Database Users

[Q] Possible to lock phone in case of theft?

My Galaxy 1 was stolen from me in Feb, after that i went through a lent s3 and now proud owner of an s4 (i9500).
So i have two questions on this:
1) is there an equivalent for what a bios password is in a PC?
(have to go short something in hardware to bypass, only is asked upon powerup/hard reboot).
2) Is is technically possible for an app to lock on custom sim? (possibly modifying efs folder)
Thanks!

Abrojo said:
My Galaxy 1 was stolen from me in Feb, after that i went through a lent s3 and now proud owner of an s4 (i9500).
So i have two questions on this:
1) is there an equivalent for what a bios password is in a PC?
(have to go short something in hardware to bypass, only is asked upon powerup/hard reboot).
2) Is is technically possible for an app to lock on custom sim? (possibly modifying efs folder)
Thanks!
Click to expand...
Click to collapse
http://bit.ly/174zPh6

LeJolly said:
http://bit.ly/174zPh6
Click to expand...
Click to collapse
Thank you for patronizing me but that didnt answer my question, already been through pages of results when i previous galaxy was stolen (even tried locking from google play). None of the apps listed on a google search for locking and tracking do what i ask.
Centralized cloud based locking doesnt work (a blacklisted imei can get reinstated fairly easy), neither does the standard password Operating System level password.
Thats why i am asking for specific alternative ways of locking the phone that should be (if possible) more tampering resistant.
1) bios equivalent password.(requiering hardware shorting to bypass)
2) custom simlock

I use avast! free mobile security (https://play.google.com/store/apps/details?id=com.avast.android.mobilesecurity&hl=en),
the anti-theft module has option to block the phone if the sim card is changed

LeJolly said:
http://bit.ly/174zPh6
Click to expand...
Click to collapse
What a woeful answer. Try reading before you be a ****.
In answer, no there is nothing similar to a BIOS lock on Android phones, however like mist813 said, Avast is quite good. If you have root access you can install it as a system apk then even if the thief wipes your phone, it's still there.

You could also try lookout its free. Can do tracking, remote wipe and also takes a photo of anyone trying to unlock your phone.
I don't think there is anything that can prevent someone from just flashing a new firmware and wiping the phone completely.
Sent from my Nexus 10 using Tapatalk 2

I don't think there is an equivalent to BIOS lock in Android. I'm not sure if you tried Lookout or the native Samsung remote control under security settings. Both gives you the options to locate, lock, scream or wipe your data. I tried the locate and scream options and they work. Never tried lock or wipe, but they should also work! Now going to the fact of wether someone can bypass or overcome these security measures, then I personally think it's possible and whatever we do he can find a way to go around it depending on how smart and resourceful he is! If my phone is stolen, frankly speaking I won't waste my time trying to find it or just lock it. All what I'll care about is to wipe the data off, and hopefully these softwares will work if needed!
Sent from my SGS IV using Tapatalk 2

Abrojo said:
Thank you for patronizing me but that didnt answer my question, already been through pages of results when i previous galaxy was stolen (even tried locking from google play). None of the apps listed on a google search for locking and tracking do what i ask.
Centralized cloud based locking doesnt work (a blacklisted imei can get reinstated fairly easy), neither does the standard password Operating System level password.
Thats why i am asking for specific alternative ways of locking the phone that should be (if possible) more tampering resistant.
1) bios equivalent password.(requiering hardware shorting to bypass)
2) custom simlock
Click to expand...
Click to collapse
Okay lets not be a **** this time.
1) There's nothing equivalent to that bios thing
2) http://stackoverflow.com/questions/...-the-device-on-removal-of-sim-card-or-sd-card
There are also apps that just notify you if sim card is changed for example this https://play.google.com/store/apps/details?id=instigate.simCardChangeNotifier&hl=fi
And of course there are some apps that let you remotely control your phone for example http://forum.xda-developers.com/showthread.php?p=7567932

Abrojo,
You don't really need a third-party app for this.
Please check out the Samsung Dive service. (www.samsungdive.com)
You can track your phone, lock it with a custom password, sound an alarm, etc...
The problem is, the phone needs to have Internet access.
I am using the Cerberus app (https://play.google.com/store/apps/details?id=com.lsdroid.cerberus&hl=en)
This is the best rated Anti-theft app you can find for your Android.
a license costs 3USD if I remember correctly. With one license you can secure up to five Android phones.
Featuers:
Track your phone
Remote lock
Remote wipe
And a lot more options...
A couple of things that I think are extremely useful:
When a wrong password or pattern is drawn to unlock your phone, a picture is taken with the front camera and emailed to you together with the location of the phone.
When the SIM is swapped, you can configure up to three phone numbers that will receive an SMS with the new SIM card number and the location of the phone.
You can hide the app from the App Drawer.
Check it out... very useful

i use also cerberusapp 4 years now. everything is perfect. when u install as system app u can do everything.
Sent from my ThL W8 using xda premium

Apparently there is also rumors of LoJack already being built into these phones, with the possibility to activate it some time in the near future. Don't remember all the details, but I just read an article about that. Not being patronizing when I say it, but Google Galaxy S4 LoJack and look into it.
Also, I am on Verizon, and am testing out their mobile security app that is preinstalled. It's $1 a month, but they allow you to remotely lock your phone, wipe it, and track it should you lose it. I don't believe it embedded at the hardware level, but it is something that gives me a little piece of mind.
Edit: I went to switch to the Norton Mobile Security app, since I use it for all of my other devices, and discovered that the Verizon Mobile Security App - once activated - cannot be uninstalled, force stopped, you cannot clear the data, and you cannot disable it. In order to do so, I first have to go into my Verizon account online, sign in, and unsubscribe from the service. After realizing that, I have chosen to keep the Verizon security app, because it has that extra layer of security. Are there ways of bypassing that, I'm sure there are. But assuming that my phone is stolen by some low level thief and not some crazy high level criminal circuit, I should have no problem retrieving it.

Samsung Dive down?
I cant seem to have this page load up www.samsungdive.com
Is it down for you too?

Sm007hCriminal said:
I cant seem to have this page load up www.samsungdive.com
Is it down for you too?
Click to expand...
Click to collapse
It's working with me.
Sent from my SGS IV using Tapatalk 2

[Q] About forgot password (strange)

(sorry about my chinglish )
So here's how:I locked my nexus10 and forgot the password, and I do not see the "Forgotten" button on the screen and also I didn't turn USB debugging mode on, so is there any possibility I can save my data instead of cleaning them up? Thank you (btw, I deleted the original recover files(because I once booted Ubuntu Touch on it) how can I reset it anyway?) Tanks a lot

EX_RIVER said:
(sorry about my chinglish )
So here's how:I locked my nexus10 and forgot the password, and I do not see the "Forgotten" button on the screen and also I didn't turn USB debugging mode on, so is there any possibility I can save my data instead of cleaning them up? Thank you (btw, I deleted the original recover files(because I once booted Ubuntu Touch on it) how can I reset it anyway?) Tanks a lot
Click to expand...
Click to collapse
If you have TWRP (not sure about Clockworkmod), "Factory Reset" will leave personal files on while clearing settings, custom apps, etc. FORTUNATELY, there is no way to bypass, other than resetting the device, the password for security reasons

dibblebill said:
If you have TWRP (not sure about Clockworkmod), "Factory Reset" will leave personal files on while clearing settings, custom apps, etc. FORTUNATELY, there is no way to bypass, other than resetting the device, the password for security reasons
Click to expand...
Click to collapse
Pretty sure that's not true, strictly speaking. Unless OP is talking about encryption, flashing a new ROM over top will preserve most user data saved on /sdcard (much to my annoyance).

Rirere said:
Pretty sure that's not true, strictly speaking. Unless OP is talking about encryption, flashing a new ROM over top will preserve most user data saved on /sdcard (much to my annoyance).
Click to expand...
Click to collapse
You are correct. I forgot that circumstance. TWRP specifically excludes the data/media area
Sent from my Samsung Galaxy Victory via XDA Developers App

dibblebill said:
You are correct. I forgot that circumstance. TWRP specifically excludes the data/media area
Sent from my Samsung Galaxy Victory via XDA Developers App
Click to expand...
Click to collapse
I mean, it's useful because if you flub a flash you can use a backup, but these recoveries are not secure and aren't designed to be.

EX_RIVER said:
(sorry about my chinglish )
So here's how:I locked my nexus10 and forgot the password, and I do not see the "Forgotten" button on the screen and also I didn't turn USB debugging mode on, so is there any possibility I can save my data instead of cleaning them up? Thank you (btw, I deleted the original recover files(because I once booted Ubuntu Touch on it) how can I reset it anyway?) Tanks a lot
Click to expand...
Click to collapse
USB debugging isn't required for ~all~ USB stuff, so you should try it anyways.
Then, as long as you still know your Google password you can install this to your Nexus, via the web (no log on to device actually needed):
http://www.androidlost.com/
I haven't actually tried or used that program, so cant say 100% it will work on N10 - but "in general" it seems like it should!
:good:

bigmatty said:
USB debugging isn't required for ~all~ USB stuff, so you should try it anyways.
Then, as long as you still know your Google password you can install this to your Nexus, via the web (no log on to device actually needed):
http://www.androidlost.com/
I haven't actually tried or used that program, so cant say 100% it will work on N10 - but "in general" it seems like it should!
:good:
Click to expand...
Click to collapse
I don't know if AndroidLost can unlock a device, and he doesn't seem to have lost it either. Unless an app had root/device admin access, I can't imagine that it would have the privileges necessary to remove authentication from a device (since that seems to be the pinnacle of bad security). Secure Settings + Tasker can do it, but you need to set that up beforehand.

Rirere said:
I don't know if AndroidLost can unlock a device, and he doesn't seem to have lost it either. Unless an app had root/device admin access, I can't imagine that it would have the privileges necessary to remove authentication from a device (since that seems to be the pinnacle of bad security). Secure Settings + Tasker can do it, but you need to set that up beforehand.
Click to expand...
Click to collapse
It says it can:
Lock the phone
You can lock and unlock the phone from the web. If you forget your pincode you can simply overwrite it or remove it from the web

bigmatty said:
It says it can:
Lock the phone
You can lock and unlock the phone from the web. If you forget your pincode you can simply overwrite it or remove it from the web
Click to expand...
Click to collapse
I don't think this means what you think it means (and I could be wrong). Many security apps like avast! offer a similar "locking" functionality, where the normal lockscreen (whatever security it is) is covered by a second lockscreen, superimposed over all system UI elements to prevent access. This lockscreen is controlled by the app, but it will not affect any underlying security (basically, think of it as a replacement lockscreen for security reasons, not much unlike HoloLocker or Go Launcher's lockscreen).

Rirere said:
I don't think this means what you think it means (and I could be wrong). Many security apps like avast! offer a similar "locking" functionality, where the normal lockscreen (whatever security it is) is covered by a second lockscreen, superimposed over all system UI elements to prevent access. This lockscreen is controlled by the app, but it will not affect any underlying security (basically, think of it as a replacement lockscreen for security reasons, not much unlike HoloLocker or Go Launcher's lockscreen).
Click to expand...
Click to collapse
I don't know man, and like I said I've never tried it. But its a super popular app, and has been featured in write ups. On their main page it states that text, as the fifth "main feature" which seems pretty straight forward to mean "the main lock screen"...

bigmatty said:
I don't know man, and like I said I've never tried it. But its a super popular app, and has been featured in write ups. On their main page it states that text, as the fifth "main feature" which seems pretty straight forward to mean "the main lock screen"...
Click to expand...
Click to collapse
No good, sorry. You're right on one count-- I just tested it, and it does interact with the stock lockscreen. Unfortunately, as I said earlier, unless the app is granted root/device admin privileges, no Android app can change the stock lockscreen...and since OP can't get into his device, he can't grant it device admin.

Rirere said:
No good, sorry. You're right on one count-- I just tested it, and it does interact with the stock lockscreen. Unfortunately, as I said earlier, unless the app is granted root/device admin privileges, no Android app can change the stock lockscreen...and since OP can't get into his device, he can't grant it device admin.
Click to expand...
Click to collapse
Nice on the testing! Too bad about the unlock. Perhaps he can still use it to offload his content though.
Did you try to "push" it to your device w/out installing it direct? I have wondered if I should pre-load this app on my devices, but "they" tout its remote-install-ablity, so I somewhat feel like I would not have to pre-install. (But then again, Im always apprehensive of claims that make things seem super easy.)
EDIT: Hmmm.... I see it requires "SMS" to install this on a device via Push - so I guess it NEEDS to be pre-loaded on a N10 if one wishes to use it to retrieve a lost N10, or even use it in this context! Now to decide if I install this or not...

bigmatty said:
Nice on the testing! Too bad about the unlock. Perhaps he can still use it to offload his content though.
Did you try to "push" it to your device w/out installing it direct? I have wondered if I should pre-load this app on my devices, but "they" tout its remote-install-ablity, so I somewhat feel like I would not have to pre-install. (But then again, Im always apprehensive of claims that make things seem super easy.)
Click to expand...
Click to collapse
I installed direct. I use Cerberus (and before that, avast! Anti-Theft) to help secure my devices, but these things are all a game of chance. My advice: completely disregard remote-install abilities. If you're going to use this kind of service, it really doesn't make any sense not to install it yourself, where you can change your preferences (such as install to /system or rename the application) to work for you.
The bigger problem is that, obviously, six hundred million things could go wrong. I noticed that AndroidLost noted that they were using Google to push messages, which indicates that they're using C2DM (unlikely, it's deprecated) or GCM push services, which require your phone being connected to a network (itself a big assumption) that will allow Google's ports to send traffic. This excludes no small number of places, particularly corporate networks (and many schools as well). It also looks like one of the wakeup methods if SMS, which is not only noticeable (to a thief), but potentially may be intercepted by other apps on the phone (such as an alternative SMS app).
The idea is that these apps intercept and delete any command SMS before any other app, but in practice this doesn't always happen. So test your setup before something happens!

Rirere said:
I installed direct. I use Cerberus (and before that, avast! Anti-Theft) to help secure my devices, but these things are all a game of chance. My advice: completely disregard remote-install abilities. If you're going to use this kind of service, it really doesn't make any sense not to install it yourself, where you can change your preferences (such as install to /system or rename the application) to work for you.
The bigger problem is that, obviously, six hundred million things could go wrong. I noticed that AndroidLost noted that they were using Google to push messages, which indicates that they're using C2DM (unlikely, it's deprecated) or GCM push services, which require your phone being connected to a network (itself a big assumption) that will allow Google's ports to send traffic. This excludes no small number of places, particularly corporate networks (and many schools as well). It also looks like one of the wakeup methods if SMS, which is not only noticeable (to a thief), but potentially may be intercepted by other apps on the phone (such as an alternative SMS app).
The idea is that these apps intercept and delete any command SMS before any other app, but in practice this doesn't always happen. So test your setup before something happens!
Click to expand...
Click to collapse
Thanks for the info, I will look into Cerberus. I am assuming you would recommend that as you are currently using it? Do you think its better than AndroidLost, even though you haven't spent as much time w/ AndroidLost?

bigmatty said:
Thanks for the info, I will look into Cerberus. I am assuming you would recommend that as you are currently using it? Do you think its better than AndroidLost, even though you haven't spent as much time w/ AndroidLost?
Click to expand...
Click to collapse
I like it a lot more, but I will admit I personally liked avast! better. Its uncertain future (plus a nice promotion) led me to jump ship to Cerberus. I'd have to play around with it a bit more to be sure though.

Rirere said:
No good, sorry. You're right on one count-- I just tested it, and it does interact with the stock lockscreen. Unfortunately, as I said earlier, unless the app is granted root/device admin privileges, no Android app can change the stock lockscreen...and since OP can't get into his device, he can't grant it device admin.
Click to expand...
Click to collapse
Yep, you're right I can't get root under this situation, thanks a lot I'm trying to figure out how to save my data mow

EX_RIVER said:
Yep, you're right I can't get root under this situation, thanks a lot I'm trying to figure out how to save my data mow
Click to expand...
Click to collapse
It's not root you need per se, it's device admin. But root isn't an easy option for you either, because unlocking your bootloader will hose your data. I also think most of the locked-bootloader exploits require the device to be on and unlocked. If you're signed into your Google account, you should have a fair degree of stuff backed up already-- what sorts of data are you trying to save?

Rirere said:
It's not root you need per se, it's device admin. But root isn't an easy option for you either, because unlocking your bootloader will hose your data. I also think most of the locked-bootloader exploits require the device to be on and unlocked. If you're signed into your Google account, you should have a fair degree of stuff backed up already-- what sorts of data are you trying to save?
Click to expand...
Click to collapse
Mostly..........Photos and videos

EX_RIVER said:
Mostly..........Photos and videos
Click to expand...
Click to collapse
...do you have a Google+ account? Slash have you ever opened the app? If so, you might actually be in luck and your data should have been backed up to your Google+ (or PicasaWeb if you prefer).

ENCRYPTION and selling my phone.

Currently I have an S7 Edge, but my companies IT is supplying everyone with iPhones since it was too hard to juggle so many different phones. Well as much as I love Android, I don't want to carry 2 phones around everywhere lol, so I was thinking about selling it as it was mine to begin with and the company just paid my phone bill. IT at work just said factory reset it and you're good to sell, but idk they don't seem like the brightest bulbs.
My work involves a good deal of private information from my clients. So my phone is full of photos, texts, emails, pdfs, etc... of things that my clients would probably be extremely angry about if it got out.
Is there anyway to wipe this phone 100% clean with 0% chance of anything being recovered by anyone?
I saw this review article quote:
I asked Samsung if these new phones were encrypted, like the iPhone (most Android phones aren’t.) Referring to both models, the company said: "Default encryption is turned on for Galaxy S7. Samsung cannot decrypt the user’s encrypted phones. The encryption key is randomly generated for each user and the key is protected with the user’s password."
According to that, it sounds like Samsung themselves couldn't even get my data after I factory reset? Is this true? What exactly do I need to do to get to this point?
I'm not sure what this encryption key is and user password? Is user password just your lockscreen pin?
Reason why I'm worried is I remember people always saying if you delete something its gone! Well I remember 10 years ago my mom formatted her camera SD card on accident and all it took was me hooking it up and googling a free recovery program and BAM I had all the photos back. I imagine technology has advanced ten fold since then. I don't want someone rooting my phone and getting some super program and next thing I know my personal information is out there.
Thanks!

wipe the operating system.
reinstall new operating system with odin or if you have an sd card using stock recovery. make sure that you do not reinstall your gmail account to prevent auto recovery.

Cosmic Blue said:
wipe the operating system.
reinstall new operating system with odin or if you have an sd card using stock recovery. make sure that you do not reinstall your gmail account to prevent auto recovery.
Click to expand...
Click to collapse
I do have an SD card. But I'm not sure about anything you said. Is it possible for you to make a guide for me?

which model of do you have.
?
I will point out the correct rom to copy to your sd card and/or computer.
Do you know anything about flashing a phone at all ?

This is what i usually do.
a. delete all files in internal memory with myfiles/any file explorer
b. delete your google account via settings
c. factory reset your device.
that will do.

A factory reset wipes your pin / pattern / password so that in itself makes the encryption key useless even if you use the same pin / pattern / password. Without that key you can still recover files but it will take hundreds of years to break the encryption.
You may see stories like the FBI breaking encryption but thats not strictly true. They break the unlock system which gives them access to the encryption key which decrypts the data.
Safe to say a factory reset will do the job nicely and if you are in the UK, you will be okay under the Data Protection Act as youve done all YOU can to secure the data from recovery. Its up to your IT tech to make sure you are compliant, especially with Bring Your Own Devices policies so any fallback should be on them.
I would question why you havent mentioned Knox as thats like a safe within a safe and you IT tech should be employing it if they let you use BYOD!
Just note that your clients security is only as secure as your password as if anyone gets hold of that password then they have free rein to your files. You did mention a pin code which i hope you will update to a password asap!!
There are 10,000 possible combinations that the digits 0-9 can be arranged to form a 4-digit pin code.
Click to expand...
Click to collapse
36×36×36×36=1679616 distinct passwords of length 4
Click to expand...
Click to collapse
As you can see, a pin has much less combinations than a password and passwords can be even more secure the longer they are and if you include special characters like @ # * etc. Here is a site which you can use to test how easy it would be to crack your pin or password: https://password.kaspersky.com/
My pin would take 15 minutes to crack, my password would take 33 centuries
Sources:
https://password.kaspersky.com/
http://www.datagenetics.com/blog/september32012/
http://math.stackexchange.com/quest...-digits-0-9-how-many-combinations-are-possibl

Galaxy s8 security dilemma/question

Hey guys, it's been a few years since I've been active in the android community but hoping someone may be able to help me out, I'm in a little bit of a weird predicament.
Girlfriend has an s8 with fingerprint functionality setup, and has forgotten her pin, but can still use the phone normally through fingerprint reader..but we're trying to figure out some method of changing the pin or doing a backup / restore that doesn't require the pin as shes concerned about an update or whatnot that's going to require it.
She doesn't have samsungs find my phone stuff setup so that isn't not an option I dont believe as I think it requires a pin to install so installing after she's forgotten it is a no go.
Is there any way to backup everything so she can do a backup / restore that isn't going to require a pin? She's not opposed to a backup or restore just doesn't want to lose data and preferably not configuration.
As I said, right now she can get into the phone via fingeprint, just trying to figure out some way to make sure we can do this without locking her up somehow. Halp?

adb backup?

If the phone reboots or gets restarted, the pin will have to be put in even if fingerprint is in place.
Sent from my SM-G950F using XDA-Developers Legacy app

What is she needing to backup? Contacts? Google account does that for you. Photos / videos? Google Photos app takes care of that, unlimited storage and free. If she has files downloaded, BOX or any other site like that allows you to upload and store there. If there is a true concern regarding the pin, move these items and then do a factory reset of the phone, and start fresh. Anybody agree?

Lockscreen issues and Device Manager properties

Two separate topics.
I have the LS777 Boost version running Nougat. I broke the screen and it sat for a couple years before I decided to replace it. Either I forgot the pattern lock or it did because I can't get past it. key points:
USB debugging IS on. It shows up as unauthorized
I can access the recovery screen
NOT rooted (yet, seeing it can be on here prompted me to fix it)
NO custom recovery
No dialer in emergency call mode
When I go from the lockscreen to the camera, take a pic, then hit the pic to preview it, then hit the share button, a bunch of social media icons pop up. If I hit one, it ALMOST goes past the lock screen trying to pull up the app to share.
I have it registered with LG, but I can't find a way to do anything with my device, let alone unlock it, you know like Samsung has.
Account device manager experiment: It had all five of my main accounts on there, but since I regularly change my passwords, I get the Account Action Required notification. If I can get it to authenticate on one of them, then I should be able to go to Where's My Device and set a new lock. I know all of the passwords I have used on my accounts, but I don't know what password I was on when this phone was active. Using my hotspot and changing the name to one of an open wifi I know I conneted that phone to, I am able to get it online (hence the notifications). I took one account and started changing the password on it, waiting 24 hours between each change and waiting a few minutes (until the notification hits my main phone at least) before powering it on. I'm on the third password and no luck.
It's theoretically sound, but I'm wondering if anyone knows for sure whether my device will authenticate the account when I get to the right password.
And yes, I know I can just wipe it. It's an old phone running Nougat that I haven't factory reset. The data on there isn't important, it's just a perfect situation to run some experiments on.
Second thing, because the issue of unlocking LG bootloaders still exists:
I have up Windows Device Manager because I'm working with various phones here. It's on the lock screen (booted normally) and is showing up under Portable Devices. If you co to the Details tab, scroll down to Capabilities, it has a second value: "CM_DEVCAP_SURPRISEREMOVALOK"
Remove a lock? Is this something we can exploit, or is LG pouring salt into the wound caused by them refusing to give us the codes to unlock the bootloaders.

Upon further research, that description in device manager is "surprise removal ok" and had to do with unplugging it.
Still, screw LG for keeping their bootloaders locked even after they decided they were getting out of the cell phone business. Makes the fact they had to shut down their forums even funnier.
On password number 4 of 5. I have a feeling this experiment isn't going to work. I'll report back after the next be password change.

I'm fairly certain I have tried every password from that account by now, and it didn't work.
However there are three other counts on there, stop I'll run the same experiment with them and see what happens.
I mentioned something about sharing pics from the gallery. From the lock screen,
1. Go to the camera icon and pull up camera,
2. Take a pic,
3. The picture will show up in the gallery preview box in the lower right corner. Press (or long-press) it and a pop-out menu will appear just above it.
4. If you pull the menu out, you'll see a bunch of links to various social media sites.
5. Click one of them. I've tried them all, but I usually pick Tumblr because it's the first one.
6. The screen changed to the app's background and it appears to start loading the app and will hang there for about 3 seconds, but then you get sent back to lock screen. It's 3 seconds can be maddening because looks like you're allllllllllmost there and then...no, no you're not.
If anyone knows if there's an exploit there, in all ears. I'm going to restart that password experiment with the second account now.
And I know most "plz help me get past me locked screen" posts are sus and address likely people trying to either scam someone by stealing their info or trying to spy on their significant other. So if anybody has any questions I'll gladly verify that I do own all of the accounts, that they're on this locked device, but due to the time that has passed they don't show up in the device lists in the accounts (not even in the web version of the Play store), and due to password changes wile it was broken, it won't sink now and allow me to reset the lock through "where's my device."