TrustExecutor when I need to enter sensitive information like a password/PIN in public I just deliberately hide the screen towards my body just like you have to do on a shop payment terminal or an ATM.
Do you actually use password at all? The buttons are tiny, it's not easy to correctly type in the password even in comfortable situation, while entering it with this "hiding" technique of yours with cameras around, people sitting next to you, or riding a bike or in a full bus - it's very hard, if impossible.
The problem is why must I enter password in the first place, I have fingerprint set, the real timeout of unlocking is not reached (GrapheneOS one), but this defective 48h google timeout kicks in and creates problems with zero security improvements (actually negative effect).
TrustExecutor You can maybe code up a solution and submit a pull request if it is very important for you.
I am not advanced in this OS and building ecosystem to make it good and fast. But others are. I cannot be good at every field, so I make the world a better place by creating own open source projects or committing code to ones I can.
phospmph The 48 hours timer for falling back to primary unlock is a reasonable balance between security, convenience and usability.
How come?
Nobody argues that fingerprint is MUCH weaker that proper password. The problem is that 48h timer is not adding any security
1) criminal or police can force you to put finger within a smaller time,
2) the auto-reboot timer in case of unlock is better in any way, and you can set it to like 10 hours without suffering.
Also this 48h timer forces users to use short pins instead of long proper passwords, so it's not adding any security for any "balance".
DeletedUser299 I know press the power button, turn off the screen, put the phone in a pocket and do it later.. OMG security problem averted.
You received something, it can be SOS-sms or something important. If you do not need a phone during the day, it's you user-case, that does not fit others.
Blastoidea It looks to me as if he’s looking for an argument, rather than a workaround, which he’s been given.
The workaround is no good. User still have to enter password daily and it is:
- annoying,
- time and energy consuming,
- pushes user to use shorter and weaker password,
- HAS NO SENSE in the first place, because a simple toggle to disable this faulty 48h timer would allow users to avoid all this mess and improve security.
Isn't it correct?
DeletedUser495 one to improve their security has either a choice to remove themselves from such harmful environment or restrict their actions (i.e. pretend they don't have a phone).
So, you are in a shop full of cameras and you get an SMS. It can be urgent, you may have to reply fast. Are you offering people to drop all shopped items, go to parking lot, set in car, unlock the phone to check that it's a SMS with ads?
I think this approach is not practical for a lot of people.
Do you use password yourself?
Open_Source_Enjoyer If you hold the power button, a menu opens, in this menu you can click on "Lockdown" which forces password/pin entry
I know it, as I said before in this thread, I would like to be able to lockdown without using touchscreen, like iphones (supposedly).
Open_Source_Enjoyer I think knowing this solves the problem.
No, it instead adds different problems. It's a painful workaround that almost no usual users would use.
"Solving the problem" would be making this timeout optional, maybe even off by default for better security.
JustBeginnez When I attempted to use my Pixel while on the subway, the 48-hour timer prevented me from using fingerprint authentication, leaving me unable to use my phone on the train.
Perhaps the issue lies in GrapheneOS not offering an option to opt out of this feature, similar to Aegis Authentication.
Exactly. Aegis app is a good example, that I wanting to provide, which solved this issue way better than google devs.
JustBeginnez However, I understand the importance of the 48-hour timer function, so I’m willing to accept this minor inconvenience.
Can you please explain to me the importance of this timeout?
Let's say you have a proper GrapheneOS locked-reboot timeout set to like 10 hours, what is importance of this faulty 48h/random timeout?
Because I really see no security improvements at all. The only plus is that you have recall you password every 48 hours, but it does not add security, only lessens it.
@DeletedUser313 @lynatic @stick4611 and others, you are awesome guys, thank you for your support.