Tell me more ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.
up vote 6 down vote favorite
1

A new policy at my work is being drafted regarding email access on phones. A requirement will be that the phone must automatically have all data erased after a certain amount of failed login attempts. Let's ignore the fact that it's pretty silly to a.) be allowing work email access on personal phones when such stringent expectations are in place, and b.) expect to be able to enforce something like this across a variety of phone platforms. Is it possible to set this up in vanilla Android without any apps?

share|improve this question
3  
Not related to the number of logins, but if you use the default email app with Outlook, and Outlook is configured properly, you need to accept the ability for remote wiping. Presumably then the Outlook administrators can wipe the phone's data remotely. (There are other questions here about how to prevent that that might be useful for you.) – Al Everett Sep 22 '11 at 12:25

2 Answers

up vote 6 down vote

The problem is that wiping data requires to overwrite it. On todays devices with lots of in-device flash memory and large SD-cards this can take a while - up to several hours. This leaves a lot for the attacker to interrupt this process and try again. Therefore wiping triggered by false login attempts is only reasonable if your data is encrypted. Then you wipe the device by simply erase the key from memory that is required to read/write your data.

Since Android Honeycomb (3.0) you have the possibility to encrypt all your data and to erase the device if the wrong password/pin has been entered several times. Therefore what you want to achieve is only possible with android tablets at the moment. For smartphones you have to wait for Android (4.0) Ice Cream Sandwich.

share|improve this answer
Right on. You can quickly make the device unusable without encryption, but you can't quickly make its data unrecoverable without encryption. – Matthew Read♦ Sep 22 '11 at 16:06
"Since Android Honeycomb (3.0) you have the possibility to encrypt all your data and to erase the device if the wrong password/pin has been entered several times. For smartphones you have to wait for Android (4.0) Ice Cream Sandwich." --- could you shed some more lights here please? Is it actually available? – zerkms Feb 27 at 4:39
Most Android 4.x devices include encryption support. However this only applies to the internal memory. The encryption is based on your lock scree passwoard which there has to be 8+ chars to be secure. External memory on an SD-card can only be encrypted by certain Samsung devices. – Robert Feb 27 at 9:02
@Robert: encryption is a good thing, but it's helpess against brute-force. If you've lost your device and it's locked by sim or gesture - then it will take less than a day to brute force manually. For 8 chars password you may use some intelligent way of bruteforce - I'm sure there are some. That's what the auto-wiping feature useful for. PS: not even mention that you'll get bored soon to enter 8 char password each time you unlock your phone – zerkms Feb 27 at 10:00
up vote 2 down vote accepted

Apparently, this might not be a built-in security option in the OS itself, but Exchange ActiveSync can enforce this requirement.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.