Hot answers tagged

356 votes

Police forcing me to install Jingwang spyware app, how to minimize impact?

This may not be the answer you will be happy with but how about abstaining from having any undesirable data inside your phone in the first place and instead using the right tool for the job? ...
user avatar
  • 2,296
194 votes

Police forcing me to install Jingwang spyware app, how to minimize impact?

Get a phone which doesn't support Android apps. Why are so many of the answers complex? And not just complex, fragile and suspicious and downright dangerous to the questioner? You want to use your ...
user avatar
  • 2,175
93 votes
Accepted

Security implication if android app can be installed on emulator

It is unclear what kind of security requirements you have in the first place and thus it is unclear if your security measures are sufficient or not. Fully protecting against a malicious user using ...
user avatar
90 votes
Accepted

Bypass with wrong cvv of debit card and getting OTP

But shouldn't it suppose verify before I get the OTP? What's the reason, Isn' it a security issue? This is absolutely NOT a security issue! quite the opposite it's a protection. Lets go through ...
user avatar
  • 3,699
88 votes
Accepted

Can phone apps read my clipboard?

Android Prior to Android 10 any app could freely register listeners to receive the clipboard contents whenever they changed. As of Android 10, only the current app with focus and any app set as the ...
user avatar
  • 4,438
86 votes
Accepted

Google account verification request

Google says it's not a security problem and that you don't have to worry. After investigation they issued a statement in the Google product forums: What happened? During routine maintenance [from 1pm ...
user avatar
  • 43.8k
85 votes
Accepted

Why do mobile devices force user to type password after reboot?

First: password is used to get access to the full disk encryption key fingerprint is used to unlock the screen (of an already "decrypted" device) Encryption key retrieval must be: accurate - on ...
user avatar
  • 9,131
85 votes
Accepted

How can Android encryption be so fast?

Encryption happens in memory, not on the disk. You are misunderstanding how disk encryption works. It does not read the entire disk and replace it with a decrypted version. Rather, when a file or ...
user avatar
  • 64.1k
81 votes

Police forcing me to install Jingwang spyware app, how to minimize impact?

This is a tricky one. It goes without saying, but it's also a dangerous one. Attempting to circumvent these restrictions and getting caught doing so will potentially cause a lot of legal trouble. ...
user avatar
81 votes
Accepted

Downsides of showing email address on Android lock screen

Your email address is generally public knowledge, so disclosing it is often not a big security risk. But it gets complicated when it's your phone. Because your email address is often used as your ...
user avatar
  • 123k
64 votes

How can common users defend against the StageFright vulnerability?

You should disable the automated downloading of media files through SMS/MMS, there are multiple services that use this. Depending on which you use, you should disable this in the settings per service ...
user avatar
  • 4,394
60 votes
Accepted

Why is Firewire a bigger threat than USB?

Firewire and also Thunderbolt provide direct access to the OS memory, thus bypassing the operating system. See Wikipedia: DMA attack for more details on the possible attacks. USB does not provide ...
user avatar
60 votes
Accepted

My Android phone is vulnerable, but there are no updates?

You are essentially asking what to do if you are using software which is known to be vulnerable but where no updates are available. This is a problem not restricted to Android phones but you'll find ...
user avatar
57 votes
Accepted

Are staggered roll outs of security patches bad?

Excellent question. Yes, your understanding is correct, as well as your rationale behind it. Staggering roll outs for new features often makes good sense. Staggering roll outs for security patches ...
user avatar
55 votes

Police forcing me to install Jingwang spyware app, how to minimize impact?

They can execute code on your device while they have physical access to it. And you can't refuse it. I'm sorry to say that but you are basically doomed. There's no way to trust this device anymore. ...
user avatar
  • 2,523
52 votes

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Is 2FA via mobile the best security there is? No. SMS 2FA is the weakest form of 2FA, however, it's still worthwhile because it does improve security and it has a relatively low barrier of entry ...
user avatar
  • 31k
50 votes

How can Android encryption be so fast?

It doesn't decrypt the full disk at startup. Instead, it continously decrypts data as it is read from the disk when it is read from the disk, leaving the actual content on the disk untouched and ...
user avatar
  • 64.2k
49 votes
Accepted

How does Android L achieve strong encryption with a low entropy passphrase?

Chip-based banking cards typically use a 4-digit PIN. It would take at most a few hours to try them all if the card didn't protect against brute force attempts. The card protects against brute force ...
user avatar
48 votes
Accepted

Why are there more research papers on Android malware than iOS malware?

Android has 87% market share. Even if attackers manage to infect small percent, that is still lot of devices they can cover in small time frame they get before the vulnerability is fixed or malware is ...
user avatar
  • 6,061
47 votes
Accepted

How exactly does the Stagefright Vulnerability work on Android?

The details will be released on the 5th of august. However, on the Cyanogenmod github repository there are several interesting details that appear to be related: it appears that certain fields in 3GPP ...
user avatar
  • 608
47 votes
Accepted

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

At a high level, disk encryption is implemented using a data encryption key (DEK) and a key encryption key (KEK). The DEK is generated randomly and used to encrypt the drive, the KEK is derived from ...
user avatar
47 votes
Accepted

Can a stolen Android phone with USB debugging enabled have screen lock bypassed?

A sophisticated threat actor could potentially try to exploit the Android Debug Bridge's authorization protocol by switching your phone's storage media to another same model phone with already active ...
user avatar
  • 612
45 votes

Why do mobile devices force user to type password after reboot?

Because the fingerprint is only used for authentication, while the password is also used for encryption, and these are distinct processes with very different requirements. As you probably know, the ...
user avatar
  • 5,308
38 votes
Accepted

Why is it possible to bypass Android full disk encryption?

You seem to be confusing two different security features that are intended to protect against two different types of attacks. The three attacks you mentioned are to bypass the lock screen of the phone,...
user avatar
  • 1,331
36 votes
Accepted

Can we prevent SSL Pinning Bypass by pinning key instead of certificate?

Unless you specified that your software has to be secure against TLS interception even in the case of a jailbroken/rooted machine - which I hope you didn't, because that's impossible and a fool's ...
user avatar
  • 39.6k
34 votes
Accepted

Why Can't Google Just Switch to Pushing Android Security Updates Directly to Users?

The crux of the problem is that with only a few notable exceptions, every phone ships with a fork of Android, not with the software written by Google. So Google can't push changes to Samsung's phones ...
user avatar
  • 82.1k
34 votes
Accepted

Verifying android application integrity from server side

Use Android SafetyNet. This is how Android Pay validates itself. The basic flow is: Your server generates a nonce that it sends to the client app. The app sends a verification request with the ...
user avatar
  • 2,185
31 votes

Secure way to hold private keys in the Android app

All android 7+ devices are equipped with Trusted Execution Environment (TEE) as a mandatory requirement for Google apps licensing. It's a hardware backed keystore which provides isolated storage and ...
user avatar
  • 6,061
28 votes

Police forcing me to install Jingwang spyware app, how to minimize impact?

Use a custom ROM (two, to be correct). Android phones can have more than one ROM installed, and you choose one or the other. So install two copies. On the clean ROM you install the spyware, anything ...
user avatar
  • 50.5k

Only top scored, non community-wiki answers of a minimum length are eligible