8

I am using Android 4.4.4. There is an option called phone storage encryption.

From what I have read the crypto is secure. However, I read this article which said Google is able to reset passwords: http://thehackernews.com/2016/03/unlock-google-android.html

How can I prevent google from getting my encryption keys?! I am kind of shocked by the article.

I also read: "In other words, unlike Apple, Google has technical abilities to reset device passcode for about 74% of Android users (~Billions) running all versions older than Android 5.0 Lollipop that does not have full disk encryption."

If the above is true, what is the difference between full disk encryption and phone storage encryption which I am using?

Thank you!

EDIT - In response to comments: My phone is HTC Desire 620. Under settings, storage I have two options: - Phone storage encryption = Protect content on this phone with a password. - Encrypt SD card content = Help prevent other phone from accessing this CD card.

The phone storage encryption to me seems like full disk encryption, so is the article very wrong?

Improve this question
5
  • "what is the difference between full disk encryption and phone storage encryption which I am using" -- you would need to explain what "phone storage encryption" means.
    – CommonsWare
    Commented Apr 1, 2016 at 11:26
  • 1
    @CommonsWare To be fair, that's all it says on the menu option. I recently upgraded from 4.4.1 to 5.0, and 4.4.1 just labels it as "Phone Encryption". It doesn't list a specific method or anything helpful on the phone itself, but I imagine it's burred in some google support post somewhere.
    – WorseDoughnut
    Commented Apr 1, 2016 at 12:48
  • "that's all it says on the menu option" -- and what "menu option" is this? "I imagine it's burred in some google support post somewhere" -- you assume that this has something to do with Android, rather than something to do with a device manufacturer. For example, in Settings > Security on a Galaxy Nexus (Android 4.3), there is an "Encryption" heading with an "Encrypt phone" option. That is full-disk encryption.
    – CommonsWare
    Commented Apr 1, 2016 at 12:55
  • @CommonsWare I'm speaking from experience with two separate (LG from Play Store and HTC from Verizon Store) manufactures distributions of the stock android 4.4.1. So, barring any weird vendor specific menus/launchers you may be referring to, the stock Android 4.4.1 settings menu lists "Phone Storage Encryption" under the "Security" heading, and entering that submenu offers no further explanation into the specifics of the encryption used on the device.
    – WorseDoughnut
    Commented Apr 1, 2016 at 13:56
  • Only because this a more device-specific question than a security question in general, I would consider asking this question on the XDA Forums for the HTC Desire. They would have better device-specific knowledge about the encryption on that specific device. forum.xda-developers.com/htc-desire/help
    – WorseDoughnut
    Commented Apr 1, 2016 at 14:05

3 Answers 3

Reset to default
4

What's going on is that, per the article, Google has the ability to remotely tell your phone to set a new password, which applies to unlocking the phone and unlocking the encryption key. They aren't remotely recalling your encryption key or the unencrypted data, but they are able to sidestep it because your phone will listen to mobile device mgmt instructions given by the Google Android server.

Its important to note that you are basically always trusting your phone's content to the maker (apple OR google), and if they receive a court order of high enough esteem, and they have possession of your device, they will be able to get the information out of it. If you have reason to believe you need to protect the data on it against state-level intrusion, just make sure that it is powered off whenever not in use, since a remote password reset can't happen on a phone that isn't already up and running. This will force them into the situation of needing to completely "break into" the phone as opposed to just remotely unlocking it.

Improve this answer
4
  • Is there any way to stop google from contacting the phone to do that?
    – k1308517
    Commented Apr 1, 2016 at 15:17
  • @k1308517 Sure, turn on Airplane mode.
    – Jeff Meden
    Commented Apr 1, 2016 at 16:06
  • Any sensible ways?
    – k1308517
    Commented Apr 4, 2016 at 8:18
  • 1
    @k1308517 honestly no, if you are running the Google commercial version of Android they have a lot of control over the phone, including remote access. This is a two edged sword that facilitates all kinds of good things like MDM, security updates, remote backup, etc. If you want out, you either need to run Cyanogenmod or perhaps root it and run a firewall that blocks a swath of google server IPs.
    – Jeff Meden
    Commented Apr 4, 2016 at 12:48
2

That is true. Third party software can so similar if they have the phone in their possession. Phone storage encryption with encrypt your files "/sdcard" being some application data and some of your personal files in most cases. In other it will just encrypt your personal data. Depends if the applications installed use /sdcard to say store database/config files in. Full disk encryption will encrypt everything. So the filesystem and your personal files.

Improve this answer
4
  • Can and how do I stop google getting my decryption key? Is my only option to have Android 5.0 or above? Thanks for your good answer.
    – k1308517
    Commented Apr 1, 2016 at 14:01
  • @k1308517 They don't have the decryption key, they merely have leverage to compel your phone to decrypt the data (which is exactly what happens to any device under attack from a sufficiently resourceful foe) including the "San Bernadino Shooter" iPhone.
    – Jeff Meden
    Commented Apr 1, 2016 at 14:17
  • Okay, so how can I stop them from being able to decrypt my phone?
    – k1308517
    Commented Apr 1, 2016 at 15:14
  • @k1308517 quite simply the only solution is to not use their phone. As the producer of the software and hardware specs, they have lots of opportunities to control ways to unlock the phone, and they are simply not in the business of selling a phone that makes data impervious to all angles of attack.
    – Jeff Meden
    Commented Apr 1, 2016 at 15:17
1

In other words, full disk encryption only provides data at rest security. Nothing new here!

Data at rest security means that the literal data itself cannot be decrypted without the key. If the key is still in memory while the device is powered on, then anyone with access to the device (e.g. if the device is unlocked, or if it gets hacked, or cold booted, or gets a malicious or "court-authorized" update) can either extract the key or set a new one. Or just read the contents of the unlocked disk.

If you want your phone's disk encryption to be secure, power it off. As long as it is powered off, not just sleeping but totally off, then there is nothing at all Google, or the FBI, or the NSA, or Chuck Norris could do. Unless your password is weak enough to crack, of course.

Improve this answer
7
  • So make sure battery isn't in phone when you get a loud bang on the door.
    – k1308517
    Commented Apr 4, 2016 at 8:21
  • Or make sure the battery isn't in the phone when the warrant is signed to remotely send an "update" to your phone to extract the key and information without your knowledge or interaction at all. ;)
    – forest
    Commented Apr 5, 2016 at 3:53
  • Isn't there like a host file where I could block URLs to prevent that happening?
    – k1308517
    Commented Apr 5, 2016 at 10:34
  • Yes, block the ability of Apple to update and contact the system at all. If you do that, your system will be unable to update, and it will grow outdated and insecure. Possibly, it might not even be able to access the internet at all. But you will be able to prevent Apple from sending an evil update. In other words, there's really no way to prevent that.
    – forest
    Commented Apr 6, 2016 at 2:34
  • You mean Android? @forest Would Black Phone be a viable solution?
    – k1308517
    Commented Apr 6, 2016 at 9:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .