Hacker News new | ask | show | jobs
by abstractbarista 2022 days ago
Seems to be a common thread - if you want your phone to remain secure, it must be powered off before seizure. This way, there is no encryption key in RAM. As long as the key is sufficiently strong (random passphrase, not a 4-digit PIN), you have a reasonable guarantee that they will fail to crack it.
3 comments
m463 2022 days ago
What about the iphone POWER+VOLDOWN thing that flushes the biometric keys and requires the pin?
link
chenxiaolong 2020 days ago
Looking at the iOS platform security document ([0] page 68), apps use NSFileProtectionCompleteUntilFirstUserAuthentication by default, which keeps keys in memory after the first unlock, regardless of the Power + Volume Down lock. If an app opts into NSFileProtectionComplete, I believe the keys are purged from memory upon locking.

[0] https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...

link
angry_octet 2022 days ago
More obscure phones might not have support, but that doesn't mean they can't be opened with more effort.

When off, you're relying on the strength of the FDE passphrase and whatever key strengthening they implemented, and that the OS didn't leave some key fragments somewhere (accidentally on flash, which would be very bad, or remanent in memory if it has only been off for a short period).

Using a long alphanumeric (>12 random, >20 passphrase), not installing random apps, keeping it patched and keeping it powered down is probably the best you can do. I wouldn't use the baseband comms if I could avoid it, just a huge 4G attack surface.

link
Forbo 2022 days ago
Android has a 16 character limit for your password. Or at least it did as of Android 10, not sure if that's changed.
link
marcan_42 2021 days ago
If you root your phone, you can set your FDE passphrase to whatever you want while keeping a usable shorter unlock code. My phone's FDE passphrase is 26 characters long.
link
ActorNightly 2021 days ago
Even better, if you have a reasonable worry about losing control of your phone with data that is on there, you should just get a second one that contains nothing sensitive or personally identifiable, uses wifi only, no sim.

This is even good practice if you go to public places where you can get your phone stolen.

link