Latest Android Encrypted by Default, Adds “Smart” Device Locking

The Latest Version of the Android Operating System, Lollipop, Adds Encryption by Default, along with a Variety of Easy-to-Use Ways to Lock and Unlock the Phone and a More Secure Foundation to Help Protect Devices against Current Threats. In a Blog Post Published on Tuesday, Google Described the Features, which will Begin Shipping with the Lollipop OS in New Android Devices in the Coming Weeks. While Some of the Capabilities, such as Encryption, are already Included in the current Android OS, the New Version will Turn them on by Default. Many of the Security Features were Born of Android’s Open-Source Foundations and the Fact that Other Researchers and Companies Can Create and Test New Security Features for the Operating System, Adrian Ludwig, Lead Security Engineer for Android at Google, Said during a Briefing on the Security Features. “It is that openness and visibility that is really unique to Android among all the mobile operating systems and will make sure that we have security innovation and is a long-term advantage in terms of security”, he Said. “With Lollipop, we have a chance to make improvements at the operating-system level and really advance the trusted platform.”


Google Classifies its Security Efforts on Android into 3 Groups, Consisting of Building a Trusted Platform, Adding Additional Services to Help Secure Devices and Supporting Additional Security for the Open Android Ecosystem. Most of the Work in Lollipop Focused on Helping Users Lock Down their Devices from the Most Significant Danger, the Loss or Theft of a Device. To that End, the Company has Turned on Encryption by Default, essentially Placing any Data on an Android Smartphone or Tablet into a Digital Safe that Should be Impossible to Crack. The Move, which has Caused Much Consternation among Law Enforcement and Intelligence Agencies, Means that, Users will No Longer Have to Make the Choice of Whether to Turn the Feature on. “The question is not whether the security feature exists but, how do we make sure it is available and as easy to use for as many users as possible”, Ludwig Said.


Current Android Users Could Turn on Encryption in a Device’s Settings but, Would Have to Wait for any Data to be Encrypted, which Could Take Minutes or Hours. The Company has also Created SmartLock, a Way to Automatically Lock and Unlock the Phone Using a Variety of Factors, such as Facial Recognition or the Proximity of a Specific Device — such as an Earpiece — Using Bluetooth or Near-Field Communications (NFC). Because Many Users Don't Set a Passcode on their Phones, Google Hopes the SmartLock Technology will Convince People to Use the Easy-to-Use Locking Mechanism and Protect the Device if it is Lost or Stolen. “The goal is, if the user’s device is lost, they don’t have to worry about the sensitive data, that data will automatically be protected”, Ludwig Said. Google has also Invested in Using Security Enhancements for Linux Project, Known as SE Linux, to Harden the Foundations of the Android Operating System. The Added Security Allows the OS to Better Isolate Applications from Each Other and Prevent a Malicious Application from Accessing Other Software on the Device. “We have already seen examples of existing vulnerabilities that were blocked because of the adoption of SE Linux”, Ludwig Said.


SE Linux Not Only Provides Better Security but also Provides, a Better Look into the Security Model on any Particular Device. Users Can View the Security Model on a Lollipop Device and Gain a Better Idea of its Security, he Said. As a Way to Guide its Security Efforts in the Future, Google is also Analyzing its User Data to Figure Out What are the Actual Threats to Android Devices, Ludwig Said. While it is Obvious that Lost and Stolen Devices are the #1 Threat, the Company Doesn't actually Know which of the Distant-Second Security Issues it should Worry about, Ludwig Said. “We do believe there are some small number of users affected by potentially harmful programs or malware; we do believe there is a small number of users who have network-level exploitation of their devices, such as man-in-the-middle attacks”, he Said. “There are a variety of these different threats that are relatively low in volume but, we are trying to understand what the frequency is of these lower-volume threats.”




Info Source:

http://officialandroid.blogspot.com/2014/10/a-sweet-lollipop-with-kevlar-wrapping.html