Continuing to Raise the Bar for Verifiable Security on Pixel

https://security.googleblog.com/2021/03/continuing-to-raise-bar-for-verifiable.html

by theafh • 5 years ago

14 10 5 years ago

security.googleblog.com

coolspot• 5 years ago

It’s all great unless (until?) they use the security as an excuse to prohibit side-loading and lock every piece of content with DRM.

panarky2• 5 years ago

There is zero evidence that this is happening.

commoner• 5 years ago

Android's SafetyNet API already prevents devices with unlocked bootloaders from accessing certain apps, including some games and financial apps, although there is a way to bypass this check. A future update (hardware attestation for SafetyNet) is expected to remove this workaround:

https://www.xda-developers.com/safetynet-hardware-attestatio...

errantmind• 5 years ago

If you really want to raise the bar for security on your Pixel phone, check out https://grapheneos.org/

177tcca2• 5 years ago

Even if you'll never touch a phone with a Google logo, Daniel does such an excellent job at explaining applied (in)security information that the website is worth every second you spend there.

cheald• 5 years ago

Security's great until it starts being used to secure the device against its owner.

177tcca2• 5 years ago

Have you heard of GrapheneOS.org?

fitblipper• 5 years ago

From the article:

Threats: Physical Access -> Mitigations: Protected Storage - Secure storage (that is, encryption of data-at-rest) for data contained on the device

From https://securephones.io/main.pdf

An attacker who can logically gain access to the memory of a device following boot and first unlock can directly access encrypted data and keys.

To (over?) simplify things: If you have already unlocked your phone at least once, even if it is currently locked (which is probably >99% of the time) your phones data is not protected as these repeated statements of "your data is encrypted at rest!" imply.

exabrial• 5 years ago

Funny, I don't have root access on my pixel to block ad traffic to Google servers.

Continuing to Raise the Bar for Verifiable Security on Pixel

Related Stories