jcom if I am understanding the 2FA biometric login completely, it's only a secondary method to track logins. Nor would I be comfortable running one, as
That's right. The primary pin is your disk encryption key. Biometrics are not as secure in this use as a strong password, random 14 char+ ideally. GOS doesnt allow biometrics here
jcom This is less about preventing the access from occurring or safeguarding any data than it is about knowing with absolute certainty that the device wasn't accessed
I hear you. I'm not aware of any login tracker tools on GOS. Tbh this is not a threat model that makes sense to me. Bob should focus on ensuring the device is secure, not trying to track successful breaches
jcom the device is still technically accessible without a fingerprint if the primary PIN/passphrase are known
the primary pin only needs to be entered at first unlock, whether it be on a manual restart or when the system is automatically configured to reboot. It should be pretty straightforward to only need this once a day, in the morning, entered while in a secure space where an adversary cannot watch, thus ensuring no adversary can ever compromise it - if all else fails, go to a bathroom stall
At the end of the day, if Bob has access to no secure spaces in his life, and is targeted by a adversary to such a degree that his threat model must assume every pin is/will be compromised, GOS cannot be secured; he falls under a category of high-risk user that should not store data on a smart phone