Samsung’s “repair mode” lets technicians look at your phone, not your data

https://arstechnica.com/gadgets/2022/07/samsungs-repair-mode-lets-technicians-look-at-your-phone-not-your-data/

by WaitWaitWha • 4 years ago

195 86 4 years ago

Following is the text of the post as translated to English by G.

Samsung Electronics has officially unveiled the 'repair mode' service that can prevent the leakage of personal information of Galaxy smartphone users. 'Repair Mode' is a function that allows you to selectively disclose data when repairing a smartphone, and fundamentally blocks concerns about access or leakage of personal information that may occur during the repair process through some private companies. If the user executes 'Repair Mode' in the 'Battery and Device Care' menu in the 'Settings' of the smartphone, the smartphone is rebooted. After that, you won't be able to access your personal data, such as photos, messages, and accounts, and only use the default installed apps. After repairing the smartphone, the user can access personal data again after exiting the 'repair mode' and rebooting through pattern/fingerprint recognition. Samsung Electronics will first introduce 'repair mode' through software updates from the Galaxy S21 series, and plan to expand it to some other models in the future. Recently, Samsung Electronics has been continuously adding functions to protect and secure sensitive personal information to mobile devices such as smartphones and tablets. Last year, it unveiled 'Samsung Knox Vault,' an information protection technology that blocks various attacks by storing encrypted personal information in its own storage space. We released a new security solution to block. In a recent article published in the Samsung Newsroom, Shin Seung-won, managing director of the Security Team of Samsung Electronics' MX Division, said, "Technology is connecting the world closer than ever, but the risks are also increasing." "Samsung's top priority is customers “It’s about making sure you stay safe while trying out this new experience.”

pvg• 4 years ago

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

For things like that, find an English language source or wait till one materializes.

63• 4 years ago

This feels like a big win for privacy. I just hope that it's communicated well enough that users know to enable it when they send in their phone for repairs.

I also wish there was a way to enable it if the touchscreen is inaccessible, as it usually is by the time I would consider seeking repairs.

ISL• 4 years ago

Smart repair shops will enable it (and document it) as Step 0 in a repair. What a great way to reduce risk and liability for everyone.

randombits03• 4 years ago

It’s also bs. The promise is only as good as the maker and the technology. Has it been vetted? Are there independent evaluations? Is Samsung willing accept any liabilities in the event of failure?

All hype, no substance. Delete your data (with no way of verifying) and restore it on return.

missedthecue• 4 years ago

What would make you feel it's sufficiently vetted?

xeromal• 4 years ago

If you don't trust the manufacturer of your phone, don't buy the phone.

silversnitch3• 4 years ago

Curious, why does Samsung need to have Phone booted up for battery repair? I recently had a battery replacement done for my iPhone and I had similar concerns if I need to give them Phone unlocked, but they asked me to turn off Phone. That is what I expect from battery repair!

bpodgursky• 4 years ago

I assume the technician wants to make sure the phone still works after they replace the battery...

recycledmatt2• 4 years ago

You want to turn it back on to validate everything is working right and it’s all plugged in correct. You also want to validate you didn’t break anything else while attempting the repair

gambiting• 4 years ago

And also(sadly necessary) you want to stop scammers who will send you a broken phone and then pretend you broke it. So you want to switch it on before and after the repair.

kevincox• 4 years ago

Can't they have a signed "self-test" image that they can boot up and it checks the phone? This wouldn't have access to any user data but can boot up and check that all of the components are working. This sounds much quicker and more effective than prodding at the user's OS anyways.

takeda• 4 years ago

Oh man, HTC 10 was the worst phone I owned in terms of repair-ability (I even saw one phone repair place explicitly saying they don't support that phone). Not only you risk screen (primarily) and other components damage. You can also break the phone in subtle ways when putting it back[1] and reopening it back is again tough because you need to unglue the screen first to get to screws.

Having a builtin validating code as one commenter mentioned would be a godsend, but nearly all companies do everything they can to make customers not want their phones repaired.

[1] things like some sensors not working, accidentally clipping the tape with buttons, touch screen being funky (although that likely was due to non genuine screen), or my favorite - gps working but never able to get exact location)

ajsnigrutin• 4 years ago

Plus, a lot of phones give out diagnosic info (current going in, battery voltage, current going out, etc.)

Phones also have induction chargers on their back plates (Qi, usually to charge heaphones and stuff), that have to be enabled in software to charge.

godelski2• 4 years ago

Especially the screen. I mean you have to rip off the screen to get to the internals. Lots of people already have cracked screens and it is hard to put them back on without making the cracks even bigger. A small crack with no chromatic effects can easily make those from the prying. Why would you not want to validate the quality of the screen after you have just been wrestling with it?

silversnitch3• 4 years ago

In my case they ran a diagnosis over the network to make sure everything is working.

Diagnosis software is built into iPhone so I can put a trust on it that it ain't sharing private data to the store employees.

Similarly they ran a diagnosis again at the end of repair. They did boot up the phone my themselves and ran it. Looks like they can run diagnosis on locked Phone.

This is overall much better than asking to unlock Phone.

vladvasiliu• 4 years ago

When I had my iPhone battery changed, they explicitly said it should be unlocked and / or I should give them the code. So I went through the trouble of backing everything up, wiping the phone clean, and then reinstalling everything when I got it back.

If there was some kind of "status debug port" or whatever, the technicians could've done the various checks the sibling talks about without needing full control of my phone.

vinni22• 4 years ago

This.

silversnitch3• 4 years ago

I replied to another thread and adding here again, they have diagnosis tool built into iPhone that can be triggered over the network when connected to same WiFi. This also works when Phone is locked.

This is how my repair went through. At no point they asked for my passcode or to unlock Phone.

vinni22• 4 years ago

It’s not just Samsung Apple does the same. I was shocked when I wanted to replace my iphone display and the technician asked me to turn off pass code. Like he didn’t even give me another choice. I did a quick backup on icloud and wiped my phone and gave it. It was annoying to restore everything.

frozenport• 4 years ago

Everybody that upvoted read the article in Korean?

teej• 4 years ago

We live in the richest time in human history for free, high quality text translation.

blooalien2• 4 years ago

Google Translate *is* "a thing" these days… Amazing where technology has gotten us. Much of what we enjoy as commonplace today was literal science-fiction when I was just a child (not so very long ago).

rvba• 4 years ago

We played Starcraft: Brood War so we know how to translate Korean

leereeves2• 4 years ago

If the user executes 'Repair Mode' in the 'Battery and Device Care' menu in the 'Settings' of the smartphone, the smartphone is rebooted.

But how do you enter repair mode if your phone is broken?

liminalsunset2• 4 years ago

I think on Samsung phones, plugging them into a standard USB-C multiport hub with an HDMI monitor and a keyboard/mouse plugged in allows use of the "DeX" mode, even while locked.

I would assume someone could plug the phone in, use the mouse to enter their password and operate the UI to activate such a feature.

Nullabillity• 4 years ago

I'm sure that'll be helpful for the one person in the world who owns a USB-C multiport hub.

nolok2• 4 years ago

You can just use a usb to hdmi cable or adapter

blooalien2• 4 years ago

Depends entirely upon how exactly it's broken, and how the mode is enabled. If it's done in the settings app, then as someone else here pointed out, a broken screen would make that a bit pointless. If the mode can be enabled other ways (button combination, something via USB, etc) preferably in multiple possible ways, then it could be extremely useful.

zuminator• 4 years ago

Seem to me that if your phone can't even boot up, then repair mode is moot, the repair person won't be able to log into your account to access your private info. Even after the phone is operational they still won't be able to run anything without you putting in your password. I think this is more for the situation where the repair person asks you to log in so they can verify that the phone is fully working. You'll want to expose as little sensitive data as possible.

I do think you have a point though. If you sent in a non-functional phone, and now it's in the shop being fixed, but the repair person needs to do a detailed check of the phone's operation, how can that be done safely without you being present? Maybe there could be a "repair mode password" that you can give out remotely and only allows the phone to enter repair mode.

leereeves2• 4 years ago

Seem to me that if your phone can't even boot up, then repair mode is moot

I've never needed to repair a phone, but I assumed the repair shop asked for your password. (And some other comments have said as much here.) Do they not do that?

If they do, I like the idea of a "repair mode password".

re• 4 years ago

Some English-language coverage:

https://arstechnica.com/gadgets/2022/07/samsungs-repair-mode...

https://www.sammobile.com/news/samsung-repair-mode-data-isnt...

https://news.google.com/stories/CAAqNggKIjBDQklTSGpvSmMzUnZj...

dang• 4 years ago

Changed from https://news.samsung.com/kr/%ec%82%bc%ec%84%b1-%ea%b0%a4%eb%.... Thanks!

MrDresden• 4 years ago

What does PII stand for? Personal identifiable information?

If so, there is much more stored on a device then identity information.

foota• 4 years ago

It generally means anything sensitive.

karamanolev• 4 years ago

It's not so much identity information (i.e. data about your identity), as much as data that can personally identify you. The obvious PII is your full name and social security number. That's your identity. But your credit card number or your address aren't your identity, per se, but still can personally identify you, so also considered PII.

Things that are not normally considered PII is for example your OS or even specific device model (i.e. user is using iPhone 12 Pro is not normally considered PII). As usual, it's not a crystal clear definition, so varies by context, company, industry regulations and so on.

pbhjpbhj• 4 years ago

Things like IMEI are PII too, the number is printed on a label on the mobile phone box and recorded by the seller (in UK, I gather) when you make a purchase.

ixmerof• 4 years ago

That's both odd and interesting, my only experience with official repair services was that they always were starting ANY job by wiping the entire device. That was always written in bold letters that's what I have to agree for. Their answer on why it is required was always that's the only way to test the phone is fully functional as from factory with default config. Thus... I started fixing them on my own.

jiggywiggy• 4 years ago

The amount of times it refused to give my password for a repair and they in returned refused warranty is more too often. Luckily it was mostly their bluf.

turtleman1338• 4 years ago

There is a standard android feature for years that works the same: Guest Account. Anyway I would wipe my device before sending it to repairs.

baisq• 4 years ago

That's okay, but I would never send my phone in for repair without wiping it first no matter what. Surely I'm not alone :-)

627467• 4 years ago

Companies (apple included) can invest all they want in features and press releases claiming that said features are to ensure customer privacy but - unless these features are open sourced and subject to public and recurrent scrutiny - it is just faith that they expect from customers.

If you care deeply about the privacy of you data, don't hand your data on a physical device to anyone.

Pakdef• 4 years ago

Also, we know that if you use icloud, Apple saves a copy of your encryption key ...

init2null• 4 years ago

That's true with iCloud Backup specifically, not iCloud. But unsecured notes and photos don't fall under the encryption umbrella, so syncing those means you lose privacy. Even syncing messages is safe, since messages are shared with your private encryption key. iCloud Backup and photo syncing are pretty much the bones thrown to US law enforcement.

Gigachad2• 4 years ago

You don't need open source. Just look at the business incentives. Samsung has no incentive at all to give 3rd party repair workers access to your private data. Even if the feature isn't bullet proof, its going to be a whole lot better than the current situation where you hand your phone and password over and come back later to pick up the phone.

na85• 4 years ago

National Security Letters or their equivalent in other jurisdictions render the "no business incentive" argument to be moot.

gdaramouskas• 4 years ago

Are you sure you 100% knowledgeable of a conglomerate's business incentives?

godelski2• 4 years ago

I disagree. Hype matters. If companies are advertising themselves on privacy then that makes the average person concerned about safety. It then makes it when privacy concerned techies sound less like conspiracy theorists and creates some feedback. I wouldn't be surprised if there's been an uptick in Signal downloads due to Apple and Samsung advertising.

Something is better than nothing. And the smoke and mirrors can still help. I agree OSS would be better, but I'll take what I can get. Even if that is just a moving ecosystem.

ibejoeb3• 4 years ago

There are other practical indicators of how good things are. Apple, for instance, demonstrated that the iphone was sufficiently secure to provoke some novel legal maneuvering during the San Bernardino situation.

lern_too_spel2• 4 years ago

Which was then circumvented by a third party. The legal maneuvering wasn't that novel: despite what Apple advertised, Apple could obtain the data off the device, and the FBI simply asked Apple to do it for them.

sneak2• 4 years ago

Apple had already provided all of the data from the phone to the FBI via the iCloud Backup that is readable by Apple.

The rest was media posturing.

sebazzz• 4 years ago

it is just faith that they expect from customers

You know independent infosec reviews are a thing, right?

greatgib• 4 years ago

I also call for bullshit feature. Most of the time, you send your phone because it is not working anymore, unreactive, so there will be no way to go into repair mode.

But, that being said, this does not address also one big hurdle for people sending their phone for repair, that is the opposite: losing all data. As a standard procedure, most technicians will reset to factory the device to see if it fixes the problem even when you send it for an unrelated issue.

stjohnswarts2• 4 years ago

but your phone (at least most modern phones) are encrypted and password/facialy recog locked. How are they going to get anything useful off of it?

raninepaths• 4 years ago

Something is better than nothing.

Too• 4 years ago

What an odd feature to expose to the the user. User data partition is already encrypted. It would be enough with different boot option, chosen by the workshop with usb, fastboot or key combo, they could not access data anyway. Maybe its hard to explain to non techies why they need to power off their phone before handing it to the workshop. Otherwise this just sounds like PR stunt.

booi• 4 years ago

How would the workshop test the repair if they can't boot into the phone?

seba_dos1• 4 years ago

Have you replied to the correct comment?

alephxyz• 4 years ago

I wonder if it works well enough to travel, i.e. does it make it obvious that the phone is in repair mode and does it stop someone from copying an image of your personal data.

alok-g• 4 years ago

Manufacturers, please do the same for laptops too.

ASUS warranty policy makes people click "I agree" to all their data being erased during a warranty repair. So what the repair needed is for a touch screen.

Samsung’s “repair mode” lets technicians look at your phone, not your data

Related Stories