4

I found the explanation for Android M, how does it work now in Android N? Bonus question: is it right to say that the encryption in N is weaker than the one in M? Because the OS can now be started up without pin/pass, so maybe this could bring some advantages to an attacker?

Improve this question
1
  • 1
    You security concern is a possible vulnerability indeed, but the insecurity in this case is not the OS' fault, its of those apps which store critical data in Device-Encrypted Storage, which is the one accessible on device boot without unlock. If they store they data on Credential-Encrypted Storage, that data is not accessible without the device being unlocked.
    – Tamoghna Chowdhury
    Oct 11, 2016 at 10:40

1 Answer 1

Reset to default
3

This doesn't address how encryption is done in Nougat but addresses your concern

Because the OS can now be started up without pin/pass, so maybe this could bring some advantages to an attacker?

The boot process is actually strengthened by strictly enforcing verified boot

As explained in Google is making it harder to root Android 7.0 Nougat,

Google wants to make its OS safer and to do that it has come up with features like verified boot to make sure that everything is working as it should be, and that no one — not even the intended user — can do something to change that and expose themselves to unnecessary risks.

What happens if your device fails the test on booting?

If your device fails the tests — Google gives a corrupt boot image and verified partition as examples — it may not boot at all. But if it does boot, it will do so in a “limited capacity” and only with your consent.

Downsides of this

  • Difficulty in rooting, which would be overcome in time by developers or if OEMs don't implement this feature in their devices

  • Data corruption

Google says that by using verified boot the impact of data corruption increases, and therefore reliability is reduced. However, there is an error correction feature that will help recover from data loss, which should also minimize the chances of it impacting users. Google notes that there is an overhead of 0.8 percent with regards to space but no performance toll, unless, of course, there is data corruption detected.

(Emphasis supplied)

See for details on Strictly Enforced Verified Boot with Error Correction

tl:dr; : Theoretically, this ensures that your OS system is intact on booting by not booting or booting with reduced functionality if the system is corrupted / modified by malware or attackers - which increases your protection.

Improve this answer
3
  • There is still the possibility to also password protect the booting in Android N, so activating this would result in more security, right? otherwise why would be the option be there?
    – David
    Oct 12, 2016 at 12:39
  • That may be an additional layer of security for user comfort. As it stands, it looks like safeguards have already been built into OS. I am not on Nougat to to comment further
    – beeshyams
    Oct 12, 2016 at 12:46
  • As explained here, by normal direct booting you are giving limited functionality, and by password protected booting, you are gaining access to complete access of device contents
    – beeshyams
    Oct 15, 2016 at 10:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .