3 ms·

> an iOS device needs to be fully unlocked to be serviced but realistically there should be something between "service access" and "full unrestricted access to

by yosito 5y ago

> an iOS device needs to be fully unlocked to be serviced but realistically there should be something between "service access" and "full unrestricted access to a customer's PII and app state." This exists. Anyone who is security conscious should store all of their sensitive files and PII in an encrypted vault that only they hold they keys to. Realistically, most people don't have the vigilance to do this, and it's pretty hard to do it perfectly. But I highly recommend to everyone at least to install something like Cryptomator to secure their most private documents and information, so that no one else has access even if they gain access to your computer or cloud storage.

g_sch 5y ago
This seems like something that would be difficult to do on a mobile device such as an iOS or Android, which trains the user not to think about the filesystem at all. Is there a user-friendly mobile solution for this?
- bellyfullofbac 5y ago
  I don't think there is a solution as yet, but phones nowadays already have full disk encryption, i.e. the bits stored on the "disk" are garbled, and they have to be read through the decryption layer that transforms the gabled bytes to my_butt.jpg (And well, it also encrypts that image the IM app wants to save, before writing it to disk). The decryption layer gets initialized with a key during the boot process of the phone (after you've entered your password and unlocked the key) and remains active until the phone is shut down. One way of using the above would be to allow "logout" of the main user and login of an e.g. repair user, on logout the decryption key would be erased from memory, and this way the repair user has no access to my_butt.jpg . Actually Android already has the concept of multiple users, and each user has their own data storage, so the can open their own Facebook or Tinder and have the phone be loading their personal profile. Not sure about things stored on disk, though, and AFAIK if a user can be root then s/he can read all the files on the mounted encrypted disk. So, the repair user would not have access to my_butt.jpg, but maybe they need access to an installed app? I guess 1 solution would be to have apps installed on a separate partition to data. Android has a system partition (I'm not familiar with iOS), so if the repair user just needs internal apps, that should be accessible from the system partition.
  - yosito 5y ago
    > phones nowadays already have full disk encryption Full disk encryption is basically useless if the device is turned on/logged in.
- yosito 5y ago
  I use cryptomator on my phone, but you're right, it's not user-friendly at all. I have to remember to delete files after I download them from cryptomator.

by yosito 5y ago

g_sch 5y ago

This seems like something that would be difficult to do on a mobile device such as an iOS or Android, which trains the user not to think about the filesystem at all. Is there a user-friendly mobile solution for this?

bellyfullofbac 5y ago
I don't think there is a solution as yet, but phones nowadays already have full disk encryption, i.e. the bits stored on the "disk" are garbled, and they have to be read through the decryption layer that transforms the gabled bytes to my_butt.jpg (And well, it also encrypts that image the IM app wants to save, before writing it to disk). The decryption layer gets initialized with a key during the boot process of the phone (after you've entered your password and unlocked the key) and remains active until the phone is shut down. One way of using the above would be to allow "logout" of the main user and login of an e.g. repair user, on logout the decryption key would be erased from memory, and this way the repair user has no access to my_butt.jpg . Actually Android already has the concept of multiple users, and each user has their own data storage, so the can open their own Facebook or Tinder and have the phone be loading their personal profile. Not sure about things stored on disk, though, and AFAIK if a user can be root then s/he can read all the files on the mounted encrypted disk. So, the repair user would not have access to my_butt.jpg, but maybe they need access to an installed app? I guess 1 solution would be to have apps installed on a separate partition to data. Android has a system partition (I'm not familiar with iOS), so if the repair user just needs internal apps, that should be accessible from the system partition.
- yosito 5y ago
  > phones nowadays already have full disk encryption Full disk encryption is basically useless if the device is turned on/logged in.
yosito 5y ago
I use cryptomator on my phone, but you're right, it's not user-friendly at all. I have to remember to delete files after I download them from cryptomator.