Cryptography professor warns about Android security, says some of it is six years behind the iPhone
We are constantly barraged with sensationalist headlines of the "millions of Android phones are under threat" type that inform about this and that malware or security lapse that is usually pretty easy to avoid if you install decent apps from legit sources.
The sole reason for so many Android security news, however, is that Android's encryption is still not up to par, even the latest 7.0 Nougat version, reveals a cryptography professor from Johns Hopkins university.
On the other hand, you might notice that this is a pretty goddamn low standard. In other words, in 2016 Android is still struggling to deploy encryption that achieves [lock screen] security that Apple figured out six years ago. And they’re not even getting it right. That doesn’t bode well for the long term security of Android users.
Android struggling to deploy encryption that Apple figured out 2010
According to Matthew Green, while Nougat devices have moved away from the full-disk encryption (FDE) of yesteryear that is easier to hack, and employ file-level protection if you set a passcode, there are scenarios where you can still access some files directly as the encryption keys are being stored in memory.Apparently, while Apple provides no less than four protection levels for developers to choose from, Android N has only two, and even if it adds more down the road, this will still leave millions of legacy apps somewhat vulnerable. In a nutshell, the cryptography professor's disheartening conclusion is that the current state of Android's security is only good for Google to keep the FBI at arm's length.
If you’re an optimistic type, you’ll point out that Android is clearly moving in the right direction. And while there’s a lot of work still to be done, even a half-baked implementation of file-based protection is better than the last generation of dumb FDE Android encryption...
On the other hand, you might notice that this is a pretty goddamn low standard. In other words, in 2016 Android is still struggling to deploy encryption that achieves [lock screen] security that Apple figured out six years ago. And they’re not even getting it right. That doesn’t bode well for the long term security of Android users.
source: Matthew Green (Cryptography Engineering)
Popular stories
Latest News
Things that are NOT allowed:
To help keep our community safe and free from spam, we apply temporary limits to newly created accounts: