4 ms·

The RMA instructions should include using android.com/find to lock and wipe an inoperable device if it ever gets turned on again. https://support.google.com/ac

by bhawks 5y ago

The RMA instructions should include using android.com/find to lock and wipe an inoperable device if it ever gets turned on again. https://support.google.com/accounts/answer/6160491?hl=en https://support.google.com/accounts/answer/6160491?hl=en

mattnewton 5y ago
This is what apple asks you to do IIRC. They could have just copied that practice instead of having to learn the hard way why ಠ,_｣ಠ Though, this apparently didn't save apple in at least one recent case: https://www.theverge.com/2021/6/7/22522560/apple-repair-multimillion-iphone-nude-photos-privacy-settlement-pegatron https://www.theverge.com/2021/6/7/22522560/apple-repair-mult...
- rootusrootus 5y ago
  > this apparently didn't save apple I can't imagine it would. It isn't a contract, just a best practices guide. Apple and Google are still ultimately responsible for what their employees do on the job.
deadbunny 5y ago
I would suggest that this should also be part of the RMA process for the repair center. I'd assume it can be done on some device id basis, so 1) Check in phone 2) Initiate wipe 3) put in service tech queue
qwertox 5y ago
> About a month ago my wife broke her pixel phone. It couldn't be turned on so we couldn't wipe it. That says it all. You can't expect them to try 24/7 until they get a confirmation. In addition, I doubt that they would have included the SIM card in the RMA, which means that the device would not be online through mobile, and there's no reason for the repair shop to connect the device to the WiFi as the first step, so that any erase-request can come through. You either trust the RMA process or you burn your phone.
- kelnos 5y ago
  That's fine. Just put in one request to wipe it, and if/when the device comes online, it'll get wiped. If it doesn't come online, then the attacker is sophisticated enough to predict that, and used something else (USB) to pull files off the phone. But since the old phone was still on OP's "Find My Phone" account, and was successfully pinging the service, clearly it had been connected to WiFi, so a queued remote wipe should have worked. Sure, this won't catch all cases, but if you are unable to factory-reset a broken phone before sending it in, it would be useful to instruct the customer to queue a wipe online instead. Not perfect, but better than nothing.

by bhawks 5y ago

mattnewton 5y ago

This is what apple asks you to do IIRC. They could have just copied that practice instead of having to learn the hard way why ಠ,_｣ಠ Though, this apparently didn't save apple in at least one recent case: https://www.theverge.com/2021/6/7/22522560/apple-repair-multimillion-iphone-nude-photos-privacy-settlement-pegatron https://www.theverge.com/2021/6/7/22522560/apple-repair-mult...

rootusrootus 5y ago
> this apparently didn't save apple I can't imagine it would. It isn't a contract, just a best practices guide. Apple and Google are still ultimately responsible for what their employees do on the job.

deadbunny 5y ago

I would suggest that this should also be part of the RMA process for the repair center. I'd assume it can be done on some device id basis, so 1) Check in phone 2) Initiate wipe 3) put in service tech queue

qwertox 5y ago

> About a month ago my wife broke her pixel phone. It couldn't be turned on so we couldn't wipe it. That says it all. You can't expect them to try 24/7 until they get a confirmation. In addition, I doubt that they would have included the SIM card in the RMA, which means that the device would not be online through mobile, and there's no reason for the repair shop to connect the device to the WiFi as the first step, so that any erase-request can come through. You either trust the RMA process or you burn your phone.

kelnos 5y ago
That's fine. Just put in one request to wipe it, and if/when the device comes online, it'll get wiped. If it doesn't come online, then the attacker is sophisticated enough to predict that, and used something else (USB) to pull files off the phone. But since the old phone was still on OP's "Find My Phone" account, and was successfully pinging the service, clearly it had been connected to WiFi, so a queued remote wipe should have worked. Sure, this won't catch all cases, but if you are unable to factory-reset a broken phone before sending it in, it would be useful to instruct the customer to queue a wipe online instead. Not perfect, but better than nothing.