Hacker News Reader

Comment by hollander | Hacker News Reader

You apparently lose your phone, and you can be sure they will copy any content on it, even if it's decrypted. If you enter, change your PIN to something alphanumeric, especially when you're on Android. Just a number is easy to beat, even if it's 10 digits long. I think the latest iphones are safe enough. I don't know about Windows Phone, but don't think it's safer than Android.

View on HN

> I think the latest iphones are safe enough.

Not sure about that. After Apple refused to help, the FBI claims to have hacked that iPhone anyway, with a tool developed outside the government.

https://www.theguardian.com/technology/2016/apr/27/fbi-apple...

Yeah, but that's an iPhone 5C, which is three generations old.

It was an iPhone 5c. No Secure Enclave.

BTW, what was the result of that? They paid hackers a ton of money to unlock old firmware, iOS 8.0, on an old phone, 5C.

This was also a phone from a terrorist.

> This was also a phone from a terrorist.

I think the downvoted parent is relevant in that they mightn't make the effort for a 'normal' person.

> I don't know about Windows Phone, but don't think it's safer than Android.

Windows Phone user here. I know for a fact the SD card you put in your phone is encrypted and can only be decrypted in the phone itself[1]. I don't know for sure about the internal storage; it's supposed to be encrypted if you use a screen lock on your device but I have no easy way to test that. Regardless, if they can force you to reveal your pin/password you're hosed anyway.

[1] "Can't be decrypted" assumes, of course, that the government wanting to decrypt it doesn't have an agreement with Microsoft to hand over the private key or otherwise provide access. My understanding is that Microsoft's position lately has been "no warrant, no access" but that could just be lip service. In either case, Windows Phone is a dying platform and anyone security conscious enough to worry about border crossings would hopefully have something more inherently secure anyway.

Windows Phones use the Secure part of the Secure Digital(SD) standard. Very few other platforms use it.

That's my understanding, yes. And I've had to deal with it first hand when I forgot I had used a certain SD card in a Windows phone and then tried to access its data in another device. I had to pull that old phone out of storage to access, then wipe and unlock the card. It's a great feature that I wish other phone manufacturers would adopt.

Windows Phone/Mobile user here. SD card content is not encrypted. Encryption for SD cards is coming in the Windows 10 Creators Update and just dropped in the dev builds[1].

[1] https://blogs.windows.com/windowsexperience/2017/01/12/annou...

It's been a feature since the WP7 days, and as I stated in another comment, it's obviously still in practice because I've had to decrypt a card using the Windows Phone 8.1 (upgraded to 10) device that originally encrypted it.

http://www.ghacks.net/2010/11/13/windows-phone-locks-in-micr...

http://www.card-data-recovery.com/unlock-windows-phone-7-car...

Maybe this was an WP7 feature which still had backwards compatibility.

My personal knowledge starts with 8.1. At least since 8.1 - so practically any relevant phone sold or in use today - the SD card has a hidden encrypted partition which holds apps moved to the card and a public partition for user data (photos, downloads, audio, video etc). This public partition with userdata is not encrypted and can be read at any device.

In the coming W10M update it's possible to encrypt the whole card again, so e.g. photos are protected.

You know what...the same card has migrated with me from WP7 to 8.0 to that 8.0 device being upgraded to 8.1 then 10. Still, I had to put it back in that last device to get it unlocked for use on my current phone (Lumia 650). Otherwise the phone refused to recognize it, wanting to immediately format it, and ditto my Windows 10 and Linux desktops. On Linux at least, it did show two separate encrypted partitions, so given what you said that makes sense.

There's a device for unlocking I-phones. I saw it in action a few times at work: The I-phone is placed horizontally into a cradle, 40 cm above the screen there's some kind of a device. That device produces flash flights, a couple times per second and I suspect it takes pictures. If I remember correctly there's nothing touching the buttons. The officer said that it can crack I-phone 6 (7 was not out when I asked it). What I suspect is that it uses brute force and avoids the delaying system. Since I work in a low tech environment, I was surprised to see that thing in action.

Reply on news.ycombinator.com