Hacker News Reader

One thing I've always wondered... is the PIN code or unlock pattern (and disk encryption key) protected by a hardware security module that rate limits attacks? If someone has physical access to the device and can image the flash drive, what's to keep them from brute forcing the tiny PIN code keyspace to gain access to the drive?

View on HN

Newer iPhones do this in hardware, not sure about Android phones but a software approach is far less secure than using a hardware chip.

Most Android phones throttle the rate you're allowed to enter PINs if you fail multiple times in a row (from minutes to hours). You can set the phone to wipe the entire flash memory if too many PIN entries in a row fail.

But that won't help if you're up to the sort of attacker disk encryption is supposed to protect from, right? Disk encryption protects data at rest, in which case you can assume the attacker has loaded the flash into his own system and don't give a cent about Android's PIN restrictions.

It would if the KDF used to expand the PIN also used some per-device secret in a HSM.

Reply on news.ycombinator.com