Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It only takes a minute to sign up.
Sign up to join this community
I understand that my Android phone is encrypted, however I never input any password to decrypt the phone. If the key is stored in some hardware component but is automatically retrieved every time my phone boots, how is it secured?
Edit: I do have to unlock my phone, but that's after it's booted. Doesn't seem logical.
My phone clearly states its encrypted:
This question came from our site for information security professionals.
The data is encrypted by default, but if you don't have a pin, or code to unlock your phone, then it's obviously not secure at all.
If you set a pin, password, or pattern lock etc. then you will need to provide this when the phone boots, to decrypt the drive.
A PIN/Password/Pattern/Swipe at lock screen only unlocks for access, not decryption. You have to setup actual encryption on the device at boot level, before your lock screen policy.
Unlocking phone for use/access does NOT equal decryption.
According to the Android documentation it uses a default password of "default_password". This is obscured by a hash involving hardware encryption keys and a salt unique to your hardware signature.
As already mentioned, this isn't very good security so there's not much point. Without securing your phone with a strong password to rehash the key, it's easy to get into. What wouldn't be easy would be recovering your data if you had some sort of hardware damage. If you were able to externally mount it all you'd get is encrypted garbage; all this for what added security? So the FBI can't see videos of my kids graduation? This is a move to encourage you to back up your data into the manufactures cloud infrastructure... the least secure thing you can do.
