1

is there a way to disable app installations until you provide a certain PIN? I have the following scenario in mind:

I'm a heavy Google Photos and Google Drive user, but only from my Windows computer as cloud-backups.

When I loose my smartphone and they "somehow" got access to it (even though I'm using fingerprint - but you never know. I would not bet against it that there is ANY way to break into the phone) -> Even though they I'm not yet using Google Drive or Photo Android apps, people could easily install them on the phone and as my Google account is known to the phone, they could do whatever they want with the data.

Is there ANY way to protect against it? Can you trust Android lockscreen if you use fingerprint sensor or is there mostly a way around it?

I know I can detach devices from my granted account-access for services like Google, Dropbox, Facebook from the Web-Frontend - but what if I don't have any internet connection - or if I am away from home and I use 2-step auth using my phone? Then I can't simply login from any other computer then the one at home to revoke Account-Authentication for the mentioned apps.


After thinking about my question again and reading your answers - I come to the conclusion, I didnt think the question to an end. Indeed, the core of the question is not really about preventing anyone from installing any app, because as Mike Ounsworth pointed out -> If they gain access, they can somehow do it for sure.

So I guess I should rephrase the question to: How to best protect against anyone from stealing my identity if they gain physical access to my device by stealing it or finding my lost device.

Is the Android safe, i.e. can I trust it so that it keeps anyone out even if they have all their tools on Windows, which are available on the darknet or anywhere else.

  • 1
    Yes, you could encrypt your phone, and use a PIN / password instead of a fingerprint, which would be more secure. – JonasCz Jun 10 '16 at 16:13
  • PIN / PW is more secure? :-O Wouldn't have thought so. And aren#t there any known attacks? I mean, in the past, the Android Lockscreen was EASILY breakable using USB when you have the full Toolsuite available on some computer. If they supply power to my stolen phone until they have a computer available -> Not possible to break in? – tim Jun 10 '16 at 16:20
  • If it's encrypted, no, it's not possible to break in. At least there are no attacks against android's encryption that I know of. Even without encryption, the android lockscreen has become a lot better security wise, and it's a lot harder to break in these days than it was in the past. – JonasCz Jun 10 '16 at 16:23
  • 1
    lol - you've taken your question from one extreme to the other, from extremely specific "PIN on app store?" to extremely broad "secure Android against physical access by the best hackers?". I think the only answer that takes less than 1,000 pages is "Security is hard. Set a strong password and leave the complicated stuff to the professionals." – Mike Ounsworth Jun 10 '16 at 19:12
  • Yes might be - but if you think about it, it totally makes sense. As the specific question was actually the first approach on how to secure my data (on the examples of google drive / google photos etc) - but if continue that idea, it gets quickly to "secure every data", which effectively will yield the question "is my android device secure"? – tim Jun 10 '16 at 19:47
2

The core of your question seems to be:

If I lose my phone, can I prevent the attackers with physical access from installing apps through the apps store?

The hidden assumption here is that you don't mind if they get into your device and root around in the apps / data that are already there, but you really don't want them installing new apps. Well, they're into your device, presumably they have access to your SMS, email, and 2FA code generator app so they are you; they can more or less reset any passwords they want.

This is an oddly specific request, so I think the standard advice applies:

  1. Use a strong password so they can't get onto the device at all.

  2. If you know you've lost the device, use Android's remote lock / erase functionality (yes, this requires both you and the device to have internet connectivity).


As for

Can you trust Android lockscreen if you use fingerprint sensor or is there mostly a way around it?

I typed "fingerprint unlock spoof" into Google and got a list of articles like this and this which tell me how to lift fingerprints off the device screen and create a fake fingerprint that will unlock the device. The process takes 15 - 30 minutes if you know what you're doing. So yeah, fingerprint unlock is fine for keeping your kid sister from reading your texts, but don't mistake it for real security.


Addressing comment:

I'm very curious why fingerprint is less secure then a password.

Two reasons:

  1. You don't leave a copy of your password on every glass, table, doorknob, iPhone that you touch.

  2. If your password gets cracked, you can change it. Fingerprint not so much.

  • Thanks. I rephrased my question a little bit. I guess, this is really my aim, to protect against general attacks. And thanks for the Edit, Ill read it - Ill investigate here a little bit more! EDIT: That means, using a PW is totally safe if it is good enough against guessing it? – tim Jun 10 '16 at 19:04
  • @tim Updated answer to address comment. – Mike Ounsworth Jun 10 '16 at 19:08
1

is there a way to disable app installations until you provide a certain PIN?

Possibly via a device owner app, but that has to be set up when the device is first powered on. Or, possibly via a custom ROM. Otherwise, no.

even though I'm using fingerprint - but you never know. I would not bet against it that there is ANY way to break into the phone

It is theoretically possible that there is an attacker with the tech savvy to get past a lockscreen, who then suffers a fatal stroke, and none of the rest of ~7 billion people on this planet can figure out your PIN, possibly because they too all suffered fatal strokes at the same time.

In general, anyone who can get past a lockscreen could get past your don't-install-an-app PIN.

in the past, the Android Lockscreen was EASILY breakable using USB when you have the full Toolsuite available on some computer.

Not since around Android 4.2.

0

Personally I use CM Security which uses application based security... it's free and does everything you're asking for. It will also take a picture using your camera and email you when someone fails authentication of your CM Security password.

It's definitely been helpful for me I love that app. You can lock down any app you want on your phone or EVERY app on your phone. It goes way beyond a lock screen just to open your phone. You can set it to require the pin/pattern for every app you open.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.