22
A sophisticated threat actor could potentially exploit the Android Debug Bridge's key file permissions by switching your phone's motherboard to another same model phone and some tinkering.
From then on, provided he knew how to get there, even an encrypted device might be under threat of full decryption.
The key factor here is the fact nothing is ...
20
Without full-disk encryption, your unencrypted data can be read without recovering the pincode. Enabled USB debugging, definitely, extends the attack surface, but it's not necessary for a determined and skilled thief.
But most likely, they will wipe everything and resell your phone to get the daily dose.
13
Without the encryption, your data can be trivially read out using a flash adapter such as this one:
Removing a flash chip is a 5 minutes job on a hot air rework station.
Of course, this assumes that the thief decides that the data on your phone is worth more than they could get by wiping and reselling it. If you have an old inexpensive phone or it has ...
11
Is 2FA via mobile the best security there is? No. SMS 2FA is the weakest form of 2FA, however, it's still worthwhile because it does improve security and it has a relatively low barrier of entry especially for non-technical users.
What can be improved? You can use TOTP token using apps like Google Authenticator. This still uses your mobile phone, but it ...
4
While mutual TLS and certificate pinning are intended for different problems they can be used to solve the specific problem of detecting active MITM too. Only, with mutual TLS it is the server which detects the MITM (client certificate not as expected) while with certificate pinning it is the client (server certificate not as expected).
Implementation ...
3
Flash memory could be read externally by a very determined attacker, but probably a random pickpocket isn't going to bother. Full disk encryption would eliminate that possibility.
An unlocked bootloader would allow simply changing the device password from a recovery environment, but given that your phone's bootloader is not unlocked and bootloader exploits ...
2
If your phone is powered on during access, and they have a way to get past your lock codes, I don't see why not.
In the end, phones nowadays are just computers, and if you give someone else physical access to your computer, it's not your computer anymore.
One example would be that the attacker disables the 3d party APK install protection and downloads his ...
1
Your first concern is a very real one, services who don't understand that sometimes, some customers may have no access to text messages – these services are wrong.
However, having other software running on your phone is not the worst concern regarding 2FA via SMS.
OK, some bad actor will read a one-time 6-digit authorization token. They cannot reliably ...
1
The CAC seems to be a typical smartcard where the private key is stored on the card itself and crypto operations involving the private key like signing are also done on the card. Such smartcards do not allow extraction of the private key. In fact, that is the main purpose of these cards that any use of the private key should explicitly require physical ...
1
Whatsapp asynchronous messaging and calling use different protocols for communication. For messaging it uses XMPP and for VoIP it uses SRTP for multimedia communication.
Both can be distinguished by their different traffic fingerprints. SRTP uses UDP as transport protocol and media elements are end-to-end encrypted. While directly analysing the UDP header ...
1
ISPs in general can detect VoIP connections because these network flows in general have specific network metrics such as , constant rate, a relationship between up stream and downstream and some more. However, some applications such Skype the embed all encrypted traffic on one network flow, make impossible to know how many messages has been sent. In the case ...
1
If you are worried that the client can fall in malicious hands, take into account that you app can be instrumented such that the certificate is still valid, but the payload is manipulated and/or stolen.
Consider two distinct scenarios:
To instrument your app such that the certificate for mutual TLS is still valid, but the data is manipulated and/or ...
Only top voted, non community-wiki answers of a minimum length are eligible
