News for hackers. Stuff that matters.

A comment on To hack an Android phone, just type in a really long password. Parent comment

Re:To hack an Android phone, just type in a really long pass... by bilbo0s on Monday September 21, 2015 @08:01AM (#10251628)
Please pardon my ignorance. I'm not a security expert.

Is there any reason this can't be fixed by just copying iOS in this regard ??? I guess the question I'm asking is, this bug is entirely fixable right ???

Not trying to diminish the seriousness of it. It sounds pretty horrible. Just saying that if Android's architecture will allow you to do something like iOS does, but it's simply unimplemented currently, that's one thing. It would be quite another thing if Android's architecture would NOT allow you to do something like iOS does. As I said... I'm not a security expert... but it SOUNDS like you can implement a fix that would mirror the protections provided in iOS ???

Is that true ???

[ Parent | on HN ]
Re:To hack an Android phone, just type in a really long pass... by mehrdada on Monday September 21, 2015 @11:06AM (#10252768)
Yes. It requires serious engineering across the OS stack though. Also, it is generally harder and less effective to this retroactively; existing third party apps may not switch to leverage the new APIs when it is done retroactively. This makes it hard for PC operating systems to effectively adopt it, though I really hope they do it soon.

Right now it seems the low hanging fruit for Android would be to encrypt devices _at all_ (by default). Different classes of encryption is a luxury.

[ Parent | on HN ]
Re:To hack an Android phone, just type in a really long pass... by crazysim on Monday September 21, 2015 @12:52PM (#10253517)
I did hear they did encrypt by default on the Nexus 6. Unfortunately, it seriously affected performance and was then turned off. I guess this may be due not having a fast hardware encryption path to and from the flash memory.

iOS encrypts, even if you don't set a passphrase or something and their security white paper does mention having dedicated hardware to make it seamless.

[ Parent | on HN ]
Re:To hack an Android phone, just type in a really long pass... by andrewpi on Monday September 21, 2015 @01:34PM (#10253804)
I believe a later software update for the Nexus 6 sped up encryption considerably.
[ Parent | on HN ]
Re:To hack an Android phone, just type in a really long pass... by Glide on Monday September 21, 2015 @02:30PM (#10254206)
How do I check if encryption is turned on for a Nexus 6?
[ Parent | on HN ]
Re:To hack an Android phone, just type in a really long pass... by azernik on Monday September 21, 2015 @04:37PM (#10254966)
If an Android device has encrypted storage, it has to ask you for the decryption password before it will boot (ie BEFORE you get to a lock screen). If it doesn't, then it's not encrypted.
[ Parent | on HN ]
Re:To hack an Android phone, just type in a really long pass... by misnome on Monday September 21, 2015 @08:16AM (#10251664)
> I guess the question I'm asking is, this bug is entirely fixable right ???

Of course. The problem android has had in the past, though, is that actually getting security updates to users could be incredibly convoluted - with every vendor and network having their own, slightly tweaked (and heavily branded) versions of android.

[ Parent | on HN ]