Hacker News Reader

Comment by coldcode | Hacker News Reader

Since the security of Android depends on hardware and OEM software not under Google's control, depending on FDE is apparently pointless. I guarantee Google really wants to build their own branded phones with their own secure Android version and gain Apple's advantages in building secure systems because you own everything.

View on HN

This vulnerability does not make FDE pointless per se. It means that your security depends completely on the complexity of your passphrase (like the iPhone prior to the introduction of Secure Enclave). Which is still fairly bad given the typical passcode complexity on phones.

> Since the security of Android depends on hardware and OEM software not under Google's control, depending on FDE is apparently pointless.

For 99% of the users, this is complete nonsense. Why do we encrypt the phone? Are we afraid of the NSA or whatever agency cracking our phones? No! The reason most of us encrypt the phone is to prevent others from posting our pictures or reading our mail.

When somebody else finds my phone, or steals it, the four digit PIN is enough protection. Then again, I don't use a four digit PIN, but something longer, and from six or up it's really strong enough for manual unlocking.

People who have the means to read contents from the memory chips, they probably have the means to use other measures to get what they want.

There are levels of threat and protection between those you mentioned. As the threat from people with access to "other measures" increases, you moght at least want to make them work for it and have to go through proper channels.

Businesses typically have rules about securing data, that covers a lot of users.

It runs the 2-factor app that secures my online accounts, which may or may not include banking.

Are you guaranteeing that Nexus phones exist, or that Google will introduce a second line of phones?

Google don't manufacture the Nexus.

But they had a chance (and didn't) to bring that all in house with the Motorola buy, no?

Google wanted and kept most of the patents.

The (thinly sourced) rumor is that Google wants to build a new phone from scratch, a separate project from Nexus

ARA?

Nope, that's the modular phone. This is talking about a standard phone manufactured by Google.

For this to work they only need one little chip that can do what the secure enclave does. They can then require that chip in Android phones. That's a lot cheaper and easier. Then they need to control the manufacturing of this chip, not outsource it to China.

If only they had an OEM to do this, with a plant in Texas....

> I guarantee Google really wants to build their own branded phones

Considering they just sold for scrap an entire manufacturing pipeline to do exactly that, I'd say they really don't. If they do, they're going about it in the silliest and most roundabout way.

Reply on news.ycombinator.com