Okay, so i was wondering for a while why we need to remember strong passwords!?
I mean a long time ago i learned that a password has to be as cryptic (and unrememberable) as possible to increase security. A not so long time ago i learned that passwords dont have to be cryptic, but should be as long as possible.
For me, long passwords are okay if im in front of my computer, but since i have to enter them on my phone or tablet it gets really troublesome and annoying to enter long passwords.
So my idea was that it would be much nice if servers (or whoever demands passwords) would do more to prevent password attacks. For example, if your account has entered a wrong password for example 10 times than lock it for 5 Minutes. If there are 10 more attempts lock it for another hour. If there are 10 more failed attempts shut it down for a day.
By that approach you only get 30 attempts in one day. Even an ridiculously easy password would be enough to withstand password breakers.
So why isnt this done more often? Why do i need a strong password?
Another possibilty would be just to shutdown any account with more than 50 attempts and you need to reset your password.
So am i missing something?
Check out "KeePass" and other password storage systems.
I use KeePass and KeePass Droid and sync between devices. The database file is encrypted and unlocked with a master password - one that while long, is easy to remember - the passwords for individual accounts are random strings.
One disadvantage I can think of as to locking down accounts with incorrect guesses is that it would give people who want to annoy/troll/et cetera a way to lock people out and have them keep resetting their password - or, if you suggest locking the account down - lock the real user out indefinitely by continuing to spam passwords they know are wrong. This kind of assault could continue even after the password has been reset - rendering the account unusable.
Lutziver said:
Okay, so i was wondering for a while why we need to remember strong passwords!?
I mean a long time ago i learned that a password has to be as cryptic (and unrememberable) as possible to increase security. A not so long time ago i learned that passwords dont have to be cryptic, but should be as long as possible.
For me, long passwords are okay if im in front of my computer, but since i have to enter them on my phone or tablet it gets really troublesome and annoying to enter long passwords.
So my idea was that it would be much nice if servers (or whoever demands passwords) would do more to prevent password attacks. For example, if your account has entered a wrong password for example 10 times than lock it for 5 Minutes. If there are 10 more attempts lock it for another hour. If there are 10 more failed attempts shut it down for a day.
By that approach you only get 30 attempts in one day. Even an ridiculously easy password would be enough to withstand password breakers.
So why isnt this done more often? Why do i need a strong password?
Another possibilty would be just to shutdown any account with more than 50 attempts and you need to reset your password.
So am i missing something?
Click to expand...
Click to collapse
Passwords are normally not stored on a webserver, just a password hash, which is a code made form your password for example the md5 hash could be used.
So when you create an account the hash is stored (so the webserver never knows your password) and then when you come to login you enter your password, the hash is created and check agaisnt the stored hash.
Passwords are hacked by someone gaining access to the password database then downloading its contents, from there own machine they can then run a brute force attack moving through possible passwords, generating there hash and checking against the hashs downloaded.
They will normally start by using some form of dedicatory of known used passwords (things like 1234, qwerty etc etc) and then go into generating random strings until the right one is found.
professional hackers will use hardware like this http://www.gizmodo.co.uk/2012/12/the-hardware-hackers-use-to-crack-your-passwords/ to brute force which is able to work through billions of hashs a second.
Thus the longer and more random your password strength the better but then again if the attacker wanted to and had enough time they will get your password.
The only thing webservers can do is try and keep databases secure enough that an attack to grab the data isnt possible, but we all known this often is not the case
Pennycake said:
Check out "KeePass" and other password storage systems.
I use KeePass and KeePass Droid and sync between devices. The database file is encrypted and unlocked with a master password - one that while long, is easy to remember - the passwords for individual accounts are random strings.
One disadvantage I can think of as to locking down accounts with incorrect guesses is that it would give people who want to annoy/troll/et cetera a way to lock people out and have them keep resetting their password - or, if you suggest locking the account down - lock the real user out indefinitely by continuing to spam passwords they know are wrong. This kind of assault could continue even after the password has been reset - rendering the account unusable.
Click to expand...
Click to collapse
I would also recommend taking a look at LastPass, along these lines. A long master password and individual passwords is really rather safe.
Funny thing, after setting up KeePass, I had a few accounts compromised - the ones I forgot I had and didn't switch over. The its a good thing I did switch over, or something important could have been gotten into.
Sent from my SGH-T999 using xda app-developers app
Also I would like to suggest Dashlane for password security. It's the only form of password management software I've ever used but I've been very happy with it. It's definitely worth checking out
In terms of password security, the most important factor is the length of the password: with each character added, the time taken to brute force the password increases dramatically, following a power law model.
That said, you also want your password to not be easily guessable: so don't use something that relates to personal information about you, or about what the password is for (i.e. don't make your XDA password 'xda-developers').
This XKCD is relevant, in case someone in the universe hasn't seen it already...
Password storage programs like KeePass are a great way of solving the security vs. memorability problem: your passwords can be as long and random as you want, you only need a strong master password to be secure.
Not even passwords, we need strong security. Check out these thread:
http://forum.xda-developers.com/showthread.php?t=1931627
[Suggestions & Discussions] Why mobile security matters
Sent from my GT-I9103 using xda premium
With iOS I used 1password to generate 20 character passwords so I don't remember any of my passwords since it's kept in the app. Hopefully they update the Android version soon.
Sent from my Nexus 4
Another one for Keepass here. The array of devices it is available for is impressive. I am trying to convince everyone I know to use some sort of password management since more and more of our lives are on the net now, particulary bank and government accounts.
You don't need a really strong password if you're protecting your device from people who don't know you (not your friends, or your kids). If you're only worried about your device getting stolen by someone you don't know (who doesn't know you) you can make your password easy to remember and enter by making it your first born child's name or pet's name, or first born child's birth date. But if you're trying to protect the device from your kids (or other people who know you), you better make it something a little harder for them to guess.
Lutziver said:
Okay, so i was wondering for a while why we need to remember strong passwords!?
I mean a long time ago i learned that a password has to be as cryptic (and unrememberable) as possible to increase security. A not so long time ago i learned that passwords dont have to be cryptic, but should be as long as possible.
For me, long passwords are okay if im in front of my computer, but since i have to enter them on my phone or tablet it gets really troublesome and annoying to enter long passwords.
So my idea was that it would be much nice if servers (or whoever demands passwords) would do more to prevent password attacks. For example, if your account has entered a wrong password for example 10 times than lock it for 5 Minutes. If there are 10 more attempts lock it for another hour. If there are 10 more failed attempts shut it down for a day.
By that approach you only get 30 attempts in one day. Even an ridiculously easy password would be enough to withstand password breakers.
So why isnt this done more often? Why do i need a strong password?
Another possibilty would be just to shutdown any account with more than 50 attempts and you need to reset your password.
So am i missing something?
Click to expand...
Click to collapse
No u r write but thn it is easy for our frnds r closed ones to know our pswds
Sent from my Micromax A50 using xda app-developers app
---------- Post added at 08:02 PM ---------- Previous post was at 08:00 PM ----------
Sry its right nt write
Sent from my Micromax A50 using xda developers app
I would be very careful about using "apps" to manage stored passwords. Hopefully the database is encrypted. (There is e.g. a bitcoin wallet app that doen't encrypt stored data!) It is sometimes trivial to decompile the app to get the java sources with the decryption algorithm. If it was a native app, decompilation would be harder.
You have to assume the attacker can get the db and the algorithm, and therefore only has to guess the key. Therefore, the password you choose must be as difficult to guess as possible. (This goes double for people using software they can't build themselves, such as linux distros and roms. There is a reason Debian devs cryptographically sign their contributions (packages) which are then built and distributed by other machines; it is near impossible to inject malware, in such a way that others can't discover who did it.)
The real problem is that malware on e.g. a desktop os can install keyloggers and grab the contents of copy/paste buffers. So the mechanism to move the password from the db to the app that needs it must also be secure. Passwords must be salted, and correct algorithms chosen for each part of the software (E.g. MD5, mentioned above, is considered insufficient for password hashes and most other uses, and should not be used).
A lot of people think that encrypting things or hashing them multiple times or with 2 or 3 different algorithms will improve security; this can actually decrease the amount of work for an attacker, so must not be done.
Ask yourself if the developer of such an app is aware of these issues, and also of the specific API and other features of Android that provide (some) security in the face of an attack. Ask yourself if such a developer would be compensated more by writing such an app, or by doing other work.
Then make your decision about how much you can trust the app that you have.
Sent from my SGH-I317M using xda app-developers app
Just have a long passward or any cryptic 1,
Remember on your web and use a masterpassward in firefox if shared system,
And just save it in an app called msecure in android just sync with Dropbox and tjen when ever you need to enter a password just copy from msecure and paste it where you want.
Ty:thumbup::sly::beer:
----------------Read If You Have Time----------------
Send From My Samsung Galaxy Note 2 N7100,
HIT thanks if I did Helped you.
LIFE! It's what you make out of it!
rselthn slight
KeePass or 1Password instantly springs to mind as others have already mentioned.
One way to keep secure passwords easy to remember is by taking the websitename, domain, or some other criteria (5th word on the homepage) and applying a couple of rules on that. E.g. take the word phonetically in reverse order, shift all vowels one place in the alphabet, append an exclamation mark, prepend a fixed number (e.g. 5), and add the length as a number to the end. XDA would become exdeeaa -> aaeedxe -> bbffdxf ->5bbffdxf! ->5bbffdxf!9 ... still quite difficult to guess, but easy to remember, because you just have to remember the rules.
Obviously those rules aren't the actual rules I use, but I do use something like this...
Related
Exchange/Password
Now with Android 2.1 it now makes me use a password word. Is there a way to bypass this as it is annoying, or maybe use a pattern instead?
With 1.5 i didn't have to use a password, but with 2.1 now i do.
This works
just thought i would update with my latest info. So here is the scoop. You can disable the exchange password lock and have it survive reboot/and mail checks. To do this follow these steps:
[APP] LockPicker - disable Exchange lock screen [30-03-2010]
Hi all,
"j0bro"
Just whipped an app together that disables the Exchange lock screen as soon as the server has enforced its policy by using a background service and an observer on the system setting. This requires no polling, scripting, etc. and survives reboots/enforcements
If you want to use the pattern lock follow the next steps if not just skip the next steps., First set the lock pattern before you setup your exchange server, Then after you set your pattern lock setup your exchange and it will ask you to set your password after complete download Lockpicker in the market and install & run. Iit will bypass the Password lock and the pattern will now work.
Or
klaus27
Originally Posted by klaus27
Ok, my app is ready. I have sent it to tamburylar for testing.
Version 1.0 is ready for testing. Working with HTC Sense. Waiting for reply for Milestone support. HERE
__________________
HTC Sense or Motorola Droid with Exchange and password policy? Get rid of it: http://forum.xda-developers.com/showthread.php?p=6044673
networx2002 said:
Exchange/Password
Now with Android 2.1 it now makes me use a password word. Is there a way to bypass this as it is annoying, or maybe use a pattern instead?
Click to expand...
Click to collapse
Not sure what you're trying to say here...
I'm using Exchange through my work, and the process is exactly the same as it has been on 1.5. Can you clarify your issue? Thanks!
networx2002 said:
Exchange/Password
Now with Android 2.1 it now makes me use a password word. Is there a way to bypass this as it is annoying, or maybe use a pattern instead?
Click to expand...
Click to collapse
This has to do with the exchange active sync policies your IT dept has implemented. I believe you can remove that option from EAS on the exchange server.
As a workaround, you can use touchdown for your exchange needs as it doesnt lock down your phone but just your exchange email.
swornenemy said:
This has to do with the exchange active sync policies your IT dept has implemented. I believe you can remove that option from EAS on the exchange server.
As a workaround, you can use touchdown for your exchange needs as it doesnt lock down your phone but just your exchange email.
Click to expand...
Click to collapse
Thanks,
With 1.5 i didnt have to use a password, but with 2.1 now i do.
Thanks
networx2002 said:
Thanks,
With 1.5 i didnt have to use a password, but with 2.1 now i do.
Thanks
Click to expand...
Click to collapse
Yeah android 2.1 is more EAS compliant and can actually do remote wipes if you ever lose your phone which is nice. I did this on my hero and it wacked everything off and would only boot into recovery. Thank god for nandroid.
Be advised that if you enter your password wrong 10 times, (provided that you are still using the built in android exchange support) it will format your phone as well.
I've got it backup, Just hate to have to unlock it all the time.
Wish they would let you use a pattern
networx2002 said:
I've got it backup, Just hate to have to unlock it all the time.
Wish they would let you use a pattern
Click to expand...
Click to collapse
I am in the same position as you. Delete your exchange account and use touchdown for your exchange mail. This way it doesnt require you to use a pin to use your phone except when accessing your exchange mail through touchdown
swornenemy said:
I am in the same position as you. Delete your exchange account and use touchdown for your exchange mail. This way it doesnt require you to use a pin to use your phone except when accessing your exchange mail through touchdown
Click to expand...
Click to collapse
i have never been able to get touchdown to work for me
Just thought I'd join this thread, as I was shocked to find the exchange password on 2.1 too. Personally I love the idea of password and secure wipe, but the problem is the keypad is so difficult to type passwords on it takes me forever to login. I prefer just using the sliding password. And lets face it if someone wants into your password protected phone all they need is a USB cable, laptop, and SDK and they can bypass it.
To this end I've been playing with a way to bypass the password and I have been somewhat successful. I am VERY new to this stuff I've been basically teaching myself as I go, so if there are any experts around with an interest please feel free to take this knowledge and run with it.
** DISCLAIMER ** I've no idea what this will do to your phone or your email so make sure you backup, i've had no problems with any of these settings and I've always been able to just delete the exchange account and readd it when there was a problem. That being said.. you've been warned, Backup. Also bypassing your companies pointless security measures may be dangerous and cause for termination.
To get started you'll need the SDK and working ADB. It appears all the exchange info is stored in a database file that you can read/edit with sqlite3. Here is what I've found so far:
adb shell (probably need root, not sure)
cd /data/data/com.android.providers.settings/databases
sqlite3 settings.db
Optional sqlite3 settings to make reading easier:
.headers on
.mode column all
.width 2 40
There are two tables of interest here:
select * from secure;
select * from system;
The following update commands are what I used:
update secure set value=0 where name='DevicePasswordEnabled';
** This command will turn off the DevicePasswordEnabled and let you use a slide unlock pattern, but the password is still set from before.
update system set value=0 where name='lockscreen.lockexchange.enable';
** This command is the magic, I found out by watching logcat that when you unlock your phone it does an IF check on this variable and if it's set then it requires you to enter a password. Once this is set to 0 it skips the password and will ask for your slide unlock pattern instead. If you don't have an unlock pattern it will just jump to your home screen.
update secure set value=0 where name='MaxInactivityTimeDeviceLock';
** This one isn't too critical but I found it and thought I would share it. It basically removes the Exchange requirement for a idle timeout.. mine was set to 30 mins which was perfectly reasonable, but I removed it anyway.
Now once you run these update commands the changes are "done" no need to reboot or do anything special (don't even need to quit sqlite3) if you try to unlock your phone it might ask for a password the first time but enter it and lock the phone again. When you try to unlock it now the password has been removed. WOOOT!!
Now if you recall at the begining I mentioned that I've been "somewhat" successful, this fix appears to work perfectly and survives Mail client refreshes and reboots. BUT to my dismay every morning when I wake up and unlock my phone I'm presented with the same "You must enable security settings" msg from exchange. When you click OK it resets all the changes we made and we are back to square one and have to unlock it again.
I am guessing there is some type of refresh of the Exchange provisioning. I've not found how to disable this as of yet. I'm presently playing with the files located in /data/data/com.htc.android.mail/app_config it appears to store all the provisioning data in a file called eas_provision.prefs. I've just tried to change the two changes we made in this file in the hopes that perhaps it looks here to compare against the database settings and if it finds a difference it refresh, but I have my doubts.
Unfortunately I cannot test this until morning as I've found no way to replicate whatever causes the exchange security check.
My guess however is that the mail client itself is re-requesting the security settings.. if thats the case we'd have to either "decompile the mail cient" which I don't have the expertise to do. Another option might be to try using an older mail client (assuming this is where the check is).
I hope this helps some folks out there, please share comments and questions hopefully we can find a good solution. Remember my objective isn't to bypass the security completely but utilize the slide unlock which I feel is just as secure as the password (thought I am not certain if the wipe will happen with the slide unlock).
Good Luck
My employer is one of the paranoid companies that require the full password, so I'm also pretty interested in the answer. Changing values in the database show promise, but we'll need to see how this impacts what data is sent back to Exchange. For example, if I change the value to not requiring a lockscreen password, does Exchange know? If so, I get in trouble with Exchange admins, and they probably wipe my phone at their will. Ultimately, the device sends data back to Exchange, and the real solution is to find where the connection between Exchange and the lock screen is, and cut the cord.
For what it's worth, on the Pre this was handled in the lockscreen app and not anywhere near Exchange. The result was bypassing the lockscreen app altogether (return true; - elegant, right?), but that wouldn't meet the needs here of still having something. Once I get it reflashed with Damage's ROM tonight, I'll be playing with this.
And for the record - I'm also not trying to work around security policies enacted by my employer. This is purely for research and educational purposes.
say I wanted to go the other way, my Exchange server doesn't require a password but I want to use a pass... will following inverse instructions enable the policy?
networx2002 said:
Exchange/Password
Now with Android 2.1 it now makes me use a password word. Is there a way to bypass this as it is annoying, or maybe use a pattern instead?
With 1.5 i didn't have to use a password, but with 2.1 now i do.
Click to expand...
Click to collapse
My company has the security enforced on our Exchange server. Keyguard Disabler (look it up in Market) will do this, but it also disables the slide-to-unlock. You can toggle it on and off as you need it.
-Daryel
Ill have to try it.
Installed Keyguard Disabler from the market and it works great. Well worth the buck 50. Buggy when set to auto start on boot so I just put in the password once at boot and run the app. Completely bypassed the lock enforced by my exchange server.
Hell, I just logged into my Exchange server and disabled the pin requirement.....
tamburylar said:
Now if you recall at the begining I mentioned that I've been "somewhat" successful, this fix appears to work perfectly and survives Mail client refreshes and reboots. BUT to my dismay every morning when I wake up and unlock my phone I'm presented with the same "You must enable security settings" msg from exchange. When you click OK it resets all the changes we made and we are back to square one and have to unlock it again.
I am guessing there is some type of refresh of the Exchange provisioning. I've not found how to disable this as of yet. I'm presently playing with the files located in /data/data/com.htc.android.mail/app_config it appears to store all the provisioning data in a file called eas_provision.prefs. I've just tried to change the two changes we made in this file in the hopes that perhaps it looks here to compare against the database settings and if it finds a difference it refresh, but I have my doubts.
Unfortunately I cannot test this until morning as I've found no way to replicate whatever causes the exchange security check.
My guess however is that the mail client itself is re-requesting the security settings.. if thats the case we'd have to either "decompile the mail cient" which I don't have the expertise to do. Another option might be to try using an older mail client (assuming this is where the check is).
I hope this helps some folks out there, please share comments and questions hopefully we can find a good solution. Remember my objective isn't to bypass the security completely but utilize the slide unlock which I feel is just as secure as the password (thought I am not certain if the wipe will happen with the slide unlock).
Good Luck
Click to expand...
Click to collapse
I remember from the windows mobile days that most exchange servers automatically refresh the policies each night just after midnight. I used to have a program that ran every so many minutes that looked for that policy to be set and would unset it again. Maybe we can get a DEV here to write us a program that runs in the background on android that will chech and apply your changes above at some periodic amount of time. I would donate for it.
kranz68osu said:
I remember from the windows mobile days that most exchange servers automatically refresh the policies each night just after midnight. I used to have a program that ran every so many minutes that looked for that policy to be set and would unset it again. Maybe we can get a DEV here to write us a program that runs in the background on android that will chech and apply your changes above at some periodic amount of time. I would donate for it.
Click to expand...
Click to collapse
That would be nice
magic answer to fixing this password stuff
i had the same problem with my work email server, i tried touchdown, didnt like. here's th eanswer people, download lockbot, the free version , from the market. use it, and if your like me, you will have no problem.
damn it feels good to finally help and not be helped by these forums. lol. hope i tworks. post back
ukcatsfan said:
i had the same problem with my work email server, i tried touchdown, didnt like. here's th eanswer people, download lockbot, the free version , from the market. use it, and if your like me, you will have no problem.
damn it feels good to finally help and not be helped by these forums. lol. hope i tworks. post back
Click to expand...
Click to collapse
Downloading now
It works. Thanks
one happy hero user
I am going to be honest, I have never taken computer security seriously and I feel like it is going to bit me in the bum really soon if I don't change my habits. This all started with a few emails I received about forgetting my password on multiple accounts. The first time, I just assumed someone typed in the wrong account. I received a second one a few days later and it started to make me wonder if someone had my email. Then a few days ago I signed into Paypal only to realize that they locked down my account and refused to open it again until I provide some more information. I thought this was strange because I had been using my PayPal account for a few years now to purchase things on eBay. After I submitted my information, they wanted an explanation as to why someone who lived in Iran tried to access my account. I don't know anyone who lives in Iran and so now I am a little freaked out. I want to know what I can use to prevent hackers from getting access to my accounts.
Is it a good idea to pay for a vpn service for daily online activities?
Should I setup a password keychain for my accounts and use long randomly generated passwords?
Should I switch to Ubuntu? (current running Windows 8)
My computer skills are pretty solid so feel free to suggest things that maybe a more advanced user might do.
It is possible but can be done without paying. Tor is very popular and a really good service but it can only provide anonymity, not security. That for install HTTPS everywhere and customize every service you use to provide SSL.
Sent from my GT-I9100 using xda app-developers app
PayPal are pretty smart, your account should be safe, your account was flagged because of an attempt of a login x amount of miles from your usual common log in region, like you said Iran, so of course, PayPal will do whatever they can to protect your account, even if it bugs you.
You can protect yourself by making sure you have virus protection, free or paid, making sure its up to date, and scan once in a while.
I use Windows 7, so I use Microsoft Security Essentials for real time protection, I also use Malwarebytes but disable it for real time protection as more than one real time scanner would cause performance issues for anyone. keeping both up to date and scanning regularly should keep you virus/adware/malware/spyware free.
As a precaucion, I also use adblock plus for firefox to prevent ads, not just because its annoying, but also because ads sometimes are bad for you and you end up with fake antospyware 20xx and so on.
As for passwords, just try your best to make sure your entering them at the actual website you think your on, check the security certificate on the address bar on the left of the url.
First of - I'm just an everyday user of Android device, never interested in hacking or any other "advanced" use of computers and likes. My greatest achievements so far are jailbreaking Iphone, rooting an Android phone and installing stock ROM on it. You can call me a noob. However - I like to improve things I use and I also value my privacy. That's why I installed a software that locks access to certain apps on my phone. I recently found this app actually made an opposite - it made my device vulnerable to identity theft and potential financial loss. I wouldn't really bother telling my story if developers didn't delete my one-star-rating with a brief description of the problem right after I posted it in Play store.
So, to the point. I installed CM Security and app lock app (nearly 14 millions of users and 4,7 rating) and locked some of the "sensitive" apps with it. One evening I was bored enough to try and play "a hacker" who "found my phone" and see what such person could do. Considering "a hacker" somehow managed to unlock the device he'd now encounter my second line of the defense - the mighty app locker. And now, in a few short steps I'll show you how much damage you can do with it:
1. First it obviously asks you for an unlocking password/pattern, but -as you don't know it - you hit in-app menu button and choose "forgot password?" option.
2. It asks you to log in to your Google account in order to reset the password (YES, you can access Google password recovery from inside the app, so even if you lock your device's Settings, your mail client and so on, you can still access the most vulnerable option of your account from "security" app).
3. As you don't know a Google password you hit the "forgot password" link that starts Google password reset process.
4. It will ask you for the "last password you remember", but you can just say you don't know it and then it gives you an option to get a verification code by SMS - chances are it will be sent to the device you're just holding in your hands. And these chances are big.
5. After you get a verification code you're in. You can now set a new Google account password and reset app locker password/pattern.
It's that easy. You not only unlocked an app locker but also got access to Google account which gives you pretty much endless possibilities, including purchase of some apps in the Play Store as it stores your card details and you only need an account password to authenticate the purchase. You can also try to restore Ebay or Paypal passwords or even try to get directly into bank accounts via banking apps. Sky is the limit.
I already deleted CM "security" app and looked for some replacement. I wasn't really surprised it's kind of a standard that when you install them, security apps ask you to give your Google account details just in case you need to recover your password in a future. And they often make you think that giving these details is an integral part of installation process, a must-do that is necessary for an app to install and work. Some apps, like CM "security" don't even ask - they just use your Google account details and don't give you a chance to give up such option.
After all - here's some advice I can give:
1. Don't install any security software that connects to your Google account and gives "password reset" options;
2. Don't give Google your mobile number, even if it seems convinient;
3. Don't use your Google account address as your contact information in "owner info" option of your device.
If you have any other suggestions that may improve security, please share.
Cheers
Question is why you didn't lock your device in the first place.
I think you are misappling this feature 's benefit/use. It is not there, IMO, to secure your phone from an advesary that has even brief access to your phone.
That is what a combination of a lock screen pwd,short for convenience, and full encryption using a separate and longer pwd of high entropy/randomness is for. Even with that its important to understand how it works and its limitations. Such as it does not encrypt.the ext sd card data. So if you put apps or privledged data there you either should not or using other means to encrypt it. One such way would be to use truecrypt to encrypt it using a pc, being the easiest and then use one of the apks that gives suports accessing those types of partitions/files.
The function you are speaking of is ther to prevent people you have a large degree of trust in such as a family member or close.friend possibly that you may allow to use your phone but do not want them to be able to access private data. Think of a parent allowing their child to use the phone to play a game but does not want them scewing up email or going into their bank app and randoming clicking around etc...
I hope you get the idea. Its not there to prevent someone that means to do you direct intentional harm.
I also want to point out my comments are only directed at the most basic level and only deal with physical secure of data on the phone and not the phone itself nor from remote access or privacy.
Also want to point out that a screen lock pwd is nothing but a inconvenience at best to someone wanting access to your data. A quick reboot into recovery and a bkup to a sd card will get them all your data and any weakly secured credentials there in. Its only one part of physical security, of which, is only itself one part in over all data security, which itself, is only a part of data privacy. Its a large house of cards and removing one or putting one little piece in just slightly the wrong place and collapse the whole house.
Its hard to do just the small piece of each of these parts correctly and exrremely hard to.combine all the small and large parts together for a total protection scheme. It takes considerable research and learning to do these things especially if your goals are for higher levles of security and privacy.
As an example someone that really wants their phone data ue on android to be private from commerical.data collection which via proxy means all gov access to said data would never install goggle play store or any google app on their device. That is just one glaring example of many.
http://ad.cmcm.com/en/?f=home-en-top
Cheetah Mobile is spyware. watch the video on their website
I would suggest using the built-in encryption on Android. I don't use it myself, but have the Avira app installed. I like their PC software, and gave it a try.
It can be used to track a lost phone or lock it remotely. Since I have rooted my Huawei G300 it complains a bit, but still scans all apps being installed.
bigeasy911 said:
I think you are misappling this feature 's benefit/use. It is not there, IMO, to secure your phone from an advesary that has even brief access to your phone.
Click to expand...
Click to collapse
Fact is still that this app claims it provides certain security, yet it doesn't. Not everyone will realize this. So it's always good that people keep pointing this out.
Nearly a year gone since I posted this and now I returned to "AppLockers" during my mobile security research. This is such a bad thing I can't believe apps of this kind are accepted by PlayStore and not banned eternally as the most fake security solution that ever existed. What surprised me even more, "serious" companies, eg. Norton are also in this business... anyway
I checked this one first - Best App Lock - it's "best", right? And it's got 4.5 stars rating with 1,000,000 - 5,000,000 downloads.
I set it up, set the PIN, locked test app - everything seems fine.. as long as you don't go to Settings > Apps and don't force stop Best App Lock, because then - your protection is gone. But OK, you can also lock Settings and prevent such tricks and it works... as long as you don't use Activity Launcher to call App Lock's pin reset activity... Yes, you can reset the PIN without even opening the app itself.
Now, Best App Lock was clearly made by some amateur, so let's see what pros got for us, the big ones. I checked mentioned Norton App Lock, with 4.6 rating and surprisingly not as popular, with "only" 500,000 - 1,000,000 downloads. It's a bit better, it only contains one activity, so you can't bypass it easily, because the app itself is protected with a pattern, but here's another trick - reboot device in Safe Mode and you can disable Norton's permission to draw over other apps to make it helpless as a baby. Or you can just uninstall it in SM. I didn't check anything else, because what more you can do to prevent such workaround, than Norton already did?
If someone is aware of a way to disable power menu, or at least the ability to disable Safe Mode on unrooted Android please share. Until then I call all the App Lock apps the biggest scam in mobile security.
minimale_ldz said:
Nearly a year gone since I posted this and now I returned to "AppLockers" during my mobile security research. This is such a bad thing I can't believe apps of this kind are accepted by PlayStore and not banned eternally as the most fake security solution that ever existed. What surprised me even more, "serious" companies, eg. Norton are also in this business... anyway
I checked this one first - Best App Lock - it's "best", right? And it's got 4.5 stars rating with 1,000,000 - 5,000,000 downloads.
I set it up, set the PIN, locked test app - everything seems fine.. as long as you don't go to Settings > Apps and don't force stop Best App Lock, because then - your protection is gone. But OK, you can also lock Settings and prevent such tricks and it works... as long as you don't use Activity Launcher to call App Lock's pin reset activity... Yes, you can reset the PIN without even opening the app itself.
Now, Best App Lock was clearly made by some amateur, so let's see what pros got for us, the big ones. I checked mentioned Norton App Lock, with 4.6 rating and surprisingly not as popular, with "only" 500,000 - 1,000,000 downloads. It's a bit better, it only contains one activity, so you can't bypass it easily, because the app itself is protected with a pattern, but here's another trick - reboot device in Safe Mode and you can disable Norton's permission to draw over other apps to make it helpless as a baby. Or you can just uninstall it in SM. I didn't check anything else, because what more you can do to prevent such workaround, than Norton already did?
If someone is aware of a way to disable power menu, or at least the ability to disable Safe Mode on unrooted Android please share. Until then I call all the App Lock apps the biggest scam in mobile security.
Click to expand...
Click to collapse
The first step to real security is removing all Googleapps and Google account. There is no other way around this. Next, don't install any app that is not open source. Also, don't use any recovery. And finally, either epoxy your entire usb port, if you have let's say a magnetic charging port or cut all usb port pins except for 2 for charging. In addition, you should open the phone and epoxy usb port and contacts from inside, so that it can't be replaced. Or even better: epoxy your entire motherboard. That would take care of UART socket or any other way of entering CPU/GPU/RAM from inside. Encrypt your phone. After that, your phone couldn't be penetrated (other than through the air/baseband, which is a whole different level of sophistication). If someone targets you over the baseband, throw your phone and run for your freedom...
Seriously, in the above scenario, no one can have access to your data: no fastboot, no adb, no recovery. They wouldn't be able to replace kernel, recovery, system or use any OEM official flashing method... . I welcome any suggestion to hack such a device...
minimale_ldz said:
Nearly a year gone since I posted this and now I returned to "AppLockers" during my mobile security research. This is such a bad thing I can't believe apps of this kind are accepted by PlayStore and not banned eternally as the most fake security solution that ever existed. What surprised me even more, "serious" companies, eg. Norton are also in this business... anyway
I checked this one first - Best App Lock - it's "best", right? And it's got 4.5 stars rating with 1,000,000 - 5,000,000 downloads.
I set it up, set the PIN, locked test app - everything seems fine.. as long as you don't go to Settings > Apps and don't force stop Best App Lock, because then - your protection is gone. But OK, you can also lock Settings and prevent such tricks and it works... as long as you don't use Activity Launcher to call App Lock's pin reset activity... Yes, you can reset the PIN without even opening the app itself.
Now, Best App Lock was clearly made by some amateur, so let's see what pros got for us, the big ones. I checked mentioned Norton App Lock, with 4.6 rating and surprisingly not as popular, with "only" 500,000 - 1,000,000 downloads. It's a bit better, it only contains one activity, so you can't bypass it easily, because the app itself is protected with a pattern, but here's another trick - reboot device in Safe Mode and you can disable Norton's permission to draw over other apps to make it helpless as a baby. Or you can just uninstall it in SM. I didn't check anything else, because what more you can do to prevent such workaround, than Norton already did?
If someone is aware of a way to disable power menu, or at least the ability to disable Safe Mode on unrooted Android please share. Until then I call all the App Lock apps the biggest scam in mobile security.
Click to expand...
Click to collapse
Reviews or star ratings are not always very reliable, just use as a rough guide .... (In my opinion SOME of those Chinese apps seem to be amongst the worst offenders)
https://techcrunch.com/2014/05/27/f...unes-but-google-play-has-the-worst-offenders/
optimumpro said:
The first step to real security is removing all Googleapps and Google account. There is no other way around this. Next, don't install any app that is not open source. Also, don't use any recovery. And finally, either epoxy your entire usb port, if you have let's say a magnetic charging port or cut all usb port pins except for 2 for charging. In addition, you should open the phone and epoxy usb port and contacts from inside, so that it can't be replaced. Or even better: epoxy your entire motherboard. That would take care of UART socket or any other way of entering CPU/GPU/RAM from inside. Encrypt your phone. After that, your phone couldn't be penetrated (other than through the air/baseband, which is a whole different level of sophistication). If someone targets you over the baseband, throw your phone and run for your freedom...
Seriously, in the above scenario, no one can have access to your data: no fastboot, no adb, no recovery. They wouldn't be able to replace kernel, recovery, system or use any OEM official flashing method... . I welcome any suggestion to hack such a device...
Click to expand...
Click to collapse
Well you forgot SD card, unless you encrypt that as well, which for a user who uses the card for transferring files across different devices is not such a bright idea.
using epoxy could slow down the hack, and seriously give more trouble to the user than the hacker.
that being said your idea of securing the data is somewhat clear but really a secured device? cause epoxy can be penetrated as well, lock screen can also be bypassed, even without Google and a recovery.
it might take more time than hacking an average device, but still it can be done and most probably the hacker would be the same owner. cause he forgot the damn password and is looking to get back the data.
the more we try to secure, the more we make our lives tough.
billysam said:
Well you forgot SD card, unless you encrypt that as well, which for a user who uses the card for transferring files across different devices is not such a bright idea.
using epoxy could slow down the hack, and seriously give more trouble to the user than the hacker.
that being said your idea of securing the data is somewhat clear but really a secured device? cause epoxy can be penetrated as well, lock screen can also be bypassed, even without Google and a recovery.
it might take more time than hacking an average device, but still it can be done and most probably the hacker would be the same owner. cause he forgot the d
amn password and is looking to get back the data.
the more we try to secure, the more we make our lives tough.
Click to expand...
Click to collapse
Epoxy: Knowing how small and fragile phone motherboards are, I think you will most likely damage the board while trying to penetrate epoxy... Maybe you shouldn't epoxy the usb port on the ouside, but cut the data pins and epoxy on the inside to not give a hint to an attacker. Anyway, I wish an attacker fun time trying to remove epoxy...
The point of encryption is to protect data when the phone is off. So, it makes sense that for someone without a password, the phone turns into a brick. And if you tend to forget the password, then write it down somewhere other than the phone...
Mobile security is a myth. At best it is a door knit lock. Will keep honest People honest but won't stop someone from. Really trying and doing it.
I see lots of talk from people about security and yet these same people use Facebook which has enough holes in it that anyone could hack someone else pc. I use it all the time to mess with people. The looks on their faces are priceless.
Hello all,
I'm looking for an advanced security feature for my S21 Ultra without success; I'm reaching out to you, and hopefully, you'll have a working solution or thoughts on how to achieve my goal.
The problem:
My phone, like most, has a password manager holding all my accounts credentials, secured notes, crypto wallets, bank applications, and so on; although the phone protected by pin code and fingerprint, it doesn't solve the case of being forced by a law officer or worse, by gunpoint to unlock the phone.
The desired solution:
If any of you are familiar with the Nano Ledger (cold storage crypto wallet), they have implemented a "secret wallet", especially for the case of being forced to enter your pin code by bad actors; it works in such a way you set two different pin code; when using the first one the wallet has one amount, but when using the second pin code the wallet has a different amount, obviously, the bad actor has no idea you used a pin code that gives you access to $100 worth of crypto. In contrast, the other pin code would have given access to a million dollars worth of crypto.
I'm looking for the same behavior with my phone, meaning, if I use one pin code or fingerprint, I'll be logged in to my regular user settings and applications; however, if I'll enter a different pin code or fingerprint, I'll be logged into different user settings and applications.
Many thanks to you all,
Best,
Ram
I don't know an app with this feature. But you can use another (hidden) profile for this.
The "Shelter" app for example uses the built-in Andoid workprofile to run apps in an isolated environment, separated from the apps in the main profile. You can also use (a copy of) the password manager here.
You can easily disable the workprofile and enable it again.
It will not be visible for thiefs or police. Only forensics or persons with some IT-skills that are aware that you are using the workprofile would easily find it and try to force you to unlock it.
FeeMale said:
I don't know an app with this feature. But you can use another (hidden) profile for this.
The "Shelter" app for example uses the built-in Andoid workprofile to run apps in an isolated environment, separated from the apps in the main profile. You can also use (a copy of) the password manager here.
You can easily disable the workprofile and enable it again.
It will not be visible for thiefs or police. Only forensics or persons with some IT-skills that are aware that you are using the workprofile would easily find it and try to force you to unlock it.
Click to expand...
Click to collapse
thank you for your input! i'll defiantly look into that.
I appreciate your time in responding, once again, many thanks!
Best,
RS
I have being facing seriously issues with my infinix note 10 for over a month now. Unknown hacker took over my device controlling and disturbing my devices. I have changed up to 3 phone which they are still controlling till now. I seriously don't know what have done wrong.
Please the awesome form. I have come to you for recue from this unknown hackers. Both my emails, whatsapp, phone call and test messages is being controlled remotely with a lot of different apps downloaded on my phone.
Please I need help I beg you .... This are the many things downloaded on my phone.
Most of those are either integrated system processes or otherwise appear innocuous. I'm not sure how much help we can be if you believe someone has hacked you.
This is what I would recommend:
Using a computer, log into your Google account. Go to the Security tab, sign out from all devices, and disable third party app access. Immediately change your password. Use a secure password consisting of, at a minimum, 8 characters including lowercase, uppercase, numbers, and special characters. Enable two factor authentication using your phone.
Factory reset your device, and be careful what apps you install.
Never, ever give anyone else your personal information and passwords.
Remember, the best way to avoid being the victim of identity or financial theft is to practice good security.
Okay thank you. But I will say that have done everything you just mentioned and the same is still happening. This unknown are always online and I think they are in groups. But anyway I appreciate your respond so much . I will keep looking for a way out. Thank you