4 ms·

> Several manufacturers have now implemented on-by-default device encryption with no backdoor. Both Apple and Google's schemes are predicated on the assumption

> Several manufacturers have now implemented on-by-default device encryption with no backdoor. Both Apple and Google's schemes are predicated on the assumption that you'll have a full phone backup stored in the "cloud." They also offer photo backup and sync other key data. The whole setup is meant to make an individual phone (and Chromebook) completely hardware agnostic. You lose your old phone? You buy a new one, sign in, wait a bit and like magic it is all set and ready to go. Windows (and OS X) aren't really designed with that model in mind, so if you lose your keys you may not have your data stored elsewhere (and indefinitely data loss due to a HDD/SSD failure is extremely common). > With Microsoft's solution, you oay all the overhead -- and still get a much more limited form of protection. In this context "much more limited" is against: almost every government in the world, private individuals, and against private companies. So, what, like 98%+ of the world's population? You make it sound like Microsoft's device encryption scheme uses ROT13. Instead they're using industrial strength encryption and your only real criticism is that either someone with a court order or the NSA can potentially gain access. That's still a huge win for day to day security. If someone breaks into my apartment and steals my laptop, I will be a bit less concerned about potential identity theft as it is reasonable to assume that your average street thief isn't an NSA agent.

biafra 12y ago
Since when can I do a full backup with Google/Android? Let alone store it in some cloud? If this is really possible, how do I do it? There is a backup api that backups stuff the developer of the individual app thinks about storing. And there is adb backup which does backup some stuff of apps that allow it. There are full backup solutions but they are not by Google and they require an unlocked bootloader to install them in the recovery partition or root. So if you know a full backup solution by Google for Android that does not require root or an unlockes bootloader I'd be interested to hear about it.
- UnoriginalGuy 12y ago
  > Since when can I do a full backup with Google/Android? Since at least 4.0? Maybe earlier? I have three full phone backup providers installed by default, Google, Samsung, and one by AT&T (ick). > Let alone store it in some cloud? That's the default way to do backups on Android. Look in the "Backup & Reset" sub-menu in settings. > If this is really possible, how do I do it? Here's an article from 2012: http://www.techhive.com/article/248984/how_to_back_up_your_android_phone.html http://www.techhive.com/article/248984/how_to_back_up_your_a... I'm talking about the first style of backup that backs up more than the data types listed in this 2012 article.
  - berdario 12y ago
    Do you realize his questions were mostly rethorical? > There is a backup api that backups stuff the developer of the individual app thinks about storing. And there is adb backup which does backup some stuff of apps that allow it. "thinks about storing", "some stuff"... he's criticizing the fact that the backup solution that most Android users rely upon aren't really backing up everything (The same thing happened years ago with Time Machine on MacOsX, not sure if it improved) I also realized at restore-time that my backups weren't really comprehensive... so I understand if people are bitter about the currrent state of things
joosters 12y ago
Both Apple and Google's schemes are predicated on the assumption that you'll have a full phone backup stored in the "cloud." What utter rubbish. You do not need to turn on iCloud backups to use any of the encryption features.
- UnoriginalGuy 12y ago
  You call it utter rubbish then make a correction to a point I never made. I won't argue with a point I never made. Good day.
matthewdgreen 12y ago
> Both Apple and Google's schemes are predicated on the assumption that you'll have a full phone backup stored in the "cloud." They also offer photo backup and sync other key data. I wouldn't grant that. The whole context of this discussion is related to Microsoft's SkyDrive, which is a free cloud service offered to MS customers. It even provides photo and document backup if you want it. I suppose it may not be as developed as iCloud (for iOS devices) but I don't see a principled difference in the two systems. Moreover, the purpose of the recovery key doesn't seem to be related to data backup. If your disk fails or you lose your device then there are two cases: 1. You backed up your data, either to the cloud or to an external backup disk. In this case the device encryption and recovery keys become irrelevant. That's because device encryption is only applied to data on internal drives. 2. You didn't back up your data. In this case your recovery keys are useless, since you don't have the data. So it seems like the use-case for recovery keys is primarily for situations where the user has forgotten his/her password. Saying that Apple/Google don't need to care about this because they have cloud backup (and implicitly MS doesn't) seems like a bit of a cop out. > In this context "much more limited" is against: almost every government in the world, private individuals, and against private companies. So, what, like 98%+ of the world's population? Much more limited against someone who can get your computer/tablet/phone and guess a password or some security questions. Don't jump straight to the NSA when your threat model is adequately met by someone who knows that your password is 'Kitty123'.
- Guvante 12y ago
  > Saying that Apple/Google don't need to care about this because they have cloud backup (and implicitly MS doesn't) seems like a bit of a cop out. No, what people are saying is the average user doesn't store a lot of data on their phone except what they have backed up through a cloud service. The average user has a ton of data that isn't on the cloud on their local machine, losing all of that because they forgot their password isn't something that the user expects so adding encryption with no backdoor hurts the average user more than it helps. Bitlocker doesn't back up the keys anymore than you ask it to and it easily enabled if you care about the NSA being able to get ahold of them. > Much more limited against someone who can get your computer/tablet/phone and guess a password or some security questions. Don't jump straight to the NSA when your threat model is adequately met by someone who knows that your password is 'Kitty123'. If they know your password no amount of device encryption will protect you, that is why he is ignoring them.

biafra 12y ago

Since when can I do a full backup with Google/Android? Let alone store it in some cloud? If this is really possible, how do I do it? There is a backup api that backups stuff the developer of the individual app thinks about storing. And there is adb backup which does backup some stuff of apps that allow it. There are full backup solutions but they are not by Google and they require an unlocked bootloader to install them in the recovery partition or root. So if you know a full backup solution by Google for Android that does not require root or an unlockes bootloader I'd be interested to hear about it.

UnoriginalGuy 12y ago
> Since when can I do a full backup with Google/Android? Since at least 4.0? Maybe earlier? I have three full phone backup providers installed by default, Google, Samsung, and one by AT&T (ick). > Let alone store it in some cloud? That's the default way to do backups on Android. Look in the "Backup & Reset" sub-menu in settings. > If this is really possible, how do I do it? Here's an article from 2012: http://www.techhive.com/article/248984/how_to_back_up_your_android_phone.html http://www.techhive.com/article/248984/how_to_back_up_your_a... I'm talking about the first style of backup that backs up more than the data types listed in this 2012 article.
- berdario 12y ago
  Do you realize his questions were mostly rethorical? > There is a backup api that backups stuff the developer of the individual app thinks about storing. And there is adb backup which does backup some stuff of apps that allow it. "thinks about storing", "some stuff"... he's criticizing the fact that the backup solution that most Android users rely upon aren't really backing up everything (The same thing happened years ago with Time Machine on MacOsX, not sure if it improved) I also realized at restore-time that my backups weren't really comprehensive... so I understand if people are bitter about the currrent state of things

joosters 12y ago

Both Apple and Google's schemes are predicated on the assumption that you'll have a full phone backup stored in the "cloud." What utter rubbish. You do not need to turn on iCloud backups to use any of the encryption features.

UnoriginalGuy 12y ago
You call it utter rubbish then make a correction to a point I never made. I won't argue with a point I never made. Good day.

matthewdgreen 12y ago

> Both Apple and Google's schemes are predicated on the assumption that you'll have a full phone backup stored in the "cloud." They also offer photo backup and sync other key data. I wouldn't grant that. The whole context of this discussion is related to Microsoft's SkyDrive, which is a free cloud service offered to MS customers. It even provides photo and document backup if you want it. I suppose it may not be as developed as iCloud (for iOS devices) but I don't see a principled difference in the two systems. Moreover, the purpose of the recovery key doesn't seem to be related to data backup. If your disk fails or you lose your device then there are two cases: 1. You backed up your data, either to the cloud or to an external backup disk. In this case the device encryption and recovery keys become irrelevant. That's because device encryption is only applied to data on internal drives. 2. You didn't back up your data. In this case your recovery keys are useless, since you don't have the data. So it seems like the use-case for recovery keys is primarily for situations where the user has forgotten his/her password. Saying that Apple/Google don't need to care about this because they have cloud backup (and implicitly MS doesn't) seems like a bit of a cop out. > In this context "much more limited" is against: almost every government in the world, private individuals, and against private companies. So, what, like 98%+ of the world's population? Much more limited against someone who can get your computer/tablet/phone and guess a password or some security questions. Don't jump straight to the NSA when your threat model is adequately met by someone who knows that your password is 'Kitty123'.

Guvante 12y ago
> Saying that Apple/Google don't need to care about this because they have cloud backup (and implicitly MS doesn't) seems like a bit of a cop out. No, what people are saying is the average user doesn't store a lot of data on their phone except what they have backed up through a cloud service. The average user has a ton of data that isn't on the cloud on their local machine, losing all of that because they forgot their password isn't something that the user expects so adding encryption with no backdoor hurts the average user more than it helps. Bitlocker doesn't back up the keys anymore than you ask it to and it easily enabled if you care about the NSA being able to get ahold of them. > Much more limited against someone who can get your computer/tablet/phone and guess a password or some security questions. Don't jump straight to the NSA when your threat model is adequately met by someone who knows that your password is 'Kitty123'. If they know your password no amount of device encryption will protect you, that is why he is ignoring them.