. Wonder why you are so naive and think that they won't do bad things if they are _really_ interested into getting into your phone.
deleted 7y ago
[deleted]

mattlondon 7y ago

From what I understand, the pixel 3a contains the titan m security hardware that is detailed here: https://www.blog.google/products/pixel/titan-m-makes-pixel-3-our-most-secure-phone-yet/ https://www.blog.google/products/pixel/titan-m-makes-pixel-3... (this talks about the pixel 3 but the 3a has the same thing from what I have read) ... but of course XKCD got it completely right: https://www.xkcd.com/538/ https://www.xkcd.com/538/