Hey guys,
Does anyone know what's the encryption level supported by p20 pro and how do i check it?
My organization has disabled any mobile device to connect which does not support 256 bit encryption, this level of encryption is only on iphone's & knox enabled Samsung phones.
Hence wanted to know the encryption level supported by p20 pro.
Thanks in advance.
No one guys?
I've chased Huawei again for an answer, only been waiting since May and constantly chasing each month, so not sure when they will reply
Sent from my Huawei P20 Pro using XDA Labs
I've finally had an update from Huawei
In response to your question, please be informed that the Huawei P20 Pro device it is not encrypted. However, all the information you are saving on the "file safe" it is encrypted. This means that the information is private and it can be accessed only by you. This option it is secured and it can be accessed only with your fingerprint.
Click to expand...
Click to collapse
So by default the device is not encrypted
walkerx said:
I've finally had an update from Huawei
So by default the device is not encrypted
Click to expand...
Click to collapse
That's f*ing ridiculous!! It's 2018!!
krs360 said:
That's f*ing ridiculous!! It's 2018!!
Click to expand...
Click to collapse
another reason to not buy the next huawei device
walkerx said:
another reason to not buy the next huawei device
Click to expand...
Click to collapse
Really bizarre why full encryption is unavailable on the Pro. If there's no way to enable it, then ya, I might avoid Huawei for my next phone as well.
Me too, this is gonna be my last Huawei
Guys, are you sure this is correct? If you read the EMUI 8.0 Security Technology White Paper on consumer-img.huawei.com/content/dam/huawei-cbg-site/en/mkt/legal/privacy-policy/EMUI%208.0%20Security%20Technology%20White%20Paper.pdf it seems to indicate that the entire phone is encrypted using HW key (HUK):
"To ensure data security, user data is encrypted using a hardware-based hardware unique key
(HUK) and user lock screen passcode. Data files of different apps are stored in the directories
of the corresponding apps, so that the files of one app cannot be accessed by other apps. The
data erasure function is provided for permanently erasing data during device recycling or
factory default restoration to prevent illegitimate data restoration."
and then:
"The AES256 hardware encryption/decryption used by the secure storage function is
compatible with the GlobalPlatform TEE standard. The secure storage keys are derived by the
HUK and not sent outside of the TrustZone. Data encrypted using the keys cannot be
decrypted outside of the TrustZone"
soniva said:
Guys, are you sure this is correct? If you read the EMUI 8.0 Security Technology White Paper on consumer-img.huawei.com/content/dam/huawei-cbg-site/en/mkt/legal/privacy-policy/EMUI%208.0%20Security%20Technology%20White%20Paper.pdf it seems to indicate that the entire phone is encrypted using HW key (HUK):
"To ensure data security, user data is encrypted using a hardware-based hardware unique key
(HUK) and user lock screen passcode. Data files of different apps are stored in the directories
of the corresponding apps, so that the files of one app cannot be accessed by other apps. The
data erasure function is provided for permanently erasing data during device recycling or
factory default restoration to prevent illegitimate data restoration."
and then:
"The AES256 hardware encryption/decryption used by the secure storage function is
compatible with the GlobalPlatform TEE standard. The secure storage keys are derived by the
HUK and not sent outside of the TrustZone. Data encrypted using the keys cannot be
decrypted outside of the TrustZone"
Click to expand...
Click to collapse
Got the info from Huawei stating there is no default encryption on the device
walkerx said:
Got the info from Huawei stating there is no default encryption on the device
Click to expand...
Click to collapse
Yes, I saw that earlier in the thread. But as others are saying - "it's crazy not to support this"
Just wondering if I should trust Huaweis official white paper on security and privacy or a person in customer support. I would expect them to provide the same answer. Assuming I'm reading the white paper correctly, encryption is on by default for the entire phone, with some additional safety-level for personal files (i.e. docs and images).
We have similar policies for our company-services utilized on phones and I am allowed to download, read and send e-mails on my P20 Pro just as on phones I've used earlier (with explicit encryption). Which is also the reason for following up on this issue. Either my phone is ok, the policy is not working as intended or my phone is reporting the wrong answer when queried from the server "are you encrypted". The last one would be the most critical I guess.
Also note the last comment on this thread: forums.androidcentral.com/huawei-mate-10-mate-10-pro/865831-does-pro-have-full-device-encryption-like-most-phones-now-9-did-not.html
To put it bluntly, I wouldn't trust any Chinese device when it comes to encryption. I'm not surprised that the P20 Pro is unencrypted. I used to have a OnePlus 3 that was encrypted (according to OnePlus, anyway...), yet when I factory reset it through the bootloader and gave to a family member, half my apps and SMS messages were still on the phone. when they signed in with their own Google account.
If you want data security, I think Samsung and the Knox platform is about as good as you're going to get. Apple won't give governments advice on how to decrypt iPhones, but I'm pretty sure it's possible with the right third party equipment.
This is the answer I got from Huawei customer support:
Our devices are encrypted from the factory when they are made, a user can then also add passwords, fingerprints and facial recognition to allow access to the device but as a standard in the Android system the main security function is a password and this is required after a restart of the device even if you have other unlock functions.
The encryption from the factory is an encryption on the internal storage unit.
Click to expand...
Click to collapse
So based on this, and the white paper mentioned previously, the devices are encrypted.
soniva said:
This is the answer I got from Huawei customer support:
So based on this, and the white paper mentioned previously, the devices are encrypted.
Click to expand...
Click to collapse
I've replied to my email from Huawei advising to confirm as we are getting different answers from support staff (my updates are coming from the UK Technical Support Team)
Update: Further from my post earlier, I've now had more information back from Huawei who have confirmed there is encryption by default, so have asked them to ensure all staff know as I seem to be getting incorrect information (especially from one member of staff)
Related
Even though there was zero documentation and nobody else seems to have tried it, I turned on storage encryption on my HTC One.
Not impressed. Here are a few observations:
1. At power up (once the drive is encrypted), it appears to go through a full boot cycle. It then presents you with an authentication screen to enter your credentials. It then appears to reboot itself through another full boot cycle and then finally move on to the lock screen. This seems really idiotic.
2. There is no separate crypto password. If you use a 5 digit numerical pin, this is automatically your encryption password. If someone were to really attack the storage crypto, they would be able to brute force a pin in seconds (probably less). Long complicated passwords are too cumbersome to be used on a lockscreen.
3. Luckily, performance impact appears to be minimal once booted - at least not enough to noticeably bother me. I don't have enough comparative data to talk to battery impact, but it appears to be minimal.
4. There is no way to undo encryption....you have to do a factory reset. To be fair, this was documented in the warning screens.
Overall, it feels that this entire feature was an engineering afterthought added to make sure there is a check box for encryption for those customers that require it.
This is a standard Android feature (and therefore provided by Google not HTC). If you search there is plenty of information on this feature, just not in this HTC One specific sub-forum.
Rumball said:
This is a standard Android feature (and therefore provided by Google not HTC). If you search there is plenty of information on this feature, just not in this HTC One specific sub-forum.
Click to expand...
Click to collapse
Thanks for clarification.
Sent from my HTC One using Tapatalk 2
I turned on encryption the day after receiving mine. It hasn't seemed to impact battery life or performance but as the previous poster mentioned, it acts like other Android devices with encryption upon boot.
It is a pain but not near as bad as losing my phone and knowing someone with very little computer skill might be able to get at my data.
Sent from my HTC One using xda premium
rootshot said:
2. There is no separate crypto password. If you use a 5 digit numerical pin, this is automatically your encryption password. If someone were to really attack the storage crypto, they would be able to brute force a pin in seconds (probably less). Long complicated passwords are too cumbersome to be used on a lockscreen
Click to expand...
Click to collapse
have you looked at Cryptfs Password?
it lets you set a separate password for your encrypted volume, so you can have something long 'n complex, but a short numerical pin for your lockscreen
i use it and it's totally awesome
PS: there's also EncPassChanger, it does the same thing
Advance Mobile Care has a folder specific encryption facility called 'privacy locker'
http://forum.xda-developers.com/showthread.php?t=2290180
There are other folder specific encryption apps available.
The main issue with encryption apps is their reliability. Can you really trust them not to lock you out for an unspecified, unrecoverable error?
Zoltair Wright said:
have you looked at Cryptfs Password?
it lets you set a separate password for your encrypted volume, so you can have something long 'n complex, but a short numerical pin for your lockscreen
i use it and it's totally awesome
PS: there's also EncPassChanger, it does the same thing
Click to expand...
Click to collapse
Awesome! Exactly what I was looking for. Thank you.
Hi,
So, Android has a permission system which albeit somewhat flawed (malware can gain permissions not intended for it) and not very suitable for laymen (non rooted phones have to either accept all permissions or be denied from the app. In many programs people don't have the luxury of not using them) theoretically has merit. IOS has...well actually I'm not sure how it works security wise but I pressume it creates sandboxes for each app, layman wise it is reasonable since you (theoretically) can deny access for all programs to certain components (no need to jailbreak).
How does WP works?
Thank you.
Security is different, apps can't do as much as on android. But iOS is better in this, because capabilities are like in Android: you can see what the apps want prior to installing them, but blocking some of them isn't possible.
I am very saddened to hear this.
Is there an ability in place similar to Androids rooting?
Also, what do you mean by "apps can't do as much as on android"?
Thank you!
@th0mas96's post is technically *mostly* accurate but very confusing and doesn't actually answer your question at all.
The short version is that WP apps use a capability-and-sandbox system much like iOS and Android, with each app getting a sandbox that gives it read-only access to the app-specific install directory and the global system directory, read/write access to the app-specific data directory, and access to whatever other stuff is specified in the capabilities. Capabilities are currently all-or-nothing; you can't reject or disable any capability except by just not installing the app.
I could go into the technical implementation of the system a bit, but the short version is that WP8 apps use fairly standard NT (as in the NT kernel that is at the core of PC Windows versions) security features: each app has a unique token (rather than inheriting the token of the process that crated it, the way it normally works on PC but very much like how Windows Store apps work on Win8) which contains the app-specific Security IDentifier (SID) that gives access to the app directories, plus the SIDs of the various capabilities that the app has.
What @th0mas96 was talking about is that WP capabilities usable by third-party developers are much more restrictive than they are on Android. For example, Android allows an app have full read-write access to your contacts or to send SMS directly. WP8 doesn't allow that unless you use capabilities that are normally neither allowed on the store nor allowed in sideloaded apps (Microsoft's code can have them, of course - that's how the built-in SMS app works - but not Joe Random Dev). The downside of this is obvious; some app behaviors (like a full replacement for the SMS app or phone dialer) are not possible. The upside is that apps are *way* more limited in how malicious they can be; the most common way that Android malware makes money (remember, the vast majority of malware is for profit) is by sending SMS to "premium" numbers. On WP8, an app could *compose* such a message, but it couldn't *send* it for you (unless it had a capability that third-party apps normally can't have) so you'd have a chance to see what the app was doing and decide not to send that message after all.
This means that the ability to disable capabilities is much less important on WP8 than on Android.
Oh, then those restrictions are actually good news.
Aside from from your typical run-of-the-mill malware my main concern was actually privacy. I have a huge displeasure from apps like Whatsapp which on android takes a whole plethora of liberties and was hoping that perhaps some other system may contain their user data voracity and their ability to control the divice their on.
Is there any link in which I could see the full list of those restrictions?
I'm still downhearted from not having a more fine grained control of the system but maybe it still has it uses in some scenarios...
Also, thank you very much for your comprehensive explanation!
i found a tiny file stored inside some of the unbranded htc accord RUUs. its call disablewriteprotect.test. the only thing the file contains is a sentence stating write protection will be disabled until this file is removed. followed by a music note and some other symbol. so there you go thats how you make your entire htc 8x read and write. one file less than 1kb in size. ROOT!
but how can we flash this file. im still working on it. this file is located within the efi partition which also houses the ffuloader.efi, and severl other efi executables. check this post http://forum.xda-developers.com/showthread.php?p=53687985#post53687985
you wont find that on google search.
Sent from my Galaxy Nexus using XDA Free mobile app
Window phone Security Issues
Your Windows Phone is secure by design. Many security features are turned on by default. For example, apps you download from the Windows Phone Store are tested by Microsoft and encrypted to make sure you don't accidentally install malicious software on your Windows phone.
Set a password
Setting up Kid's Corner
If you've ever handed your smartphone to a child, you know that they can quickly get into all sorts of apps and settings they shouldn't. No such worries with Kid's Corner, a place on your phone where your child can play with the games, apps, music and videos
Use the free Find My Phone service
Say yes to updates . check out more at Master Software Solutions - Windows Phone Update
grilledcheesesandwich said:
i found a tiny file stored inside some of the unbranded htc accord RUUs. its call disablewriteprotect.test. the only thing the file contains is a sentence stating write protection will be disabled until this file is removed. followed by a music note and some other symbol. so there you go thats how you make your entire htc 8x read and write. one file less than 1kb in size. ROOT!
but how can we flash this file. im still working on it. this file is located within the efi partition which also houses the ffuloader.efi, and severl other efi executables. check this post http://forum.xda-developers.com/showthread.php?p=53687985#post53687985
you wont find that on google search.
Sent from my Galaxy Nexus using XDA Free mobile app
Click to expand...
Click to collapse
Sounds interesting.
Not something I'd try )) but interesting.
Aman Raien said:
Your Windows Phone is secure by design. Many security features are turned on by default. For example, apps you download from the Windows Phone Store are tested by Microsoft and encrypted to make sure you don't accidentally install malicious software on your Windows phone.
Set a password
Setting up Kid's Corner
If you've ever handed your smartphone to a child, you know that they can quickly get into all sorts of apps and settings they shouldn't. No such worries with Kid's Corner, a place on your phone where your child can play with the games, apps, music and videos
Use the free Find My Phone service
Say yes to updates . check out more at Master Software Solutions - Windows Phone Update
Click to expand...
Click to collapse
I pressume this is an advert for Master Software Solutions, but nevertheless I did google the term you suggested and got nil results. I also browsed the main site of the company itself but haven't found anything related, nor did I find anything on their facebook page.
Regardless, I checked out this Kids corner thing, it's cute but not really security related...
Thx anyway.
Hi all,
I recently bought a P7 as my new smartphone. However, there is one thing missing. In the EMUI settings device encryption is not accesible, however this is a standard Android feature. I need this feature enabled because of enterprise policies otherwise I can't connect to our Exchange. Contact & agenda synchronization is necessary for me as my smartphone is a working device.
I tried updating to EMUI 3, but it's still not part of the ROM. It's a bit ridiculous Huawei isn't enabling this option within EMUI or doesn't even put encryption enabled by default.
Is their a workaround to enable this feature?
Thanks in advance.
Cerveza said:
Hi all,
I recently bought a P7 as my new smartphone. However, there is one thing missing. In the EMUI settings device encryption is not accesible, however this is a standard Android feature. I need this feature enabled because of enterprise policies otherwise I can't connect to our Exchange. Contact & agenda synchronization is necessary for me as my smartphone is a working device.
I tried updating to EMUI 3, but it's still not part of the ROM. It's a bit ridiculous Huawei isn't enabling this option within EMUI or doesn't even put encryption enabled by default.
Is their a workaround to enable this feature?
Thanks in advance.
Click to expand...
Click to collapse
I didn't find in setting but using the app "activity launcher" you can reach the hidden menu.
Open activity launcher>all activity>setting> encrypt phone
I don't know if encryption will work
Thank you for this interesting post usb2. I am able to open the Encrypt Phone activity and I can do all the prerequisites. When I start the encryption the phone gets "stuck" on a white screen with the green Android dude.
It's actually the same as the encryption screen on stock android, except without text and loading bar. Only the guy on a white background.
First I thought he was just busy encrypting but after 3 hours it was still like this. I just rebooted my phone and he is still working. Still not encrypted tho.
This is sad, I will need another ROM for this phone.
So, this sounds simple; but I guarantee you it is not.
I just got my Note5 about 2 weeks ago; and despite some missing key features, I really like it. Until today.
Carrier: Sprint (who apparently doesn't have 24/7 customer service)
My fingers were a little dirty (which they have been before) and my scanner wouldn't unlock the phone. Cleaned them and now it's already locked and seems to not really check the prints anymore?
First attempted fix: backup password, I know I set it up...but it doesn't work. None of the passwords I might use will work.
Second attempted fix: Google signin, I have a free google apps account and apparently using my whole email address as username doesn't work on this; also tried just using the plain username just in case. I know the password is correct. I'm the domain administrator.
Third attempted fix: Android device manager, tried setting a new password on the lock screen and was greeted by the infuriating message "Since google has verified that your screen is already locked, the password you set won't be needed"
Fourth attempted fix: chat with samsung support, which was utterly useless. Although I did find out that samsung has their own unlock utility...except that it has to be setup beforehand.
Fifth attempted fix: bang head on cement...hasn't shown any signs of working yet. Although I feel less frustrated.......and less conscious.
Theories: free version of Google Apps, sucks (the apps themselves are great)...I've had tons of trouble getting signed into certain google features over the years. Also I have no option for a support PIN to use to contact google support.
I think that my latest OTA update may have somehow changed or reset my backup password.
The last theory is whomever changed Android device manager to not reset lockscreen passwords whenever you want to...basically made that tool half as useful as it should be and completely useless to me.
Anyone have any other ideas, that don't involve a full wipe?
I was finally able to gain access to my phone. I had to disable two-step verification in order to sign into my google apps account from the lock screen.
I am having the same issues and tried ALL of the fixes you tried except I didn't get the notification to login with google. When does that happen?
I had the problem, too. I ended up having to factory reset. REALLY irritated by this.
Make sure you put 1* reviews on your Banking apps or all apps that need updating to support face unlock, hopefully it will help speed up the development and support of face unlock on the pixel 4. I am really missing fingerprint unlock on my apps!
Demolition49 said:
Make sure you put 1* reviews on your Banking apps or all apps that need updating to support face unlock, hopefully it will help speed up the development and support of face unlock on the pixel 4. I am really missing fingerprint unlock on my apps!
Click to expand...
Click to collapse
Why? I just contacted my credit union asking for them to add support. Maybe larger national banks and stuff should have been aware and had support ready but smaller, more local institutions might just need to know that it's a thing on Android now.
Sent from my Pixel 4 XL using XDA Labs
In the Play Store, you can reach out to contact each app's development team via email. I've written to Chase, Bank of America, Mint, Credit Karma, and the other apps I use. Some developers are aware that they need to update, others aren't. Here are some of the responses I've received.
My original email (to each app):
Please update the Android app to support the biometric API so that I can use the secure face unlock on my Pixel 4! Thank you!
Click to expand...
Click to collapse
Bank of America:
Thank you for your feedback and we apologize for the inconvenience. We are working to update to the latest biometric authentication for the Pixel 4 and expect to have a supporting app shortly. For now, sign-in to the app using your online ID and password. Please look out for an app update soon.
Click to expand...
Click to collapse
Chase:
We'll be happy to review your request to update the
Android App.
Ivan, please note that the Chase Mobile App will work on
any Android smart phone or tablet running Android
operating system 5.0 (Lollipop) or higher. The minimum
operating system is 5.0 or higher. If your mobile phone
does not have the minimum requirement, the Chase Mobile
app will not be compatible.
We want our mobile app users to have the best experience
possible, so we regularly test chase.com using the most
current versions of operating systems. Since some mobile
app functionality may not work well on older operating
systems, we ask that you perform these updates. We
recommend you update your operating system and application
to the newest versions available. If your device isn't set
up to receive updates automatically, you can get the We
recommend you update your operating system and application
to the newest versions available.
We appreciate your business and thank you for choosing
Chase.
Click to expand...
Click to collapse
Credit Karma:
To determine if your Touch ID or Face ID function is turned on or off, go into your settings by clicking the icon in the top right corner of the app. The directions are the same whether you’re using Touch ID or Face ID.
If Touch or Face ID is turned on you will see a green circle with a white check mark.
If it’s turned off, simply click the empty circle and you’ll be prompted with a message stating the fingerprints or face registered on your phone can be used to access your Credit Karma account. Click “OK” to this prompt and you will be asked to enter your PIN to confirm this change.
Touch or Face ID is now turned on and you will be allowed to use this function to access the Credit Karma app moving forward.
Please note that if you log out of your account, the next time you open the app you’ll be prompted to enter your email address and password.
Thanks so much,
Click to expand...
Click to collapse
I've been sending further follow-ups to the ones who clearly don't understand what we are asking.
The more people who contact them, the more they'll understand that their apps are the problem by not using the current API.
I think Chase already stated that they were going to have an update before the end of the year. Hopefully sooner rather than later.
Robinhood works!
btonetbone said:
In the Play Store, you can reach out to contact each app's development team via email. I've written to Chase, Bank of America, Mint, Credit Karma, and the other apps I use. Some developers are aware that they need to update, others aren't. Here are some of the responses I've received.
My original email (to each app):
Bank of America:
Chase:
Credit Karma:
I've been sending further follow-ups to the ones who clearly don't understand what we are asking.
The more people who contact them, the more they'll understand that their apps are the problem by not using the current API.
Click to expand...
Click to collapse
Very nice work, I have left reviews and also contacted all my Banks via email. Hopefully it speeds up the process.
Throwing up a bunch of one-star reviews won't help, and all it serves to do is make the rater (you) look petty and childish. I'll send an email to my institutions, like a grownup, and go from there.
Getting in contact directly works best, via the play store will get you to the android app devs. I usually go through Twitter and you get a spokesperson who wouldn't know an apk from an adb and will give a stock response of soon™.
Remind them that the old biometric APIs are deprecated and that they should update to current versioning. Should anything happen they don't want to be the story of the bank that wasn't able to keep up.
Honestly I'm not missing it that much for my bank that much because I use LastPass which autofills it quickly. I do miss it for Outlook though because I have to do a pin.
Sent from my Pixel 4 XL using Tapatalk
So Far E-Trade has been updated to the Pixels face Unlock... I sent an email via the app store also to a credit union hoping they will update their app. I'm hoping within the next 2 weeks to a month that all major banks will update...
How secure if this anyway? I mean, my banking account has a password. I enter that password in my banking app to log into my account. In the future I will use my facial scan to log into my banking app.
Does that mean my banking account will have two password (1x password + 1x facial scan) oder will my password be stored somewhere in the app or on android and simply be passed on the my facial scan is verified?
Both do not sound very secure to me.
If you don't feel it's secure then just don't use the app.. simple. I trust that the banks know the risks and have mitigated them. After all they are the ones on the hook if there's fraud.
bobby janow said:
If you don't feel it's secure then just don't use the app.. simple. I trust that the banks know the risks and have mitigated them. After all they are the ones on the hook if there's fraud.
Click to expand...
Click to collapse
Not really the informative answer I was looking for.
I wouldn't blindly trust a bank app or any of the other countless apps that would use my facial scan.
What happens if your facial scan gets stolen / leaked. Everyone with that information will for ever be able to access your data. And you can't even change your access code like you would be able to with a password.
And it seems like you also have no idea where your facial scan is being saved, and how it is secured / locked down. Maybe it is just a plain file on your phone's storage? You don't seem to know.
Why no simply write down all your passwords in a .txt file and save it on your sdcard? That would alteast have the advantage that you could change your password at some point.
Utini said:
Not really the informative answer I was looking for.
I wouldn't blindly trust a bank app or any of the other countless apps that would use my facial scan.
What happens if your facial scan gets stolen / leaked. Everyone with that information will for ever be able to access your data. And you can't even change your access code like you would be able to with a password.
Click to expand...
Click to collapse
Isn't the face unlock for that device only? It's not like someone can install your bank app on their phone, somehow use your face unlock information, and spoof you on that device. Also there's still 2 step verification, at least with my bank, so the new app would still need to get the verification code. If anything, it's easier to do with your password because that's something that can be typed in and then somehow get the verification code text.
Sent from my Pixel 4 XL using Tapatalk
Utini said:
Not really the informative answer I was looking for.
I wouldn't blindly trust a bank app or any of the other countless apps that would use my facial scan.
What happens if your facial scan gets stolen / leaked. Everyone with that information will for ever be able to access your data. And you can't even change your access code like you would be able to with a password.
Click to expand...
Click to collapse
I'm not sure of the question you are asking. It seemed rhetorical to me basically commenting on how you don't think fingerprint, facial or password entry is secure on your app. I don't think any of it is stored in the cloud but nonetheless it's probably not as secure as walking into your bank and transacting with a teller. Even websites probably aren't as secure as you wish they were. So what exactly are you asking that you expect a reply to? You can perhaps check with your bank as to what your liability would be if your account got hacked.
EeZeEpEe said:
Isn't the face unlock for that device only? It's not like someone can install your bank app on their phone, somehow use your face unlock information, and spoof you on that device. Also there's still 2 step verification, at least with my bank, so the new app would still need to get the verification code. If anything, it's easier to do with your password because that's something that can be typed in and then somehow get the verification code text.
Sent from my Pixel 4 XL using Tapatalk
Click to expand...
Click to collapse
Oh is it? That makes it defeniately more secure. But then I would still like to know how it is ensured that my facial scan only works with my specific mobile device and not with any other mobile device.
Yep for banking there is still 2 step verficiation. Good point. But I was actually thinking more about e.g. KeePass.
bobby janow said:
I'm not sure of the question you are asking. It seemed rhetorical to me basically commenting on how you don't think fingerprint, facial or password entry is secure on your app. I don't think any of it is stored in the cloud but nonetheless it's probably not as secure as walking into your bank and transacting with a teller. Even websites probably aren't as secure as you wish they were. So what exactly are you asking that you expect a reply to? You can perhaps check with your bank as to what your liability would be if your account got hacked.
Click to expand...
Click to collapse
Maybe I didn't explain my question good enough. I will try again:
Currently I would unlock e.g. my KeePass Database with a password.
In the future I would use my facial scan for that.
I wonder at what point my facial scan will access my password of the KeePass Database, because it somehow has to know my password in order to unlock KeePass?
And in that case my password suddenly isn't saved only in my head anymore but also within android or another app (because Face Unlock has to somehow know it?).
Or will my KeePass database get a second "password" which is my facial scan data?
In that case I want to make sure that my facial scan is very secure and can't be stolen. Because if it turns up in smth like "haveibeenpwnd.com" everyone will forever be able to access all my files with my leaked facial scan which I cannot even change to something different anymore.
Utini said:
Maybe I didn't explain my question good enough. I will try again:
Currently I would unlock e.g. my KeePass Database with a password.
In the future I would use my facial scan for that.
I wonder at what point my facial scan will access my password of the KeePass Database, because it somehow has to know my password in order to unlock KeePass?
And in that case my password suddenly isn't saved only in my head anymore but also within android or another app (because Face Unlock has to somehow know it?).
Or will my KeePass database get a second "password" which is my facial scan data?
In that case I want to make sure that my facial scan is very secure and can't be stolen. Because if it turns up in smth like "haveibeenpwnd.com" everyone will forever be able to access all my files with my leaked facial scan which I cannot even change to something different anymore.
Click to expand...
Click to collapse
I used LastPass and I think it's not different then when I died the fingerprint option for it. There's a master password for the account and biometric login is, again, just for the individual device. And again, there's 2 step verification at least with LastPass, for whenever you set up.
Sent from my Pixel 4 XL using Tapatalk
EeZeEpEe said:
I used LastPass and I think it's not different then when I died the fingerprint option for it. There's a master password for the account and biometric login is, again, just for the individual device. And again, there's 2 step verification at least with LastPass, for whenever you set up.
Sent from my Pixel 4 XL using Tapatalk
Click to expand...
Click to collapse
Sounds interesting and secure. Now I am interested in how it is ensured that my fingerprint / facial scan will only work with my specific mobile device and that the stolen data from my device can't be used from another device
Utini said:
Oh is it? That makes it defeniately more secure. But then I would still like to know how it is ensured that my facial scan only works with my specific mobile device and not with any other mobile device.
Yep for banking there is still 2 step verficiation. Good point. But I was actually thinking more about e.g. KeePass.
Maybe I didn't explain my question good enough. I will try again:
Currently I would unlock e.g. my KeePass Database with a password.
In the future I would use my facial scan for that.
I wonder at what point my facial scan will access my password of the KeePass Database, because it somehow has to know my password in order to unlock KeePass?
And in that case my password suddenly isn't saved only in my head anymore but also within android or another app (because Face Unlock has to somehow know it?).
Or will my KeePass database get a second "password" which is my facial scan data?
In that case I want to make sure that my facial scan is very secure and can't be stolen. Because if it turns up in smth like "haveibeenpwnd.com" everyone will forever be able to access all my files with my leaked facial scan which I cannot even change to something different anymore.
Click to expand...
Click to collapse
Oh I see now. This really has more to do with your password manager than the bank. Unfortunately, I don't use a PM even though I suppose I should. Everyone says it's pretty secure. Since I don't really know what I'm talking about at this point I'll give it a shot anyway. lol
I don't think the facial scan or the fingerprint scan is saved anywhere other than your device. But I do use fingerprint (or did) scans on my banking app. If I change my password on the banking site my fingerprint scan will no longer work on the app. I would first have to change my password on the app and then reregister my fingerprint when the new password is entered. Can we compare it to the face scan at this point? I mean you can't change your fingerprints either right? Before I go on, am I reading your concerns correctly?
Utini said:
Sounds interesting and secure. Now I am interested in how it is ensured that my fingerprint / facial scan will only work with my specific mobile device and that the stolen data from my device can't be used from another device
Click to expand...
Click to collapse
https://support.google.com/pixelphone/answer/9517039?hl=en
Maybe this confirms it?View attachment 4860867
Sent from my Pixel 4 XL using Tapatalk