3 ms·
The article doesn't specify how the backup is encrypted, but it says that in can be decrypted with a PIN or unlock pattern. These are weak keys and can be easil
by codedokode 4y ago
The article doesn't specify how the backup is encrypted, but it says that in can be decrypted with a PIN or unlock pattern. These are weak keys and can be easily bruteforced by Google.
Also if you get banned from Google then you might lose access to your keys.
- lll-o-lll 4y agoThey can only be decrypted on the device with the TPM. Google would need to have your device.
- codedokode 4y agoI think that you are wrong. The blog post [1] says: > In some cases, for example, when the older device was lost or damaged, users may need to recover the end-to-end encryption keys from a secure online backup. > To recover the end-to-end encryption key, the user must provide the lock screen PIN, password, or pattern of another existing device that had access to those keys. This clearly states that you don't need original device to decrypt the keys: you only need a backup and a PIN code or unlock pattern which are easy to bruteforce. [1] https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html https://security.googleblog.com/2022/10/SecurityofPasskeysin...
- brookst 4y ago> of another existing device that had access to those keys Doesn’t that mean you have to be able to log in to a device that has the keys stored locally? I did not take that to mean you can just give google the pin and they can provide the keys.
- codedokode 4y agoAlso, on Android instead of real TPM they often use a Trusted Execution Environment, which is basically a CPU mode.