72
votes
Accepted
How to securely dispose of a smartphone?
Unless you have secrets on that phone that someone would pay a lot of money to uncover, you don't need to go overboard. A factory reset would work just fine.
To decrease the chances someone would ...
- 55.1k
65
votes
Is a 'dumbphone' mobile more secure for basic phone calls than a smartphone?
Has the security of the basic phone call changed much, in the last 10 years ?
So, do smartphones utilise anything new [purely in] the initiation and connection of just the phone call itself ?
Yes. ...
- 934
51
votes
How to securely dispose of a smartphone?
Under the assumption that you have a somewhat recent phone (Android 6+ installed from factory, I don't know for Apple but read something about from iPhone 6 on):
Wipe the phone/do a factory reset (...
- 6,001
47
votes
Accepted
Can a stolen Android phone with USB debugging enabled have screen lock bypassed?
A sophisticated threat actor could potentially try to exploit the Android Debug Bridge's authorization protocol by switching your phone's storage media to another same model phone with already active ...
- 612
47
votes
Accepted
Does the saying "physical access = game over" apply to smartphones, too?
"Physical access = game over" is an over-simplification. It absolutely boils down to the outcome of a threat assessment, or what the vendor needs to protect and to what level. The direct answer to ...
- 3,931
46
votes
Accepted
Does rebooting a phone daily increase your phone's security?
Rebooting a phone regularly helps cleaning non-persistent malware, i.e., malware that only exist in memory – and non-persistent malware alone, as explained in Paul Ducklin's Sophos blog article on the ...
- 19.2k
41
votes
Password manager: safer on laptop or on smartphone?
I don't understand why you don't want a password manager that works on both? Your non-tech friends that don't use a password manager yet are too limited by your requirements. You seem to be running in ...
- 7,549
40
votes
Accepted
2FA: Why do I need to keep my backup codes for each platform on paper?
Writing them to paper is one of the simplest, guaranteed to be safe from malware and hardware failure for the average people. If you have a password manager, usually you can store secure notes too, ...
- 561
31
votes
Secure way to hold private keys in the Android app
All android 7+ devices are equipped with Trusted Execution Environment (TEE) as a mandatory requirement for Google apps licensing. It's a hardware backed keystore which provides isolated storage and ...
- 6,931
28
votes
Can a stolen Android phone with USB debugging enabled have screen lock bypassed?
Without full-disk encryption, your unencrypted data can be read without recovering the pincode. Enabled USB debugging, definitely, extends the attack surface, but it's not necessary for a determined ...
- 848
23
votes
Is a 'dumbphone' mobile more secure for basic phone calls than a smartphone?
Case in point: Snowden uses a feature phone (i.e. 'dumb phone). A few people would like to attack his phone, but even if they succeed, it's a very limited reward. OpenMOKO is an example of such a ...
- 873
22
votes
Does the saying "physical access = game over" apply to smartphones, too?
As a general concept in information security, physical access is a rather severe attack vector.
Standard x86 PCs and servers are particularly vulnerable because they have little or even no ...
- 3,299
21
votes
Can a stolen Android phone with USB debugging enabled have screen lock bypassed?
Without the encryption, your data can be trivially read out using a flash adapter such as this one:
Removing a flash chip is a 5 minutes job on a hot air rework station.
Of course, this assumes that ...
- 10.2k
19
votes
Accepted
Does disabling WiFi and mobile data make my phone impossible to hack online?
By disabling WiFi and mobile data, you shut down some attack paths. That means that your system is more secure, and probably immune to most "script kiddies" attacks.
However, the telephony part will ...
- 26.8k
18
votes
Does the saying "physical access = game over" apply to smartphones, too?
TL;DR: the answer is yes, given enough (unrestricted) physical access, skills, motivation, and resources.
Long answer
Those laws are often very general laws that express general concepts in ...
- 15.9k
17
votes
How was Walmart able to pop up an unsolicited "Rate your visit" notification on my phone?
TL;DR: By December 6th, 2018, Google stopped serving Nearby Notifications. Android users won't receiving this kind of notifications.
How were they able to push a notification?
As @Martin Fürholz ...
- 572
17
votes
Is it possible to identify a phone model by screenshot stripped of metadata?
You're unlikely to be able to identify the exact model, because of the sheer number of different Android phones out there, many of which will have the same resolution and UI.
But you can probably ...
- 14.7k
16
votes
Accepted
Why do smartphones limit the amount of fingerprints that can be recorded?
No, theres no specific security reason to limit the number of fingerprints stored.
However, given that these fingerprint modules normally is a HSM, like a smart card, storing fingerprints, the number ...
- 8,994
16
votes
How to securely dispose of a smartphone?
Under the assumption you do not trade state secrets I would:
Wipe the phone/do a factory reset (assuming the phone is still working)
Remove the SD Card (keep it for later use) (does not apply to the ...
- 4,103
16
votes
2FA: Why do I need to keep my backup codes for each platform on paper?
But the whole point of using password managers (yes, that's another thing) is that you don't have to write down all the passwords...
Backup codes are distinct from passwords.
Passwords are something ...
- 1,589
13
votes
How much entropy does a smartphones' pattern lock have?
You cannot reach 42 bits of entropy with a regular android unlock pattern. The 3x3 grid is limited to 389,112 distinct patterns, giving you an entropy of 18.57 bits. This is less than you might assume ...
- 45k
13
votes
Blocking people from taking pictures of me with smartphone
This is not doable.
Unless hacked, your smartphone doesn't communicate with other smartphones around it. It doesn't even know if someone is taking pictures. There's no way it could possibly block ...
- 14.7k
11
votes
Is a 'dumbphone' mobile more secure for basic phone calls than a smartphone?
Sure, Internet connection and physical data intefaces like USB or microSD constitute attack vectors.
However, if you use your smartphone as a dumbphone (i.e. never enable data connections, never plug ...
- 10.2k
11
votes
Can a smartphone strictly be viewed as the 'something you posses' factor for 2FA when it has no hardware token capability like smartcards?
[This is my view, I'm not claiming that it represents the view of the industry]
I totally agree that some piece of secret data stored on your main device blurs the line between "something you know" ...
- 59.2k
11
votes
Accepted
Is using desktop 2FA clients like Authy Desktop a good practice?
You made an assumption that affects your outcome, and you cannot forget that you are making this assumption: that one "likely" gets your password via the desktop computer (i.e. keylogger). If that is ...
- 132k
11
votes
How to securely dispose of a smartphone?
"Impossible to restore" can only be securely achieved by physically destroying chips.
Which one, depends on the device and an optional encryption.
(By that I mean, if the flash storage on the device ...
- 850
11
votes
Does the saying "physical access = game over" apply to smartphones, too?
To simplify and exemplify, it is a major issue of resources and determination by the attacker, and availability of hacking tools.
Historical fact: FBI hacked the "in"famous San Bernardino phone, as ...
- 5,408
10
votes
Does disabling WiFi and mobile data make my phone impossible to hack online?
If you only disable WiFi, mobile data, NFC and Bluetooth you still leave normal telephony and SMS/MMS.
MMS was for example the attack vector for exploiting the Stagefright bug which is still not ...
- 206k
9
votes
What can Google actually do on my phone using Google Play Services?
But there are some problems with all these possibilities:
There's no proof that something like this ever happened before (except the vulnerabilities. nobody could seriously deny that such a
...
- 6,274
Only top scored, non community-wiki answers of a minimum length are eligible