Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption

bits-please.blogspot.com

Post reply on HN
Print view View original

81–90 of 99 posts

Re: Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption

#81

Post by kllrnohj »

Sarkie wrote: post #60
williamscales wrote: post #38

Earlier quoted context omitted.

Wait, Android doesn't use LUKS? Argh. Just give me a stinkin' smartphone that runs Linux. These are solved problems, people.

Isn't Android running a really old Linux because they can't rebase? So they have to cherry pick... or has that stopped now?

No, but they tend to stick to the LTS releases and the kernel tends to not get a version update for the life of the device.

So it doesn't track the latest, but it's also not "really old" in that upstream Linux still considers it a supported version.

Re: Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption

#82

Post by 616c »

gcr wrote: post #79
snassar wrote: post #74

Earlier quoted context omitted.

A friend saw me entering my longish, non-trivial passphrase into my android phone and commented that I must not have many friends if I have to enter this passphrase every time to use my phone. For a moment I was torn between being proud in my passphrase and sad at my lack of friends.

You bring up an interesting UX issue. If I need to be constantly available to my friends, "number of seconds to a text reply" is something that I need to minimize. Longer passphrases prevent me from sending quick replies.

Some of my more sophisticated friends take this a step further and taunt me for not securely hiding notifications and buying a smart watch.

This confuses me because Bluetooth over the air does not strike me a secure mechanism (is it just Bluetooth; ironically scant detail unless my Google-fu is off, likely at this hour for me).

http://www.wareable.com/android-wear/android-wear-hack-alert...

And do I need yet another smart device? The mobile first movement, with shinier crap, moving away from standard protocols, leads me to believe I have been passively perpetuating the biggest wart on computer science's labors. I am kind of embarassed, a few years in and late to the party, I bought an Android phone at all.

Re: Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption

#83

Post by DenisM »

koolba wrote: post #35

Full disk encryption (FDE) is a UX issue, not a technical one. You don't need a secure cryptographic processor, but the UX sucks without one. A simple, working, FDE setup would be something like LUKS running at boot: 1. Turn on phone 2. Phone loads up initial bootstrap OS 3. Phone prompts user for master key 4. Master key is used to unlock volume 5. Regular OS boot continues If the master key has enough entropy, brut…

QR code maybe? I think that might work...

Re: Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption

#84

Post by Zigurd »

mjevans wrote: post #70
haikuginger wrote: post #53

Earlier quoted context omitted.

I do find it somewhat amusing that Android went from Dalvik precompiled to Dalvik JIT, to ART precompiled, to ART JIT.

It's actually a rather logical set of steps, it follows the same pattern as elsewhere probably for the same underlying reasons. Compiled once is easier to develop, prove correct and validate functionality. Just in time offers convenience in deferring compilation, but increases storage requirements and can decrease the initial runtime performance due to compiling the code. If you have spare cores this starts to make m…

Another interesting aspect of the evolution of the Dalvik and ART runtimes is that they are runtimes for (mostly) battery-powered devices. A JIT compiler was an obvious next step but less obvious is that it had to be battery conscious. It was designed to JIT as little code as possible to attain the greatest gain in performance as possible. That's not how you would design a JIT compiler for server Java!

Re: Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption

#85

Post by athenot »

wyldfire wrote: post #69
Pxtl wrote: post #57

Earlier quoted context omitted.

A ring or bracelet with an NFC tag in it. Well, a ring is probably too small for a proper NFC tag, but either way: NFC jewellery.

They absolutely make rings w/NFC tags. At least men's rings, I assume they may do it for women's too.

Really? That is something I dreamed about for a long time. A small object on the finger is the least obstructive form factor and becomes part of self. But unlike a fingerprint, a ring can be replaced if somehow compromised.

Re: Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption

#86

Post by cbsmith »

koolba wrote: post #35

Full disk encryption (FDE) is a UX issue, not a technical one. You don't need a secure cryptographic processor, but the UX sucks without one. A simple, working, FDE setup would be something like LUKS running at boot: 1. Turn on phone 2. Phone loads up initial bootstrap OS 3. Phone prompts user for master key 4. Master key is used to unlock volume 5. Regular OS boot continues If the master key has enough entropy, brut…

The other UX problem is you need to make sure that someone doesn't replace the initial bootstrap OS with something else that captures the master key.

So, that's where you need the secure cryptographic processor and the trusted environment, etc.

Re: Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption

#88

Post by toyg »

coldcode wrote: post #2

Since the security of Android depends on hardware and OEM software not under Google's control, depending on FDE is apparently pointless. I guarantee Google really wants to build their own branded phones with their own secure Android version and gain Apple's advantages in building secure systems because you own everything.

> I guarantee Google really wants to build their own branded phones

Considering they just sold for scrap an entire manufacturing pipeline to do exactly that, I'd say they really don't. If they do, they're going about it in the silliest and most roundabout way.

Re: Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption

#89

Post by kevin_thibedeau »

snassar wrote: post #74
616c wrote: post #52

So out of curiosity, as someone who has a nontrivial passcode on his Android device that people constantly mock, how many characters are we talking to be safe. I have known for a long time 4 digit numeric PINs are stupid. Sadly the San Bernadino case, for all the wrong reasons, taught me all the alternative auth methods are just as risky. Should I be worried? I don't know. But as a long time Android enthusiast and po…

A friend saw me entering my longish, non-trivial passphrase into my android phone and commented that I must not have many friends if I have to enter this passphrase every time to use my phone. For a moment I was torn between being proud in my passphrase and sad at my lack of friends.

What's sad is your friend's superficial criteria for judging sociability.

Re: Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption

#90

Post by wyldfire »

athenot wrote: post #85
wyldfire wrote: post #69

Earlier quoted context omitted.

They absolutely make rings w/NFC tags. At least men's rings, I assume they may do it for women's too.

Really? That is something I dreamed about for a long time. A small object on the finger is the least obstructive form factor and becomes part of self. But unlike a fingerprint, a ring can be replaced if somehow compromised.

e.g. http://amzn.com/B00UTEHH8K claims "Lock and Unlock Your Smart Phone or Tablet Quickly, Hide the App When You Leave Your Smart Phone Alone"
Post reply on HN