Ask Slashdot: How Do You Protect Data On Android? 238
Gibbs-Duhem writes "It makes me very nervous that my Android phone has access to my email/AIM/G-talk/Facebook, protected only by a presumably fairly easily hacked geometric password protection scheme. Even more because simply attaching the phone to a USB port allows complete access to the internal memory and SD card regardless of whether a password is entered. I have no idea how much of that information ranging from cached emails to passwords stored in plaintext is accessible when mounting the device as a USB drive, and that worries me."
For the rest of Gibbs-Duhem's question about issues in Android security, read on below.
Gibbs-Duhem continues:"I have a lot of sensitive information in my email, including passwords for websites and confidential business/technical strategy discussions (not to mention personal emails ranging from racy emails from boyfriends to health discussions). My email and messaging client passwords are difficult to type (or even remember), so I would ideally want them saved in the device, although at least having something like a keyring password that needed to be re-entered after a time delay would make me feel better. This leaves me relying on encryption and OS level security to protect me.I'm okay with this on my real laptop and computers as my hard disks are software encrypted and I make a habit of locking my session whenever I leave my desk. For instance, if I lost my laptop, the odds of the thief getting access to my information is minimal. However, I don't feel that this is at all true for my phone (which is frankly far more likely to be lost).
How is it that the Slashdot security pros handle this issue? Do you just not use email or the many other incredibly convenient capabilities of new Android smartphones due to the risk? Or are there specific ways in which we can guarantee (or at least greatly augment) the existing security practices?"
You can't have your cake and eat it too (Score:3, Insightful)
Just suck it up and type your password each time.
Re: (Score:2, Informative)
Actually you can have your cake and fucking eat it too:
Set the default USB connection activity on the phone to "CHARGE" instead of "MOUNT SDCARD LIKE A FUCKING DUMB ASS".
Then enable the lockscreen option and if someone picks your phone up and connects it to a PC, its only going to charge the battery.
Now the thing to really worry about is someone taking your phone and then pulling the SDCARD out and mounting that on their PC, that will give them full access to everything stored on it, including all downloade
Re: (Score:2)
Actually you can have your cake and fucking eat it too:
Set the default USB connection activity on the phone to "CHARGE" instead of "MOUNT SDCARD LIKE A FUCKING DUMB ASS".
Then enable the lockscreen option and if someone picks your phone up and connects it to a PC, its only going to charge the battery.
Now the thing to really worry about is someone taking your phone and then pulling the SDCARD out and mounting that on their PC, that will give them full access to everything stored on it, including all downloaded emails, dirty picks and movies you've shot in the bathroom to send your partner, etc.
Replying to this interesting comment to undo my accidental moderation.
Whispercore (Score:5, Informative)
This [whispersys.com] looks like exactly what you want. It warns that its in beta, though, so I'm not sure how well I would trust it. Seems like better than nothing.Says it does full encryption of the entire system, optionally your SD card, as well as optional firewall for your phone. Wouldn't rely on it without backups, but it should work. Also, you could look at a system that keeps passwords off your actual phone, like LastPass does. Not sure how well it works with Android, but I'd look into it.
Also, Honeycomb supposedly offers device-level encryption link [engadget.com]), so if you can wait for that on phones, that'd work too.
Re: (Score:3)
I'd like to add this functionality to other ROMs like CM, but time forbids lately. However, since Honeycomb supports full disk encryption, and the tablet/phone forks are supposed to merge in the next major version, full disk encryption should be available for both Android phones and tabl
Re: (Score:2)
You can't. (Score:2)
Phones suck for that sort of thing. They also assume one user, so you can't hand your phone to your friend/daughter/colleague without wondering if they're going to phone/text/ install non-free apps etc. It would be nice if they were more like regular computers so they could log on as a guest and have largely read only access, limited access to the above etc. It would also be great if the filesystem was encrypted so if your phone was stolen it wouldn't give up its secrets quite so easily. All solved on a
Re: (Score:2)
Re: (Score:2)
There are plenty of phones which do a great job with security. Blackberry being the primary example. Even the iphone now supports full-disk encryption and remote wipe. Just because most android devices are horrible doesn't mean all phones are.. To counter your desktop point, I doubt most linux desktops are put together with full drive encryption by default..
Re: (Score:2)
How Do You Protect Data On Android? (Score:2)
One seven three four six seven three two one four seven six Charlie three two seven eight nine seven seven seven six four three Tango seven three two Victor seven three one one seven eight eight eight seven three two four seven six seven eight nine seven six four three seven six. Lock? [youtube.com]
Re: (Score:2)
Re: (Score:2)
And how do you secure the electronic device that generated the code in the first place?
You give it a phaser and combat training.
Re: (Score:2)
Re: (Score:2)
Judging by the the amount of 7's and 3's (common in human generated "random" numbers), it was most likely generated by a human (possibly on the fly during filming)
I think they just told Brent to generate it on the spot, and then generated the "display" during Post, based on what he rattled-off.
Simple... (Score:2)
...don't lose your phone.
Yes, I know, there are some people who lose things all of the time, things like keys, wallets, pagers, phones...
So far in the roughly sixteen years that this could be a problem for me, I have never lost a wallet, a set of keys, a pager, or a phone. I have locked keys in the car twice, but that was within my first two or three years of driving. I lost a Gerber Model 600 multitool once, but I think someone grabbed it and it wasn't simply lost.
If I was the kind of person who lost stu
Re: (Score:2)
Keeping the phone tethered to you at all times is unrealistic. For example, I work with MRI scanners. I'm not allowed to bring my phone int
Re: (Score:2)
I disagree.
If your phone has data on it that is just as sensitive as your credit card details, then treat it that way.
You wouldn't leave your wallet lying around would you? Then treat your phone the same way.
I dont see how this is any different to keeping your wallet safe.
I really dont see anyone trying to "encrypt" their wallet (whatever that would mean), and yet the issue is exactly the same. I guess the difference is you can cancel your cards if your wallet gets stolen...so install an app that can do r
I am also curious. (Score:2)
Re: (Score:2)
Re: (Score:2)
I don't... (Score:3)
Re: (Score:2)
I don't keep that kind of data on my Android phone to start with.
This is a great idea, except that Android devices can pretty much access all data you leave in Google's cloud. It does not need to be on your device. This includes, Gmail, Google+, Google Docs, Picasa, Google Finance, Google Wallet, Android Market, Google Maps, and more. Android can even log you in to any website that uses google as a sign in... (I know a few things on appspot.com utilize google in this way.)
Now, you can say you can avoid using google services and accessing them from your phone, but then wh
Re: (Score:2)
Exactly.
I do keep sensitive data on my phone and in Google's cloud. That's why I use Android, after all. My phone is either in my belt or in my hand all the time. I don't put it down except when asleep in my bed, and when I'm asleep in my bed there aren't friends of friends present.What about recharging, you say? I have four batteries, one in the phone, one in the charger, two spare, usually fully charged. I shall investigate WhisperCore [whispersys.com], but the fundamental security is physical security. Never lose the dev
Re: (Score:2)
Primarily for better contact functionality, and I like knowing it runs Linux (why I didn't get the iPhone). I didn't get a smart phone for Internet access, data plans, etc.
Now I do access the Internet, apps, etc - but that's not why I got it. And I still don't keep the sensitive information on it, or in the Cloud for that matter. Sensitive information stays on my laptop (also Linux).
Re: (Score:2)
Re: (Score:2)
So the answer is "don't use a smart phone". Pardon me but I think we should be trying to find a way to make technology better and improve our lives, not simply reject advancements that can improve our lives.
To give you a real world example I use my Android phone's mapping software. I am now living in a world where I will never be lost ever again. Don't even have to wonder where the nearest branch of is or how to walk from here to . The down side is that both my phone and the phone company knows where I am
Re: (Score:2)
So the answer is "don't use a smart phone". Pardon me but I think we should be trying to find a way to make technology better and improve our lives, not simply reject advancements that can improve our lives.
To give you a real world example I use my Android phone's mapping software. I am now living in a world where I will never be lost ever again. Don't even have to wonder where the nearest branch of is or how to walk from here to . The down side is that both my phone and the phone company knows where I am and at least the latter keeps logs. In fact sometimes I keep logs, e.g. for geotagging photos I take. Rather than give that up how about we find a way to encrypt the data on the phone and change the law to ban the phone company from keeping logs.
FYI - even with a dumb-phone the phone company knows where you are. Somethings like that have no relation to being a smart phone. The nice thing about the smart phone is that you also easily know where you are on the maps.
Re: (Score:2)
The google account tied to my phone is completely unrelated to the google account that has my email/etc. What sort of crazy person wouldn't create a random google account when setting up the phone in the first place?
Don't worry... (Score:2)
Complete access to the internal memory? (Score:5, Informative)
Even more because simply attaching the phone to a USB port allows complete access to the internal memory and SD card regardless of whether a password is entered.
No, it doesn't. You get access to /sdcard (whether it corresponds to a physical SD card or not), but that's it. You don't get access (even read access) to sandboxed application and system data storage, unless your phone is rooted.
So the obvious answer is that, if you want security, don't root your phone. It should be kinda obvious that if you can do what you want with the phone via USB, so can any application running on your PC.
Re: (Score:2)
Even more because simply attaching the phone to a USB port allows complete access to the internal memory and SD card regardless of whether a password is entered.
No, it doesn't. You get access to /sdcard (whether it corresponds to a physical SD card or not), but that's it. You don't get access (even read access) to sandboxed application and system data storage, unless your phone is rooted.
So the obvious answer is that, if you want security, don't root your phone. It should be kinda obvious that if you can do what you want with the phone via USB, so can any application running on your PC.
Even if you're not kernel-rooted chances are (depending on the phone) all the hacker has to do is bypass your lock screen to enable usb debugging and root the phone himself.
Re: (Score:2)
Note the quoted part. It says "regardless of whether a password is entered".
If the hacker bypasses the lock screen, he can already have fun with your mail/FB/whatnot by using the apps directly, without even bothering to extract the password. Obviously, the first thing you should do if you're concerned that someone may steal your phone and get access to valuable info within, is to ensure that it is locked with a reasonably strong password, not a simple PIN.
Or are you saying that there is some known vulnerabi
Re: (Score:2)
If the attacker has access to your phone they can simply remove the sd card and mount it on another system. Complaining that it can be accessed via USB seems a bit redundant.
But even if you do attach a usb cable, you must enable remote debugging or manually confirm every time you wish to share the sdcard.
Re: (Score:2)
You can't even access the internal memory or SD card over USB without unlocking the phone first, because Android requires you to click a button before it will actually mount the drives on USB. If the attacker doesn't know the code to unlock the phone they can't press the button.
Obviously an SD card can be removed, but many phones have a large internal memory that can't. My Galaxy S has 8GB. None of this is foolproof because I suppose in theory an attacker could do a factory reset, but it raises the bar a bi
Re: (Score:3)
Let's say the phone was lost or stolen. It'd be pretty trivial to root would it not?
All root guides that I've seen for Android phones (admittedly, just a few, for those which I either owned or considered owning) require the phone to be put into USB debugging mode first. That is not on by default, and is tucked away pretty far, so it's not like you're going to enable it by default. If your phone is PIN or password-protected - which TFA seems to assume it is (makes sense if you're concerned about valuable data on it!) - I don't know of any way to enable USB debugging without getting past the
Re: (Score:2)
I don't care much about the "true nature" of the source, so long as idea itself is good. E.g.:
"Those who have no understanding of the political world around them have no right to criticize or complain."
"We want the people to be peace-loving, but also to be courageous."
"History shows that there are no invincible armies and that there never have been."
Should be semi-doable (Score:2)
First you encrypt the sensitive bits on the android (ie passwords) with a master key.
Then you store the master key on an external server.
When you check your email the phone automatically sends the encrypted password to the server, gets back a decrypted password, and uses that to check your email. So there's no loss in convenience.
But if you lose your phone you can de-authorize it at the server level so the phone can no longer access the passwords and other encrypted data that was stored on it. This also mea
Nice idea. (Score:2)
This sounds like a pretty nice and simple idea to me.
The extra amount of traffic does not matter, just a few bytes for the passwords and the delay does not really matter. Additionally that helps you if someone stole your phone as you could easily add some information about the current location.
One loophole is that you have to disable access/decryption instantly after your phone is missing, otherwise interception of the traffic would give the attacker the unencrypted password.
Droid 3/Android 2.3.4 (Score:3, Interesting)
FWIW, the Droid 3 has full device encryption (Android 2.3.4). You can encrypt the whole phone, or just the internal memory card & SD card. It also has a time-lock password/pin/pattern that kicks in after 1-20 minutes (configurable). I was very surprised after upgrading from a Droid 1, which has basically no device protection what so ever...
Facebook? Secure? (Score:2)
You do not (Score:3)
Put data on a modern "smartphone" of any kind and you can expect everybody halfway competent to get all data on it. That includes thiefs, the police, customs etc.. Believing anything else is just foolish.
Re: (Score:2)
Not true. I keep a Keepass database on my phone and unless someone happens to wrench it from my hands in the few seconds when I have the database open and unlocked there is little they can do to get into it. Obviously I use a good password.
how do I protect my data? (Score:3)
I keep my phone with me. I never get drunk enough that I'm likely to leave my phone in a bar. I do a belt check whenever I leave a hotel room. My phone charger is on my desk in full view so I'm not likely to forget it in the charger.
Keeping your phone near you is at least 80% of security. No tool will absolutely guarantee you won't lose your data if you lose your phone. So first and foremost, don't lose your phone.
Re: (Score:2)
Exactly.
I use LookOut which does remote backup and remote wipe (and can locate your phone I believe).
Its like this:
1. Enable remote backup. (should be able to find something that only syncs on wifi if you're worried about data usage).
2. Enable remote wipe.
3. Try to never lose your phone - treat it as if it is your credit card, because in many ways, it is.
4. Oh, and make sure you secure the passwords used for #1 and #2 - and never save them on the device.
Using encryption just seems like overkill and inconven
Re: (Score:3)
"I treat my phone like my wallet or my kidney". That's my new favorite phrase.
For Google, Two-Factor Authentication (Score:3)
For linking your Google account to your phone, turn on two-factor authentication. You can't actually use two-factor authentication to add your Google account to the phone, so you get the option to set up an application-specific password. Though nothing stops someone from reusing this password to access your mail, you can revoke this password at any time without affecting the rest of your application-specific passwords or your main Google account password. If your phone is lost, get to the nearest computer and revoke the phone password. Then if the thief does manage to extract your password, it's useless.
For the rest... well, the advice in the other comments seems to be about the best you can do.
Re: (Score:2)
Those are some valid points to consider. Here are some others.
You can carry a set of one-time use tokens with you, or leave them with someone trusted and that you will be able to contact. In this way, you won't require Google Authenticator to log in and revoke. You get 10 of these, and an emergency code can be sent to a landline or other mobile phone.
I'm not sure how or if Authenticator tries to protect its data. I would hope that it does something, as anything which slows down the thief buys you more ti
Android? Good question (Score:3)
Effect:
- All content on device is encrypted.
- Any attempt to enter device password wrong 3 x wipes device - erases all content.
Re: (Score:2)
You restore from your backup.
Re: (Score:2)
Short answer. (Score:2)
Where are the lame Star Trek Jokes? (Score:2)
I'll Start. In Starfleet Federation, android Data protects you.
I'm screwed (Score:2)
Two Environments? (Score:2)
And so that you didn't have to regularly encrypt/decrypt the secure environm
Re: (Score:3, Insightful)
Yes but let's assume we aren't asking the question for the 0.00001% of humanity with no interest in being a part of society.
Re: (Score:2)
Yes but let's assume we aren't asking the question for the 0.00001% of humanity with no interest in being a part of society.
Boy are you on the wrong site.
Re: (Score:3)
If you think that 99% of people use "smart phones", you're grossly out of touch with reality. "Smart phones" are grossly expensive status symbols. The only people I know who use "smart phones" have them to impress other people. I run a multi-million dollar business just fine with a laptop and a "dumb" cell phone.
I think you are grossly out of touch with reality. A smartphone lets me do my business without having to carry the laptop around, like you are apparently doing everywhere you go. I suppose you'd also like the children to stay off your lawn?
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
I use it for vim and ssh all the time.
VPN is great on CM7. I too have a D1.
Re:How do you protect your mobile phone (Score:4, Informative)
If you think that 99% of people use "smart phones", you're grossly out of touch with reality. "Smart phones" are grossly expensive status symbols. The only people I know who use "smart phones" have them to impress other people. I run a multi-million dollar business just fine with a laptop and a "dumb" cell phone.
In Australia in 2010, 43% of phones sales were smart phones. The prediction for 2011 is 70% of sales will be smart phones..
Smart phones are becoming the norm.
Re: (Score:3)
"Smart phones" are grossly expensive status symbols.
Thems new-fangled smartphones are just for them there kids that want to look "cool" with their myface, their twizzler and their spacebook. I don't want no smarphones on my lawn!
Re: (Score:2)
Where did you get that stupid idea from (that they are more secure)? You do understand that they have to store their passwords in plain-text aswell?
Why couldn't they just store a hash? -Doug
Re: (Score:2)
Ok, so if they can store a hash that is capable of logging into your account, how do they protect the hash?
Re: (Score:3)
Why couldn't they just store a hash?
What would be the point of that?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I'm an embedded dev. by trade; but I have to admit that I don't know diddly about how this sort of thing works. I just assumed that the firmware in the phone would have a routine that would generate the hash from user input, and the text to hash algorithm would use some "trapdoor" (non-reversible) math. That way, the only way to really get the data out would be to dump the data out of the flash directly (kinda hard when the flash is built into a SoC, and then decrypt it with the hash, and t
Re: (Score:2)
But then if you do reverse the hash then what's to stop an attacker reversing the "hash" to recover your password? But a reversible hash isn't a hash, it's an encryption scheme - with the key right there on the device. Think of it as being like storing your password in ROT13.
There is no real way of storing a password securely in an encrypted form, without requiring a password to decrypt it.
Re: (Score:2)
That is certainly true. But at the same time, it points to how Android (or iOS, or WP7 and so on) could implement better security. Encrypt all files (say with AES-128 for the purposes of this discussion) using a randomly generated AES key. Then encrypt that key with a password/passphrase required when the phone boots. This would ensure that data would be stored securely when at-rest, which
Re: (Score:2)
Where did you get that stupid idea from (that they are more secure)? You do understand that they have to store their passwords in plain-text aswell?
iOS doesn't. So clearly this isn't required.
Re: (Score:2)
If iOS doesn't store passwords as plaintext, it's really dumb.
In order for your phone to authenticate with an online service, it has to send the password. In order to be able to do that, it has to retrieve the plaintext.
You could hash the plaintext to obscure it in some manner, but whatever process you use has to be easily reversable in order to get the plaintext back so you can send it off to the server (hopefully over a secure connection!).
You can only access the plaintext from that database if you've roo
Re: (Score:2)
If iOS doesn't store passwords as plaintext, it's really dumb.
In order for your phone to authenticate with an online service, it has to send the password. In order to be able to do that, it has to retrieve the plaintext.
You could hash the plaintext to obscure it in some manner, but whatever process you use has to be easily reversable in order to get the plaintext back so you can send it off to the server (hopefully over a secure connection!).
You can only access the plaintext from that database if you've rooted your phone. Even then, you have to be using an application that you've allowed to run as root.
Given all of the above, there's no point in obscuring passwords. If the password database is compromised, the phone is compromised and whatever mechanism there is for retrieving the passwords is also compromised.
I don't think you understand. iOS has a keychain (just like OS X, upon which it's based). The keychain is an encrypted file that contains things likes passwords.
The iPhone is just as insecure: http://www.slashgear.com/iphone-password-broken-in-6-minutes-10132627/ [slashgear.com]
Note that process also requires the iPhone to be rooted.
That's the very definition of being more secure.
Re: (Score:3)
I don't think you understand. iOS has a keychain (just like OS X, upon which it's based). The keychain is an encrypted file that contains things likes passwords.
But that only keeps you safe if your storage media is somehow stolen. Given that the media is soldered into the phone, that's an unlikely scenario.
The only way to access the password database on Androind (and I presume iOS) is to be root. If you're root, you've got access to the procedure for decrypting passwords.
Therefore, what's the point of obscuring the passwords?
Re: (Score:2)
First of all, it is not an unlikely scenario. Why should someone bothering with getting the media when they can simply get the container of the media much more easily. Secondly, that is the only scenario where encryption helps -- your phone is stolen, or taken by police or somesuch. I would venture to say that is a very probable scenario, and from a risk analys
Re: (Score:2)
Re:How do you protect your mobile phone (Score:4, Insightful)
Yea,
and I secure my car by having a bicycle, instead.
Sure, I get wet when it rains, but I'm a so much safer.
As Ben Franklin would say... (Score:3, Funny)
Those who would gain a little safety by giving up necessary not-being-molested deserve neither and will lose both.
Re: (Score:2)
I swear to god most of the people here these days don't even think before th
Re: (Score:2)
If you are seriously interested in security, and have the budget to support it, get a enterprise-level Blackberry. These are used for highly sensitive data and are encrypted, remotely wiped.
Second, don't load a bunch of applications that offer to share your data--do you really need twitter on your work phone? I'd recommend a basic phone and a encypted laptop if your data is that valuable. If you need a cool phone for social stuff, carry two phones. One for your top secret data and other for social inter
Re: (Score:3, Informative)
"Even more because simply attaching the phone to a USB port allows complete access to the internal memory and SD card regardless of whether a password is entered."
I have a Nexus S with Android 2.3.4. Whenever I plug in a USB data cable, a pop-up asks me to "Turn on USB storage". This is only accessible after I enter my password. I realize he is bitching in general but with respect to this specific problem... it's a non-issue.
Re: (Score:2)
I have a Nexus S with Android 2.3.4. Whenever I plug in a USB data cable, a pop-up asks me to "Turn on USB storage". This is only accessible after I enter my password. I realize he is bitching in general but with respect to this specific problem... it's a non-issue.
This first appeared in Android 2.2.1
http://books.google.ca/books?id=yTrYZ2t7oPQC&pg=PA60&lpg=PA60&dq=android+%22turn+on+usb+storage%22+android+2.2&source=bl&ots=h4Z4ERUvtP&sig=REGSUTfY4y2VrnRHwUIsdsJh7ew&hl=en&ei=TeQxTpq9Gqnu0gHEn6XiCw&sa=X&oi=book_result&ct=result&resnum=8&ved=0CFgQ6AEwBw#v=onepage&q&f=false [google.ca]
And technically, unauthorized people cannot remove the SD card from a Nexus S :)
Re: (Score:2)
Yes, but how do you keep your stuff secure after you plug it into a computer, give it to an enemy, give apps permission to view your email/sdcard/facebook/twitter/texts/etc? I mean, with a system like this that just "lets" users give away their data, I don't see how anyone can ever consider using it!
complex passwords vs. saving (Score:4, Insightful)
Not necessarily I think, as these two things protect against different style attacks.
Complex passwords:
+protects against brute force attacks
Manual entry of passwords every time (as opposed to saving them in client):
+protects against loss of control of your device
Depending on the situation, it's completely plausible that a complex saved password may be the right call.
Moreover, manual entry of passwords has a big negative: weak against shoulder surfing and entry loggers, which is enhanced by the fact that this is a mobile phone and you never know who might be watching.
Re:usb security (Score:5, Informative)
Can you even access the pull down the activate USB mass-storage mode when the phone is locked?
I would think it's sufficient just to disable development mode, so that ADB cannot be hooked into USB, which I think does work when the phone is locked.
Re: (Score:2)
My Android phone frequently does not lock when the screen times out.
And it's not just a matter of forgetting to paint the lock screen. It's unlocked when I hit the power button. Sometimes a day or two after I put it down.
Re: (Score:2)
Yes you can activate the USB without unlocking the phone, at least that's the case on my G2. But this only gives access to the SD card, which you have physical access to anyway (remove battery, pull SD card, mount with any adapter). The device's internal memory is another case, and may be protected when the screen is locked and development mode is disabled, but I personally wouldn't trust this lock. An obvious f
Re: (Score:2)
You still get debugger access on charge only. Also, they can just take the sdcard out of the phone and mount it on something else.
Re: (Score:2)
So don't have USB debug turned on in your phone options.
If someone can take your SD card out, your physical security has failed. Give me enough time alone with just about any computer short of some serious enterprise system and I can break the security. That's why physical security is paramount.
Re: (Score:3)
If they can plug in a USB cable, they can take the SD card out. That was my point.
If they can't do either of those things, that means they don't have your phone and there's no worry.
Re: (Score:2)
Ah, I see.
I totally agree then.
Re: (Score:2)
Your phone may be fragmented, but my phone only has a bit of a dead spot in the upper left corner of the screen because I dropped it about 45 minutes ago. Nothing's fallen off it yet though.
But seriously, you're either grossly uninformed, a rabid fanboy parroting talking points, have never used an Android device for more than a few minutes, or just a weak troll. Fragmentation is largely irrelevant when you have a developer community like the folks at XDA [xda-developers.com] working on pretty much any android device they can ge
Re: (Score:2)
Doesn't the iPhone suffer from pretty much the same problems as well? Moving to iPhone as the troll suggests solves nothing, and may even make the problem worse.
Nope. Encryption + Remote Wipe + Local Wipe on too many failed password attempts (see "Safe and Secure by Design" and "Ready for Business" on this page [apple.com]). Not even in the same universe as far as security goes...
Re: (Score:3)
Nope. Encryption + Remote Wipe + Local Wipe on too many failed password attempts (see "Safe and Secure by Design" and "Ready for Business" on this page [apple.com]). Not even in the same universe as far as security goes...
See, I don't get all the people in this thread saying Android devices are "horrible" and "not even in the same universe as far as security." I have an Android phone from Motorola. It's billed by T-Mobile as one of their lower-end, entry-level smartphones, as opposed to a "teh awesomeness" phone. Nonetheless, my phone can encrypt the data on the device and the SD card, and it comes bundled with a (free) service from Motorola that not only lets you remote wipe your data, but will tell you where your phone is
Re: (Score:3)
Take your phone, run it over with a truck. Then set it (the phone, not the truck) on fire. Then throw the ashes in a glass block. Then launch the glass block into the sun.
And so you think that isn't susceptible to an extraterrestrial-in-the-middle attack?
Re: (Score:2)
I was thinking more of a moon-in-the-middle attack here, but hey.. that could work too.
Re: (Score:2)
Re: (Score:2)
Passwords and other sensitive data are not stored on SD card though (unless the app in question is written by someone really clueless).
Re: (Score:2)