Explorer666
You may be surprised..
Tbh, i've never setup a a new device nor after a reset of existing, via a copy/transfer/or even from backups..
It's always done from scratch, and data is populated as required (even contacts) (only exception would be anything stored on imap(mail), but given the very nature of that, it would fall in its own category for several reasons anyway)
Every financial app i've used had a 'quick view' enabled as default - some were persistent settings attributed to the profile on their end (so would replicate across installs), most are not though (some quick views also arnt as obvious as others, still accessible though).
Re the 'attack surface' more just using that term due to it usage in this very place, ie; by GOS devs in the docs, and on this forum - it is a term i personally have a great appreciation for also..
It's an ingenious way to refer to issues and/or implications of implementations, that is only limited by the readers perception and/or understanding.
(I'm feeling incredibly arrogant right now wording it that way, just not sure how to for that direct part)
It sort of ties in with earlier re 'tools', 'extent', etc
In the context of cryptography and security - everything that has any link in any form to the implementation, falls under the overall 'attack surface' -
The exact same as the concept of something is; "only as strong as its weakest link'"
Vulnerabilities or their potential to exist can not be attributed or limited to any specific or single general area, eg; be it with a device, programming related, or degree and variance of implementation(largest array possible as its also based on amount of users and the fact we are all unique, have our own style and wants/needs/changes we make/never ending list..)
Obviously, the line has to be drawn somewhere and that 'endless array', is well out of the scope, but does have a degree of 'predictability, and 'realism', eg; the very topic(s) we are talking about and defining along with their relevance ugh this is tricky to explain lol..
Cryptography as a whole needs to always still have the realistic view there of what it is; Theoretical.. No this isn't a constant, nor should be broken down to such a simple word - for the sake of trying to explain in this context though, it is.
Eg; Look at a brute force - for 'realistic' reasons we default to the 50% rule, as in, however long and how much it costs to run through x combinations upto and including y length and complexity(entropy) we get z - we halve that because it's 'realistic' it could be found in the first half of iterations performed / 'first half of the potential time/cost'
However it's not unrealistic that it could be in the 90% of iterations done, or even the first 10% (..yea)
'Attack surface' when applied to real world use case, potential implications and severity of (which is a vast spectrum) - The further something deviates and expands from its most basic realistic implementation, the attack space there also travels parallel to it, eg also increasing..
Willl stop here - have a feeling this is way too long - hopefully this might help explain.. or possibly make it more confusing lol :(
(the joys of being audhd lol)