Database Info

[Q] Lock Screen Security

Hi, I am trying improve the security on my phone, There has been a recent report about a guy who was forced to enter his unlock screen password to border officials at the airport (although he didn't comply). This is a HUGE abuse of power and an even bigger violation of privacy.
I hope never to be in that situation, but if i am i want an easy way out so i am looking for the following solutions:
Entering a secret code / Pattern on the lockscreen that would trigger a factory reset
And / Or
A secret code / Pattern on the lockscreen that would load a "dummy" home Lanucher
as far as i can tell neither exist. Any help/Advice would be great, thanks

Just enter into the guest mode?

HOW??
aniketpatil87 said:
Just enter into the guest mode?
Click to expand...
Click to collapse
How? I mean suppose that official is infront of you , how will you switch to gusest mode wihout letting him know .... i mean in power off option ?? or any other way?

What you are describing is similar to the plausible deniability mode of Truecrypt. However Android doesn't have this function natively, and I don't see how you can implement it without doing some major modification to the system.
What about bringing a secondary phone as a distraction instead?

There is already one major bug in Google Play services 7.0.97 reported by Android Police which alllows attackers to unlock the phone without any password since it takes around 15 ~ 20 seconds to re-apply the lock. Another hole seems that attackers could steal your phone if your phone just gets into the standby mode with disabled sceen. There are general known attacks with such smart-lock enabled function which allows to bypass the pin.

not sure if this is relevant , but on any phone i've owned with a 'swipe-down-status-bar' when phone is showing lock screen all i have to do is swipe the status bar down and can click on any icon to bypass lockscreen then back out of that setting , i.e. settings , apps , wifi , etc. and will be on home screen.
"all I can really do , is stay out of my own way and let the will of heaven be done"

mrrocketdog said:
not sure if this is relevant , but on any phone i've owned with a 'swipe-down-status-bar' when phone is showing lock screen all i have to do is swipe the status bar down and can click on any icon to bypass lockscreen then back out of that setting , i.e. settings , apps , wifi , etc. and will be on home screen.
"all I can really do , is stay out of my own way and let the will of heaven be done"
Click to expand...
Click to collapse
That only works if you didn't set any password lock.

I have es file manager, and i zip and password protect files or folders wich i need but dont want people finding if my phone ever gets stolen. you can check that out.

Maybe there's gonna be something I oversee, but you could (easily) do this with Tasker.
You could use tasker to make an 'app' to login with a different profile on your android. By opening that app, you go into a self-defined stealth-mode, where you disable everything you want to hide and where you open a minimal homescreen.
Tasker + Secure Settings should have all the tools you need to set it up without destroying your real security.

Maybe dual booting to an empty ROM with sdcard access removed and only a small amount of fake information down on the device?
Would not help if they decided to copy your entire devices info for a close exam but should fool most guards into thinking you don't use your phone much.
Just reboot into that ROM at any time you think anyone would ever check.

Performance with encyrption enabled

Has anyone encrypted their device and if so, how is the performance afterwards? I'm asking because I know the performance on older phones nearly halved after encrypting.

supernova_00 said:
Has anyone encrypted their device and if so, how is the performance afterwards? I'm asking because I know the performance on older phones nearly halved after encrypting.
Click to expand...
Click to collapse
It should come encrypted by default out of the box. In fact, I haven't seen any option to DECRYPT it. So, any benchmarks you see are for an encrypted device.

garyd9 said:
It should come encrypted by default out of the box. In fact, I haven't seen any option to DECRYPT it. So, any benchmarks you see are for an encrypted device.
Click to expand...
Click to collapse
Hmmm seems it is. I searched the settings for encrypt and there is a setting for "Protect encrypted data" the description says "Device is encrypted. Protect your encrypted data by selecting Require screen lock when device turns on. This helps protect data on lost or stolen devices." There are two options "Require screen lock to decrypt data when devices turns on" and "Do not require".
I already have a lock screen set so I'm guessing the encryption doesn't work all the time without selecting the first option? Or would this force a lock screen no matter what, regardless of smart lock settings and/how long after screen turns off that the device locks?

supernova_00 said:
I already have a lock screen set so I'm guessing the encryption doesn't work all the time without selecting the first option? Or would this force a lock screen no matter what, regardless of smart lock settings and/how long after screen turns off that the device locks?
Click to expand...
Click to collapse
My Best Guess on this option is that it controls when data is able to be read. "Do not require" allows the phone to read the data before the screen is unlocked, while the other option requires the screen to be unlocked first.
Why would it need to read the data before unlocking? Well, it my guess is correct, then the device would be mostly useless until that first unlock - unable to get new email, unable to know what wifi AP's it can connect to, etc.
Sadly, my interpretation might be way off on what this option does. It's not documented very well... I'm also not certain how the option relates in regards to "turning on" the device. Does that mean turning it on after a full reset, or after each time the device goes into standby (screen off)?
I can tell you that it does NOT decrypt the device and write decrypted data. It's function relates to the reading only. (In order to "read" encrypted data, it must be decrypted in memory.)
(Obviously, I haven't had a chance to play with the option to explore what it does and how it works...)

supernova_00 said:
Hmmm seems it is. I searched the settings for encrypt and there is a setting for "Protect encrypted data" the description says "Device is encrypted. Protect your encrypted data by selecting Require screen lock when device turns on. This helps protect data on lost or stolen devices." There are two options "Require screen lock to decrypt data when devices turns on" and "Do not require".
I already have a lock screen set so I'm guessing the encryption doesn't work all the time without selecting the first option? Or would this force a lock screen no matter what, regardless of smart lock settings and/how long after screen turns off that the device locks?
Click to expand...
Click to collapse
I think of "Protect encrypted data" as the pre-boot BitLocker password on Windows. When enabled, immediately after the bootloader completes, you're prompted for your unlock pattern. Only after the pattern is given will Android OS boot. It's kinda like a "keep the authorities off my phone" setting. Once powered off, even access to the filesystem from things like ADB is impossible until the pattern is supplied.
- Dave

Lets hope its better than in 5.0 lollipop:
http://www.anandtech.com/show/8725/encryption-and-storage-performance-in-android-50-lollipop

IIRC it uses two pieces of data for the encryption, one is your password and the other is in hardware identifier on the device. Any Lollipop or higher device will typically be encrypted (with some exceptions because some devices lack the hardware for fast encrypting/decrypting) out of the box with just the hardware identifier and once you set the passcode lock will require that to decrypt the user data partition (IIRC this is the only partition encrypted). The settings toggle you mention adds a prompt on reboots to require the passcode on boot but afaik samsung doesn't change the actual android scheme of luks-like encryption. That said I may be full of it and Samsung Knox may invalidate everything I've said

I just played around with the settings...
It only impacts a boot or reboot (which is powering the device off and back on again, or selecting "restart" from the shutdown menu) (which is NOT standby/resume or screen off/on)
Assuming you have a fingerprint and password set up (if you have a fingerprint and pin, replace "password" with "pin):
If configured as "Do not require", it works as you expect.
If configured as "Require screen lock to decrypt data when devices turns on", it appears that the data partition is NOT decrypted on bootup. Nothing on the phone works until the password is entered. It doesn't allow fingerprints, has no notification shade, and doesn't even show the lockscreen wallpaper. (No email or other notifications seem to come through. I didn't test with phone calls.) Once the password is entered initially, the phone spends a couple minutes claiming that it's decrypting, and eventually it goes to the normal lock screen.
---
Be aware that smartphones (especially phones with Samsung Incompetent Engineering software) have been known to reboot at seemingly random times. It could be very frustrating to not get that important notification or phone call... and then realize it was all because the phone rebooted and is locked down until you enter a password. If you are aware of that risk, then by all means go ahead and lock it down. It certainly seems more secure.

Anti Theft and Anti Flash Protection

Hello everyone!
I've just bought my 1+6 and I really don't want to lose it.
Is there a way for protecting the phone against theft? I mean, against a thief trying to flash the ROM.
I was thinking in installing Cerberus but it won't survive as a system app.
Is there some tutorial for making Cerberus beneath ROM ? Is there a way for preventing and blocking flash?
I know for example that Xiaomi Redmi 4 Pro had the bootloader locked and the only way for flashing was by login in xiaomi site and unlock the bootloader.
What can we do for protecting OnePlus 6 ?
Thank you all!

cmlssr said:
Hello everyone!
I've just bought my 1+6 and I really don't want to lose it.
Is there a way for protecting the phone against theft? I mean, against a thief trying to flash the ROM.
I was thinking in installing Cerberus but it won't survive as a system app.
Is there some tutorial for making Cerberus beneath ROM ? Is there a way for preventing and blocking flash?
I know for example that Xiaomi Redmi 4 Pro had the bootloader locked and the only way for flashing was by login in xiaomi site and unlock the bootloader.
What can we do for protecting OnePlus 6 ?
Thank you all!
Click to expand...
Click to collapse
It is encrypted to begin with and you cannot access any data without the password/pin/pattern, if you have either set. If you unlock bootloader, it will erase everything in the phone, including internal storage.

Recovery mode
I protected my phone with FTP (my phone was already assigned to my gmail account and encrypted) so I tried to test it what would happen if anyone steals me.
I entered the recovery mode and hit recover and then Forget Password and only by doing that I did a hard reset on my phone! How can I prevent this from happening ? It’s a big flaw that I can do this without password. I know that after this I must enter with the previous gmail account.. But still.. I’m sure there is a workaround.
mikex8593 said:
It is encrypted to begin with and you cannot access any data without the password/pin/pattern, if you have either set. If you unlock bootloader, it will erase everything in the phone, including internal storage.
Click to expand...
Click to collapse

android.com/find
just leave data and GPS on - you can always locate your phone, and wipe it remotely if needed.

virtyx said:
android.com/find
just leave data and GPS on - you can always locate your phone, and wipe it remotely if needed.
Click to expand...
Click to collapse
The thing is, you can swipe down for notification bar and turn on airplane mode directly from lockscreen. GPS and location will not work afterward :silly:

elrosid said:
The thing is, you can swipe down for notification bar and turn on airplane mode directly from lockscreen. GPS and location will not work afterward :silly:
Click to expand...
Click to collapse
silly google
should prevent people from turning ap mode on and disabling any settings set before screen lock - similar to how google pay needs you to unlock screen to use it, same thing should be set for the settings in the status bar,

elrosid said:
The thing is, you can swipe down for notification bar and turn on airplane mode directly from lockscreen. GPS and location will not work afterward :silly:
Click to expand...
Click to collapse
Thanks for that heads up...
I've just removed mine with the editor so it doesn't show. That makes my access to airplane mode a couple of more steps but probably worth it.

I'm interested too in how to protect against theft, I just got mine stolen.
About the status bar, even if he cannot put airplane mode, he can still switch off the phone and take out the Sim card.
If you don't unlock the bootloader they cannot use the phone but it doesn't mean that you'll get it back.
If you install cerberus as a system app, you have to unlock the bootloader, isn't it possible to relock the bootloader after install cerberus and keep it as system app?
Sent from my H8324 using Tapatalk

Disadvantages of rooting?

I just ordered a Pixel 3a and I was gone for a while from the world of Google phones (since Nexus 4).
I know Magisk hides any trace of root and unlocked bootloader, but is there any disadvantages unique to Pixel devices when rooting, like disabled features or is hiding good enough that there won't be any difference? Just to be sure

Artim_96 said:
I just ordered a Pixel 3a and I was gone for a while from the world of Google phones (since Nexus 4).
I know Magisk hides any trace of root and unlocked bootloader, but is there any disadvantages when rooting, like disabled features or is hiding good enough that there won't be any difference? Just to be sure
Click to expand...
Click to collapse
Nothing as far as i know.

Unstroofy said:
Nothing as far as i know.
Click to expand...
Click to collapse
That sounds great. Wasn't sure if they might have done something through the Titan M or else

Rooting means unlocking your bootloader. This makes your phone at greater risk of being compromised - especially if someone has physical access to your phone (ie you lost it and someone finds it). Therefore you don't want to leave your bootloader unlocked if you have any sort of sensitive, illegal, or secret information on your phone. That's the #1 issue you have to live with. Of course for 99% of the population, there isn't anything really sensitive on their phones.
Google Pay can be hard to get working when rooted. There are ways to make it work, but it's always a cat and mouse game with Google and it may not always work in the future if Google changes something until the developers can catch up. If you can't live without Google Pay, rooting may not be the best choice for you.
There are other apps that can be temperamental when rooted - usually finance apps and some games (because they don't want players cheating). However, the Magisk hide functionality usually works with most of these apps now.
For me, the added functionality that being rooted brings (via modules and apps) is far better than the potential issues.

sic0048 said:
Rooting means unlocking your bootloader. This makes your phone at greater risk of being compromised - especially if someone has physical access to your phone (ie you lost it and someone finds it). Therefore you don't want to leave your bootloader unlocked if you have any sort of sensitive, illegal, or secret information on your phone. That's the #1 issue you have to live with. Of course for 99% of the population, there isn't anything really sensitive on their phones.
Google Pay can be hard to get working when rooted. There are ways to make it work, but it's always a cat and mouse game with Google and it may not always work in the future if Google changes something until the developers can catch up. If you can't live without Google Pay, rooting may not be the best choice for you.
There are other apps that can be temperamental when rooted - usually finance apps and some games (because they don't want players cheating). However, the Magisk hide functionality usually works with most of these apps now.
For me, the added functionality that being rooted brings (via modules and apps) is far better than the potential issues.
Click to expand...
Click to collapse
Tl;dr: nothing new. And never had a problem with any apps. Magisk Hide is working well enough, deleting apps data always works as last resort. And on custom ROMs just use MagiskHide Props Config. And if you are concerned about your data, just use the lockscreen passport as bootup protection. Then it's simply impossible to get to the data through that "insecurity", no matter what you do. And since fingerprint readers a more complex password isn't a problem.

Artim_96 said:
Tl;dr: nothing new. And never had a problem with any apps. Magisk Hide is working well enough, deleting apps data always works as last resort. And on custom ROMs just use MagiskHide Props Config. And if you are concerned about your data, just use the lockscreen passport as bootup protection. Then it's simply impossible to get to the data through that "insecurity", no matter what you do. And since fingerprint readers a more complex password isn't a problem.
Click to expand...
Click to collapse
I'm not sure exactly what you mean by lock screen passport. Can you share some more details?
The insecurity comes from the fact that a person that has physical access to your phone can simply turn the phone off and then start it and hold the power and volume up buttons. This will boot the device into the bootloader. Because the bootloader is unlocked, it allows that person the ability to flash anything and gives that person access to anything they want. That super secure lockscreen password or fingerprint won't help keep them out and does nothing but give users a false sense of security.
When the FBI paid a 1 million dollar bounty to someone to access an iPhone, they were paying someone to get around the bootloader. If you unlock your bootloader, you give this access right from the beginning - for free, and without any effort required.
I'm not trying to be argumentative either. You asked what the drawbacks to rooting were and I was simply trying to give a thorough answer. It's up to the individual user to decide if the the positives of unlocking the bootloader and rooting outweigh the negatives. If you look at my signature, you can see what side of the fence I fall on.

sic0048 said:
I'm not sure exactly what you mean by lock screen passport. Can you share some more details?
The insecurity comes from the fact that a person that has physical access to your phone can simply turn the phone off and then start it and hold the power and volume up buttons. This will boot the device into the bootloader. Because the bootloader is unlocked, it allows that person the ability to flash anything they want. That super secure lockscreen password or fingerprint won't help keep them out.
Again, I'm not familiar with this lockscreen passport you mention, so perhaps there is a way to secure the phone that I am not aware of.
I'm not trying to be argumentative either. You asked what the drawbacks to rooting were and I am simply trying to give an thorough answer. It's up to the individual user to decide if the the positives or rooting and unlocking the bootloader outweigh the negatives. If you look at my signature, you can see what side of the fence I fall on.
Click to expand...
Click to collapse
Was a typo,I meant lockscreen password. Android should ask you, if you set up a lock method other than Swipe to unlock, if you want to be asked for it on bootup.
So no matter what you are able to flash through an unlocked bootloader, /data and with it anything that could be relevant stays encrypted until you enter the lockscreen pin/pattern/password, no matter if you do this on the screen that will interrupt bootup after a few seconds or in TWRP. So it doesn't matter what you could come up flashing, as long as you don't find a way to extract the encryption key from the secure storage either in Titan M or any ARM processor, there is no way to get your hands on user data. The only thing you can do is simply wipe /data. Then you can start up new, but the users data will be gone.
And no, I never asked for disadvantages of root itself since there are little to none, I just asked for Pixel unique stuff since Google always adds stuff that other OEMs won't use for years to come.

Artim_96 said:
And no, I never asked for disadvantages of root itself since there are little to none, I just asked for Pixel unique stuff since Google always adds stuff that other OEMs won't use for years to come.
Click to expand...
Click to collapse
I misunderstood your initial post then, but the title of the thread says, "Disadvantages of rooting?"

sic0048 said:
I misunderstood your initial post then, but the title of the thread says, "Disadvantages of rooting?"
Click to expand...
Click to collapse
Fixed that. Hope the text is more clear now.
But could you reproduce what I explained? Because I would be very surprised if that was unique to Motorola and not AOSP

Android lock screen password / PIN / Pattern

Hello;
After looking for hours about this I'm very angry because of the stupidity of Google. Here I go:
I have configured fingerprint to unlock my phone because I sometimes can't or it's very uncomfortable for me to unlock my phone with a password / PIN / Pattern because using with one hand and I need to unlock as fast as possible all the time.
Now it comes the stupidest thing I've ever seen in my life: no matter what, the phone will ask me to enter whatever I have configured for security, rendering my fingerprint totally useless. This is completely nonsense because it's not configurable by the user. The correct way of doing this is to enable an option for the user to choose: "Additionally ask every 72 hours for the password to provide extra security". Just a checkbox that can be enabled or disabled, because Google should think about the user. This security crazy paranoia is making devices less secure, because people who don't want to enter their password when they have configured fingerprint choose to disable security completely to stop being asked for the damn password.
But I'm asking here because I absolutely know there is a way to disable this, I don't care if it involves hacking / opening / soldering the device, anything to stop this will be welcome, because for me is completely necessary, or else I will have to either sell the phone or disable security completely. Entering the password on startup or when your finger fails 3 times is ok and full of sense, I have no problems with that, but every 72 hours because yes is an absolute no-no, sorry.
I hope somebody knows the exact formula to [email protected] Google / Xiaomi back, because they are simply stupid.
Thanks.
P.S: Please, if you are about to say things like "it's a feature" or "I like it, it makes more secure your device so it makes sense" or "somebody could cut your finger and use it", I prefer you don't post a comment, because I'm looking for a solution not an explanation on why it is like that to understand why the things are done like they are done, I hope you understand.

How about a factory reset?

bigogofthewest said:
How about a factory reset?
Click to expand...
Click to collapse
I think this is the right decision.

Dassote said:
I think this is the right decision.
Click to expand...
Click to collapse
This is bad design from Google. When I was in the crowd (e.g. inside the train), people surrounding me were looking at my finger typing the PIN as I was not able to unlock it using my fingerprint anymore after 72 hours. It makes the phone becoming very insecure. You should lock the phone with PIN only when I am not inside the crowd (e.g. during evening hour)