Can an Android device connect to the internet before the user enters their decryption password? I assume it cannot connect to saved WiFi networks, as these should be encrypted, but how about mobile networks?
Add a comment
|
1 Answer
Yes, it can. Android uses File Based Encryption which has Device Encrypted storage that encrypts device data and non-personal user & app data without screen lock credentials so that this data can be decrypted in Before First Unlock (BFU) state. Device Encrypted (DE) storage includes data like WiFi passwords, Bluetooth connections, alarms, theme, wallpaper, apps & device settings. Apps can also mark some of their data to be encrypted by DE so that they can operate in BFU state. Most of your personal and app data is encrypted under Credentials Encrypted (CE) storage which requires screen unlock credential for decryption.
Mobile networks and SIM card does not depend on device encryption. Only /data partition is encrypted. /system and /vendor partitions kickstart the hardware components. As soon as their firmware is loaded from /vendor after verified boot checks, modem starts searching for mobile networks and then SIM card authenticates with the station. You will receive incoming calls and SMS but you won't be able to see their contact names. For security reasons, the incoming SMS is not shown in BFU state either. As device settings are decrypted at BFU state, your device knows your preferred connections to choose from. From Android 12 onwards, you can disable 2G connections.
Android 12 devices support Resume on-reboot feature which schedules reboot for OTA updates. This requires an internet connection before and after the scheduled reboot so that the device can connect to Google servers to obtain the encryption key which is used to fully resume the device without having you unlock it.
-
Comments are not for extended discussion; this conversation has been moved to chat.– Firelord ♦Dec 14, 2022 at 12:19