New Android Identity Check locks settings outside trusted locations

Privacy News
1

Should probably be recommended for Android when it rolls out, as PG currently recommends the functionally identical Stolen Device Protection for iOS.

1 Like
2

Unfortunately, this is a Google Play Services feature, not an AOSP feature. If Google actually cared about protecting users, this wouldn’t be part of their proprietary feature set.

2 Likes
3

To be fair, the feature is more about protecting your Google account than your phone. Just like iOS’s Stolen Device Protection is about protecting your Apple ID and not your phone.

3 Likes
4

That’s true, but a lot of the settings it locks behind biometrics aren’t related to Google account functionality.

Some sensitive actions that fall within Identity Check’s protections include performing a factory reset, changing the screen lock, registering a new fingerprint, turning off ‘Find My Device,’ adding a Google account, accessing developer options, and opening Google Password Manager.

5

Many of those already require a fingerprint or PIN anyway. Like enabling dev mode, changinf screen lock, adding FP

6

What settings or apps would protect Android devices and or iPhones in the case of theft ?
I am not convinced about the trustworthiness of remote methods. Being WiFi access is necessary for this to happen.

On my Password Manager, after 5 failed login attempts, my vault is erased. Can this feature be applied to devices as well ?

7

iOS has a built-in feature you can enable to erase the device after 10 failed attempts, don’t think android does by default, but GOS might have that feature (it seems like it’d be up their alley to add)

8

From what i can tell GOS doesn’t have a way to limit the number of incorrect password attempts similar to iOS. though GOS does disable fingerprint after 5 attempts and has a reboot timer if not unlocked within a given time.

https://discuss.grapheneos.org/d/501-wipe-device-after-failed-10-password-attempts

1 Like
9

Crazy how Android is going like iOS and iOS is going like Android nowadays… Lol

1 Like
10

Way off. Android does. Has been doing it since Gingerbread or Ice Cream Sandwich (10+ years ago).

11

Oh neat, where in settings is it because I was taking a look on my Pixel yesterday and couldn’t find it :sob:

12

This isn’t a good approach. You should learn the CIA principle.

13

Pray tell …

14

I assume they’re talking about confidentiality, integrity, availability (is your data private? has your data been tampered with? can you access your data?)

2 Likes
15

We are still waiting ?

16

How can i enable said function??

17

If the OEM doesn’t include this as part of their ROM Settings app, you’ll have to install a “device admin” app (docs) that will let you set this.

On an AOSP distribution I worked on, we set the device to factory reset after 20 failed attempts (not changeable to a higher value even by other device admin apps, iirc) back in 2012/13!

I don’t want to link any app here as “device admin” APIs, in the past (and in the present, too?), were a popular stalkerware vector. Such apps are readily Googleable/Kagiable/Letable/DDGable though.

Edit: @anon6884803 had a query for me:

I pointed out to @pinkandwhite that AOSP has had “factory reset on max failed password attempts” since Gingerbread / ICS.

The API documentation I shared points out that such a setting can be changed by a “device admin” app starting with Froyo (one release before Gingerbread).

And then I said, if OEMs / ROMs one might be using don’t expose this via its Settings app, one could use a “device admin” app to set this up.

I recommend being extra cautious with “device admin” apps as they’re a popular stalkerware vector.