What you need to know about encryption on your phone - CNET
What you need to know about encryption on your phone - CNET |
| What you need to know about encryption on your phone - CNET Posted: 10 Mar 2016 12:00 AM PST  The heated and very public confrontation between the FBI and Apple has spurred a lot of talk about encryption, the technology that shields data on phones and other gadgets. The feds are pushing Apple to find a way to prevent an iPhone 5C from erasing itself after 10 successive incorrect guesses at the passcode. The user of that phone, San Bernardino shooter Syed Farook, used a PIN code to secure his device, and without bypassing that code, the data stored on it is unreadable, thanks to encryption. If Apple were to disable the auto-erase feature, the FBI could then connect the iPhone to a computer and quickly and repeatedly attempt to guess the passcode -- a technique commonly referred to as a brute force attack -- until the device is unlocked. Should the FBI prevail and the courts force Apple to comply, the decision could have widespread implications for our daily lives. Apple and fellow technology companies would be forced to create permanent solutions for law enforcement to get around encryption, using what's commonly referred to as a back door. Alternatively, companies could very well decide the financial burden of maintaining encryption and abiding by law enforcement requests is too much, and give up on adding security features to the devices we've come to rely upon. With our personal devices carrying more and more of our lives than ever before, it's a good time to look at what is and isn't encrypted and what you can do to ensure your information is safe. What is encryption? A fancy word for a basic concept, encryption is the science behind protecting any information stored on an electronic device, be it a phone, a laptop or a server. On a phone that means your photos, text conversations, emails and documents. Encryption stores information in a scrambled format, typically unreadable by computers or people without a key (which only the device's owner should know) to unlock the data. PIN codes (of numbers, letters or a combination of both) and fingerprints are just two of many examples of keys used to unlock an encrypted device. Indeed, the practice of encryption is far more technical than requiring a PIN code or fingerprint to unlock a device. Some phone manufacturers, such as Apple, require multiple pieces of information -- one known to the device owner, another embedded in the processor inside the device unknown to anyone -- to unlock data stored within the device. It's important to note, regardless of the device you're using, data created by third-party applications store information on their own servers, which may or may not be encrypted. Even then, the rules for decrypting data stored on a server are often different than data stored on a phone (see iCloud section below for more information). In other words, most of what we do on a phone is backed up to a server at some point. That means a copy of your Facebook posts or photo albums, Snapchat conversations, or Twitter direct messages are stored on your device but also on the respective servers for each service. Essentially, any information stored within an app on your phone that forgoes any sort of connection to a server is encrypted and inaccessible by law enforcement on a locked phone. For example, if an iOS user wanted to keep Notes or Contacts off of Apple severs, he or she would need to disable iCloud sync for the respective app in Settings. If you've opted not to sync your contacts or calendars through Google or a similar service, relying instead on a local copy of information on your device, that data is encrypted and presumably inaccessible by law enforcement. How does iOS handle encryption? Apple began encrypting iOS devices in 2014 with the release of iOS 8. Prior to iOS 8, iOS users were able to set a PIN or passcode to prevent unauthorized access, but some of the data stored on the device was still accessible by Apple when law enforcement presented the company with a valid warrant. A total of 84 percent of iOS devices are running iOS 8 or later. With iOS 8 and beyond, Apple no longer has the tools required to bypass a device's lock screen and gain access to any data stored on your iOS device. That means items such as call logs, photos, documents, messages, apps and notes are inaccessible to anyone without a device's PIN. This is an important detail, as it has led to the current situation playing out in public view between the FBI and Apple. How does iCloud factor in? Another topic that's come up in the battle between the FBI and Apple is what data stored in an iCloud backup of an iOS can and cannot be accessed by Apple. Apple's Legal Process Guidelines state iCloud backups are encrypted and stored on the company's servers. However, unlike an encrypted device, Apple can access information stored within a backup. Specifically, it's possible for Apple to provide authorities with "photos and videos in the users' camera roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail," as detailed in Section J. What about encryption on Android? As with all things Android, there's a long list of caveats regarding encryption on an Android device. Android manufacturers use different processors and components, each requiring custom software and backup services outside of what Google originally designed Android for. It's the key selling point of Android over iOS, as Android fans are quick to espouse. And they're not wrong. However, each change can introduce unintended security issues outside of Google's control. Google first provided the option for users to opt into encrypting their devices in 2011. At the time, the option was strictly up to the user, leaving the manufacturer out of the equation. Toward the end of 2014, though, the company released Android 5.0 Lollipop with the default setting of encryption turned on. But phone makers didn't have to enable encryption to be default when they made phones; it wasn't a requirement of Google, and in the end, most OEMs left the setting turned off, citing performance issues as the reason. Then, with the release of Android 6.0 Marshmallow in 2015, Google started requiring manufacturers to enable encryption on all devices out of the box. There is, of course, an exception to the rule: Google allows phone makers to disable the feature on what amounts to entry level, and thus often slower devices. For those who want a more technical explanation, read section "9.9 Full-Disk Encryption" of this document. Once an Android device is encrypted, all data stored on the device is locked behind the PIN code, fingerprint, pattern, or password known only to its owner. Without that key, neither Google nor law enforcement can unlock a device. Android security chief Adrian Ludwig recently took to Google+ to refute a claim of a back door into Android: "Google has no ability to facilitate unlocking any device that has been protected with a PIN, password, or fingerprint. This is the case whether or not the device is encrypted, and for all versions of Android." Nevertheless, each phone manufacturer is able to alter Android, customizing its look, adding or removing features, and in the process potentially introducing bugs or vulnerabilities authorities can use to bypass Android's security features. So how do you know if you've got encryption working? Android users can check the encryption status of a device by opening the Settings app and selecting Security from options. There should be a section titled Encryption that will contain the encryption status of your device. If it's encrypted, it will read as such. If not, it should read similar to "encrypt device." Tap on the option if you want to encrypt your device, but make sure to set aside some time -- encrypting a device can take upwards of an hour. Google's backup service for Android devices is optional for device manufacturers and application developers. As with Apple's iCloud Backup practices, data within a backup stored on Google's servers is accessible by the company when presented with a warrant by law enforcement. However, because the backup service is opt-in by developers, it may not contain data from every app installed on your device. What can you do to better protect your data? Android users should enable encryption and set a PIN code or alphanumeric passcode. iOS users, setup Touch ID and use an alphanumeric passcode containing at least six digits. The longer password is a hassle, yes, but with Touch ID enabled, you shouldn't have to enter it too often. If the FBI succeeds in forcing Apple to bypass a device's lock screen timeout, it would take five and a half years for a computer to crack a six-digit alphanumeric passcode, according to Apple's iOS Security Guide (see page 12). As for protecting data stored in backups on Apple's or Google's servers, you can start by disabling iCloud backups by opening the settings app, selecting iCloud, followed by Backup and sliding the switch to the Off position. Apple also allows you to delete iCloud backups from your account through the iCloud settings on your iOS device by opening Settings > iCloud > Storage > Manage Storage. On Android, the process for disabling backups will depend on the device you're using, but generally the setting is found in Settings app under Backup & Reset. You can remove backed-up data from Google's servers under the Android section in your Google Dashboard.  |
| Encryption: What it is and how it works for you - Tom's Guide Posted: 24 Jan 2020 12:00 AM PST  Encryption refers to any process that's used to make sensitive data more secure and less likely to be intercepted by those unauthorized to view it. There are several modern types of encryption used to protect sensitive electronic data, such as email messages, files, folders and entire drives. Both Android and iOS smartphones now encrypt their stored data by default if the user creates a screen-lock passcode (sometimes to the chagrin of law enforcement), and Windows and macOS offer optional full-disk encryption. Many brands of the best antivirus software can encrypt individuals files and folders. Still, it's very important to understand what kinds of encryption are most important for a particular need, and to not be lulled into a false sense of security by fancy-sounding names. Many encryption programs provide excellent security for very little money — sometimes even for free. For example, consider the folder-encryption options available to users of the Microsoft Windows operating system. Microsoft's own encryption software is generally strong, meaning that most users won't have to seek out additional methods of protecting their sensitive financial data, medical records and other sensitive files. MORE: 15 best mobile security and privacy apps Or, if you're worried about Microsoft's alleged relationship with the U.S. National Security Agency, try VeraCrypt, an open-source, free-to-use software solution. (VeraCrypt is a fork of TrueCrypt, which is no longer developed.) The most dangerous pitfall of folder encryption is that there may be temporary versions of the sensitive files that are not encrypted. Consider this: Most computer users regularly save their work to avoid catastrophic data loss due to a power outage, electrical storm or other unexpected event. Each time the user saves a file in progress, a temporary version of that file is created and stored in the aptly named "temp" folder, where it remains unencrypted. Simply deleting temp files isn't enough protection, either. Someone who wants to access your data badly enough will likely be able to access those files using free or cheap data-recovery software. Weaknesses in encryptionAll encryption techniques have weak spots. As these weaknesses are revealed and exploited, new methods of encrypting data are developed to provide additional layers of security for users. One of the most common and bothersome weaknesses occurs when an encryption method, also called a cipher or an algorithm, that's supposed to generate seemingly random strings of gibberish instead produces outputs that have a discernible pattern. If the pattern gets noticed by interlopers, it may help them crack the encrypted data. A similar issue involves encryption algorithms that generate predictable patterns of characters in response to repetitious, predictable input. MORE: Email encryption: Worth the trouble? If this problem is extensive enough, it can help digital intruders decipher at least part of the encrypted data, which may include financial information, government documents or other sensitive information. In many cases, even a partial data breach can be devastating. Defenses against hackers and file corruptionIndividuals and organizations that want to add protection to their encryption algorithms often insert extra lines of code to alter the outputs -- a practice known as "salting." For example, one of the most common passwords used is simply "password." Malicious hackers know what "password" and other common passwords look like after they're run though common encryption algorithms. But if an organization adds extra characters to each password during the encryption process, such as "password" plus "safe," the output will be something malicious hackers won't recognize — as long as the extra characters are kept secret. Encryption can also be used to verify the integrity of a file or piece of software. The raw binary data of a file or application is run through a special encryption algorithm to produce a "hash," a long number unique to that file. Any alteration to the file, such as by a hacker inserting malicious code or by random data corruption, will produce a different hash. Computers and mobile devices compare a new piece of software's stated hash to its actual one before installing the software. A similar process involves running a piece of software through a simple algorithm that produces a single short number, a "checksum." Altering the software in any way will likely produce a different checksum. To guard against random, accidental corruption, many pieces of software include protection in the form of self-diagnostic checksum matches that the software performs each time it's launched. Everyone's concernData encryption is important for everyone, not just big corporations and government officials. The topic can be intimidating for those without extensive computer experience, but thankfully, for most users, keeping sensitive data safe is a relatively straightforward process. The key is to start early and regularly verify the effectiveness of the chosen security measures.  |
| You are subscribed to email updates from "voice encryption,galaxy s4 encryption,how to encrypt files on android" - Google News. To stop receiving these emails, you may unsubscribe now. | Email delivery powered by Google |
| Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | |
Comments
Post a Comment