1

Recently, both Google and Apple announced their new OSes encrypt the device by default. This caused a lot of complaints from government agencies. Let me quote an article

http://trendblog.net/fbi-worries-android-l-ios-8-data-encryption-going-too-far/

Apple, for its part, has made iOS 8 so thoroughly encrypted that the company itself can’t unlock either iPhones or iPads for police or anyone else unless they have the user’s passkey.

Google is mirroring the same procedure by making the latest (not yet available) version of Android encrypt all user data by default instead of having the encryption as an available option. Just like with Apple’s data protection update for iOS 8, the new version of Android will also be uncrackable without access to the user’s passkey, even by Google itself it seems.

Currently, Android features a cryptography function to protect the sdcard partition and extSdcard too so that the device can be decrypted on boot and unlocked during usage only with a password (you cannot have a pattern lockscreen enforced, for example: certain devices require you a minimum password complexity level).

Here comes my question: given that Google and Apple only announced "by default"-cryptography, and given an expert user can encrypt the device by himself, and given that the FBI deals with people with great expertise in proptection technologies [the criminals, to clarify], what is the real Android security level when using cryptography?

With regards to versions < 5.0

  • Does Google have ways to unlock or decrypt the device without user key? (Maybe, because you can unlock your phone with your Google account, and Google has technical control over your account)
  • Is the widely-announced feature a revising of the classic sdcard protection or a brand new way to encrypt the device?
  • Unlocking the device with your Google account isn't the same as decrypting it. Which are you asking about? – Dan Hulme Nov 11 '14 at 15:22
  • Sure, but if you hold an unlocked phone in your hands you can inspect it. So I'm asking for both – usr-local-ΕΨΗΕΛΩΝ Nov 11 '14 at 15:23
1

What is the real Android security level when using cryptography?

The cryptography is strong itself. Its application can be weak in systems of many applications and heterogenous hardware. Many outdated applications can also increase the risk of security tweaks. I can say that the security level of Google Pixel (sorry Android 7.x) can be strong because of both hardware and software control in the development of the product.

Does Google have ways to unlock or decrypt the device without user key? (Maybe, because you can unlock your phone with your Google account, and Google has technical control over your account)

There are no standard ways to do this. Secondary ways may exists but they are because of other reasons, than Google.

Is the widely-announced feature a revising of the classic sdcard protection or a brand new way to encrypt the device?

I think no. I see no revises on the classic sdcard protection system here.

  • No doubt secondary ways (i.e. vulnerabilities) may exist. San Bernardino and Tiziana Cantone's iPhones were both cracked exploiting a vulnerability, but at least the spirit was to make both strong like steel – usr-local-ΕΨΗΕΛΩΝ Feb 15 '17 at 21:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.