Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption

Re:Extracting Qualcomm's KeyMaster Keys – Breaking Android F... by 616c on Thursday June 30, 2016 @01:13PM (#12010042)

So out of curiosity, as someone who has a nontrivial passcode on his Android device that people constantly mock, how many characters are we talking to be safe.

I have known for a long time 4 digit numeric PINs are stupid. Sadly the San Bernadino case, for all the wrong reasons, taught me all the alternative auth methods are just as risky.

Should I be worried? I don't know. But as a long time Android enthusiast and power user who does not use Google Play on his phone and restrictive permission customization like XPrivacy, I am about to just give up and have a newish iPhone for secure stuff and knock around Android for the cool open source dev I aspire to with F-Droid.

[ Parent | on HN ]

Re:Extracting Qualcomm's KeyMaster Keys – Breaking Android F... by snassar on Thursday June 30, 2016 @04:32PM (#12011431)

A friend saw me entering my longish, non-trivial passphrase into my android phone and commented that I must not have many friends if I have to enter this passphrase every time to use my phone.

For a moment I was torn between being proud in my passphrase and sad at my lack of friends.

[ Parent | on HN ]

Re:Extracting Qualcomm's KeyMaster Keys – Breaking Android F... by kevin_thibedeau on Thursday June 30, 2016 @11:16PM (#12013667)

What's sad is your friend's superficial criteria for judging sociability.

[ Parent | on HN ]

Re:Extracting Qualcomm's KeyMaster Keys – Breaking Android F... by gcr on Thursday June 30, 2016 @05:51PM (#12012078)

You bring up an interesting UX issue.

If I need to be constantly available to my friends, "number of seconds to a text reply" is something that I need to minimize.

Longer passphrases prevent me from sending quick replies.

[ Parent | on HN ]

Re:Extracting Qualcomm's KeyMaster Keys – Breaking Android F... by 616c on Thursday June 30, 2016 @07:15PM (#12012619)

Some of my more sophisticated friends take this a step further and taunt me for not securely hiding notifications and buying a smart watch.

This confuses me because Bluetooth over the air does not strike me a secure mechanism (is it just Bluetooth; ironically scant detail unless my Google-fu is off, likely at this hour for me).

http://www.wareable.com/android-wear/android-wear-hack-alert...

And do I need yet another smart device? The mobile first movement, with shinier crap, moving away from standard protocols, leads me to believe I have been passively perpetuating the biggest wart on computer science's labors. I am kind of embarassed, a few years in and late to the party, I bought an Android phone at all.

[ Parent | on HN ]