[Q] Encryption, Security and Root (Android work device) - Galaxy Note 3 Q&A, Help & Troubleshooting

My place of work has moved over to Google, but for me to add the Google Apps account I need to install the security module which then enforces encryption if I wish to access the account.
I've done it on my Nexus 7, and am wondering about doing it on my Note 3.
My only concern is that I don't like using passwords on my phone. I've never lost one or had one stolen (touches wood) and never suffered any problems by not locking my device.
If I encrypt, from what I can see, it's a one way street. Is this correct? I can't change my mind and un-encrypt it? Can I wipe and that will start fresh, no encryption?
Also, will me being rooted and on a custom ROM cause any problems?
Thanks for any help offered (Please lets not get into an argument about why I shouldn't mind it having a lock screen)

AndyCr15 said:
My place of work has moved over to Google, but for me to add the Google Apps account I need to install the security module which then enforces encryption if I wish to access the account.
I've done it on my Nexus 7, and am wondering about doing it on my Note 3.
My only concern is that I don't like using passwords on my phone. I've never lost one or had one stolen (touches wood) and never suffered any problems by not locking my device.
If I encrypt, from what I can see, it's a one way street. Is this correct? I can't change my mind and un-encrypt it? Can I wipe and that will start fresh, no encryption?
Also, will me being rooted and on a custom ROM cause any problems?
Thanks for any help offered (Please lets not get into an argument about why I shouldn't mind it having a lock screen)
Click to expand...
Click to collapse
Once done yes it can be undone by wiping the device and starting from scratch.
As for using with rooted/custom ROMs - encryption itself works, but whether your software for your work stuff works is a different matter.

Related

[Q] Can't enable encryption on Nexus 4

I am running cyanogenmod 10.2 stable on my Nexus 4 and I am trying to enable disk encryption in order to be able to use the stock Email app to access my work email account, which is an ActiveSync Exchange account that enforces disk encryption. I have set up a numerical PIN and then when I try to enable encryption, it flashes a picture of a wireframe android for a second and then reboots without encrypting my phone. any way to fix this? I'd really rather not spend $20 on Touchdown to use a function that my phone supports for free
Have you tried it on a stock rom? Could be a CM issue. What recovery are you using? AFAIK CWM does not support encryption so try with TWRP too.
There's also a module for xposed framework that bypasses exchange security policies.
DrFredPhD said:
Have you tried it on a stock rom? Could be a CM issue. What recovery are you using? AFAIK CWM does not support encryption so try with TWRP too.
There's also a module for xposed framework that bypasses exchange security policies.
Click to expand...
Click to collapse
The power and flexibility of Android never ceases to amaze me! Until now, I've only ever used xposed on devices that didn't have custom firmware available like my kids' el-cheapo tablets. I never would have thought to check if you could actually do anything USEFUL with xposed. Thank you so much!!! FINALLY!!! I can get my corporate email in the same place as my 3 other email accounts, and I don't have to use that God awful piece of crapware called Touchdown! Just pure, unadulterated, email connectivity bliss.

[Q] Question about Security on Rooted Phones

I love having my phone rooted. I am grateful to all the work by the devs on this board making my S5 run the way it should.
However, I try to keep my phone as secure as possible. I have my S5 set to use Fingerprint identification at login. I also have Google Location set up so I can locate my phone or wipe it remotely if it is lost or stolen.
However, with Safestrap, it is very easy for someone to get past the security. They can boot my phone, see the message for SafeStrap Recovery mode, push recovery and wipe my phone. Then they can then use any gmail account and reconfigure my phone for their own use. Of course, this disables me using Google Locate to find or wipe my sdcard.
Also, since SafeStrap does not support encryption, they can pop out my sdcard and read all of my data in any computer.
Is there a way to secure a rooted phone? Perhaps, SafeStrap could have an optional stealth mode that does not show on boot without a keypress combination? Maybe a third party encryption app that secures the sdcard?
Is there any way around these security issues (besides not rooting the phone)?

Nexus Imprint Issues After Nandroid Backup Restore

Has anyone had issues setting up Imprint after importing a nandroid backup?
I had to RMA my 6P due to a faulty charging port and I can successfully set up Imprint in the factory state, however, after I import the backup, it won't allow me to set it up.
I've tried to do just a data import, a full nandroid import...pretty much every single option and constantly reflashing to stock to retry. I'm at a loss because it's definitely not a hardware problem as I can set it up during stock.
As soon as I click next to train my fingerprints, it flashes: "Enrollment was not completed. Fingerprint enrollment didn't work. Try again or use a different finger."
Has anyone ever run into this issue? Thanks for your help!
Never and I mean never restore a nandroid from one device to another. There are device specific files in that nandroid. Just hope you didn't kill your efs partition which kills your IMEI and in turn makes it not connect to any network.
RaysBucsBolts said:
Has anyone had issues setting up Imprint after importing a nandroid backup?
I had to RMA my 6P due to a faulty charging port and I can successfully set up Imprint in the factory state, however, after I import the backup, it won't allow me to set it up.
I've tried to do just a data import, a full nandroid import...pretty much every single option and constantly reflashing to stock to retry. I'm at a loss because it's definitely not a hardware problem as I can set it up during stock.
As soon as I click next to train my fingerprints, it flashes: "Enrollment was not completed. Fingerprint enrollment didn't work. Try again or use a different finger."
Has anyone ever run into this issue? Thanks for your help!
Click to expand...
Click to collapse
As already stated you should never restore a backup from a different device. If you had a pin and fingerprint setup when you made the backup then it will not restore properly on any device. A thread has been pinned in the general section about TWRP'S issues with lockscreen security and backups.
If you can get into adb try this after restoring:
rm /data/system/locksettings.db
rm /data/system/*.key
If this doesnt work, go to twrp file manager and manually delete the files.
As mentioned above, before backing up you should always remove security.
It was mentioned in the TWRP thread that you should NEVER make a Nandroid Backup before disabling the fingerprint and swipe gestures. If you did a Nandroid Backup without having removed the security options first, you won´t be able to use it.
I am having the same issue after getting my new phone and trying to do the same thing. Each device seems to have some kind of Sensor ID or something else that stops the scanner from working. check out the reddit thread and this other thread on xda...
https://www.reddit.com/r/Nexus6P/comments/3vjkq3/q_nandroid_from_6p_to_6p_which_partitions_to/cxqfcl1
http://forum.xda-developers.com/nexus-6p/help/fingerprint-hardware-unavailable-t3274436
seems everyone has the same issue. No fix as of yet but twrp will work to restore all of your data including your android id from a nandroid im pretty sure
jerflash said:
I am having the same issue after getting my new phone and trying to do the same thing. Each device seems to have some kind of Sensor ID or something else that stops the scanner from working. check out the reddit thread and this other thread on xda...
https://www.reddit.com/r/Nexus6P/co...oid_from_6p_to_6p_which_partitions_to/cxqfcl1
http://forum.xda-developers.com/nexus-6p/help/fingerprint-hardware-unavailable-t3274436
seems everyone has the same issue. No fix as of yet but twrp will work to restore all of your data including your android id from a nandroid im pretty sure
Click to expand...
Click to collapse
Of course each one has its own ID.
This is not what Nandroids are for. Restoring this way you risk ruining your imei which then requires you to get a new device which warranty will not cover. So come on guys stop being lazy and do things properly. If you mess up your device then you have no else to blame but yourself.
And we wonder why OEM/Google are locking devices down.
zelendel said:
Of course each one has its own ID.
This is not what Nandroids are for. Restoring this way you risk ruining your imei which then requires you to get a new device which warranty will not cover. So come on guys stop being lazy and do things properly. If you mess up your device then you have no else to blame but yourself.
And we wonder why OEM/Google are locking devices down.
Click to expand...
Click to collapse
I would never tell anyone to restore EFS between two different devices! That could really mess things up. What we are talking about here is restoring the "Userdata" backup between two devices which can be safe if you know what you are doing...(I have done it for years without issue.) problem comes form there must be something hidden inside the userdata that stops you from restoring and using the fingerprint reader. Its actually a good feature for most if not a high level user.
I'm sure there will be a work around soon enough
jerflash said:
I would never tell anyone to restore EFS between two different devices! That could really mess things up. What we are talking about here is restoring the "Userdata" backup between two devices which can be safe if you know what you are doing...(I have done it for years without issue.) problem comes form there must be something hidden inside the userdata that stops you from restoring and using the fingerprint reader. Its actually a good feature for most if not a high level user.
I'm sure there will be a work around soon enough
Click to expand...
Click to collapse
More and more apps are not storing their info into data partition.
Wouldn't count on a work around. With the new Qualcomm security settings many oem are really looking at doing it like the BB android device which can't even be rooted.
Did you find a solution guys? I have same problem.
Tell you the truth guys... just use helium, then factory reset. let google re-add everything and for what does not use helium. i did this and it works for most things. not very annoying at all

Backup dilemma

I have a problem transferring all of my data to my replacement 6P. My charging port burnt up and broke the data connection. My phone will still charge though even though I do not trust it. My problem is that I cannot find a way to conveniently restore all apps and data to my replacement phone. ADB is not an option since the data lines are fried and all of the ADB over WiFi options I know of require me to set it up with the cable first. I am not rooted. My bootloader is currently locked. Native Android backup only has like 9 apps backed up and won't restore anything else but those 9 apps and my contacts. I cannot get the native back up to sync anything besides those 9 apps (not sure why this is happening). I could download all of my apps manually and use my NAS to transfer individual files but that will take forever. I want to lose as little data as possible. I do have an ADB backup from right before I updated to Nougat on the official release day so I might just have to lose a month of data (which isn't horrible but not ideal). Does anyone have any other suggestions besides manually reinstalling everything or using my old ADB backup?
AJZ12 said:
I have a problem transferring all of my data to my replacement 6P. My charging port burnt up and broke the data connection. My phone will still charge though even though I do not trust it. My problem is that I cannot find a way to conveniently restore all apps and data to my replacement phone. ADB is not an option since the data lines are fried and all of the ADB over WiFi options I know of require me to set it up with the cable first. I am not rooted. My bootloader is currently locked. Native Android backup only has like 9 apps backed up and won't restore anything else but those 9 apps and my contacts. I cannot get the native back up to sync anything besides those 9 apps (not sure why this is happening). I could download all of my apps manually and use my NAS to transfer individual files but that will take forever. I want to lose as little data as possible. I do have an ADB backup from right before I updated to Nougat on the official release day so I might just have to lose a month of data (which isn't horrible but not ideal). Does anyone have any other suggestions besides manually reinstalling everything or using my old ADB backup?
Click to expand...
Click to collapse
I realize this doesn't really help you now, but you have articulated the best argument for rooting, as Titanium Backup would fix your issue. Second, what about TWRP and a nandroid? You don't need root but you do need an unlocked bootloader. Your only good option would be to manually reset up your apps IMHO.
Sent from my Nexus 6P using Tapatalk
Lol. I know. This is the first device I haven't rooted and the only one that absolutely needs root. I was happy with stock on this so I never got around to it then when I did have time, I didn't want to restore everything after unlocking the bootloader. I'm the only one to blame for this. I just can't figure out why the native backup won't back anything up. If I could figure that out, I could easily solve this problem.
I can't unlock the bootloader without losing everything. Looks like I have a long day to look forward to tomorrow.
AJZ12 said:
Lol. I know. This is the first device I haven't rooted and the only one that absolutely needs root. I was happy with stock on this so I never got around to it then when I did have time, I didn't want to restore everything after unlocking the bootloader. I'm the only one to blame for this. I just can't figure out why the native backup won't back anything up. If I could figure that out, I could easily solve this problem.
I can't unlock the bootloader without losing everything. Looks like I have a long day to look forward to tomorrow.
Click to expand...
Click to collapse
Google backup is OK for apps but your settings and data don't get backed up properly anyway. At this point just suck it up, unlock your new BL, custom recovery and root it, then set it up from scratch. After that you can have nandroid and TB app backups and be in good shape.
Sent from my Nexus 6P using Tapatalk

Encryption Boot Pattern is Broken

I'm running Carbon rom on my 6P, after getting around to flashing the flashabling zip for supersu, my pattern I use to boot into android(not the lockscreen pattern) no longer works.
It still asks for my pattern to start android, but when I put it in, it says it's not right. I've tried my pattern several times and a couple random ones to see if it just messed it up.
Is there something I can do in twrp to fix this? Or will I have to lose everything off my phone?
There's a sticky in the general section:
Https://forum.xda-developers.com/nexus-6p/general/psa-twrp-backups-lockscreen-security-t3245070
drnizeguy said:
There's a sticky in the general section:
Https://forum.xda-developers.com/nexus-6p/general/psa-twrp-backups-lockscreen-security-t3245070
Click to expand...
Click to collapse
I just had another person point me to that thread a few minutes ago. Deletion of the locksettings does nothing. I still have it asking for a pattern to start android.
xBr4v3x said:
...Is there something I can do in twrp to fix this? Or will I have to lose everything off my phone?
Click to expand...
Click to collapse
Nothing to do. Yes, you have already lost everything. Factory reset and start over. Most of the time this happens to people who have been running unencrypted, screw up, and then end up encrypted. NOT saying this is you because you seem to have at one time been encrypted and HAD a working boot PIN. One of the features of a true encrypted system is that once you lose the keys, nobody can help you. I usually keep a TiBu of all my non-market apps on the PC. Between Google's restore of market apps and Ti-Bu, anyone can be up and running the way they were within one hour. Sucks but there it is.

Resources