Android 15’s security and privacy features are the update’s highlight

Post content hidden for low score. Show…

Arstotzka

Ars Scholae Palatinae
1,260
Subscriptor++
Nice set of enhancements. Better late than never on some of these. One thing Google is doing which I'd like to see Apple implement is warnings about Stingray usage, or any other form of GSM encryption downgrade. Equipment for that is available in an "off the shelf" capacity, and I don't have faith in the pre-sales verification of purchasers nor for legitimate users to not chuck one in the e-waste pile where it can get bought by anyone.

iOS, with its much tighter control over the hardware, should be able to do this. (Even if it's only available in Lockdown mode.)
 
Upvote
67 (69 / -2)
Post content hidden for low score. Show…

evan_s

Ars Tribunus Angusticlavius
7,480
Subscriptor
Is there any small device (that you keep in your pocket) such that the phone will automatically lock itself if the phone isn’t within a few feet of it? Do Apple make anything like that? If such things existed they might help to reduce the number of “grab and run” attacks.

Nothing specifically for that. An Apple Watch can use find my to activate lost mode as long as it has a data connection. You might be able to setup an automation with an Air Tag to do something like that. A lock when leaving proximity of my Apple Watch feature does seem like something Apple could implement. Maybe tying it in with the anti-theft stuff so it doesn't kick in at home when you are likely to leave your watch on a charger or even just turning off when charging.
 
Upvote
11 (13 / -2)

gmyx

Ars Centurion
231
Subscriptor
It's nice that many of these security improvements are actually Google Play Services updates and not just confined to Android 15, since some of us have perfectly functional phones that just happen to no longer be getting new Android versions (Galaxy S10, in my case).
Just checked on my phone and the theft detection and remote lock are available. Fold 5. That is nice - but I wonder how well they work.
 
Upvote
9 (9 / 0)

gmyx

Ars Centurion
231
Subscriptor
Just checked on my phone and the theft detection and remote lock are available. Fold 5. That is nice - but I wonder how well they work.
Just tested remote lock - it was quick about 2 seconds. But I can see this feature being miss used since there is no authentication. At least its not a custom lock and regular unlock worked fine.
 
Upvote
26 (26 / 0)

evan_s

Ars Tribunus Angusticlavius
7,480
Subscriptor
This is not restricted to phones you own, put in any number you like and it will try and lock it. Have fun everyone...

http://android.com/lock


As this is the same lock that would happen after a timeout or when you hit the power button I don't think that's a major issue. If someone does this to your phone you just unlock it like normal with your pin/passcode/biometrics etc. This needs to be quick and easy to do when your phone is actually stolen so a full Gmail account login wouldn't really work especially for account with Advanced Protection Program enabled where you would need a security key to log in. That's probably also why it's tied to phone number and not an email address or login. Quick and easy to give someone else to fill in and lock your phone.
 
Upvote
43 (43 / 0)

JohnnySocko

Ars Praetorian
436
Subscriptor
Is there any small device (that you keep in your pocket) such that the phone will automatically lock itself if the phone isn’t within a few feet of it? Do Apple make anything like that? If such things existed they might help to reduce the number of “grab and run” attacks.
In Android, a "Trusted Device" designated by the owner (such as a smartwatch or paired headphones) can unlock a phone by being within Bluetooth range. Ostensibly this means that a phone taken away from its Trusted Device will automatically lock, but all of the documentation I can find is vague on how quickly that will happen. That's probably because Bluetooth range is so variable that there's no way to make any kind of definitive assertion.

tl;dr -- Such a thing does exist, but it's probably not as reliable as the security features described in the article.
 
Upvote
38 (39 / -1)

shenzhe

Wise, Aged Ars Veteran
144
Subscriptor++
As this is the same lock that would happen after a timeout or when you hit the power button I don't think that's a major issue. If someone does this to your phone you just unlock it like normal with your pin/passcode/biometrics etc. This needs to be quick and easy to do when your phone is actually stolen so a full Gmail account login wouldn't really work especially for account with Advanced Protection Program enabled where you would need a security key to log in. That's probably also why it's tied to phone number and not an email address or login. Quick and easy to give someone else to fill in and lock your phone.
I agree with everything you said. One worry I have would be a denial of service type attack where someone just keeps locking out the device every 5 seconds or something so that you can't use your device.

That's solvable by putting a timeout on it. If someone unlocks the phone you just locked it's unlikely they can't do it again, so it kinda loses it's effectiveness in a near term situation. That said, for a targeted attack the "thief" would just lock your phone, let you unlock it and then grab and go, so I don't know what a good answer is. Maybe we assume that level of targeting is sufficiently rare in the scope of that harassing lockouts.
 
Upvote
26 (26 / 0)

ERIFNOMI

Ars Legatus Legionis
18,019
In Android, a "Trusted Device" designated by the owner (such as a smartwatch or paired headphones) can unlock a phone by being within Bluetooth range. Ostensibly this means that a phone taken away from its Trusted Device will automatically lock, but all of the documentation I can find is vague on how quickly that will happen. That's probably because Bluetooth range is so variable that there's no way to make any kind of definitive assertion.

tl;dr -- Such a thing does exist, but it's probably not as reliable as the security features described in the article.
Unlocked here just means you don't need to auth (pin, fingerprint, whatever) to access the phone. If you lose connection to the trusted device, I don't believe it drops you to the lockscreen. So if it's snagged while you're using it, it'll stay unlocked.
 
Upvote
0 (3 / -3)

Mhan00

Seniorius Lurkius
41
I agree with everything you said. One worry I have would be a denial of service type attack where someone just keeps locking out the device every 5 seconds or something so that you can't use your device.

That's solvable by putting a timeout on it. If someone unlocks the phone you just locked it's unlikely they can't do it again, so it kinda loses it's effectiveness in a near term situation. That said, for a targeted attack the "thief" would just lock your phone, let you unlock it and then grab and go, so I don't know what a good answer is. Maybe we assume that level of targeting is sufficiently rare in the scope of that harassing lockouts.
Under the setting, it says that remote lock is usable up to twice a day, so Google already thought of that.
 
Upvote
55 (55 / 0)
Remote lock didn't work for me just now (waited five minutes) but I am still on the last Android 15 beta (AP31) so maybe I need to be on the final release version. Still waiting for the final version to be offered via OTA...

Edit: I double-checked, and the remote lock setting was turned off. I turned it on (which consisted of allowing a new permission) and then tried again, and it still didn't work. I guess I'll test again once I receive Android 15 final.
 
Last edited:
Upvote
3 (3 / 0)

Granadico

Ars Scholae Palatinae
1,219
Jut checked my Pixel 6 and it says I have no new updates even though I checked the update screen, so hopefully I get it soon. My pixel 6 is still going strong on the battery so hopefully it'll last another 2+ years and by then this AI craze will either die or just settle to sanity. That said, more security features are always welcome, especially as the world keeps getting more technology dependent.
 
Upvote
2 (3 / -1)

MrTom

Ars Tribunus Militum
2,077
I hope theft detection lock will keep the phone recording in the case of a cop yanking a bystander's phone out of their hands to stop them recording police brutality.

One would hope the cop is not going to "rapidly moving away with it" which is one thing required for it to auto lock. But you never know, there might be some crazy clepto cops out there.
 
Upvote
10 (10 / 0)

evan_s

Ars Tribunus Angusticlavius
7,480
Subscriptor
Any clear walk through for how offline lock works? It says “when a thief has your phone offline for a while” but how does it know I’m not just in airplane mode (and/or beyond cell service) while backcountry camping?

Remember. This is just automatically doing the normal lock that you do dozens or hundreds of times a day anyway. If it does lock for this reason just unlock it like normal with your pin/password/biometrics. I assume this is thrown in there to make sure a thief can't keep the phone unlocked by keeping it offline to prevent the remote lock from working.
 
Upvote
12 (12 / 0)
I agree with everything you said. One worry I have would be a denial of service type attack where someone just keeps locking out the device every 5 seconds or something so that you can't use your device.

That's solvable by putting a timeout on it. If someone unlocks the phone you just locked it's unlikely they can't do it again, so it kinda loses it's effectiveness in a near term situation. That said, for a targeted attack the "thief" would just lock your phone, let you unlock it and then grab and go, so I don't know what a good answer is. Maybe we assume that level of targeting is sufficiently rare in the scope of that harassing lockouts.

Most people who grab and run with your phone don't know who you are, let alone what your phone number is. At worst, this is a minor nuisance, The lock requests only need to be rate limited.

The point of the feature is to quickly lock your phone before the thief gets a chance to reset logins using your email. The proper way to lock down after a theft is to asap lock your SIM with the mobile operator. This is one more reason why I now use an esim -- it removes the possibility of the thief taking the sim out and installing it into another phone.
 
Upvote
15 (15 / 0)
Post content hidden for low score. Show…
This is not restricted to phones you own, put in any number you like and it will try and lock it. Have fun everyone...

http://android.com/lock

There is a note under the Remote Lock activation slider:
"The screen can be locked remotely up to twice a day" maybe some small comfort?
 
Upvote
13 (13 / 0)