>is arguably hard unless they could read the key from RAM... That's the fine print that kind of makes FDE a bad fit for mobile. (At least FDE as it's typically

>is arguably hard unless they could read the key from RAM... That's the fine print that kind of makes FDE a bad fit for mobile. (At least FDE as it's typically implemented.) I don't think it's any secret that Trust Zone has a larger attack surface than Secure Enclave, but cold boot attacks to extract data from RAM are stupidly pedestrian. At least make it hard for them. Apple's self destruct is extremely poor UX for any user cursed with the misfortune of forgetfulness, but it's a lot more secure than Android's Trust Zone.